WooCommerce MCP vs GoBuildWP: products and orders in core, or the whole store in Pro.

WooCommerce MCP's seven abilities next to GoBuildWP's equivalents

WooCommerce's developer docs, read again on 3 October 2026, still label the feature Developer Preview and list seven abilities: query, create, update and delete products, then query orders, update an order's status and add an order note. They also describe an older set derived from the REST API, marked deprecated. Here is where each of the seven lands in GoBuildWP, and which edition you need for it.

• Query products: wppilot/woocommerce-list-products and woocommerce-get-product, both in GoBuildWP Free.
• Update a product: woocommerce-edit-product is Free for one product's basic fields; variations, attributes and bulk price or stock changes are Pro.
• Create or delete a product: woocommerce-create-product and woocommerce-delete-product are Pro. WooCommerce gives you both free, which is a real point in its favour.
• Query orders: woocommerce-list-orders and woocommerce-get-order are Free, the latter returning addresses, items, totals, notes and refunds.
• Update order status and add a note: woocommerce-update-order-status and woocommerce-add-order-note are Pro. Again, WooCommerce's core feature does this at no cost.

Order data reaches the model either way

WooCommerce's docs warn that order and customer operations can expose names, email addresses, physical addresses and payment details to the AI provider. That warning applies to GoBuildWP just as much: reading an order means the client receives the order. GoBuildWP's customer list omits password and token data, but an order read returns the addresses because that is what the agent asked for. Neither product can stop data from leaving the site once a read is allowed.

What you can control is which reads exist for a given connection. GoBuildWP access tokens can be limited to named abilities and capped at the Read Only profile, so a reporting agent can be given woocommerce-sales-summary and the sales reports without ever holding a tool that reads a single customer. WooCommerce documents a permission callback on each ability and recommends a least-privilege user; it does not document per-credential ability scoping. Check your AI provider's retention settings before either connection touches real orders.

If both servers are connected, give each one a job

Connecting both endpoints means the client sees two tools that list products and two that read orders. An agent will pick whichever description reads better, which makes a test hard to repeat. Decide the split before you start: for example, WooCommerce's abilities for product creation on a developer's staging store, GoBuildWP for everything that needs approval or a change record. Then switch off the overlapping GoBuildWP abilities on the GoBuildWP Abilities screen, or leave the WooCommerce feature flag off for that connection's site, so each request has one obvious route.

We have not run the two side by side on one store, so treat coexistence as something your staging test establishes, not something this page promises.

Undo and approvals for WooCommerce's own MCP writes

Running both servers on one store no longer means two kinds of evidence. From GoBuildWP Free 1.18.0, mapped product edits/deletes through WooCommerce 10.3's own abilities can retain whole-post snapshots when target resolution and capture succeed. Inspect the entry before requesting restoration: that snapshot can rewind later stock or sales-related state, and does not reverse external effects. A current installed-version restore test is still needed. An order status change or an order note is recorded too, marked irreversible with the reason: a status change can email the customer and move stock, and a note may already have reached the customer, so neither can be quietly reversed.

On WordPress 7.1, the Other MCP servers setting can also hold WooCommerce's writes to the store's safety profile and send destructive ones to a person for approval in wp-admin, with Pro's approval queue applying as well. It is off by default.