AI Agents and MCP

SweetCode plugins can be operated by an AI agent. A coding agent or chatbot such as Claude, Cursor or VS Code Copilot can read your plugin settings, run diagnostics, read logs and change settings for you, through the same rules and checks that apply when you click through the plugin admin yourself.

This works through two pieces of WordPress infrastructure:

The WordPress Abilities API, part of WordPress core since 6.9. Plugins register abilities: named actions with a description, an input and output schema, and a permission check.
The WordPress MCP Adapter, a free plugin that exposes those abilities to AI clients over the Model Context Protocol (MCP).

Which Plugins Support It

Plugin	Abilities	Available since
Pixel Manager for WooCommerce	53, covering every admin action: settings, backups, diagnostics, logs, opportunities, SweetCode Cloud, and the Google and Meta account connections	1.57.0, full admin coverage since 1.70.0
Google Automated Discounts for WooCommerce	22, covering settings, a step-by-step setup guide, statistics, discounted orders, product minimum prices, the caching check, logs, diagnostics and test links	1.7.1, full admin coverage since 1.10.1
Google Customer Reviews for WooCommerce	6, covering all settings (Merchant Center ID, survey opt-in, seller rating badge, product ratings), a setup guide and the debug info	1.0.3

Both the free and the Pro version of the Pixel Manager register the abilities.

What the Agent Is Allowed to Do

The agent is the user. Every ability runs the same permission check as the plugin admin page. The agent logs in as a WordPress user and can do exactly what that user can do in the admin, and nothing more.

Pixel Manager: users with the manage_woocommerce or manage_options capability, so administrators and shop managers.
Google Automated Discounts and Google Customer Reviews: users with the manage_woocommerce capability, so administrators and shop managers.

Further safeguards built into all three plugins:

Every value an agent writes goes through the same validation as the settings screen. Invalid values are refused with the reason, and the other values in the same request are still saved.
Every settings change made through an ability creates an automatic settings backup first. The Pixel Manager and Google Automated Discounts also offer abilities to list and restore those backups, so an agent can undo its own changes.
Secrets such as API tokens are never returned. The agent only sees whether a secret is set.
Each ability is marked as read-only or as one that changes something, and destructive actions such as disconnecting an account say so. Their descriptions tell the agent to confirm with you first.
Pro settings of the Pixel Manager are listed, but refused on a site without an active Pro license.

Turning Off Write Access

If you want agents to only read and diagnose, but never change anything, add one of these filters (for example in a small mu-plugin or your theme's functions.php). The write abilities are then not registered at all.

// Pixel Manager for WooCommerce
add_filter( 'pmw_abilities_allow_write', '__return_false' );

// Google Automated Discounts for WooCommerce
add_filter( 'sgadwc_abilities_allow_write', '__return_false' );

// Google Customer Reviews for WooCommerce
add_filter( 'gcr_abilities_allow_write', '__return_false' );

Requirements

WordPress 6.9 or later, which includes the Abilities API.
The MCP Adapter plugin, installed and activated.
HTTPS on the site (local development sites excepted).
An AI client that speaks MCP, such as Claude Code, Claude Desktop, Cursor, VS Code or Windsurf.

The SweetCode plugins don't bundle the MCP Adapter. Once it is active, all SweetCode abilities appear on its default server automatically. No further configuration is needed in our plugins.

Step 1: Install the MCP Adapter

Install and activate the MCP Adapter plugin from Plugins > Add New, or with WP-CLI:

wp plugin install mcp-adapter --activate

Your site now has an MCP endpoint at:

https://your-shop.com/wp-json/mcp/mcp-adapter-default-server

If your site uses plain permalinks, the endpoint is https://your-shop.com/?rest_route=/mcp/mcp-adapter-default-server instead.

Step 2: Create an Application Password

The agent logs in with a WordPress Application Password, not with your normal password.

Go to Users > Profile of the user the agent should act as.
Under Application Passwords, enter a name such as Claude and click Add New Application Password.
Copy the password. WordPress shows it only once.

Use a dedicated user

Because the agent can do whatever its user can do, consider creating a separate user with the Shop Manager role for the agent. Shop managers can operate all SweetCode plugins but cannot install plugins or manage other users. You can revoke the application password at any time without touching your own login.

