WooCommerce agentic commerce plugins: an independent review

Search the WordPress.org plugin directory for UCP or “agentic commerce” and you’ll find a row of WooCommerce plugins promising to make your store ready for AI shopping agents before Black Friday. I read the listings of five of them, plus WooCommerce’s own beta, the way I’d review any plugin before it touched a store: what it really adds, who it talks to, and what it needs from you.

The short answer: most of them are new, tiny and untested on current WordPress, and one asks for your WooCommerce REST API keys so a third-party server can work with your store. None of them can get you a Buy button in ChatGPT or Google on its own, because both platforms decide who gets one. This is a review of listings and documentation, not of code running on a store, so treat it as a checklist to start from.

What do WooCommerce agentic commerce plugins actually do?

They do one of three things, and the plugin name rarely tells you which. Sorting them first saves you from comparing a feed exporter with a checkout server:

• Feeds. They turn your catalogue into a product feed in the format OpenAI’s Agentic Commerce Protocol (ACP) describes. A feed is only useful once a platform accepts it from you.
• Discovery and checkout endpoints. They publish a profile at /.well-known/ucp for Google’s Universal Commerce Protocol (UCP), and sometimes routes an agent can use to build a cart and complete a checkout.
• Hosted bridges. The plugin is a thin connector and the real work happens on the vendor’s servers, which need access to your store to do it.

None of this is the same as WooCommerce’s MCP support, which lets an assistant help you run the store as a logged-in user. I covered that in WooCommerce 11.3 removes its MCP endpoint, and the bigger picture in Should your WordPress site have an MCP server?

Does WooCommerce have its own agentic commerce plugin?

Yes, but it’s a private beta most stores can’t join yet. WooCommerce AI is at version 0.9.0, and its product page says it’s only for stores in the US, not hosted on WordPress.com, with English as the main store language. It’s free during the beta, needs WordPress 7.1 and WooCommerce 11.1, and WooCommerce says it has no general availability date yet.

Its developer documentation describes UCP endpoints that shipped in 0.8.0: catalogue search, carts and checkout sessions under wc/ucp/v1. The part I like is the default security model. Requests go through a WordPress.com proxy and the store rejects unsigned direct requests, so the routes aren’t simply open to anyone on the internet. Checkout on Google’s AI surfaces is still described as in active development, and WooCommerce’s agentic commerce page still lists UCP and Stripe’s ACP as “Coming soon”.

One more catch from WooCommerce’s own blog: the Stripe route works through the Stripe extension, so stores on WooPayments can’t use it yet. This beta is the baseline I compare everything else with. If a third-party plugin claims more than the platform’s own beta, I want to know how.

How do the plugins in the directory compare?

They’re all young and small, and they differ most in where your data goes. Here is what each listing said when I read it, in early November 2026.

UCPhub for WooCommerce

A hosted bridge. You need an account with the vendor, and the listing’s external services section says the plugin sends your API key, store ID, store URL, store settings and your WooCommerce REST API consumer key and secret to the vendor’s API. Your /.well-known/ucp profile is fetched from their backend each time it’s requested. Version 2.1.0 fixed cart and checkout requests from its embedded checkout that always ran as a guest session. Fewer than 10 active installs. Credit where due: it discloses all of this plainly, which is what WordPress.org asks plugins that call outside services to do.

UCP/ACP Agent for WooCommerce

Self-hosted discovery and checkout. It publishes /.well-known/ucp and an ACP discovery file, supports signed HTTP messages, and charges through Stripe only once you add a Stripe key. The listing says no data goes to the plugin author, that its agent checkout endpoints are public by design, and that ChatGPT checkout needs OpenAI merchant approval. That last line is the most honest sentence I read in any of these listings. It’s version 0.1.0, needs PHP 8.1, and has fewer than 10 installs.

Universal Commerce Protocol (UCP) for WooCommerce

The broadest feature list: UCP discovery, REST and MCP transports, checkout sessions, OAuth identity linking and order tracking. It generates an API key that agents must present. Its changelog lists security fixes for inline scripts and REST permissions in 1.0.3. It shows 30+ installs, was last updated eight months before I read it, and is tested only up to WordPress 6.9, two major versions behind.

