Commerce · 2 modules
WordPress Store Operations with MCP that keeps catalogue work apart from money.
Running WordPress store operations with MCP means separating two kinds of work that look the same through an API: editing the catalogue and touching money. The modules below cover products, variations, orders, refunds and reports, and the calls that can move money wait for confirmation.
What goes wrong without a plugin-aware module
- Catalog and financial authority bundled into one credential
- Operational actions accepted without provider-side verification
- Customer and order data sent or logged beyond the minimum needed
Modules
2 modules compared
Each module loads only when its plugin is active. The Edition column shows how much of each one GoBuildWP Free covers; the rest needs Pro. Open a module for its full ability list, requirements and safety notes.
| Module | Edition | Abilities | Inspect / change / destructive | Covers |
|---|---|---|---|---|
| Free 13 + Pro 52 | 65 | 27 / 28 / 10 | products, product variations, attributes and terms, categories and tags | |
| FunnelKit | Pro | 4 | 3 / 1 / 0 | funnels with steps in order, step type, page, builder and URL, the store-checkout funnel, optins, orders and revenue per step |
Why it matters
What plugin-aware changes for commerce
Catalogue work and money work look similar through an API and are not remotely the same risk. Editing a product description and changing an order's status both return a success payload; only one of them can trigger a customer email, a payment capture, or a fulfilment run downstream.
A first safe workflow
Create one product, with one variation, and follow it all the way to the cart. That path crosses attributes, variations, pricing, stock and the storefront template, so it exercises nearly everything the module touches. Do it before any bulk import, and keep order-touching abilities off the credential entirely until the catalogue work is finished.
How to tell it worked
Separate the credential that edits the catalogue from anything that can touch orders. After a catalogue change, check the storefront, the cart and one variation; after anything order-related, verify in the payment provider, not only in WooCommerce.
Worked example
Add a T-shirt as a variable product with three sizes, and check it can be bought.
WooCommerce, with catalogue abilities only: nothing in this sequence reads an order or moves money.
wppilot/woocommerce-check-setupFreeConfirms WooCommerce meets the module's version floor and reports whether HPOS is the order store, the currency, and which extensions such as Subscriptions or WooPayments are present.
wppilot/woocommerce-list-product-attributesProReturns the global attributes (Products > Attributes) with their terms, so an existing Size attribute is reused rather than duplicated.
wppilot/woocommerce-create-product-attribute-termProAdds a missing size to the global attribute, if one is missing.
wppilot/woocommerce-create-productProCreates the parent with type set to variable and the Size attribute marked for variations. Stock fields are refused on a variable parent, because stock lives on each variation.
wppilot/woocommerce-create-product-variationProCreates one variation per size with its price and SKU. An option that is not on the parent, or a SKU already in use, is refused with a named error.
wppilot/woocommerce-list-product-variationsFreeReads the variations back in a compact form, attributes, prices and stock status, to compare with what was asked for.
What to check yourself. Open the product on the storefront, pick each size and add one to the cart. Attribute mistakes are invisible in the admin list and obvious in the size selector, and a price shown in the cart is the first thing a customer would dispute.
Running a store with an agent
WooCommerce and FunnelKit: which plugin owns which part of the sale
The two commerce modules are not alternatives. WooCommerce owns the catalogue, the orders, the customers and the money that moves through them. FunnelKit sits in front of that as a sequence of landing, optin, checkout and thank-you pages, and one of its funnels can replace WooCommerce's checkout for the whole shop. An agent working on a store that runs both has to know which plugin answers each question, because they keep separate records.
- Store-wide figures come from WooCommerce orders, through woocommerce-sales-summary, woocommerce-sales-report and woocommerce-product-sales. Funnel figures come from FunnelKit's own conversion log, through funnelkit-funnel-stats. The two can disagree, and neither is an accounting or payout report.
- FunnelKit's free edition records no page views, so it reports optins, orders and revenue per step but never a conversion rate.
- A funnel step page is built in Elementor, Divi, Oxygen, Gutenberg or Bricks. funnelkit-update-step renames, re-slugs, publishes or drafts a step; the page's content is edited with that builder's own abilities.
- Drafting a live step makes visitors skip it. On the store-checkout funnel that changes what every buyer sees, so treat it as a checkout change, not a page edit.
Split store work across three credentials
Keeping catalogue and money apart is easier to do than to remember. A store that uses an agent regularly ends up with three jobs, and each deserves its own access token with its own safety ceiling, so a mistake in one cannot spill into another:
- Catalogue: products, variations, attributes, categories, tags and bulk price or stock updates. It needs no order, customer or gateway ability at all.
- Reporting: the sales summary, sales report and product sales reads, plus FunnelKit stats. With customer and order reads switched off, a token for weekly figures sees totals and never a name or address.
- Order operations: reading orders, adding notes, changing status, refunds and customer accounts. Keep this token closest, give it to the fewest people, and use it with a person watching.
