Title: SDX AI Readiness Toolkit for WooCommerce
Author: shan
Published: 17 de junio de 2026
Last modified: 27 de agosto de 2026
---
Buscar plugins
# SDX AI Readiness Toolkit for WooCommerce
Por [shan](https://profiles.wordpress.org/suhanduman/)
[Descargar](https://downloads.wordpress.org/plugin/sdx-ai-readiness-toolkit.0.4.0.zip)
* [Detalles](https://es.wordpress.org/plugins/sdx-ai-readiness-toolkit/#description)
* [Valoraciones](https://es.wordpress.org/plugins/sdx-ai-readiness-toolkit/#reviews)
* [Instalación](https://es.wordpress.org/plugins/sdx-ai-readiness-toolkit/#installation)
* [Desarrollo](https://es.wordpress.org/plugins/sdx-ai-readiness-toolkit/#developers)
[Soporte](https://wordpress.org/support/plugin/sdx-ai-readiness-toolkit/)
## Descripción
**SDX AI Readiness Toolkit** makes any WooCommerce store auto-discoverable, readable,
and purchasable by AI shopping agents — ChatGPT plugins, Perplexity Shopping, Google’s
commerce AI, custom Claude tools, and any agent that speaks the open protocols of
the agentic commerce ecosystem.
#### Why this matters
In 2026 Google launched the **Universal Commerce Protocol (UCP)** with Shopify,
Walmart, Target, Wayfair, and Etsy. WooCommerce was absent. This plugin closes that
gap.
#### What this plugin does
* **UCP business profile** at `/.well-known/ucp` — a spec-conformant UCP 2026-08-
25 profile agents can negotiate against
* **UCP shopping catalog** at `/wp-json/agtc/v1/ucp/catalog/…` — the `dev.ucp.shopping.
catalog.search` and `.lookup` capabilities, served from your own products
* **MCP server** at `/wp-json/agtc/v1/mcp` — JWT-authenticated tools for product
listing, search, and order lookup, speaking every MCP revision from 2024-11-05
to 2026-07-28
* **ACP checkout** at `/wp-json/agtc/v1/acp/checkouts` — agentic checkout sessions
with Stripe `payment_intent` support
* **OAuth 2.0 server with discovery** — dynamic client registration, `client_credentials`
grant, and RFC 8414 / RFC 9728 metadata so MCP clients configure themselves
* **Coexistence with WooCommerce core** — defers to WooCommerce’s native ACP checkout
and to its canonical product/order Abilities instead of duplicating them
* **Web discovery** — HTML `` tags, HTTP Link headers, `robots.txt` advisory,`/
llms.txt`
* **Google Merchant Center feed** at `/merchant-feed/google.xml` — a self-hosted,
Google-spec product feed you register as a scheduled fetch
* **AI readiness dashboard** — scores your store, shows what’s missing, offers
one-click fixes
* **Production-grade engineering** — 396 unit tests, integration-tested on live
WordPress + WooCommerce, WordPress Coding Standards compliant, PHP 7.4+ compatible
#### How agents use your store
1. Agent fetches `/.well-known/ucp` and negotiates the capabilities you publish
2. Agent searches your catalog at `/ucp/catalog/search` (UCP) — no credentials needed
for public product data
3. Agent discovers how to authenticate at `/.well-known/oauth-authorization-server`
4. Agent registers via `/oauth/register` receives client ID + secret
5. Agent exchanges credentials for JWT at `/oauth/token`
6. Agent calls MCP tools under `/mcp` (search, list, order lookup)
7. Agent creates an ACP checkout session at `/acp/checkouts`
8. Agent completes the session real WooCommerce order in your admin
All standard payment gateways work. UCP creates standard WC orders.
#### How this actually helps your store
AI shopping assistants — ChatGPT, Perplexity, Gemini, Claude — now help millions
of people find products every day. When a shopper asks «find me a waterproof backpack
under $80», the assistant increasingly queries machine-readable storefronts instead
of crawling pages. A UCP platform starts by fetching `/.well-known/ucp` on the domains
it knows, reads which capabilities the store supports, and calls those endpoints.
A store with no profile — or with a profile the platform cannot parse — simply is
not part of that conversation.
This plugin publishes a conformant profile automatically, serves the UCP catalog
capabilities behind it, and exposes the same catalog through MCP. You don’t have
to write a single line of integration code; activating the plugin is enough to put
your store on the map for agents that speak UCP, MCP, or ACP.
