# WooCommerce MCP server for your Whop sales

> Connect Claude, Cursor or any MCP client to your WooCommerce store and ask about Whop sales, orders and webhooks. Read-only, token-protected, built in.

Updated: 2026-11-11 · Canonical: https://whopforwoo.com/docs/whopforwoo-mcp

WhopForWoo includes a **WooCommerce MCP server** that lets your AI assistant read your Whop sales. Enable it in **WooCommerce → WhopForWoo → AI assistant (MCP)**, copy the token into Claude, Cursor or another MCP client, and ask *"How much did I sell through Whop this week?"*. It is read-only, off by default, protected by a token you can revoke, and it never exposes full customer e-mails, addresses or keys.

MCP (Model Context Protocol) is the open standard AI assistants use to call tools on other systems. Here, the tools are reports on the orders your customers paid with Whop.

## What you can ask

| Ask your assistant | Tool it uses |
|---|---|
| "How much did I sell through Whop this week?" · "Whop revenue this month, net of refunds?" | `sales_summary` |
| "Show the last 10 Whop orders" · "Any Whop orders still pending since Monday?" | `list_orders` |
| "What's in order #1042, and was the payment verified?" | `get_order` |
| "Was anyone charged by Whop without getting an order?" | `unmatched_payments` |
| "Are Whop webhooks reaching my store? Any failures today?" | `webhook_health` |

Only orders paid with the Whop gateway are visible. Orders paid by PayPal, Stripe or any other method are invisible to the assistant.

## Set up the WooCommerce MCP server

### 1. Enable it and generate a token

1. In WordPress, open **WooCommerce → WhopForWoo → AI assistant (MCP)**.
2. Click **Enable and generate a token**.
3. Copy the token now: it is shown **once**. The store keeps only a hash of it.

The page also shows your endpoint, `https://yourstore.com/wp-json/whopforwoo/v1/mcp`, and ready-to-paste snippets with the token filled in.

![AI assistant (MCP) tab with the generated token and setup snippets](https://whopforwoo.com/img/whopforwoo-mcp-tab.png)

> Your site must use HTTPS. The server refuses plain HTTP, except on `localhost` for local testing.

### 2. Add it to your AI client

**Claude Code**: run this in a terminal:

```bash
claude mcp add --transport http whopforwoo https://yourstore.com/wp-json/whopforwoo/v1/mcp \
  --header "Authorization: Bearer YOUR_TOKEN"
```

**Claude Desktop**: add this to `claude_desktop_config.json` (Settings → Developer → Edit Config), then restart Claude. It needs Node.js for `mcp-remote`:

```json
{
  "mcpServers": {
    "whopforwoo": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://yourstore.com/wp-json/whopforwoo/v1/mcp",
               "--header", "Authorization:${WFW_AUTH}"],
      "env": { "WFW_AUTH": "Bearer YOUR_TOKEN" }
    }
  }
}
```

**Cursor**: add this to `~/.cursor/mcp.json` (or **Settings → MCP → Add server**). Other clients with a JSON config use the same shape:

```json
{
  "mcpServers": {
    "whopforwoo": {
      "url": "https://yourstore.com/wp-json/whopforwoo/v1/mcp",
      "headers": { "Authorization": "Bearer YOUR_TOKEN" }
    }
  }
}
```

**Any other MCP client**: choose the *Streamable HTTP* (or "HTTP") transport, set the URL above and the header `Authorization: Bearer YOUR_TOKEN`.

### 3. Ask your first question

Open a new conversation and try: *"Using whopforwoo, summarize my Whop sales for the last 7 days."* The assistant calls `sales_summary` and answers with order count, gross, refunds and net, per currency.

## The five tools

**`sales_summary`** sums your Whop sales over a period: `today`, `7d` (today and the 6 days before), `30d`, `month` (since the 1st), or `custom` with `from` and `to` dates (up to 366 days). It returns paid orders, gross, refunds and net per currency, and the number of orders in each status. Gross counts orders in *processing*, *completed* or *refunded* status created in the period. Amounts in different currencies are never added together. Dates use your store's timezone (Settings → General).

**`list_orders`** returns the newest Whop orders, with optional filters for status (`pending`, `processing`, `on-hold`, `completed`, `cancelled`, `refunded`, `failed`), a date range, and a limit from 1 to 100. Each order lists ID, number, date, status, total, currency, the customer's first name, a masked e-mail and the Whop payment ID.

**`get_order`** reads one order by ID or number: items, totals, refunds, Whop payment ID and the **verification result**. That result is one of these states:
- `verified`: the payment was read back from Whop and matched the order, amount and currency.
- `held_for_review`: Whop confirmed a payment that does not match, with the reason (for example `amount_mismatch`).
- `awaiting_settlement`: a bank debit is still in progress.
- `not_paid`: no verified payment yet.

