Agent Gateway: AI Agents For WooCommerce & WordPress (MCP + OAuth 2.1) - Rating, Reviews, Demo & Download
Plugin Description
Agent Gateway is the missing production layer that lets AI assistants like Claude, ChatGPT, and Cursor connect to your self-hosted WordPress & WooCommerce site over the open Model Context Protocol (MCP) – with a spec-compliant OAuth 2.1 server, per-agent permissions, and a human approval queue. Everything runs on your own domain. No SaaS backend, no phone-home, no API keys to copy by hand.
Live demo: agent-gateway-demo.instawp.site, a real WooCommerce store with the plugin active. Verify the live OAuth endpoints yourself: resource metadata (RFC 9728) and authorization server metadata (RFC 8414), or connect any MCP client to https://agent-gateway-demo.instawp.site/wp-json/agw/mcp.
Connect any AI client in one click
Add your site as a remote MCP server in Claude, ChatGPT, or Cursor. Discovery, dynamic client registration, and the OAuth handshake all happen automatically – no keys to paste. On a single consent screen you choose exactly which scopes each agent gets, and you can change or revoke them any time.
Per-agent, per-ability permissions
Agents are never mapped to your admin account – each is a zero-capability principal. Set every ability to allow, hold for approval, or deny, add hourly rate limits and JSON auto-approve constraints (for example a maximum order value), and revoke access live no matter what tokens are already out there.
A human approval queue
Write actions can be held for your review. Approve or reject from a clean queue – with constraint-based auto-approval for the routine cases, a global kill switch, and per-agent dry-run mode. Approvals run as the agent, never as your admin account, re-validating the arguments against the current schema before anything executes.
Built-in diagnostics
A one-click self-test verifies your discovery documents, that the Authorization header reaches WordPress, that credentialed responses are not cached, and a full register → PKCE → token → MCP → revoke round-trip – so you catch hosting issues before your AI clients ever do.
A complete, append-only audit trail
Every consent, tool call, hold, approval, and revocation is recorded – who did what, when, and with what outcome. Nothing an agent does is invisible.
Prebuilt WooCommerce abilities pack
Ship a working agent-commerce demo on day one. Read tools run instantly; writes wait for your approval:
- Search products, check stock, and estimate shipping
- Get order status, scoped to the agent’s own attributed orders
- Create draft orders and initiate returns – held for approval, and attributed to the agent (HPOS-safe)
Works with
Claude (custom connectors), ChatGPT (connectors), Cursor, and any MCP client, plus the @automattic/mcp-wordpress-remote stdio proxy as a fallback. Targets the MCP authorization spec (revision 2025-11-25).
Requirements
- WordPress 6.9+ (Abilities API in core)
- PHP 8.1+, MySQL 5.7+ / MariaDB 10.4+
- HTTPS with a valid certificate
- WooCommerce (optional) for the commerce abilities pack
What you get
- The installable plugin – self-contained, no Composer or build step
- Full HTML documentation and a quick-start guide
- Clean, opt-in uninstall
- GPLv2+ code; support via your CodeCanyon item page
Secure by construction: all secrets are generated with a CSPRNG and stored only as SHA-256 hashes, compared in constant time; replaying a used code or refresh token revokes the entire token family; agent scopes can only ever map to virtual per-ability capabilities, never real WordPress capabilities.
