AI agent for WordPress and WooCommerce sites

What Merlean reads in a WordPress codebase

Merlean connects to your repository through GitHub or GitLab and analyses the application rather than recording a user clicking through it. In a WordPress project, that analysis draws on:

• REST API routes registered by core, your theme and every active plugin.
• Custom post types and taxonomies, with the fields registered against them.
• Custom fields from ACF or Meta Box, which frequently carry the real business data.
• Capabilities and roles, which decide who may perform an action.
• WooCommerce entities where present - products, orders, coupons, subscriptions - and the endpoints that operate on them.
• Admin-ajax handlers, which older plugins still use in place of REST routes.

The result is a machine-readable model of what the application can do, which fields each action needs, which order multi-step work has to run in, and who is allowed to run it. That model is what user requests are resolved against.

Authentication and permissions

Merlean acts as the signed-in WordPress user through the existing cookie and nonce, or through application passwords. Capability checks run exactly as they do in wp-admin, so an editor cannot perform an administrator action.

Worth knowing about WordPress specifically

• Plugin sprawl is the reason this is useful and also the thing to review first. A site with thirty active plugins has a large surface, and it is worth confirming the generated model before opening it to users.
• Plugins that register no REST routes and rely entirely on admin-ajax are readable but less precise, because the payload contract is looser.
• Capability checks that a plugin performs inconsistently are worth finding during review. Merlean follows what the code enforces, which occasionally differs from what the menu implies.

Getting started

Connect the repository, run the first analysis, and review what Merlean understood. Reviewing is the step worth spending time on: the analysis is derived from your code, so where it is wrong it is usually pointing at something genuinely ambiguous in the application.

Then add the widget with a single script tag, or expose the application over the Model Context Protocol so an AI agent your users already use can reach it.

Frequently asked questions

Is this a WordPress plugin?

Merlean reads the site's code and calls its existing REST routes. It does not require you to rewrite anything, and it works with the plugins you already run.

Does it respect user roles?

Yes. Requests carry the signed-in user's credentials, so WordPress capability checks apply normally.

Does it work with WooCommerce?

Yes. WooCommerce registers extensive REST routes, which makes order, product and coupon workflows some of the more straightforward things to expose.

Related