# WooCommerce 11.3 will retire its MCP endpoint — store agents need new credentials and tools

WooCommerce is consolidating AI-agent access on the WordPress MCP Adapter in 11.3. Integrations using its legacy REST-key endpoint will receive HTTP 410; extension developers must explicitly expose abilities through the shared adapter.

WooCommerce 11.3 removes /wp-json/woocommerce/mcp, REST-key MCP authentication and REST-derived abilities. Migrate clients to the WordPress MCP Adapter plugin, application passwords and explicit ability metadata before upgrading.

- Status: Active
- Published: 2026-10-26T20:19:43+13:00
- Updated: 2026-10-26T20:19:43+13:00
- Categories: Web Development, WordPress, Developer Tools
- Tags: API deprecation, API migration, application passwords, Model Context Protocol, WooCommerce
- Canonical HTML: https://beyondthe.news/dossiers/woocommerce-11-3-mcp-endpoint-removal-wordpress-adapter-migration

## What changed

On October 21, 2026, WooCommerce announced a breaking change planned for version 11.3: /wp-json/woocommerce/mcp and its X-MCP-API-Key REST-key authentication are removed, with old requests returning HTTP 410. Core product and order abilities instead become available through the separate WordPress MCP Adapter plugin (0.7.0+). Clients must switch to /wp-json/mcp/mcp-adapter-default-server with a WordPress application password. Old REST-derived ability IDs, feature toggle, filters and bundled adapter packages are removed. The advisory is forward-looking; not every store has upgraded.

## Why it matters

Existing agents and extensions cannot treat 11.3 as a transparent update: hard-coded endpoint URLs, keys, tool IDs and hooks break. Authentication shifts to WordPress user capabilities, making dedicated least-privilege accounts and independently revocable application passwords important. Stores not using MCP do not need the adapter just to run WooCommerce. Custom extension abilities must explicitly opt in through WordPress Abilities API metadata.

## Old route becomes an explicit migration failure

WooCommerce 11.3 retires /wp-json/woocommerce/mcp, X-MCP-API-Key and REST-derived product/order ability IDs such as woocommerce/products-list and woocommerce/orders-get. Requests return HTTP 410 with a JSON-RPC migration message, not a silent redirect. The mcp_integration feature toggle and old ability filters are removed; integrations using them must migrate.

## Move clients to the shared WordPress adapter

Install and activate WordPress MCP Adapter, create an application password for a dedicated user with only required WooCommerce capabilities, and connect the client to /wp-json/mcp/mcp-adapter-default-server over HTTPS. Do not reuse WooCommerce REST API keys or account login passwords. Test operations before upgrading and revoke obsolete credentials.

## Extension authors must explicitly expose abilities

Custom abilities formerly exposed by namespace matching, expose_in_deprecated_woocommerce_mcp or woocommerce_mcp_include_ability do not automatically carry over. Register through WordPress Abilities API and set meta.mcp.public=true with the relevant tool type. Declare MCP Adapter dependency or check WP\MCP\* classes at runtime. Removed transport classes are inert compatibility shims.

## Permission and rollout boundaries

The shared adapter authenticates as a WordPress user; default server requires read capability, and each WooCommerce ability enforces its own permissions. Order operations may expose personal information. Restrict roles and credentials. The October 21 advisory describes planned 11.3 behaviour: confirm actual installed version and adapter availability before assuming removal is live.

## Key details

- October 21 advisory specifies WooCommerce 11.3 migration.
- Legacy /wp-json/woocommerce/mcp returns HTTP 410; X-MCP-API-Key retired.
- WordPress MCP Adapter 0.7.0+ and /wp-json/mcp/mcp-adapter-default-server are required for MCP clients.
- WordPress application passwords replace WooCommerce REST API keys for remote MCP.
- Old REST-derived ability IDs, filters and feature toggle removed.

## Builder takeaways

- Inventory agents and extensions using the old WooCommerce MCP endpoint before upgrading.
- Install MCP Adapter and test dedicated-user application-password authentication over HTTPS.
- Update ability names and explicitly expose custom tools via meta.mcp.public.
- Revoke old REST keys used only for MCP; check roles and privacy exposure.

## What to watch

- WooCommerce 11.3 stable rollout and compatibility fixes.
- MCP Adapter plugin security and release changes.
- Extension migrations and unexpected permission/exposure regressions.

## Uncertainties

- Advisory is forward-looking; 11.3 may not yet be installed on all stores.
- Independent production migration testing is limited.
- Custom extension abilities require explicit exposure and may vary.

## Sources

- [WooCommerce 11.3 MCP Adaptor updates](https://developer.woocommerce.com/2026/10/21/woocommerce-11-3-mcp/) — WooCommerce Developer Blog · primary_advisory · 2026-10-21T00:00:00+13:00. Breaking changes and migration.
- [WooCommerce MCP integration documentation](https://developer.woocommerce.com/docs/features/mcp/) — WooCommerce · primary_documentation · 2026-10-21T00:00:00+13:00. Adapter setup, permission model and removed route.
- [WooCommerce MCP migration: what changes in version 11.3](https://wpgazette.com/plugins-themes/woocommerce-mcp-migration/) — WP Gazette · independent_specialist_reporting · 2026-10-23T00:00:00+13:00. Independent ecosystem context.