**`unmatched_payments`** lists payments Whop confirmed in the last 14 days that no order could take, meaning the customer was charged but has no paid order. This is the same list as **Status & tools → Payments taken without an order**.

**`webhook_health`** shows whether your [Whop webhook](https://whopforwoo.com/docs/whop-webhooks) works: secret configured, last signed webhook received, the last 20 webhook requests with their HTTP status and outcome, failures in the last 24 hours, the last Whop API error, orders held for review and unmatched payments. A `401` means a bad signature: the secret in the store doesn't match the webhook in Whop. Requests are recorded only while the MCP server is enabled.

## Security

- **Off by default.** The endpoint doesn't exist until you enable it.
- **Token shown once, stored hashed.** The store keeps only a SHA-256 hash of the 256-bit token and compares in constant time. Lost it? Generate a new one, and the old one stops working.
- **Header only.** The token goes in `Authorization: Bearer …`. A token in the URL is refused, because URLs end up in server logs.
- **HTTPS required** (except `localhost`). Requests from a foreign browser `Origin` are refused.
- **Runs as you.** Each call runs with the permissions of the admin who generated the token, who must still have *Manage WooCommerce*. If that user loses the role, the token stops working.
- **Rate limited:** 60 requests per minute per token, and 20 failed attempts per IP address per 10 minutes.
- **Read-only, minimal data.** Customers appear as a first name and a masked e-mail. No full e-mail, address, phone, order key, API key or card data is ever returned.
- **Logged only if you ask.** With logging on (Status & tools), each call is logged with the tool name and user ID only.

To cut access, click **Disable and revoke the token**.

## Troubleshooting

**401 even with the right token.** Some Apache hosts strip the `Authorization` header. WordPress's default `.htaccess` passes it on; if yours was customized, add `RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]`. Security plugins and firewalls can also strip it. Allow `/wp-json/whopforwoo/v1/mcp`.

**403 "requires HTTPS"** behind a proxy or CDN. WordPress must know the request came over HTTPS. Most hosts set this; otherwise add the standard `$_SERVER['HTTPS'] = 'on';` check for `X-Forwarded-Proto` in `wp-config.php`.

**404 No route.** The server is disabled, or permalinks are set to "Plain". Use `https://yourstore.com/?rest_route=/whopforwoo/v1/mcp` in that case.

**429.** You hit 60 requests per minute. Wait a minute.

Get WhopForWoo: https://whopforwoo.com/pricing

## FAQ

### Does WooCommerce have an MCP server?

WordPress has an MCP Adapter plugin (WordPress 6.9 or later) that exposes abilities registered by plugins. WhopForWoo ships its own read-only MCP server, so there is nothing else to install: enable it in WooCommerce > WhopForWoo > AI assistant (MCP).

### Can the AI assistant change orders or refund customers?

No. Every tool is read-only. The assistant can read Whop orders, totals, unmatched payments and webhook health. It cannot edit, refund, cancel or create anything.

### What customer data does the assistant see?

The first name and a masked e-mail (j***@e***.com). Never full e-mails, addresses, phone numbers, order keys, API keys or card data.

### Which AI clients work with it?

Any client that speaks MCP over Streamable HTTP and lets you set an Authorization header: Claude Code, Claude Desktop (through mcp-remote), Cursor, VS Code, Codex CLI and others. The server supports both the 2025 handshake (initialize) and the stateless 2026-07-28 revision.

### Does it work with ChatGPT?

Only if your ChatGPT plan lets you set an API key or custom Authorization header on a custom connector. ChatGPT connectors that offer OAuth only cannot connect, because this server uses a bearer token, not OAuth.

### Is it on by default?

No. The endpoint does not exist until you enable it and generate a token. Disabling it deletes the token.

## Related

- [Whop webhook: setup, payment events and webhook secret](https://whopforwoo.com/docs/whop-webhooks): Set up a Whop webhook for WooCommerce: endpoint URL, payment.succeeded event, where to get the webhook secret, signature checks, retries and testing.
- [Whop API: how it works and how WooCommerce uses it](https://whopforwoo.com/docs/whop-api): Whop API explained: base URL, Bearer auth, dated versions, rate limits, pagination and webhooks, plus the calls a WooCommerce store needs to take payments.
- [Whop API key: where to find it and how to get one](https://whopforwoo.com/docs/whop-api-key): How to get a Whop API key: open Developer, create an Account API key, scope it, and paste it into WooCommerce with your Account ID. Sandbox and live.
- [Whop payment issues: causes and fixes](https://whopforwoo.com/whop-payment-issues): Whop payment issues fixed: card declines, 3D Secure, missing payment methods, Apple Pay not showing, form not loading, and paid orders not updating.
- [Whop embedded checkout: keep customers on your WooCommerce checkout](https://whopforwoo.com/whop-embedded-checkout): How to embed Whop checkout on a website: the Checkout element, what you must build around it, and how WhopForWoo does it inside WooCommerce.