feat: WooCommerce product variations & attribute management (10 new MCP tools)

[ober37]

Summary

Adds 10 new WooCommerce MCP tools for managing product variations and global attributes, plus two targeted bug fixes to Server.php that affect all users running mcp-remote against this plugin.

New tools (10)

Variation CRUD (6)

• wc_get_product_variations — list all variations for a variable product
• wc_get_variation — get a single variation by ID (validates parent ownership)
• wc_create_variation — create a new variation with full field support
• wc_update_variation — update price, stock, attributes, dimensions, etc.
• wc_delete_variation — permanently or soft-delete a variation
• wc_batch_update_variations — create, update, and delete in a single call

Attribute management (4)

• wc_get_product_attributes — list all registered global pa_* attribute taxonomies
• wc_get_attribute_terms — list terms for a global attribute (by ID or taxonomy slug)
• wc_create_product_attribute — register a new global attribute taxonomy
• wc_set_product_attributes — assign attributes to a variable product (required before creating variations)

Files changed

File	Change
includes/Integrations/WooCommerce.php	+10 tool definitions + implementations + 3 private helpers
includes/API/REST_Controller.php	+9 REST routes + handler methods
includes/MCP/Server.php	2 targeted bug fixes (see below)

---

Bug fixes in Server.php

These fixes affect all users of this plugin with mcp-remote, not just WooCommerce users.

1. protocolVersion: 2025-03-26 → 2025-11-25

The MCP protocol is date-versioned. Current Claude Desktop builds send protocolVersion: 2025-11-25 in their initialize handshake. When the server responds with 2025-03-26, Claude Desktop silently rejects the entire tool list — no error, no warning, tools simply don't appear. Bumping the server's declared version to 2025-11-25 restores compatibility with current Claude Desktop builds.

2. handle_get_stream(): return 405 instead of 200+immediate-close

The existing handle_get_stream() returns HTTP 200 with SSE headers but immediately closes the stream (as noted in the code comment). mcp-remote treats an immediately-closed stream as a dropped connection and retries rapidly. After 2–3 retries the server returns 429, mcp-remote gives up, and the entire MCP connection drops — taking all tools with it.

Returning 405 Method Not Allowed with Allow: POST, DELETE, OPTIONS is the correct HTTP signal for "this method is not supported here." It stops the retry loop immediately. The original SSE implementation is preserved (unreachable) so it can be restored if full SSE support is added later.

---

Implementation notes

• All new REST endpoints use the existing check_permission callback
• Variation ownership validated on every get/update/delete — prevents cross-product IDOR
• WC_Product_Variable::sync() called after every variation create, update, and delete to keep parent price/stock cache current
• pa_* prefix handling is correct throughout with explanatory comments
• wc_set_product_attributes emits a warning when replacing pre-existing attributes
• wc_get_product_attributes uses new \stdClass() for empty properties — PHP [] serializes to JSON array which fails MCP JSON Schema validation and silently breaks all tools

---

Testing

18 test cases against a live WooCommerce store — 18/18 passing:

• Full CRUD cycle without modifying production data
• Batch create × 2, batch update + delete in one call
• Parent price cache verified to update immediately after variation update and delete
• Cross-product ownership rejection verified on get, update, and batch update
• tools/list returns 86 tools, 0 invalid schemas