Who: Mariusz Szatkowski, a WordPress developer since 2006 and author of the MCP server running on this site and an open-source MCP server for WooCommerce. I work alone, write the integration code myself and never pass your credentials on.
What: Model Context Protocol servers with narrow tools, authorization as the MCP specification defines it, bridges to WordPress, WooCommerce, Shopify and headless CMS content, call logging and tests before go-live.
Where: remote from Gdynia, Poland. Decisions happen by email, in documents and in the repository. Before I touch personal data I sign a data processing agreement under Article 28 GDPR, which UK clients can mirror under the UK GDPR.
How much: every integration is quoted on its own, by the number of systems and tools and whether any tool writes data. You get a written proposal that lists its assumptions.
MCP and AI integration for shops and WordPress sites
Model Context Protocol gives an AI assistant a list of precisely described tools instead of an admin password pasted into a chat box. I connect those tools to the systems you already run and restrict them so the assistant sees only what you approve.
The step-by-step delivery is on the MCP server development page. This guide covers architecture decisions and the places where an integration can do harm.
A support assistant saves time, but every shortcut risks leaking personal data or contradicting live stock. So I start with a data map. Order history can often be shown to the model as product category, status and value band, without name, address or phone number. Fields that only fulfilment needs stay in the shop.
What MCP does under the hood
MCP runs on JSON-RPC 2.0. An AI application (the host, such as Claude or ChatGPT) connects through a client to a server that offers tools the model can call, resources with data, and prompt templates. The current specification is dated 28 July 2026 and defines two standard transports: stdio, for a server launched locally as a subprocess, and Streamable HTTP, for a remote server where every message is a separate POST to one endpoint (specification).
The specification also states that tools amount to arbitrary code execution, that a human should be able to deny any tool call, and that tool descriptions from untrusted servers should be treated as untrusted.
How to choose workflows for an MCP pilot
Send me the list of tasks you have in mind: order status lookups, returns guidance, searching technical documentation. Each task gets one of three levels. The tool runs on its own, the tool needs a person to confirm, or the task stays outside the assistant.
Along the way I record product identifiers, currencies per market and tax exceptions. Without that map the model averages answers and mixes up prices. Edge cases come from real tickets in your helpdesk: a partial refund, an order split across two parcels, a complaint after the deadline.
When the work is back-office workflow rather than chat, see business process automation.
How to design a secure MCP server
Tools
Every tool has a name, a description and an input schema in JSON Schema, plus an output schema when it returns structured data. I prefer deterministic operations such as “get order summary by ID” over a vague “fix order”. Fixes stay in the admin.
Errors follow the split the specification describes: a protocol error for an unknown tool or a malformed request, a tool execution error with isError: true for a bad date, a missing record or missing permission. The model then gets something it can correct.
This site already works that way. The server at https://wppoland.com/mcp offers read-only tools, including check_services and request_quote, with no API key. The setup is described in the WPPoland live MCP server guide. The shop version is my WooCommerce MCP server on GitHub: read-only, with tools such as get_product, list_orders and sales_report.
Authorization and tokens
For servers over HTTP, the specification bases authorization on OAuth 2.1. A protected MCP server is a resource server: it publishes metadata under RFC 9728, accepts only tokens issued for it, and never passes them through. The client names the server with the resource parameter from RFC 8707. A local stdio server takes its credentials from the environment (MCP authorization).
I set scopes so one tool can be switched off during an incident without taking the whole assistant down. Where WordPress or WooCommerce already model permissions, I mirror them rather than build a parallel access list that drifts over time.
What data goes back to the model
A tool response carries no unnecessary personal data. It does carry a source timestamp plus currency and language, so the model cannot quietly blend markets. Content from a headless CMS is labelled separately from store figures. On a multilingual site the tool returns the language code, so the assistant does not quote a Polish description to a customer in Dublin.
Rate limiting MCP traffic during sales peaks
The specification requires servers to validate inputs, enforce access control, rate limit tool calls and sanitise outputs. The limit matters in practice: an assistant fires requests faster than people, and the same store API serves real buyers. I set separate limits for order tools and for marketing content, so an email campaign cannot starve returns handling. Data that may be slightly stale comes from cache.
Before launch I replay a load test on staging to check retries with backoff. If a tool waits on a synchronous webhook to the ERP, I log the wait, otherwise the assistant reports an order status the ERP has not caught up with yet.
MCP integration with WordPress and WooCommerce
WordPress 6.9 introduced the Abilities API. wp_register_ability() registers an operation with a description, input and output schemas and a permission_callback, and WordPress exposes it in the REST API under wp-abilities/v1 (announcement on make.wordpress.org). The MCP Adapter, part of the AI Building Blocks for WordPress initiative, turns those abilities into MCP tools, resources and prompts, reachable through WP-CLI over stdio or over HTTP. An ability stays private to MCP until it is marked public, and the server’s default access check is only is_user_logged_in(), so I add the permission check for each operation myself.
