Everything worth asking before you connect your shop.

It connects your WooCommerce shop to an AI assistant so you can ask about your shop and change things in plain language — “what sold best last week”, “add a 20% coupon for that product”, “which orders are still unpaid”.

Nothing is copied anywhere. The assistant asks your shop a question, your shop answers, and you decide in advance which areas it may reach at all.

Paste your shop address into the AI app — that is the whole setup. There is no key to copy and no file to edit.

https://yourshop.com/mcp

The app then opens a permission screen in your browser, on your own shop, showing every area it is asking for. You tick what it may use and press Approve. That is the only moment access is granted, and you can withdraw it later in one click.

Claude — web, phone and desktop — and ChatGPT. Also the developer tools that speak the same protocol: Claude Code, Cursor, VS Code, and others.

Anything that implements the current MCP authorization standard will connect. There is no per-app setup on our side: the shop publishes what it supports and the app reads it.

Yes, and it needs nothing connected. There is a chat tab in your shop admin, next to Orders and Products, which talks to the same tools.

You are already signed in, so it can reach exactly what your own account can. Either let WordPress manage the AI connection for you, or paste a key from Anthropic, OpenAI or Google — or run a model locally with Ollama, so nothing leaves your server at all.

You choose which areas the chat may use, separately from what external apps are granted. With a Claude model the whole 127-tool catalogue is available, because it searches for the tool it needs; other models carry up to sixty tools per message, and the chat says what to untick if you exceed that.

There are 127 tools, arranged in 16 areas — products, orders, customers, reports, coupons, shipping, taxes and so on. Every area has separate switches for reading and for changing.

Out of the box, exactly three areas are readable — products, orders and reports — and not one is writable. Everything else, including anything that could change your shop, stays off until you switch it on in Settings.

The chat in your admin has its own starting set: products, orders, customers and reports, around thirty tools, adjustable at any time without affecting what external apps may reach.

• WordPress 6.5 or newer
• WooCommerce 8.0 or newer
• PHP 8.2 or newer
• HTTPS, and a shop reachable from the internet if you want to use Claude or ChatGPT

The things that could are kept apart from the things you would use daily.

• Shop settings, payment methods and maintenance routines are their own areas, switched off out of the box, behind a heading that is never pre-ticked.
• Each of those needs an explicit confirmation before it runs — the assistant has to tell you what will change and get your agreement first.
• The routines that cannot be undone are refused outright, whatever an assistant asks.
• New products are created as drafts, so nothing appears in your shop without you publishing it.

Calls to those areas are written to the action log even when logging is switched off.

The whole catalogue, not just what the app wants — so you learn on this screen, rather than later as a missing tool, what exists, what is off, and where to switch it on.

• What the app asked for and your shop allows starts ticked, ready to untick.
• Payment methods, store settings and maintenance are never ticked for you, even when asked for — granting one takes a deliberate click.
• What the app asked for but your Settings withhold is greyed out, with the reason and where to change it.
• If anything ticked can change data, a plain warning sits above the buttons.

An app that names no permissions at all is offered the read-only areas, never everything. And whatever the screen shows, the key that is issued carries only the boxes that were ticked at the moment you pressed Approve.

Only what you allow, and only while a connection is approved. Customer records sit in their own area, and it is read-only — an assistant can look a customer up but cannot change or delete one.

Nothing is stored outside your shop by us. What an AI provider does with a conversation is governed by your agreement with them, which is worth reading if you handle personal data — that is the same consideration as pasting an order into any AI chat.

Open the Connections tab and revoke it. Access stops immediately — the app cannot reach your shop again without going through the permission screen from scratch.

Each app gets its own connection with its own permissions, so revoking one leaves the others working.

Yes. Each person connects their own AI account and approves their own permissions, and each connection is listed and revoked separately.

A connection can never do more than the WordPress account that approved it, so a shop manager’s assistant reaches less than an administrator’s.

Every call is recorded: which tool, which connection, whether it succeeded, and what it was asked to do. The log is in your admin and you control how long it is kept.

Calls to shop settings, payment methods and maintenance are always recorded, even with logging switched off, because those are the ones you would want a record of.

Three things have to agree before the assistant can do something: the area is switched on in Settings, the connection was granted it on the permission screen, and WooCommerce itself allows it for the account that approved the connection.

If any one says no, it is genuinely unavailable rather than merely hidden. Check Settings first, then the connection on the Connections tab. If you switch a new area on, connect the app again — a connection only ever holds what it was approved with.

Claude and ChatGPT connect from their own servers, not from your browser, so your shop has to be reachable from the internet over HTTPS.

A shop running only on your own machine works fine with Claude Code, Cursor and VS Code, which connect from your computer. The Connect AI apps tab checks this and tells you which of the two situations you are in.

Two common causes.

Permalinks. The endpoint also answers at the long form below; re-saving Settings → Permalinks refreshes the short one.

/wp-json/counterhand/v1/mcp

A blocked path. Some servers deny everything beginning with a dot, which includes the discovery document AI apps read first. On nginx, allow it before any dotfile rule:

location ^~ /.well-known/ { try_files $uri $uri/ /index.php?$args; }

Yes. High-Performance Order Storage is fully supported, and the plugin declares that compatibility to WooCommerce so you never see a warning about it.

Yes. Every tool, the chat inside the admin, the OAuth connection for AI apps and the action log — all of it, on as many shops as you run.

The plugin is licensed GPLv2 or later. There is no Pro version and nothing that unlocks by paying: what you install from WordPress.org is the whole thing.

By one maintainer, funded through GitHub Sponsors. Releases follow WooCommerce and WordPress: when either changes something the plugin depends on, an update goes out through WordPress.org like any other plugin update.

The source and the issue tracker are on GitHub. Every release is tagged there and published to WordPress.org from the same code.

If it saves you time, sponsor it on GitHub — that is what pays for keeping up with WooCommerce releases and new MCP clients.

It also helps to leave a review on WordPress.org, report a bug with the steps to reproduce it, or contribute a translation. Each of those reaches shop owners who would otherwise never find it.

Open an issue on GitHub — questions are as welcome as bug reports, and the maintainer reads every one. The WordPress.org support forum opens with the directory listing.

Security issues are different: please report them privately, following the SECURITY.md file in the repository, rather than in a public thread.