Step 3: Connect Your AI Client

Claude Code

Claude Code connects to the endpoint directly. Build the authorization header from your username and the application password:

printf 'your-username:xxxx xxxx xxxx xxxx xxxx xxxx' | base64 | tr -d '\n'

Then add the server, using the output of the command above:

claude mcp add --transport http my-shop https://your-shop.com/wp-json/mcp/mcp-adapter-default-server --header "Authorization: Basic BASE64_OUTPUT"

Claude Desktop, Cursor, VS Code, Windsurf

These clients connect through a small helper that requires Node.js. Add this to the client's MCP configuration file (in Claude Desktop: Settings > Developer > Edit Config, in Cursor: ~/.cursor/mcp.json) and restart the app:

{
  "mcpServers": {
    "my-shop": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://your-shop.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "your-username",
        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Local Development Sites with WP-CLI

On a local site, the client can start the MCP Adapter through WP-CLI directly. No application password is needed, because --user sets the WordPress user the agent acts as:

{
  "mcpServers": {
    "my-local-shop": {
      "command": "wp",
      "args": [
        "--path=/path/to/your/wordpress",
        "mcp-adapter",
        "serve",
        "--server=mcp-adapter-default-server",
        "--user=admin"
      ]
    }
  }
}

claude.ai and ChatGPT in the Browser

The web versions of claude.ai and ChatGPT connect to MCP servers through OAuth. WordPress and the MCP Adapter don't include an OAuth server, so these can't connect to your site directly yet. Use one of the desktop or command-line clients above instead.

Step 4: Start Talking to Your Shop

Open a new chat and ask:

Which WordPress abilities are available on my site?

The agent uses the MCP Adapter's three tools, mcp-adapter-discover-abilities, mcp-adapter-get-ability-info and mcp-adapter-execute-ability, to find and run the abilities. You'll see the Pixel Manager abilities (names starting with pmw/), the Google Automated Discounts abilities (google-automated-discounts/) and the Google Customer Reviews abilities (google-customer-reviews/).

From there, just say what you want in plain language. Each ability carries a detailed description, so the agent knows which one to call and in which order. Some examples:

"Check the Pixel Manager setup and tell me what's missing."
"Set up Meta tracking with pixel ID 1234567890 and turn on the Conversions API."
"Why is the tracking accuracy for PayPal so low? Look at the diagnostics."
"Walk me through setting up Google Automated Discounts."
"Set up Google Customer Reviews and show the seller rating badge at the bottom left."
"Undo the last settings change."

See the plugin pages for everything the agent can do:

Troubleshooting

Problem	Cause and fix
`401` error	Wrong username or application password, or the host strips the `Authorization` header. Ask your host to pass it through to PHP.
`404` or `rest_no_route`	The MCP Adapter plugin is not active, or the permalinks need to be saved once under Settings > Permalinks. With plain permalinks, use the `?rest_route=` endpoint.
`npx: command not found`	Node.js is not installed on your computer.
The agent sees no SweetCode abilities, or every call is refused	WordPress is older than 6.9, or the agent's user lacks the `manage_woocommerce` capability.
The agent can read but not change settings	Write abilities were turned off with the `pmw_abilities_allow_write`, `sgadwc_abilities_allow_write` or `gcr_abilities_allow_write` filter.
A security plugin or firewall blocks the requests	Allow requests to `/wp-json/mcp/` for the agent's user.

Without MCP: REST and WP-CLI

The same abilities are also available without an AI client. Every SweetCode ability is exposed through the Abilities API's REST endpoints (for example GET /wp-json/wp-abilities/v1/abilities lists them) and through WP-CLI, with the same permission check. That makes them useful for scripts and automation too.

Which Plugins Support It​

What the Agent Is Allowed to Do​

Turning Off Write Access​

Requirements​

Step 1: Install the MCP Adapter​

Step 2: Create an Application Password​

Step 3: Connect Your AI Client​

Claude Code​

Claude Desktop, Cursor, VS Code, Windsurf​

Local Development Sites with WP-CLI​

claude.ai and ChatGPT in the Browser​

Step 4: Start Talking to Your Shop​

Troubleshooting​

Without MCP: REST and WP-CLI​

Make more money from your ads with high-precision tracking