Themesic Browser Agent Tools for WooCommerce

This plugin turns your site into a set of structured WebMCP tools that AI agents can discover and call, so an assistant can search your content and browse your catalog through a defined, permissioned interface instead of scraping pages.

It serves those tools two ways from one plugin:

• In the browser for WebMCP-capable agents, via document.modelContext (with fallbacks).
• Over REST + OpenAPI at /wp-json/themesic-agent/v1/manifest, /execute and /openapi – for any HTTP agent and for Custom GPT Actions, plus RFC 8288 Link discovery.

Every authorization decision is made server-side. The browser is never trusted.

What you get

WordPress content tools: get_site_info, get_menu, search, get_post, list_posts, list_categories, list_tags.

WooCommerce catalog tools (when WooCommerce is active): get_store_info, search_products, get_product, list_products, get_product_variations, check_product_stock, list_categories.

Plus the full engine: the in-browser WebMCP bridge, REST + OpenAPI + discovery, a security gate, per-caller and global rate limiting, an activity log with CSV export, and a request playground – all in the admin.

Every tool this plugin registers is a read tool. Nothing in it changes your content, your catalog or an order.

Security-first by design

• Every tool is classified read or write. Reads of public content are public; writes always require a same-session nonce.
• Four access tiers – public, browser session, logged in, and a specific capability – and an admin override that can only ever tighten a tool, never loosen it.
• Per-tool and per-group enable/disable from the admin.
• Per-caller and global rate limiting, applied before the authorization decision so rejected calls still cost the caller quota.
• Output is sanitized before it reaches an agent (defense against stored XSS and prompt injection).
• Denied calls are recorded in the activity log, not only successful ones, so an attempt is visible to you.
• No administrator email, usernames, private meta, secrets, or non-public content are ever exposed. Password-protected posts are never returned.

Extensible

Register your own tools with a documented PHP API (themesic_agent_register_tools) – no core files need editing. Custom tools get the same security gate, validation, rate limiting and delivery surfaces as the built-in ones. Hooks are also provided for adding REST routes, resolving a caller’s identity, narrowing which tools are allowed, and extending the admin screens.

Privacy

This plugin makes no external calls at all. Every tool runs inside your WordPress install, nothing is sent anywhere on activation or afterwards, and the optional activity log stores recent tool calls with no personal data (and can be cleared or turned off). There is no account, no licence check and no telemetry.

A separate paid add-on exists

The author also sells a separate commercial plugin that adds write tools (cart, checkout, orders), a server-side MCP endpoint, per-agent API keys and integrations with other plugins. It is a different plugin, sold and distributed from the author’s own website.

It is not part of this package, in whole or in part. Its code is not here, switched off or otherwise; nothing in this plugin downloads, installs or checks for it; and nothing anyone can buy changes what the files in this package do. Everything described above works on its own and always will.