How to Add WebMCP to WordPress and WooCommerce: A Practical Guide

WordPress and WooCommerce are a natural fit for WebMCP: the data agents need (products, prices, stock, pages, FAQs) already sits behind clean APIs. This guide shows the practical steps we use, from choosing tools to testing them, with code you can adapt. If WebMCP is new to you, start with what WebMCP is.

Step 1: Choose the first tools

Do not expose everything. Pick the two or three actions customers ask about most, and start read-only:

• Stores: search_products, get_product (variations, stock), get_store_policy (shipping, returns).
• Service businesses: find_service, get_faq, prepare_quote_request.
• Bookings: list_services, find_open_slots; confirming a booking comes later and always needs the visitor.

Step 2: Plugin or custom tools?

A plugin such as WebMCP Bridge registers standard read-only tools for posts and products in minutes. That is a good test for a simple site. It cannot know your own rules: delivery zones, bulk prices, booking limits, which plugins hold which data. For that, write a small custom plugin with your own tools. The rest of this guide shows the custom route.

Step 3: Turn existing forms into tools

The quickest win is the declarative API. Add toolname and tooldescription to a form you already have, such as your contact or quote form. Labelled fields become the tool’s inputs, and toolparamdescription can explain a field further:

<form toolname="request_quote" tooldescription="Prepare a quote request. The visitor reviews and sends it." action="/quote">
  <label for="qname">Name</label> <input id="qname" name="name">
  <label for="qemail">Email</label> <input id="qemail" name="email" type="email">
  <select name="service" toolparamdescription="Which service the quote is for.">
    <option>Website redesign</option>
    <option>WooCommerce store</option>
  </select>
  <button type="submit">Send</button>
</form>

Without the toolautosubmit attribute the browser only fills in the form; the visitor still presses Send. Keep it that way for anything that contacts your team.

Step 4: A product search tool with the Store API

WooCommerce’s Store API (/wp-json/wc/store/v1/products) is public, returns the same data shoppers see, and already respects product visibility. A small script, loaded by your plugin, can register a search tool on top of it:

const mc = document.modelContext || navigator.modelContext;
if (mc && mc.registerTool) {
  mc.registerTool({
    name: 'search_products',
    description: 'Search the store catalog. Returns up to 5 products with price, stock and link.',
    inputSchema: {
      type: 'object',
      properties: {
        query: { type: 'string', description: 'Keywords, e.g. running shoe' },
        max_price: { type: 'number', description: 'Highest price in the store currency' },
      },
      required: ['query'],
    },
    annotations: { readOnlyHint: true },
    execute: async ({ query, max_price }) => {
      const url = new URL('/wp-json/wc/store/v1/products', location.origin);
      url.searchParams.set('search', String(query).slice(0, 80));
      url.searchParams.set('per_page', '5');
      if (max_price) url.searchParams.set('max_price', String(Math.round(max_price * 100)));
      const items = await (await fetch(url)).json();
      return JSON.stringify(items.map((p) => ({
        name: p.name, price: p.prices.price / 10 ** p.prices.currency_minor_unit,
        in_stock: p.is_in_stock, url: p.permalink,
      })));
    },
  });
}

Enqueue it from your plugin with wp_enqueue_script() on the pages where it makes sense, usually the whole shop. The feature check on the first line means browsers without WebMCP skip it.

Step 5: Your own data through the REST API

For data the Store API does not cover, such as delivery zones or appointment slots from a booking plugin, add a small read-only REST route. Always set a permission_callback, validate every argument and return only what a customer may see:

add_action('rest_api_init', function () {
  register_rest_route('mysite/v1', '/delivery', [
    'methods' => 'GET',
    'permission_callback' => '__return_true', // public, read-only data
    'args' => ['postcode' => ['required' => true, 'sanitize_callback' => 'sanitize_text_field']],
    'callback' => function ($req) {
      return ['postcode' => $req['postcode'], 'days' => mysite_delivery_days($req['postcode'])];
    },
  ]);
});

Step 6: Sensitive actions need the shopper

Adding to cart, booking and sending forms change something, so mark those tools with consequentialHint: true and let the shopper confirm. Use the shopper’s own session and WordPress nonces, never an admin key. Keep checkout and payment with the shopper. Do not build tools that list orders, customers or users.

Step 7: Test, then launch

1. Build on a staging copy of your site first.
2. Test in a recent Chrome with WebMCP enabled, and call each tool with good and bad inputs.
3. Check that normal visitors see no change and that page speed stays the same.
4. Run the free WebMCP checker on the live page to confirm the tools are visible from outside.
5. Log tool calls without personal data, and review them after launch.

Want it done for you?

We design, build and test WebMCP tools for WordPress and WooCommerce, starting with a free readiness audit and a fixed quote. See our WordPress WebMCP integration service, or read WebMCP vs MCP to decide whether you also need an MCP server.