WooCommerce MCP: Ask Claude About Your Store Analytics

Revenue First Analytics registers eight read-only abilities with the WordPress Abilities API (WordPress 6.9 or newer). With the free MCP Adapter plugin and an administrator application password, Claude Desktop, Claude Code or any other MCP client can call them at https://your-site.com/wp-json/mcp/mcp-adapter-default-server and answer questions such as “Which channels brought the most revenue in the last 30 days?”. The abilities return aggregated reports only, never customer names, emails or visitor IDs.

MCP (Model Context Protocol) is the standard AI assistants use to call tools on other systems. The MCP Adapter plugin by WordPress.org turns every ability marked as public into an MCP tool, so the assistant sees the same numbers as the dashboard, computed by the same code.

What can an assistant ask?

All abilities live in the Revenue First Analytics category and have the prefix revenue-first-analytics/.

Most abilities take a period (7d, 30d, 90d, 12m, or custom with start and end dates; the default is the last 30 days) and optional exact-match filters such as {"channel": "Paid search", "country_code": "DE"}. Every response states the period, timezone and currency it used, so the assistant can say what it read. The assistant picks these inputs for you from your question.

What do you need?

The AI assistants (Claude and other MCP clients) card in Settings checks the three requirements live and shows a green check or an amber warning for each:

• WordPress 6.9 or newer. The Abilities API is part of core from 6.9; on older versions the abilities are never registered.
• MCP Adapter active. The card distinguishes “not installed” from “installed but not active” and links to the right screen.
• Application passwords available. WordPress only offers them over HTTPS.
• An administrator account. Every ability requires the manage_options capability, the same as the dashboard.

Set it up

1. Install and activate the free MCP Adapter plugin by WordPress.org. The card offers an Install it or Activate it link depending on its status.
2. Create an application password for your administrator user. The card’s Open your profile link jumps to the Application Passwords section of your profile. Give it a name such as “Claude” and copy the generated password; WordPress shows it only once.
3. Add the server to your AI client. The card shows the endpoint for your site with a Copy button. It has the form https://your-site.com/wp-json/mcp/mcp-adapter-default-server.

When all three checks pass, the card says “This site is ready” and suggests a first question to try. For the rest of the Settings screen, see Revenue First Analytics Settings Explained.

Connect Claude Desktop or Claude Code

Click Show Claude Desktop / Claude Code config on the card to get a ready-made configuration with your endpoint and username filled in. It uses the @automattic/mcp-wordpress-remote bridge, which runs through npx (part of Node.js) on your computer and signs in to your site with HTTP basic authentication:

{
  "mcpServers": {
    "revenue-first-analytics": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://your-site.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "your-admin-username",
        "WP_API_PASSWORD": "paste-your-application-password-here"
      }
    }
  }
}

The card’s note says where it goes: claude_desktop_config.json for Claude Desktop, or .mcp.json in your project for Claude Code. Replace the password with the application password from step 2, restart the client, and the Revenue First Analytics tools appear in its tool list. Other MCP clients that can call a remote server with basic authentication can use the endpoint URL directly with the same username and application password.

Example questions

• “How is the site doing this month compared with last month?” (overview)
• “Where do buyers come from?” and “Which landing pages sell?” (breakdown by channel or entry page)
• “Which campaigns brought revenue in the last 90 days?” (breakdown by UTM campaign)
• “Where do people drop off before checkout?” (funnels)
• “How do buyers move through the site before purchasing?” (conversion paths)
• “Which products convert best in Germany?” (product performance with a country filter)
• “Who is on the site right now?” (realtime)

The answers follow the same attribution rules as the dashboard, explained in How Sales Are Attributed to Traffic Sources. Funnels and goals must exist on the site first; see Building Conversion Funnels.

What do the abilities never return?

Only aggregated reports leave the site. No ability returns customer names, email addresses or hashes, visitor IDs, session IDs or IP-derived values. The conversion path examples are anonymous: a channel, a landing page, a list of page paths, an order total and product names, with no way to tell who the buyer was. The abilities also cannot change anything: they are registered with the annotations read-only, non-destructive and idempotent, and they only read from the same reporting services the dashboard uses.

Security notes

• Administrator only. A request without manage_options is refused, so an editor’s application password gets nothing.
• An application password is a full REST API credential. It gives the client the same access as your administrator account across the WordPress REST API, not only to these abilities. Treat it like your password and never paste it into a shared config.
• Use one password per client. Name them, so you can revoke a single one without touching the others.
• Revoke when done. Go to your profile, scroll to Application Passwords and click Revoke next to the entry. The client loses access immediately.
• HTTPS only. WordPress does not offer application passwords over plain HTTP, and the card warns when they are unavailable for that reason.