What changed
On October 21, 2026, WooCommerce announced a breaking change planned for version 11.3: /wp-json/woocommerce/mcp and its X-MCP-API-Key REST-key authentication are removed, with old requests returning HTTP 410. Core product and order abilities instead become available through the separate WordPress MCP Adapter plugin (0.7.0+). Clients must switch to /wp-json/mcp/mcp-adapter-default-server with a WordPress application password. Old REST-derived ability IDs, feature toggle, filters and bundled adapter packages are removed. The advisory is forward-looking; not every store has upgraded.
Why it matters
Existing agents and extensions cannot treat 11.3 as a transparent update: hard-coded endpoint URLs, keys, tool IDs and hooks break. Authentication shifts to WordPress user capabilities, making dedicated least-privilege accounts and independently revocable application passwords important. Stores not using MCP do not need the adapter just to run WooCommerce. Custom extension abilities must explicitly opt in through WordPress Abilities API metadata.
Old route becomes an explicit migration failure
WooCommerce 11.3 retires /wp-json/woocommerce/mcp, X-MCP-API-Key and REST-derived product/order ability IDs such as woocommerce/products-list and woocommerce/orders-get. Requests return HTTP 410 with a JSON-RPC migration message, not a silent redirect. The mcp_integration feature toggle and old ability filters are removed; integrations using them must migrate.
Move clients to the shared WordPress adapter
Install and activate WordPress MCP Adapter, create an application password for a dedicated user with only required WooCommerce capabilities, and connect the client to /wp-json/mcp/mcp-adapter-default-server over HTTPS. Do not reuse WooCommerce REST API keys or account login passwords. Test operations before upgrading and revoke obsolete credentials.
Extension authors must explicitly expose abilities
Custom abilities formerly exposed by namespace matching, expose_in_deprecated_woocommerce_mcp or woocommerce_mcp_include_ability do not automatically carry over. Register through WordPress Abilities API and set meta.mcp.public=true with the relevant tool type. Declare MCP Adapter dependency or check WP\MCP\* classes at runtime. Removed transport classes are inert compatibility shims.
Permission and rollout boundaries
The shared adapter authenticates as a WordPress user; default server requires read capability, and each WooCommerce ability enforces its own permissions. Order operations may expose personal information. Restrict roles and credentials. The October 21 advisory describes planned 11.3 behaviour: confirm actual installed version and adapter availability before assuming removal is live.