Manage your WooCommerce shop with an AI assistant

Once an AI assistant is connected to your WordPress site, WooCommerce gives it a second set of tools: products and orders. You can ask it to find every product without a description and write one, raise prices in a category by a percentage, list today's unfulfilled orders, or add a note to an order after a phone call. This guide shows how to set that up and, because orders hold your customers' personal information, how to do it without handing that information to anyone who should not have it.

Last reviewed: 19 October 2026, against WooCommerce 11 and the WordPress MCP Adapter. WooCommerce describes its AI connector as a developer preview, so the tools it offers may change between versions; this guide is reviewed when they do.

Official Documentation Reference

• WooCommerce: MCP: what WooCommerce exposes to AI clients and how it authenticates.
• WooCommerce: Roles and capabilities: what a Shop Manager may do.
• WordPress MCP Adapter: the connector plugin.
• POPIA, section 19: security measures on integrity and confidentiality of personal information: your duty towards the customer data in your orders.

Before you start

Follow our guide to connecting Claude to your WordPress site safely first. You need WordPress 6.9 or later over HTTPS, the MCP Adapter plugin, and WooCommerce on a current version. Everything in this guide works on any Noiz hosting plan.

Then take a backup. For a shop, the database is the part that matters, because that is where products, orders and customers live: How to export a database backup in Plesk. A full backup is better: How to generate a full backup in Plesk.

Step 1: A user for the shop, not the site

The Editor user from the WordPress guide cannot see WooCommerce. Create a second user for shop work, so that the two connections can be revoked separately and the activity logs show which one did what.

1. Users > Add New User. Username such as claude-shop.
2. Role: Shop Manager. A Shop Manager can manage products, orders, coupons and WooCommerce settings and edit posts, but cannot install plugins or manage users. It is the smallest WooCommerce role that can both read and change orders.
3. Create an application password for this user, named for the tool (Step 2 of the WordPress guide), and copy it into your password manager.

Two things WooCommerce no longer accepts, so do not look for them: the older WooCommerce REST API keys (consumer key and secret) and the separate WooCommerce MCP address. The MCP Adapter and an application password are the only route.

Start read-only

A Shop Manager can change orders, and an assistant that misreads an instruction can change many at once. For your first week, give the assistant a user that can look but not touch, then widen it when you have seen it behave. The simplest way is a Customer or Subscriber user with a small capability plugin granting only read, read_product and read_shop_order; a free plugin such as Members or User Role Editor lets you build this role in a minute. Name the role AI read-only so that nobody later wonders what it is for.

Step 2: Add the connection

Add a second connector to your Claude configuration, exactly as in the WordPress guide, with the shop user's name and application password and a name such as my-shop. Restart Claude Desktop. If you use Claude Code, run the claude mcp add command again with the new name and credentials.

Step 3: Test, then work

Ask: "How many products are published in my shop, and which five were updated most recently?" Then: "List orders from the last seven days with status Processing, showing order number, date and total." Check both answers against WooCommerce > Orders and Products. If they match, the connection is working and the user's permissions are right.

Things that work well, in our experience:

• Descriptions. "Find every published product with an empty short description and draft one from the title, the long description and the categories. Show me the drafts before saving." Review, then let it save.
• Catalogue housekeeping. "List products with zero stock that are still marked in stock." "Which products have no image?" "Which products have no category?"
• Prices. "Show me every product in the Accessories category with its regular and sale price" first; only then "raise the regular price of those by 8%, rounded to the nearest rand, and show me the before-and-after list." Never let an assistant change prices it has not first listed for you.
• Orders. "Which Processing orders are older than three days?" "Add a note to order 1234: customer called, delivery moved to Thursday." Changing an order's status is a shop decision; let the assistant propose, and set the status yourself until you trust it.
• Reports. "Total sales by week for the last eight weeks, and the ten best-selling products." The assistant reads the orders and does the arithmetic; check the totals against WooCommerce > Analytics the first few times.

Things to keep away from it: coupons that give discounts (an assistant that invents a 100% coupon has given your stock away), payment and shipping settings, tax settings, refunds, deleting products or orders, and anything in bulk without a listed preview and a backup.

Customer data: what you are responsible for

Orders contain names, addresses, phone numbers and email addresses. When an assistant reads an order, that information leaves your site and goes to the AI service you use. Under the Protection of Personal Information Act you are the responsible party for it, so three practices matter:

1. Use a business account on the AI service with the data-use terms your business has accepted, not a free personal account, and check whether the provider trains on your conversations. For Claude, Anthropic's commercial terms apply to the paid plans and the API, and consumer settings are separate.
2. Ask for what you need, not the whole order book. "How many orders shipped to Gauteng last month" needs counts, not addresses. The MCP Adapter sends the assistant what the abilities return, so a question phrased around totals and statuses exposes less than "show me all orders".
3. Keep the read-only user for reporting and the Shop Manager user for changes, and revoke both when the work is done. WordPress shows when each application password was last used.

If you sell to customers in the European Union, the same reasoning applies under the GDPR. Our article on what not to let an AI do goes further into the account-level rules.

When it goes wrong

• The assistant sees products but not orders. The user lacks order capabilities. Check the role; a Shop Manager has them, a custom read-only role needs read_shop_order.
• Changes appear that you did not ask for. Revoke the application password immediately, restore the database backup you took, read the conversation to find the instruction that was misunderstood, and narrow the user's role before reconnecting.
• The connector stops after a WooCommerce update. WooCommerce's AI tools are a developer preview and have already changed once; check the WooCommerce MCP documentation linked above and update the MCP Adapter plugin.

The server behind the shop

An assistant that queries thousands of orders and rewrites hundreds of descriptions is a busy user of your site, at the same time as your customers. On sLegacy, a shared pool where one busy site can slow the others, that work competes with everything else on the pool. sPremium gives your shop a dedicated PHP pool, so an afternoon of AI catalogue work does not slow your checkout. Compare the plans, or ask us to recommend one from your shop's real usage. If you would rather not run any of this yourself, WordPress Care keeps WooCommerce, the MCP Adapter and your site's updates in hand on any plan.