WooCommerce

New in v3.4.2 (Pro). When WooCommerce is active, EMCP exposes the full WooCommerce wc/v3 REST surface: around 120 operations: so an AI agent can manage the whole store: find and fulfil orders, issue refunds, create products and coupons, read sales reports, and adjust settings, shipping, taxes, and webhooks.

Every operation runs through WooCommerce’s own REST controllers, so it’s HPOS-safe (High-Performance Order Storage), always current with WooCommerce, and enforces WooCommerce’s own permission checks, the plugin never bypasses them.

Two tools, ~120 operations

To keep the MCP tool-list small, the whole domain is exposed as two dispatcher tools rather than one tool per operation:

• woo-read: all read operations (enabled by default)
• woo-write: all write operations (ships disabled by default)

Each takes an operation and an arguments object. Call a tool with no operation to get its catalog, then call it again to run one:

// discover
woo-read({})
// → { mode: "read", operations: [ { name: "list-orders", method: "GET", route: "wc/v3/orders", … }, … ] }

// act
woo-read({ operation: "get-order", arguments: { id: 812 } })

The dispatchers only register when WooCommerce is active, and gate on the manage_woocommerce capability; WooCommerce’s per-endpoint permission checks then apply on top.

What’s covered

woo-read and woo-write together span the full store:

Area	Operations
Products	list/get/create/update/delete + batch; variations; categories; tags; attributes + terms; reviews; shipping classes
Orders	list/get/create/update/delete + batch; order notes; refunds (create moves money)
Customers	list/get/create/update/delete (PII)
Coupons	list/get/create/update/delete + batch
Reports	sales, top sellers, and totals for orders / products / customers / coupons / reviews
Store config	settings, payment gateways, shipping zones / methods / locations, taxes + tax classes, webhooks, system status, data (countries, currencies)

Reads are enabled by default; every create/update/delete lives behind woo-write, which ships off.

Confirm-gated operations

Money-moving and irreversible operations require an explicit confirm: true in arguments, on top of woo-write being disabled by default:

• create-refund (moves money)
• every delete-* (products, orders, customers, coupons, …)
• every *-batch (bulk create/update/delete)

Without it you get a confirmation_required error, so an agent has to be deliberate about anything that spends money or deletes data.

Worked example

// 1. find processing orders
woo-read({ operation: "list-orders", arguments: { status: "processing", per_page: 10 } })

// 2. read one
woo-read({ operation: "get-order", arguments: { id: 812 } })

// 3. mark it completed
woo-write({ operation: "update-order", arguments: { id: 812, status: "completed" } })

// 4. refund $20 on it (money, needs confirm)
woo-write({ operation: "create-refund",
  arguments: { order_id: 812, amount: "20.00", reason: "partial refund", api_refund: true, confirm: true } })

// 5. create a simple product
woo-write({ operation: "create-product",
  arguments: { name: "Blue Mug", type: "simple", regular_price: "12.00", sku: "MUG-BLUE" } })

Path parts go in arguments (get-order → { id }, list-variations → { product_id }, get-settings → { group }); everything else is passed straight to the WooCommerce endpoint, list filters for reads, the record body for writes.

Safety by design

• WooCommerce’s own REST. Every call is executed by WooCommerce’s wc/v3 controllers as the authenticated admin, no privilege escalation, and HPOS is handled transparently.
• Writes off by default. woo-write ships disabled; an admin opts in under EMCP Tools → Tools → Plugins → WooCommerce.
• Confirm gate. Refunds, deletes, and batch operations refuse to run without confirm: true.
• Capability-gated. Both dispatchers require manage_woocommerce; each operation then passes through WooCommerce’s per-endpoint capability check.
• Only when active. The tools don’t register at all unless WooCommerce is installed and active.

In the admin

The dispatchers appear under EMCP Tools → Tools → Plugins → WooCommerce as two toggles, woo-read (on) and woo-write (off by default), each card listing the operations it covers. Toggle a tool to allow or block all of its operations at once. The toggles grey out with a hint when WooCommerce isn’t active.

Agent skill

Pro ships an emcp-plugins Agent Skill that teaches a connected agent this whole model, the two-dispatcher pattern, the discover→act flow, the confirm: true requirement, and the WooCommerce operation reference, so it drives the store correctly without you spelling it out.