A few complementary moves we recommend alongside this plugin: register your products
in **Google Merchant Center** so the Google Shopping feed picks them up, keep product
titles and descriptions clear and well-structured (the same SEO discipline that
helps humans also helps AI parsing), and make sure your site runs on HTTPS end-to-
end so agents trust the responses.
Once your store is published, agents can do three things that previously required
a human: discover that you exist, browse your catalog in real time, and — with ACP
enabled — create a real WooCommerce order on behalf of their user, with the same
checkout, tax, shipping, and fulfillment plumbing your human customers go through
today.
A note on where the money moves: ChatGPT’s Instant Checkout was retired in March
2026, and the buyer now completes payment on the merchant’s own checkout. That is
exactly the «Model B» flow described in the FAQ below, and it works with whatever
gateway your store already uses — so the practical path for most stores is discovery
and catalog access first, agent-initiated orders second.
#### Google Merchant Center
The plugin publishes a Google-spec product feed at `https://yourstore.com/merchant-
feed/google.xml`. It is fully self-hosted — the plugin contacts no external service.
Instead, you register that URL in **Google Merchant Center Products Feeds** as
a scheduled fetch, and Google pulls the feed on its own schedule. Once Google has
the feed, your products become eligible for Google Shopping and Google’s shopping
AI.
The feed is built from your published, catalog-visible WooCommerce products and
includes each product’s title, description, price, availability, image, and — when
set — brand and GTIN. Filling in **brand** and **GTIN** (Products product Inventory
Global Unique ID, on WooCommerce 9.2+) materially improves listing quality and how
often Google can match your products. Variable products are expanded to their purchasable
variations. The generated XML is cached for one hour to keep the endpoint fast.
#### Privacy & Data Handling
This plugin is built to be conservative about data:
* The plugin only exposes publicly available product data — name, price, image,
description — through its UCP and MCP discovery endpoints. Anything you already
display on a public product page is fair game; nothing else is.
* Order data is gated behind a valid OAuth 2.0 access token AND is scoped to the
agent’s own orders. An agent (OAuth client) can only read orders it created itself
through the ACP checkout flow; it can never read other agents’ orders or orders
placed by human customers through normal checkout. An agent without the `read:
orders` scope cannot read any orders at all, and `read:orders` is never granted
by open client registration unless it is explicitly requested.
* No customer personally identifiable information (PII) is collected, transmitted
to third parties, or stored beyond standard WooCommerce order records that WooCommerce
itself already manages.
* All admin actions — including the audit dashboard and one-click auto-fix buttons—
require the `manage_woocommerce` capability and a verified WordPress CSRF nonce.
* No outbound telemetry. No analytics calls. No external «phone home» requests.
The plugin does not contact the author, an analytics vendor, or any third party
at install time, on activation, or during normal operation.
#### External Services
WordPress.org guideline #6 requires that we disclose any external services this
plugin contacts. The list is short:
* **Stripe (optional, opt-in):** Stripe is only contacted when the ACP module’s`
payment_intent` flow is explicitly enabled by defining the `AGTC_STRIPE_SECRET_KEY`
constant in `wp-config.php`. When an agent completes a checkout session under
that flow, the plugin makes a server-to-server POST to `https://api.stripe.com/
v1/payment_intents` to authorize the payment. No data is sent to Stripe unless
this flow is activated. Stripe service terms: https://stripe.com/legal — Stripe
privacy policy: https://stripe.com/privacy.
* **No other external services are contacted by default.** UCP, MCP, and ACP discovery
endpoints are served from your own WordPress installation. The agent pulls data
_from_ you; you do not push data _to_ the agent or to any intermediary.
#### Disclaimer
This plugin is an independent, community-driven implementation of open commerce
protocols. It is not affiliated with, endorsed by, or sponsored by Stripe, Inc.,
OpenAI, Google, Anthropic, Automattic, or the WooCommerce trademark holders. «WooCommerce»
is a trademark of Automattic Inc. and is referenced solely for descriptive interoperability
purposes.
## Instalación
1. Upload to `/wp-content/plugins/agtc-commerce` (or install via WP admin Plugins
Add New)
2. Activate via Plugins menu
3. Visit **SDX AI Readiness** in the admin sidebar to see the AI Readiness dashboard
4. (Optional) Define `AGTC_STRIPE_SECRET_KEY` in `wp-config.php` to enable ACP payment
intents
#### Requirements
* WordPress 7.0 or higher (tested on 7.1)
* WooCommerce 8.0 or higher (tested on 11.0)
* PHP 7.4 or higher (PHP 8.x recommended)
* OpenSSL and libsodium PHP extensions
* Pretty Permalinks enabled
## FAQ
### Will this conflict with WooCommerce’s built-in ACP support?
No. WooCommerce 10.7+ ships internal ACP infrastructure with the `agentic_checkout`
feature flag (default off). Our `Coexistence` detector activates our endpoints only
when the WC native flag is off, and defers (410 + Location header) when on.
