WooCommerce MCP server for your Whop sales

WhopForWoo includes a WooCommerce MCP server that lets your AI assistant read your Whop sales. Enable it in WooCommerce → WhopForWoo → AI assistant (MCP), copy the token into Claude, Cursor or another MCP client, and ask “How much did I sell through Whop this week?”. It is read-only, off by default, protected by a token you can revoke, and it never exposes full customer e-mails, addresses or keys.

MCP (Model Context Protocol) is the open standard AI assistants use to call tools on other systems. Here, the tools are reports on the orders your customers paid with Whop.

What you can ask

Only orders paid with the Whop gateway are visible. Orders paid by PayPal, Stripe or any other method are invisible to the assistant.

Set up the WooCommerce MCP server

1. Enable it and generate a token

1. In WordPress, open WooCommerce → WhopForWoo → AI assistant (MCP).
2. Click Enable and generate a token.
3. Copy the token now: it is shown once. The store keeps only a hash of it.

The page also shows your endpoint, https://yourstore.com/wp-json/whopforwoo/v1/mcp, and ready-to-paste snippets with the token filled in.

2. Add it to your AI client

Claude Code: run this in a terminal:

claude mcp add --transport http whopforwoo https://yourstore.com/wp-json/whopforwoo/v1/mcp \
  --header "Authorization: Bearer YOUR_TOKEN"

Claude Desktop: add this to claude_desktop_config.json (Settings → Developer → Edit Config), then restart Claude. It needs Node.js for mcp-remote:

{
  "mcpServers": {
    "whopforwoo": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://yourstore.com/wp-json/whopforwoo/v1/mcp",
               "--header", "Authorization:${WFW_AUTH}"],
      "env": { "WFW_AUTH": "Bearer YOUR_TOKEN" }
    }
  }
}

Cursor: add this to ~/.cursor/mcp.json (or Settings → MCP → Add server). Other clients with a JSON config use the same shape:

{
  "mcpServers": {
    "whopforwoo": {
      "url": "https://yourstore.com/wp-json/whopforwoo/v1/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN" }
    }
  }
}

Any other MCP client: choose the Streamable HTTP (or “HTTP”) transport, set the URL above and the header Authorization: Bearer YOUR_TOKEN.

3. Ask your first question

Open a new conversation and try: “Using whopforwoo, summarize my Whop sales for the last 7 days.” The assistant calls sales_summary and answers with order count, gross, refunds and net, per currency.

The five tools

sales_summary sums your Whop sales over a period: today, 7d (today and the 6 days before), 30d, month (since the 1st), or custom with from and to dates (up to 366 days). It returns paid orders, gross, refunds and net per currency, and the number of orders in each status. Gross counts orders in processing, completed or refunded status created in the period. Amounts in different currencies are never added together. Dates use your store’s timezone (Settings → General).

list_orders returns the newest Whop orders, with optional filters for status (pending, processing, on-hold, completed, cancelled, refunded, failed), a date range, and a limit from 1 to 100. Each order lists ID, number, date, status, total, currency, the customer’s first name, a masked e-mail and the Whop payment ID.

get_order reads one order by ID or number: items, totals, refunds, Whop payment ID and the verification result. That result is one of these states:

• verified: the payment was read back from Whop and matched the order, amount and currency.
• held_for_review: Whop confirmed a payment that does not match, with the reason (for example amount_mismatch).
• awaiting_settlement: a bank debit is still in progress.
• not_paid: no verified payment yet.

unmatched_payments lists payments Whop confirmed in the last 14 days that no order could take, meaning the customer was charged but has no paid order. This is the same list as Status & tools → Payments taken without an order.

webhook_health shows whether your Whop webhook works: secret configured, last signed webhook received, the last 20 webhook requests with their HTTP status and outcome, failures in the last 24 hours, the last Whop API error, orders held for review and unmatched payments. A 401 means a bad signature: the secret in the store doesn’t match the webhook in Whop. Requests are recorded only while the MCP server is enabled.

Security

• Off by default. The endpoint doesn’t exist until you enable it.
• Token shown once, stored hashed. The store keeps only a SHA-256 hash of the 256-bit token and compares in constant time. Lost it? Generate a new one, and the old one stops working.
• Header only. The token goes in Authorization: Bearer …. A token in the URL is refused, because URLs end up in server logs.
• HTTPS required (except localhost). Requests from a foreign browser Origin are refused.
• Runs as you. Each call runs with the permissions of the admin who generated the token, who must still have Manage WooCommerce. If that user loses the role, the token stops working.
• Rate limited: 60 requests per minute per token, and 20 failed attempts per IP address per 10 minutes.
• Read-only, minimal data. Customers appear as a first name and a masked e-mail. No full e-mail, address, phone, order key, API key or card data is ever returned.
• Logged only if you ask. With logging on (Status & tools), each call is logged with the tool name and user ID only.

To cut access, click Disable and revoke the token.

Troubleshooting

401 even with the right token. Some Apache hosts strip the Authorization header. WordPress’s default .htaccess passes it on; if yours was customized, add RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]. Security plugins and firewalls can also strip it. Allow /wp-json/whopforwoo/v1/mcp.

403 “requires HTTPS” behind a proxy or CDN. WordPress must know the request came over HTTPS. Most hosts set this; otherwise add the standard $_SERVER['HTTPS'] = 'on'; check for X-Forwarded-Proto in wp-config.php.

404 No route. The server is disabled, or permalinks are set to “Plain”. Use https://yourstore.com/?rest_route=/whopforwoo/v1/mcp in that case.

429. You hit 60 requests per minute. Wait a minute.