XeroWP
Counterhand MCP for WooCommerce – AI Agent & MCP Server for Claude, ChatGPT, Gemini & More
Counterhand MCP for WooCommerce – AI Agent & MCP Server for Claude, ChatGPT, Gemini & More

Counterhand MCP for WooCommerce – AI Agent & MCP Server for Claude, ChatGPT, Gemini & More

0/5 (0 ratings) 20 active installs Updated Nov 12, 2026
ChatGPTClaudemcpmcp-serverwoocommerce
Download v2.1.1 Plugin Website
You decide what each AI app may do: untick anything on the consent screen, then approve.

You decide what each AI app may do: untick anything on the consent screen, then approve.

Your WooCommerce store, inside the AI you already use: Claude, ChatGPT, Copilot and other MCP apps, or a chat in wp-admin on Claude, GPT, Gemini, Grok, Mistral, DeepSeek or a local model. Ask what sold last week, find low stock, draft better product texts or look up an order. Each app gets only the areas you tick, and anything risky waits for your Approve.

  • Approve, don’t paste keys — apps connect through a consent screen in your browser. You tick what each one may read and change, and take it back with one click.
  • Changes wait for you — anything that moves money or reaches a customer, such as a price change, a refund or a new coupon, runs only after you approve it. A price change shows the price before and after.
  • Free and self-hosted — open source (GPL), no account, no service of ours in between. Store data reaches only the apps you connect and the AI model you choose.

Ask it things like

  • “What sold last week, and how does that compare with the week before?”
  • “Which products are running low? Draft a restock list.”
  • “Rewrite the short descriptions in Kitchen & Table to sound warmer.”
  • “Which orders have been on hold for more than three days?”
  • “Raise the price of the sage mug to 16.” It waits for your Approve.

Home page and documentation: counterhand.app.

Built for security

Your store gets one MCP endpoint at https://yourstore.com/mcp, and apps connect through a browser consent flow (OAuth 2.1), never a copied key.

  • OAuth 2.1 with PKCE — the modern MCP authorization standard. Client identity via Client ID Metadata Documents (CIMD); no client secrets, no manual registration.
  • You approve what each app may do — the consent screen asks “Let this app work with your store?” and lists the requested permissions under plain headings (Catalog, Sales, Insights, Content, Store setup, Advanced, Other plugins) as checkboxes you can narrow before approving. Changing never implies reading, and Advanced and Other plugins stay folded and are never pre-ticked.
  • Fail-closed security — an area switched off for the store, or a permission the app was not granted, makes its tools invisible AND uncallable. A connection can never do more than the administrator who approved it; demoting or removing that user instantly disables it.
  • Audience-bound, hashed tokens — access tokens are bound to your store (RFC 8707) and stored as SHA-256 hashes. Constant-time verification, no authentication oracle, per-connection rate limiting. Apps that can refresh get one-hour access tokens and a rotating refresh token; a replayed refresh token revokes the connection.
  • Safe defaults for writes — products and posts are created as drafts for human review; deletion moves to trash unless permanent deletion is explicitly requested.
  • Confirmation for the dangerous few — changing a store setting, enabling or disabling a payment gateway, or running a WooCommerce maintenance tool each require an explicit confirmation argument, so an assistant has to tell you what it is about to do and get your agreement first.
  • Credentials stay out of reach — settings named like an API key, secret, password or token are never writable through the API, payment gateway credentials are neither read nor written, and maintenance routines that cannot be undone (resetting user roles, deleting tax rates, dropping order tables, running the database migration) are refused outright.
  • Custom fields are guarded — WordPress’s own private fields are hidden, and the keys that hold roles, capabilities and login sessions can be neither read nor written. Customer custom fields are read-only.
  • Revoke anytime — Connect apps › Connected apps lists every app; one click cuts off its access.
  • Opt-in activity log — record every tool call, with names, addresses, emails and phone numbers masked before storage, configurable retention and one-click clearing.