Agentic Commerce Protocol & ChatGPT Product Feed for WooCommerce

A feed sent to a hosted platform. It needs an account and API key from the vendor, and the listing says product data goes to the vendor’s API. It shows 20+ installs, was last updated a year ago, and WordPress.org warns it hasn’t been tested with the last three major WordPress releases. The listing’s own name and its changelog don’t agree on what the plugin is called.

Agentabile

A feed only, despite UCP and MCP in its title. It adds a REST route that outputs an ACP feed, needs no configuration and lists no outside services. Grouped and external products aren’t supported. Version 0.1.0, fewer than 10 installs. The listing doesn’t say who can read the feed route, so that’s the first thing I’d check.

Should you give a plugin vendor your WooCommerce REST API keys?

Only if you’d be comfortable with that company logging in to your store’s back end, because that’s roughly what a key allows. A WooCommerce REST API key acts as the user it was created for, with read, write or read/write permission, and it can reach products, orders and customers. If the vendor’s servers are breached, your key goes with them.

If you decide to go ahead, this is what I’d do:

1. Create a dedicated user for the integration with the lowest role that works, rather than tying the key to an administrator. It worked if the new user appears under Users with that role.
2. Go to WooCommerce, then Settings, then Advanced, then REST API, and add a key for that user with Read access unless the vendor shows you why it needs Write. It worked if the key is listed with the right user and permission.
3. Check the key’s “Last access” date on the same screen after a few days. It worked if the dates match when you expect the service to sync.
4. Revoke the key the day you stop using the plugin. Deactivating a plugin doesn’t delete a key held on someone else’s server. It worked if the key is gone from the list.

With WooCommerce releasing several security updates this autumn, as in WooCommerce 11.2.2, I’m stricter than usual about anything that holds a key to a store.

How do you check an agentic commerce plugin yourself?

Install it on a staging copy and look at what it adds before you trust its description. These are the checks I run:

1. Read the readme’s external services section on the plugin page. It worked if you can name every domain the plugin talks to and what it sends. A missing section on a plugin that clearly needs a server is a reason to stop.
2. Fetch the discovery file and the REST index while logged out, using the first two commands below. It worked if you can see which routes the plugin added under its own namespace.
3. Call one cart or order route without credentials, using the third command with a route from the index. It worked if a route that returns order or customer data answers 401 or 403, not 200.
4. Search the plugin’s code for open permission callbacks with the last command. It worked if every match is a route that should be public, such as a catalogue or discovery route.
5. Check “Tested up to” and the last update date against the WordPress version you run. It worked if the plugin has been tested with your major version.

curl -s https://staging.example.com/.well-known/ucp
curl -s https://staging.example.com/wp-json/ | python3 -c "import json,sys; print('\n'.join(json.load(sys.stdin)['routes']))"
curl -s -o /dev/null -w "%{http_code}\n" https://staging.example.com/wp-json/ROUTE-FROM-THE-INDEX
grep -rn "__return_true" wp-content/plugins/PLUGIN-FOLDER/

A public catalogue route is normal, since agents need to read products. A public route that creates orders can be fine too, as one of the plugins above says outright, but then I want to see rate limits and payment checks behind it. WooCommerce’s own beta, for comparison, documents limits of five checkout completions per five minutes.

Do you need one of these plugins before Black Friday?

For most stores, no. Checkout inside ChatGPT needs OpenAI’s approval, and Google picks the merchants who get its checkout, as I went through in Selling through ChatGPT from WooCommerce and UCP on WooCommerce. A plugin can publish a profile or a feed, but it can’t approve you. What helps every store now is clean product data, crawlable product pages and accurate prices and stock.

If you want to experiment, pick a self-hosted plugin that doesn’t need your keys, run it on staging, and put the checks above in your notes so you can repeat them after every update. If a plugin wants your REST API keys, give it a read-only key on a dedicated user, and write down the date you created it so you remember to revoke it.