### Will this duplicate WooCommerce’s own MCP tools?
No. WooCommerce 10.9+ registers seven canonical abilities of its own (`woocommerce/
products-query`, `orders-query` and friends) through the WordPress MCP Adapter.
Two near-identical tool sets in front of the same agent makes tool selection worse,
so the «WP Abilities» setting defaults to `auto`: when WooCommerce’s canonical abilities
are present, this plugin does not register its overlapping set, and the dashboard’s
MCP-004 check tells you that happened. Set the mode to `all` (or filter `agtc_mcp_abilities_mode`)
if you want both. The plugin’s own OAuth MCP server at `/wp-json/agtc/v1/mcp` is
unaffected either way.
### Does the plugin work on WordPress 7.1?
Yes — the release is integration-tested against a live WordPress 7.1 + WooCommerce
11.0.1 install: the UCP profile, the catalog capabilities, the MCP server, OAuth
registration and token exchange, the ACP purchase flow that creates a real order,
and the readiness dashboard all pass there. WordPress 7.1 keeps PHP 7.4 as its minimum,
so no PHP change is needed.
### Which UCP version does the profile publish?
UCP 2026-08-25, date-versioned as the specification requires. The profile advertises
only the capabilities this plugin actually serves — currently `dev.ucp.shopping.
catalog.search` and `dev.ucp.shopping.catalog.lookup` — because a platform negotiates
against that document, and an over-claimed capability fails later in a worse place.`
payment_handlers` is published as an empty map until the UCP checkout capability
ships. You can extend the document with the `agtc_ucp_profile` filter.
### What happens to my data if I uninstall?
Nothing is deleted by default. Deactivating the plugin only withdraws its rewrite
rules; your signing keys, registered OAuth clients and settings stay put, so reactivating
restores the exact same store identity. Deleting the plugin also leaves that data
alone unless you tick **Delete all plugin data on uninstall** on the dashboard first—
that opt-in exists because the master secret encrypts stored client data, and removing
it cannot be undone.
### Is the public catalog endpoint rate limited?
Yes: 60 requests per minute, counted per declared platform profile (falling back
to the caller’s IP address). Over the limit the endpoint answers `429` with a `Retry-
After` header and a UCP `rate_limited` message, which platforms are expected to
honour. Tune or disable it with the `agtc_ucp_catalog_rate_limit` filter — returning`
0` turns throttling off.
### Do agents need credentials to search the catalog?
No. The UCP catalog endpoints expose only data your storefront already shows publicly,
so they are unauthenticated. They do require the `UCP-Agent` header the specification
mandates, so a misconfigured caller gets a protocol-shaped error rather than silently
reading your catalog; the `agtc_ucp_require_agent_header` filter can relax that.
Order data always requires an OAuth token and is scoped to the agent’s own orders.
### Do I need Stripe?
Only for ACP payment_intent flow. Without Stripe, agents can still discover, browse,
and create checkout sessions — they just can’t authorize payment through ACP directly.
There are two flow models to choose from, and most stores can start without Stripe
entirely:
* **Model A — Agent pays directly (ACP `payment_intent`):** Requires Stripe. The
ACP protocol uses Stripe’s PaymentIntent under the hood, so you must define `
AGTC_STRIPE_SECRET_KEY` in `wp-config.php`. The agent never sees the customer’s
card; payment is captured server-side at session completion. This is the fully
autonomous flow.
* **Model B — Agent creates order, customer pays later:** Works with **any** WooCommerce
payment gateway — PayPal, Square, Stripe via WooCommerce Payments, bank transfer,
cash on delivery, anything you already have configured. The agent creates an
ACP session, which the plugin converts into a standard pending WooCommerce order.
The customer receives an order link and completes payment using whatever gateway
your store already uses.
* **Recommendation:** Most stores should start with Model B (no Stripe required)
and add Model A later if and when they want fully autonomous agent purchases
without a human checkout step.
### What data does this expose to agents?
By default, public product data only (name, price, description, images). An agent
can additionally read its **own** orders if it holds the `read:orders` scope — but
only orders it created itself through the ACP checkout flow. Agents never see other
agents’ orders or orders placed by human customers through normal checkout.