132 tools, in areas you switch on one by one

Every area is its own switch on the Access screen, with Can read and Can change as separate switches. A fresh install exposes Products, Orders and Reports, read-only — everything else is off until you turn it on, and upgrading never widens what your store exposes.

  • Catalog — Products (11), Categories & tags (25), Variations (5), Reviews (5), Coupons (8)
  • Sales — Orders (11), Refunds (4), Customers (3)
  • Insights — Reports (8)
  • Content — Posts & pages (10)
  • Store setup — Shipping (14), Taxes (8), Reference data (7)
  • Advanced — Store settings (4), Payment gateways (3), System & maintenance (4), Undo history (2)

Tools delegate to WooCommerce’s own REST controllers, so validation, stock handling and HPOS compatibility behave exactly like the standard API. Their input schemas are read from those controllers at runtime rather than copied into this plugin, so a WooCommerce update that adds a field surfaces it automatically, and one that removes a field cannot leave a tool advertising it.

Each tool offers the ten or so fields that matter, which keeps assistants accurate; describe_woocommerce_fields reveals the rest when one is needed.

Visibility is decided by WooCommerce too: before a tool is offered, this plugin runs WooCommerce’s own permission check for that endpoint. A shop manager therefore sees a different set of tools from an administrator, without this plugin keeping a list of who may do what.

Works with your other plugins

Off until you switch each on: WPML, Germanized and Germanized Pro, Contact Form 7, Flamingo, Advanced Custom Fields, Shipment Tracking, Cost of Goods, URL Coupons, and abilities from Yoast SEO, Rank Math, WPForms and others. An assistant can preview most catalog changes, and undo them for 30 days. The FAQ has the details.

Two ways to use AI with your store

Chat inside wp-admin, on the AI model WordPress manages under Settings Connectors (WordPress 7.0 and later), or with your own key on Claude, ChatGPT, Gemini, Grok, Mistral, DeepSeek, any model on OpenRouter, or a local Ollama model. Any other OpenAI-compatible endpoint works too. It uses the same tools an outside app would, and a change that is not easily undone waits for your Approve button.

Connect the AI apps you already use. Paste one URL into Claude, ChatGPT, Claude Code or any other MCP client, or add the store to Cursor and VS Code in one click. No token to create, no local proxy, no Node.js.

More than tools

  • Overview — opens first: what is still to set up, whether AI access is on, the connected apps, and what AI did today.
  • Rewrites — the AI model drafts new descriptions for up to 25 products in a category. Nothing changes until you approve each text, and with undo history on an applied text can be undone.
  • Weekly report — each person can ask for last week’s sales, best sellers and waiting orders by email every Monday, as WooCommerce’s own reports state them. With an AI model chosen, a short summary written by AI comes first, labelled as such.
  • Activity — every call apps and the chat made, newest first, if you switch recording on.

How this differs from WooCommerce’s built-in MCP

WooCommerce registers a handful of product and order abilities, which the separate MCP adapter plugin can offer to AI clients, signed in with an application password. Counterhand adds what a self-hosted store still lacks: OAuth 2.1 browser consent instead of copied keys, the whole WooCommerce and WordPress surface (coupons, customers, reports, shipping, tax, settings, posts and pages), permissions chosen per app with one-click revocation, confirmation-gated risky writes, an activity log, undo, and the in-admin chat. The two can run side by side.

Free, open source, sponsor-supported

Counterhand is free for every store, with no paid tier and no locked features. Development and support are funded by GitHub Sponsors. The source is on GitHub — issues and pull requests are welcome.

Privacy

The plugin contacts no server of its own, collects no usage data and phones no telemetry home. It makes no outbound request until you ask it to — see the “External services” section below for exactly which services can be contacted, what is sent and when. Nothing is sent to the author of this plugin, ever.

External services

This plugin does not depend on any service of its own. It never contacts the plugin author, and it sends no analytics or telemetry anywhere. Every outbound request below happens only as a direct result of something you do in wp-admin, and most stores will only ever use one of them.