What can be undone in a store, and what cannot
Rollback in WooCommerce follows where data is stored, not what the change meant. A post or an option row can be put back from the change ledger, which covers product edits, attribute terms until they are deleted, and gateway titles and switches. Anything WooCommerce, a gateway or an email has already acted on cannot be put back.
- Most order writes are not reversible from the ledger: creating an order or editing one with woocommerce-update-order is recorded as irreversible. A status change through woocommerce-update-order-status keeps the previous status and rollback-change can set it back, but only the status field: a customer email the change triggered is not recalled. Setting an order to refunded, cancelled or failed is recorded as irreversible, because WooCommerce has already refunded, restocked or released stock and coupon usage for it.
- Refunds are always confirmed and never reversible, and sending the money back through the gateway is a separate opt-in from recording the refund.
- A product that manages its stock keeps no undo for a bulk price or stock update, or for an edit that sets its stock, because restoring it would write back the old stock count and erase every sale since. Change those values back by hand. An edit that leaves stock alone, such as a description or a single price, can still be rolled back without touching the live stock level.
- Global attribute definitions, tax rates and deleted terms or coupons are final. A customer update returns the previous values for you to write back by hand.
Free, Pro and WooCommerce's own abilities
GoBuildWP Free covers the reads a store owner asks for first: the setup check, store settings, products, variations, categories, tags, orders and customers, plus a single-product edit of name, description, prices and stock. Order and customer reads still need a WordPress user with manage_woocommerce, whatever the token allows. Pro adds creating products and variations, attributes, bulk updates, order and refund writes, coupons, reviews, shipping, tax, gateway settings, sales reporting and every FunnelKit ability.
WooCommerce can also expose abilities of its own under a woocommerce/ prefix. They have their own contracts and connection routes, so do not assume GoBuildWP's dry runs, confirmations or change ledger apply to them; inspect their live schema on the version you run. The WooCommerce MCP comparison sets the two side by side, and the WooCommerce MCP guide goes task by task.
Store checks before an agent works on a live shop
Rehearse anything near money on a staging copy with a test gateway first. Then, on the live store:
- Run woocommerce-check-setup and note whether HPOS is the order store, whether Block Checkout is in use and which extensions are present. A subscriptions extension, for example, adds product types the module does not list.
- Put product images in the media library before asking for them, since images are set by attachment id, never by URL.
- On a very large store, expect sales reports to come from WooCommerce Analytics rather than a direct read, and compare one figure with the Analytics screen.
- Open FunnelKit once in wp-admin after activation. Its funnel table is created on that first visit, and the funnel list is empty until then.
- Leave grouped and external products, brands, checkout fields, order bumps and upsell offers to the plugins' own screens; none of them are written here.
Easy Digital Downloads' own abilities, recorded
Easy Digital Downloads 3.7 registers 29 abilities of its own, which any MCP client on the site can reach. From GoBuildWP Free 1.18.0, GoBuildWP's change log knows what each of their writes touches. A download is a WordPress post, so editing one is recorded with a snapshot of the whole post and can be undone from the Changes screen; creating one is recorded with the advice to trash it.
Orders, customers, notes and discounts live in EDD's own tables, and receipts and notes are emailed, so those writes are recorded as irreversible with that reason rather than a generic one. You can see what an agent did to an order; you put it back by hand.
FAQ
Commerce and AI, answered
Can an agent change prices or process refunds?
One product's prices, stock and text can be edited on GoBuildWP Free, and batch catalogue edits come with Pro. Anything that moves money is a separate class of authority: give catalogue work its own credential, and verify order and payment activity in the payment provider rather than in WooCommerce alone.
Is customer and order data exposed to the AI client?
Only what an ability returns for the call that was made, and only within the connected user's WooCommerce capabilities. Keep order-reading abilities off credentials that exist to edit product copy.
Can an agent build a catalogue from a brief?
Yes, including variations, attributes and categories. Review the storefront, one variable product and the cart before treating the catalogue as finished, since attribute mistakes are invisible in the admin list view.
Which product types can an agent create?
Simple and variable products. Grouped and external products are not supported by wppilot/woocommerce-create-product, so build those in WooCommerce's own screen. Brands are read-only, and images must already be in the media library, referenced by attachment id.
Does it work on stores that use HPOS?
Yes. wppilot/woocommerce-check-setup reports whether High-Performance Order Storage is the canonical order store, and orders are read (in GoBuildWP Free) and changed (in Pro) through WooCommerce's own APIs rather than by querying the posts table, so the same calls work either way.
Can an agent see sales without seeing customers?
Mostly. wppilot/woocommerce-sales-summary returns order counts and totals for a date range, and wppilot/woocommerce-sales-report and wppilot/woocommerce-product-sales break sales down by period and by product. Customer and order reads are separate abilities; switch those off for a credential that only needs figures, and the connected user's WooCommerce capabilities still apply to whatever is left on.
Start in Read Only, then add what the site runs
Connect your AI client to the free MCP foundation and check what it can see. The free plugin already covers the basics for WooCommerce; add Pro when a job needs more.