### How do I let agents read orders?
Order access is scoped to ownership and safe by default: an agent (OAuth client)
can only ever read orders it created itself via the ACP checkout flow. It can never
read another agent’s orders or orders placed by human customers through normal checkout.
To read its own orders, an agent must request the `read:orders` scope at registration;
dynamic client registration only ever grants `read:products` by default, so `read:
orders` must always be requested explicitly. No server-side opt-in or `wp-config.
php` constant is required.
### Is the OAuth flow secure?
Yes. Client secrets are hashed with `password_hash()`. Access tokens are RS256-signed
JWTs with `iat`, `exp` (max 2h), `aud`, `iss`, and `jti` claims. Admin endpoints
require WP nonce + `manage_woocommerce`.
### How do I rotate the JWKS keypair?
Open the AI Readiness dashboard. If JWKS rotation is needed, click the «Rotate JWKS
keypair now» button. Old key remains valid for a 24h grace period.
### WordPress Abilities and the MCP Adapter
WordPress core ships the Abilities API (since 6.9) and the PHP AI Client (7.0).
The **MCP Adapter is not part of WordPress core** — it is maintained separately
by the WordPress AI team, and WooCommerce 11.0 already bundles it as a library,
so most stores do not need to install anything. It stays dormant until you enable
WooCommerce’s `mcp_integration` feature (WooCommerce Settings Advanced Features);
after that, MCP clients such as Claude Desktop, Claude Code, Cursor or VS Code can
reach WordPress abilities using ordinary application passwords. The dashboard’s
MCP-004 check tells you which of these two states you are in.
This plugin registers its tools as Abilities so they are available through that
adapter, using the unified `meta.public` exposure flag introduced in WordPress 7.1(
the older per-channel flags are kept for adapters that predate it). Its own OAuth
MCP server stays active alongside the adapter and continues to serve headless or
autonomous agents that manage their own credentials.
The AI Readiness dashboard shows a «Protocol exposure» card with four settings:
MCP exposure controls which MCP path is active: «both» (default — the adapter and
the plugin server run side by side), «core» (plugin’s own MCP server is disabled,
traffic goes to the adapter only), or «plugin» (adapter integration is disabled,
plugin MCP server only).
WP Abilities controls what happens when WooCommerce registers its own canonical
abilities: «auto» (default — this plugin stands down so agents do not see two overlapping
tool sets) or «all» (register both).
ACP exposure controls ACP checkout availability: «auto» (default — plugin ACP is
active when WooCommerce native ACP is off, deferred when on), «plugin» (plugin ACP
is always active regardless of WC native state), or «off» (ACP checkout is fully
disabled).
UCP exposure turns the UCP profile’s advertised services and the catalog endpoints«
on» (default) or «off».
All four can be overridden programmatically with the filters agtc_mcp_exposure_mode,
agtc_mcp_abilities_mode, agtc_acp_exposure_mode and agtc_ucp_exposure_mode, which
receive the stored option value and should return one of the accepted mode strings.
### How do I get my products into Google Shopping?
The plugin publishes a Google-spec product feed at `https://yourstore.com/merchant-
feed/google.xml`. In Google Merchant Center, go to **Products Feeds**, add a new
feed, and choose the **scheduled fetch** option pointing at that URL. Google then
fetches the feed on its own schedule — the plugin never contacts Google. The feed
carries title, description, price, availability, image, and brand/GTIN when set;
adding a brand and GTIN to each product improves listing quality and match rate.
The dashboard’s FEED-001 check flags products missing those attributes.
## Reseñas
No hay valoraciones para este plugin.
## Colaboradores y desarrolladores
«SDX AI Readiness Toolkit for WooCommerce» es un software de código abierto. Las
siguientes personas han colaborado con este plugin.
Colaboradores
* [ shan ](https://profiles.wordpress.org/suhanduman/)
[Traduce «SDX AI Readiness Toolkit for WooCommerce» a tu idioma.](https://translate.wordpress.org/projects/wp-plugins/sdx-ai-readiness-toolkit)
### ¿Interesado en el desarrollo?
[Revisa el código](https://plugins.trac.wordpress.org/browser/sdx-ai-readiness-toolkit/),
echa un vistazo al [repositorio SVN](https://plugins.svn.wordpress.org/sdx-ai-readiness-toolkit/)
o suscríbete al [registro de desarrollo](https://plugins.trac.wordpress.org/log/sdx-ai-readiness-toolkit/)
por [RSS](https://plugins.trac.wordpress.org/log/sdx-ai-readiness-toolkit/?limit=100&mode=stop_on_copy&format=rss).