AI model providers (chat, Rewrites and the weekly report summary)

Three features send store data to the AI model you choose on the Chat screen: the chat, Rewrites and the AI summary in the weekly report. They are the only features that transmit store data to a third party, and none of them sends anything until you choose a model. If you never choose one, no request is ever made to any of these services.

On WordPress 7.0 and later the AI model can be the one WordPress itself manages under Settings Connectors, so this plugin never handles the API key and the provider is whichever one you configured in WordPress. Otherwise you choose a provider on the Chat screen and supply your own API key.

What is sent, and when: only when an administrator sends a chat message (and on each follow-up step of answering it) the plugin transmits, to the provider you chose: your message text, the earlier messages in that chat conversation, the list of enabled tool definitions (tool names, descriptions and argument schemas), and the results of any tool the model calls to answer you. Those tool results contain your store’s data — for example product, order, customer or report records the model looked up in order to answer. A short system instruction accompanies the request, authenticated with your own API key (or, on WordPress 7.0 and later, by WordPress’s connector, so this plugin never sees the key).

Rewrites: only when an administrator or shop manager starts a rewrite job, the plugin sends each chosen product’s name, current description or short description and the person’s instructions to the model, one product at a time, in the background through WooCommerce’s Action Scheduler. Nothing else about the store is sent, and nothing is sent after the job ends.

Weekly report summary: only for a person who asked for the weekly report, and only while a model is chosen, the plugin sends the store’s name and the figures for last week and the week before (sales totals, best sellers by name and quantity, the number of orders waiting) to the model every Monday morning to write a short summary. No customer data is included. Without a model the report goes out without a summary and nothing is sent.

There is one other, smaller request: when you save an API key on the Chat screen, the plugin sends a single “ping” message to the provider to check the key works before storing it, so a wrong key is reported immediately. That check contains no store data.

The provider you select determines the destination:

Choosing Ollama or a self-hosted custom endpoint means the chat sends no store data to any third party.

MCP client identity documents (when an AI app connects)

When an AI assistant connects to your store, it identifies itself with a Client ID Metadata Document (CIMD) — a URL it publishes, as required by the MCP authorization specification. To show you on the consent screen which app is actually asking for access, the plugin fetches that URL once and caches the result.

What is sent, and when: an ordinary HTTP GET to the URL the connecting app supplied, at the moment someone starts a connection. It carries no store data, no personal data and no credentials — only the request itself. The URL must be HTTPS, and the request goes through WordPress’s own safe HTTP function, so private-network and loopback addresses are refused. The destination is not fixed: it is whichever app you are connecting (for example https://claude.ai/... for Claude or https://chatgpt.com/... for ChatGPT), so the applicable terms are those of the AI app you chose to connect. If the document cannot be fetched or does not match, the connection is refused.

WordPress.org (installing an AI provider plugin)

On WordPress 7.0 and later, the Chat screen can install the official “AI Provider for Anthropic”, “AI Provider for OpenAI” or “AI Provider for Google” plugin for you. This happens only when an administrator with permission to install plugins clicks the matching button. WordPress then fetches the plugin from the WordPress.org plugin directory the same way Plugins Add New does, subject to the WordPress.org privacy policy. No store data is sent; the API key for the provider is entered afterwards on WordPress’s own Settings Connectors screen.

Your own store (reachability check)

The “Connect apps” screen reports whether your MCP endpoint is actually reachable and advertising OAuth discovery. To find out, the plugin requests your own site’s URLs (/mcp and /.well-known/oauth-protected-resource) over HTTP.

This is not a third-party service: the request goes to your own domain and no data leaves your server’s control. It runs only while an administrator is viewing that screen.

Links on the Connect apps screen

That screen also shows documentation links for Claude, ChatGPT, Cursor and VS Code, and “add to editor” buttons. These are ordinary links and buttons in your browser — the plugin makes no request to those sites, and nothing is sent unless you click through.