SDX AI Readiness Toolkit for WooCommerce

No. WooCommerce 10.7+ ships internal ACP infrastructure with the agentic_checkout feature flag (default off). Our Coexistence detector activates our endpoints only when the WC native flag is off, and defers (410 + Location header) when on.

No. WooCommerce 10.9+ registers seven canonical abilities of its own ( woocommerce/products-query , orders-query and friends) through the WordPress MCP Adapter. Two near-identical tool sets in front of the same agent makes tool selection worse, so the “WP Abilities” setting defaults to auto : when WooCommerce’s canonical abilities are present, this plugin does not register its overlapping set, and the dashboard’s MCP-004 check tells you that happened. Set the mode to all (or filter agtc_mcp_abilities_mode ) if you want both. The plugin’s own OAuth MCP server at /wp-json/agtc/v1/mcp is unaffected either way.

Yes — the release is integration-tested against a live WordPress 7.1 + WooCommerce 11.0.1 install: the UCP profile, the catalog capabilities, the MCP server, OAuth registration and token exchange, the ACP purchase flow that creates a real order, and the readiness dashboard all pass there. WordPress 7.1 keeps PHP 7.4 as its minimum, so no PHP change is needed.

UCP 2026-08-25, date-versioned as the specification requires. The profile advertises only the capabilities this plugin actually serves — currently dev.ucp.shopping.catalog.search and dev.ucp.shopping.catalog.lookup — because a platform negotiates against that document, and an over-claimed capability fails later in a worse place. payment_handlers is published as an empty map until the UCP checkout capability ships. You can extend the document with the agtc_ucp_profile filter.

Nothing is deleted by default. Deactivating the plugin only withdraws its rewrite rules; your signing keys, registered OAuth clients and settings stay put, so reactivating restores the exact same store identity. Deleting the plugin also leaves that data alone unless you tick Delete all plugin data on uninstall on the dashboard first — that opt-in exists because the master secret encrypts stored client data, and removing it cannot be undone.

Yes: 60 requests per minute, counted per declared platform profile (falling back to the caller’s IP address). Over the limit the endpoint answers 429 with a Retry-After header and a UCP rate_limited message, which platforms are expected to honour. Tune or disable it with the agtc_ucp_catalog_rate_limit filter — returning 0 turns throttling off.

No. The UCP catalog endpoints expose only data your storefront already shows publicly, so they are unauthenticated. They do require the UCP-Agent header the specification mandates, so a misconfigured caller gets a protocol-shaped error rather than silently reading your catalog; the agtc_ucp_require_agent_header filter can relax that. Order data always requires an OAuth token and is scoped to the agent’s own orders.

Only for ACP payment_intent flow. Without Stripe, agents can still discover, browse, and create checkout sessions — they just can’t authorize payment through ACP directly.

There are two flow models to choose from, and most stores can start without Stripe entirely:

• Model A — Agent pays directly (ACP payment_intent ): Requires Stripe. The ACP protocol uses Stripe’s PaymentIntent under the hood, so you must define AGTC_STRIPE_SECRET_KEY in wp-config.php . The agent never sees the customer’s card; payment is captured server-side at session completion. This is the fully autonomous flow.
• Model B — Agent creates order, customer pays later: Works with any WooCommerce payment gateway — PayPal, Square, Stripe via WooCommerce Payments, bank transfer, cash on delivery, anything you already have configured. The agent creates an ACP session, which the plugin converts into a standard pending WooCommerce order. The customer receives an order link and completes payment using whatever gateway your store already uses.
• Recommendation: Most stores should start with Model B (no Stripe required) and add Model A later if and when they want fully autonomous agent purchases without a human checkout step.

By default, public product data only (name, price, description, images). An agent can additionally read its own orders if it holds the read:orders scope — but only orders it created itself through the ACP checkout flow. Agents never see other agents’ orders or orders placed by human customers through normal checkout.

Order access is scoped to ownership and safe by default: an agent (OAuth client) can only ever read orders it created itself via the ACP checkout flow. It can never read another agent’s orders or orders placed by human customers through normal checkout.

To read its own orders, an agent must request the read:orders scope at registration; dynamic client registration only ever grants read:products by default, so read:orders must always be requested explicitly. No server-side opt-in or wp-config.php constant is required.

Yes. Client secrets are hashed with password_hash() . Access tokens are RS256-signed JWTs with iat , exp (max 2h), aud , iss , and jti claims. Admin endpoints require WP nonce + manage_woocommerce .

Open the AI Readiness dashboard. If JWKS rotation is needed, click the “Rotate JWKS keypair now” button. Old key remains valid for a 24h grace period.

WordPress core ships the Abilities API (since 6.9) and the PHP AI Client (7.0). The MCP Adapter is not part of WordPress core — it is maintained separately by the WordPress AI team, and WooCommerce 11.0 already bundles it as a library, so most stores do not need to install anything. It stays dormant until you enable WooCommerce’s mcp_integration feature (WooCommerce → Settings → Advanced → Features); after that, MCP clients such as Claude Desktop, Claude Code, Cursor or VS Code can reach WordPress abilities using ordinary application passwords. The dashboard’s MCP-004 check tells you which of these two states you are in.

This plugin registers its tools as Abilities so they are available through that adapter, using the unified meta.public exposure flag introduced in WordPress 7.1 (the older per-channel flags are kept for adapters that predate it). Its own OAuth MCP server stays active alongside the adapter and continues to serve headless or autonomous agents that manage their own credentials.

The AI Readiness dashboard shows a “Protocol exposure” card with four settings:

MCP exposure controls which MCP path is active: “both” (default — the adapter and the plugin server run side by side), “core” (plugin’s own MCP server is disabled, traffic goes to the adapter only), or “plugin” (adapter integration is disabled, plugin MCP server only).

WP Abilities controls what happens when WooCommerce registers its own canonical abilities: “auto” (default — this plugin stands down so agents do not see two overlapping tool sets) or “all” (register both).

ACP exposure controls ACP checkout availability: “auto” (default — plugin ACP is active when WooCommerce native ACP is off, deferred when on), “plugin” (plugin ACP is always active regardless of WC native state), or “off” (ACP checkout is fully disabled).

UCP exposure turns the UCP profile’s advertised services and the catalog endpoints “on” (default) or “off”.

All four can be overridden programmatically with the filters agtc_mcp_exposure_mode, agtc_mcp_abilities_mode, agtc_acp_exposure_mode and agtc_ucp_exposure_mode, which receive the stored option value and should return one of the accepted mode strings.

The plugin publishes a Google-spec product feed at https://yourstore.com/merchant-feed/google.xml . In Google Merchant Center, go to Products → Feeds , add a new feed, and choose the scheduled fetch option pointing at that URL. Google then fetches the feed on its own schedule — the plugin never contacts Google. The feed carries title, description, price, availability, image, and brand/GTIN when set; adding a brand and GTIN to each product improves listing quality and match rate. The dashboard’s FEED-001 check flags products missing those attributes.