Model Context Protocol · Production Ready

WooCommerce to AI — safely.

Cartix is a strictly read-only MCP connector giving AI agents (Agent Studio, Claude, Cursor) structured, safe, normalized access to WooCommerce merchant data. Zero mutations. Zero PII leaks.

$ git clone https://github.com/ilakkiyan-j/Cartix.git

Read the Docs View on GitHub

5 MCP Tools

100% Read-Only

<15ms Serialization

60/60 Tests Passing

Strictly Read-Only

Zero write tool definitions. Impossible to mutate orders or inventory.

PII Sanitization

Customer emails auto-masked, names hashed, addresses stripped.

Token Bucket & Jitter

Built-in rate limiting with exponential backoff and 429 parsing.

Bounded Pagination

Hard-capped 100-item limits prevent LLM context blowup.

Integration Gap

Why Direct WooCommerce Access Breaks Production

Connecting LLMs directly to raw WooCommerce REST APIs creates three critical failure modes.

WITHOUT CARTIX

Fragile, Unsafe Direct Access

Security Risk: API keys exposed in agent prompts; unintended write actions are possible.
Context Bloat: Raw WooCommerce JSON contains hundreds of metadata fields and unhashed PII.
Rate Limit Crashes: Unchecked agent loops trigger 429 blocks and bring down store APIs.

WITH CARTIX MCP

Structured, Guarded Operations

Read-Only Enforcement: Server-side credentials. Zero write tool definitions guarantee immutability.
Sanitized Schemas: Zod-validated payloads normalize data and automatically redact customer PII.
Resilient Bucket: Built-in rate limiting and jittered retries absorb traffic spikes seamlessly.

System Topology

End-to-End Execution Flow

How Cartix isolates AI agent reasoning from upstream WooCommerce infrastructure.

INITIATION

Merchant & Agent

User asks a question in natural language. Agent inspects MCP tool definitions and emits a structured tool call.

JSON-RPC 2.0

MCP PROTOCOL

Cartix Dispatcher

Validates parameters with Zod schemas, enforces bounded pagination, and consumes rate-limiter tokens before dispatch.

Model Context Protocol

UPSTREAM ADAPTER

WooCommerce Client

Authenticates via Basic Auth over HTTPS, executes with jittered retry logic, and parses X-WP-TotalPages headers.

WC REST v3

NORMALIZATION

Sanitized Response

Redacts PII, masks emails, strips metadata, and returns clean structured data to the agent for final reasoning.

Normalized JSON

Tool Registry

5 Production MCP Tools

Standardized, type-safe Model Context Protocol tools ready for Claude Desktop, Cursor, and autonomous agents.

search_orders

Searches and filters WooCommerce orders with pagination, status filtering, and automatically sanitized customer records.

READ-ONLY

Parameter	Type	Description
`status`	string	pending, processing, on-hold, completed, cancelled, refunded, failed
`date_from`	string	ISO 8601 start date (e.g. 2026-10-01T00:00:00Z)
`date_to`	string	ISO 8601 end date (e.g. 2026-10-02T23:59:59Z)
`page`	number	Page number (default: 1)
`limit`	number	Results per page (1–100, default: 20)

search_orders Response (Sanitized)

{
  "orders": [
    {
      "id": 1042,
      "status": "pending",
      "total": "49.99",
      "currency": "USD",
      "created_at": "2026-10-01T14:20:00Z",
      "customer": { "email": "a***e@example.com" },
      "item_count": 2
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 1
  }
}

get_order

Retrieves a single order by ID with full line items, financial breakdown, and sanitized billing details.

READ-ONLY

Parameter	Type	Description
`order_id`	number	WooCommerce order positive integer ID (required)

get_order Response

{
  "id": 1004,
  "status": "processing",
  "currency": "USD",
  "total": "129.50",
  "line_items": [
    {
      "id": 88,
      "product_id": 45,
      "name": "Mechanical Keyboard RGB",
      "quantity": 1,
      "price": "129.50"
    }
  ],
  "customer": {
    "email": "j***n@company.org"
  }
}

search_products

Searches the store catalog by keyword, SKU, or category with bounded pagination and normalized output.

READ-ONLY

Parameter	Type	Description
`query`	string	Search keyword to match against titles, descriptions, or SKUs
`page`	number	Page number (default: 1)
`limit`	number	Results per page (1–100, default: 20)

search_products Response

{
  "products": [
    {
      "id": 87,
      "name": "Wireless Mechanical Keyboard",
      "sku": "KB-001",
      "price": "49.99",
      "stock_status": "instock",
      "stock_quantity": 45
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 1
  }
}

get_product

Fetches full product specifications including SKU, pricing, stock status, and description for a specific product ID.

READ-ONLY

Parameter	Type	Description
`product_id`	number	WooCommerce product positive integer ID (required)

get_product Response

{
  "id": 87,
  "name": "Wireless Mechanical Keyboard",
  "sku": "KB-001",
  "price": "49.99",
  "regular_price": "59.99",
  "sale_price": "49.99",
  "stock_status": "instock",
  "stock_quantity": 45,
  "manage_stock": true
}

get_inventory

Retrieves store-wide inventory levels with deterministic low-stock detection (quantity ≤ 5 or below threshold).