## Registro de cambios
#### 0.4.0
* New: UCP 2026-08-25 conformant business profile at `/.well-known/ucp` (`ucp`
object, date version, services, capabilities, `keys` JWK set, required caching
headers)
* New: UCP shopping catalog capabilities — `dev.ucp.shopping.catalog.search` and`.
lookup` served at `/wp-json/agtc/v1/ucp/catalog/{search,lookup,product}`
* New: MCP protocol negotiation across every revision from 2024-11-05 to 2026-07-
28 (`initialize`, `server/discover`, `_meta` version declaration)
* New: MCP tool results as spec-shaped content blocks, cacheable `tools/list`,
deterministic tool order
* New: OAuth metadata discovery — RFC 8414 authorization server metadata and RFC
9728 protected resource metadata, plus a `WWW-Authenticate` challenge on 401
* New: coexistence with WooCommerce 10.9+ canonical abilities via the «WP Abilities»
exposure mode
* New: UCP exposure mode and the `agtc_ucp_profile` filter
* New: rate limiting on the public catalog endpoints (60/min per platform, `agtc_ucp_catalog_rate_limit`
filter)
* New: opt-in data removal on uninstall, plus automatic rewrite handling on activation
and deactivation
* Changed: verified against a live WordPress 7.1 + WooCommerce 11.0.1 stack; 396
unit tests + 21 integration tests; CI covers PHP 7.4–8.5
* Changed: documentation corrected — the MCP Adapter is a canonical plugin, not
part of WordPress core
* Removed: the old non-standard UCP profile shape (`ucp_version: "1.0"`, `protocols`,`
oauth`, `jwks_uri`)
#### 0.3.0
* Security: plugin-owned key derivation (MasterKey) replacing reuse of WordPress
auth salts
* Security: AES-256-GCM at-rest encryption for sensitive stored data
* Security: MCP tool scope enforcement; order tools scoped to the agent’s own orders
* New: Google Merchant Center product feed at `/merchant-feed/google.xml` + dashboard
feed-readiness audit
* New: WordPress 7.0 native MCP integration — tools registered as Abilities for
the core MCP Adapter
* New: selectable MCP exposure (both/core/plugin) and ACP exposure (auto/plugin/
off) with dashboard controls and filters
* Changed: minimum WordPress raised to 7.0
#### 0.2.0
* New: ACP checkout module with Stripe payment_intent + WC native coexistence
* New: Outbound webhook dispatcher with Ed25519 signing
* New: Severity-grouped dashboard with remediation cards and one-click auto-fix
buttons
* New: `/admin/fix` REST endpoint with nonce + capability check
* Fix: PHP 8.5 deprecation warnings (`setAccessible`, `curl_close`)
* Fix: JwtVerifier enforces `iat` claim and 2h max token lifetime
#### 0.1.0
* Initial release: Core, MCP, UCP, Discovery hints
## Meta
* Versión **0.4.0**
* Última actualización **hace 2 meses**
* Instalaciones activas **Menos de 10**
* Versión de WordPress ** 7.0 o superior **
* Probado hasta **7.1.3**
* Versión de PHP ** 7.4 o superior **
* Idioma
* [English (US)](https://wordpress.org/plugins/sdx-ai-readiness-toolkit/)
* Etiquetas:
* [acp](https://es.wordpress.org/plugins/tags/acp/)[AI](https://es.wordpress.org/plugins/tags/ai/)
[mcp](https://es.wordpress.org/plugins/tags/mcp/)[ucp](https://es.wordpress.org/plugins/tags/ucp/)
[woocommerce](https://es.wordpress.org/plugins/tags/woocommerce/)
* [Vista avanzada](https://es.wordpress.org/plugins/sdx-ai-readiness-toolkit/advanced/)
## Valoraciones
Aún no se han enviado valoraciones.
[Tu valoración](https://wordpress.org/support/plugin/sdx-ai-readiness-toolkit/reviews/#new-post)
[Ver todas las reseñas](https://wordpress.org/support/plugin/sdx-ai-readiness-toolkit/reviews/)
## Colaboradores
* [ shan ](https://profiles.wordpress.org/suhanduman/)
## Soporte
¿Tienes algo que decir? ¿Necesitas ayuda?
[Ver el foro de soporte](https://wordpress.org/support/plugin/sdx-ai-readiness-toolkit/)