WooCommerce MCP After 10.9: Moving AI Agents to the Built-in Abilities
WooCommerce 10.9 deprecated the /woocommerce/mcp endpoint. Moving an agent to the built-in abilities changes its credential, its tools and who decides what it can write.
Category
Hands-on guides for developers and site owners who run WordPress in production. Covers plugin and theme code, security, performance and caching, server tuning and upgrades, with an AI angle where it earns its place.

WooCommerce 10.9 deprecated the /woocommerce/mcp endpoint. Moving an agent to the built-in abilities changes its credential, its tools and who decides what it can write.

MCP is a pipe for AI tools; ACP and UCP are the commerce contracts. Where each stands in October 2026, and what it means for WooCommerce, Shopify and Magento stores.

A 524 shows the origin was too slow, not who asked. Diagnose crawler-driven 524s on WordPress, keep robots.txt available, cache HTML at the edge, then decide which AI crawlers to block.

Google says llms.txt neither harms nor helps. Feeds and crawlable product pages are the documented routes into ChatGPT and AI Overviews for WooCommerce, Shopify and Magento.

Exposure decides what an AI agent can see in WordPress. Permissions decide what it may do. Tested abilities, and client settings for Claude Code and Codex.

Working AGENTS.md files for WordPress, WooCommerce and Magento 2, how Claude Code and Codex load them, and what no instruction file can enforce.

PHP 8.2 security support ends on 31 December 2026. Upgrade your WordPress and Magento code with Rector, PHPStan, versioned containers and a gated AI agent.

Keyword search misses the right page when the question and the answer use different words. Fixing that is mostly a data problem, starting with the fact that Oracle’s MySQL Community Server cannot rank a vector.

A relevant help article can still contain hostile instructions. Map the route from retrieved text to model output, then enforce what the application may reveal or do.

How to add useful retrieval without losing permissions, provenance or the ability to change providers.

In short: Keep the model call out of the web request: authorise at the REST route, queue an idempotent job, bound the

Three ways to list recent posts from the same category under a post without repeating the one being read: Latest Posts block, Query Loop block or a short WP_Query.
With your permission, iLogr uses Google Analytics and Jetpack Stats to count which articles are read. Nothing is loaded unless you accept. Privacy policy