MCP Server
The plugin includes an optional MCP (Model Context Protocol) server. MCP is an open standard that lets AI tools such as MCP Inspector or Claude Desktop connect to outside data sources. With the server enabled, an MCP client you authorise can search your products and read your five most recent order totals and statuses.
This is an experimental feature. It is off by default, may change between releases, and each request to it uses a PHP worker on your server. Leave it off unless you have a specific use for it.
What it exposes#
| Kind | Name | What the client gets |
|---|---|---|
| Resource | mcp://products (“Product List”) | The ten most recent published products with ID, name, SKU, price and stock status. |
| Resource | mcp://orders/recent (“Recent Orders”) | The five most recent orders: ID, total, status and date. No customer details. |
| Tool | search_products | Searches products by keyword, min_price and max_price, using the same search (and excluded categories) as the chat. |
Enable it#
- Go to LeetCart AI → Connections and scroll to MCP Server (Model Context Protocol, experimental).
- Turn on Enable MCP Server and click Save Changes.
- Click Generate Token. A 32-character token is created and saved immediately; use the copy button to copy it. Regenerate replaces it, which locks out any client still using the old one.
- Copy the Endpoint URL (Streamable HTTP), which is
https://your-store.example/wp-json/swpr/v1/mcp.
Connect a client#
Add the endpoint to any MCP client that supports the Streamable HTTP transport (MCP Inspector, or Claude Desktop through a remote-server connector). Clients that only speak the older SSE transport can use /wp-json/swpr/v1/mcp/sse for the event stream and /wp-json/swpr/v1/mcp/message for messages.
Every request must carry the token in an Authorization: Bearer <token> header. If your host strips the Authorization header, send it as X-SWPR-MCP-Token: <token> instead. Requests without a valid token are rejected with 401; a logged-in administrator’s cookie session is also accepted. A plain GET on the endpoint answers 405, which is allowed by the specification and simply means the server does not offer a standalone stream.
Turn it off#
Switch Enable MCP Server off and save. The endpoints then answer 401 to everyone, token or not. The MCP server never contacts any outside service itself.