If you are weighing WordPress.com Agent with MCP write against a self-hosted adapter, that comparison helps you pick before the project starts.
What I watch for in practice:
- A tool that has to show live stock bypasses the page cache and queries an endpoint with a short time to live.
- With HPOS, WooCommerce keeps orders in its own tables, so reports use the orders API rather than postmeta queries.
- On multisite the tool takes the site ID as an argument, so the model cannot blend catalogues from different brands.
- HTTP access uses WordPress application passwords or OAuth, with rotation written into the documentation.
MCP integration with Shopify and multi-platform stores
Shopify’s own limits apply. The GraphQL Admin API uses calculated query cost and, once the limit is hit, returns a throttle error and asks you to wait (Shopify rate limits). The tool then tells the assistant the answer is delayed instead of inventing data. Country or market is an explicit argument, so the price in the chat matches checkout. In B2B stores with company accounts, separate Admin API scopes map to separate tools, so a consumer question never exposes wholesale pricing.
In mixed setups I write down the precedence rule: stock and prices from the commerce platform, descriptions from the CMS. The rule sits in the server code.
How do you publish an MCP server in ChatGPT and Claude?
Update, . Both assistants list third-party MCP servers in public directories, so a server built for a shop’s support team can also be offered to its customers.
The ChatGPT plugin directory
OpenAI keeps one plugin directory shared by ChatGPT and Codex. According to the Apps SDK changelog, ChatGPT has been fully compatible with the MCP Apps specification since 22 February 2026. Before you publish:
- submissions must come from verified individuals or organisations,
- the plugin needs a published privacy policy and a support contact,
- the ZIP package goes through automated checks and then review, and once approved you choose when to release it,
- commerce currently covers physical goods only, paid for on your own domain (Instant Checkout is limited to select partners),
- you can restrict availability with a country list in
publication.countries, - after publication OpenAI scans the hosted MCP server daily.
Sources: guidelines, submission.
The Claude Connectors Directory
- submit through claude.ai/directory/manage as an MCP connector; anyone on a paid Claude plan can,
- a remote server over HTTPS; a local server only inside a plugin,
- OAuth 2.0 for tools that act on a user’s account, no authentication for public data,
- every tool has a title and a
readOnlyHintordestructiveHintannotation, - documentation URL, privacy policy URL, support contact, icon and a fully populated test account for reviewers,
- an automated policy scan after submission and a Community label by default; servers with per-customer URLs need the Verified label.
Desktop extension (MCPB) listings are deprecated. Source: Anthropic documentation.
What I prepare before submission
A tool marked readOnlyHint really does not change data, which matches the read and write split above. The privacy policy states what the server sends to the model provider and covers the information duties in Article 13 GDPR. The reviewer test account runs on sample data, never on real orders. A shop that wants to appear in ChatGPT without its own plugin starts with its product feed and structured data, covered on the AI commerce readiness page.
How to test an MCP integration
I keep a fixed set of questions with expected answers and run it after every tool change and every model change at the provider. It includes prompt injection attempts and scenarios where the model endpoint or the store API returns errors. I measure factual accuracy, tool latency and how often a person has to take over the conversation.
If token use grows faster than answer quality, I simplify the tools or trim the context. When the model tries several times in a row to get round a tool’s rules, I look for the cause.
Which documents you keep after the project
| Document | Purpose | Prepared by |
|---|---|---|
| MCP tool descriptions | Sign-off by your legal or security people | Me |
| Data processing agreement | Article 28 GDPR, including the model provider | You and me |
| Switch-off runbook | Cut the assistant off without taking the shop down | Me |
| Test results | A record of answer quality over time | Me, in the repository |
All of it lives in your repository next to the code, so whoever maintains the integration later does not need to ask me for passwords or screenshots.
MCP outputs and structured data for GEO and AEO
If the product page uses sku, gtin13 or priceSpecification in schema.org, the MCP tool returns the same identifiers and amounts. A mismatch between page and chat answer means a customer looking at two different prices. For new pages and offer changes I update both in the same deployment.
MCP as part of AI implementation for companies
MCP servers are one building block of wider AI implementation for companies, alongside content and operations automation and support chatbots with a human gate.
How to start an MCP integration project
Send me the list of APIs the assistant should reach, a description of its tasks and what it must never do. You get a written plan covering tools, staging tests and who is responsible for what, before any production token is switched on. A pilot with a small group of your own staff comes before any customer sees the assistant.