READ-ONLY

Parameter	Type	Description
`low_stock_only`	boolean	If true, filters to low-stock or out-of-stock items (default: false)
`page`	number	Page number (default: 1)
`limit`	number	Batch limit (1–100, default: 20)

get_inventory Response

{
  "inventory": [
    {
      "product_id": 92,
      "sku": "MC-011",
      "name": "Condenser Microphone",
      "stock_quantity": 3,
      "stock_status": "instock",
      "is_low_stock": true
    },
    {
      "product_id": 97,
      "sku": "KC-016",
      "name": "Artisan Keycap Galaxy",
      "stock_quantity": 0,
      "stock_status": "outofstock",
      "is_low_stock": true
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 2
  }
}

Security & Compliance

Built-In Enterprise Guardrails

Cartix protects merchant credentials and customer data by design — not configuration.

Server-Side Credential Isolation

API keys reside exclusively in server environment variables. Tool schemas expose zero credentials to LLM reasoning loops — the model never sees your WooCommerce keys.

WOOCOMMERCE_CONSUMER_KEY=ck_... # server-side only

Automatic PII Redaction

Customer emails are masked and physical addresses are stripped before reaching the AI model, ensuring full privacy compliance.

alexander@example.com ➔ a***r@example.com

Secret Redaction in Logs

All loggers automatically intercept ck_* and cs_* patterns, replacing them with [REDACTED] before any log output.

logger.info("auth", { key: "[REDACTED]" })

Token Bucket Rate Limiting

Proactive request throttling with 429 Retry-After header parsing and exponential jitter prevents store API saturation.

RateLimit: 98/100 tokens (refill 10/s)

Explicit Operational Boundaries

What Cartix Does

Read orders, products, and inventory levels
Sanitize and redact customer PII automatically
Rate-limit and back-off on upstream throttling
Bound query pagination up to 100 records

What Cartix Rejects

Order creation, modification, or cancellation
Refund issuance or payment capture
Product creation or inventory mutations
Unvalidated arbitrary REST requests

Developer Setup

Get Started in Seconds

Run Cartix locally, connect to Claude Desktop, or containerize with Docker.

bash — Installation

# 1. Clone repository & install dependencies
git clone https://github.com/ilakkiyan-j/Cartix.git
cd Cartix && npm install

# 2. Configure read-only WooCommerce credentials
cp .env.example .env
# Edit .env: WOOCOMMERCE_URL, WOOCOMMERCE_CONSUMER_KEY, WOOCOMMERCE_CONSUMER_SECRET

# 3. Start Cartix MCP Server
npm start

claude_desktop_config.json

{
  "mcpServers": {
    "cartix": {
      "command": "node",
      "args": ["/path/to/cartix/dist/src/index.js"],
      "env": {
        "WOOCOMMERCE_URL": "https://store.example.com",
        "WOOCOMMERCE_CONSUMER_KEY": "ck_...",
        "WOOCOMMERCE_CONSUMER_SECRET": "cs_...",
        "MCP_TRANSPORT": "stdio"
      }
    }
  }
}

.cursor/mcp.json

{
  "mcpServers": {
    "cartix": {
      "command": "node",
      "args": ["./dist/src/index.js"],
      "env": {
        "WOOCOMMERCE_URL": "${env:WOOCOMMERCE_URL}",
        "WOOCOMMERCE_CONSUMER_KEY": "${env:WOOCOMMERCE_CONSUMER_KEY}",
        "WOOCOMMERCE_CONSUMER_SECRET": "${env:WOOCOMMERCE_CONSUMER_SECRET}"
      }
    }
  }
}

bash — Docker

# Build and run with Docker
docker build -t cartix-mcp .
docker run --rm \
  -e WOOCOMMERCE_URL=https://store.example.com \
  -e WOOCOMMERCE_CONSUMER_KEY=ck_... \
  -e WOOCOMMERCE_CONSUMER_SECRET=cs_... \
  cartix-mcp

Tested Scenarios

Real Merchant Queries, End-to-End

Validated against live stores via multi-turn MCP function calls.

"Which pending orders have been waiting for more than 24 hours?"

TOOL CALLsearch_orders({ status: "pending" })

REASONINGAgent compares created_at timestamps against current ISO date.

"Which products are out of stock or critically low?"

TOOL CALLget_inventory({ low_stock_only: true })

REASONINGAgent summarizes affected SKUs and critical stock levels.

"Are any pending orders affected by out-of-stock products?"

MULTI-TURNsearch_orders() → get_inventory()

REASONINGCross-references line item product IDs against live stock levels.

"Give me the full details for order #1004."

TOOL CALLget_order({ order_id: 1004 })

REASONINGFormats ordered items, quantities, totals, and masked customer status.

Connect Your Store to AI Today

Integrate Cartix with Claude Desktop, Cursor, or your autonomous agent fleet in under 5 minutes. Free and open-source.

Read Full Documentation View on GitHub