MCP for VirtueMart is a free add-on for MCP for J that puts your VirtueMart shop in front of your AI client. Forty-eight tools cover products, categories, manufacturers, pricing, stock, orders, customers, reviews and diagnostics, so you can ask which products are out of stock, or move an order to Shipped, without opening the admin. The reason it's worth having rather than a script you write yourself is the shape of VirtueMart underneath: its own save routine treats every write as a complete admin form and deletes the prices, categories and custom fields you didn't re-send. Every write tool here is built to not do that. It needs Joomla 5 โ VirtueMart's own installer refuses Joomla 6.
Why this exists
The questions you actually have about a shop cut across its screens. Which products have stock under five? Which orders have been sitting at Confirmed for a fortnight? Which products are live but have no price for the default shopper group, so they show as free? VirtueMart stores all of that, but its admin is built around one long form per product and one list per entity, so answering any of those means filtering, paging and counting by hand. This add-on hands the whole shop to your AI client instead, and adds an audit for a failure mode VirtueMart has no screen for at all โ products that exist in the database but are invisible on the site.
What Claude can do
Forty-eight tools across ten groups.
| Area | Tools | What you can do |
|---|---|---|
| Products | 10 | List with filters, read one in full, create, update, delete, publish or unpublish, set categories, set manufacturers, and read or write a single language's name and descriptions. |
| Categories | 5 | List, read, create, update, delete โ including the parent link VirtueMart still writes even though it calls it obsolete. |
| Manufacturers | 4 | List, read, create and update the third translatable catalog entity. |
| Pricing | 4 | List a product's prices, set or delete one price row at a time, and read the calculation rules that turn a base price into what the shopper sees. |
| Inventory | 2 | Read stock across the catalog with low-stock filtering, and set the stock level on one product. |
| Orders | 5 | List with filters, read one with its line items, change its status, read its history, and list the statuses this shop actually uses. |
| Customers | 4 | Read customers and their order history, list shopper groups, and move a customer between groups. |
| Store reference | 4 | Vendors, currencies, countries and states โ the lookups everything else is keyed against. |
| Reviews | 4 | List reviews and ratings, approve or unapprove a review, delete one. |
| Diagnostics | 6 | Component and edition info, a shop-wide health check, the invisible-product audit, a configuration read, and scoped read-only access to VirtueMart's own tables. |
Installing it
You'll need Joomla 5, PHP 8.2 or later, MCP for J, and VirtueMart itself. VirtueMart is free and GPL, so there's nothing to buy and no edition to choose.
- Open Components โ MCP for Joomla โ Browse MCP Add-Ons and click Install on this add-on. You can also download the ZIP above and install it through System โ Install โ Extensions.
- That's the whole install. The plugin enables itself, and the tools show up in your connected AI client the next time it lists them.
There's no admin screen for this plugin, by design โ it adds tools to MCP for J rather than a place to click. If you go hunting for a menu entry after installing, that's why there isn't one.
Using it
Ask for what you want in plain language. "What's under five in stock right now?" runs the inventory read with a threshold. "Show me order 1042 with its line items and history" pulls the whole thing in one answer. "Move orders 1042 and 1043 to Shipped" does exactly that, and because the status change goes through VirtueMart's own routine, the stock adjustment, the order history row, the invoice number and the customer email all happen the way they would if you'd clicked the button.
If you're new to it, run the health check and the language-table audit first. Both are read-only, and the second one answers a question VirtueMart never asks itself โ see below.
Saves that delete what you did not send
This is the thing worth understanding before you point a write tool at a live shop.
VirtueMart's product save expects a complete admin form POST. Anything absent from what it's handed is treated as "the shop owner removed this", so a save that only changes the product name also deletes that product's prices, its category assignments, its shopper-group restrictions, its manufacturer link and its custom fields. The category case is the most surprising of them, because an empty category list reads as store the empty set rather than leave them alone, and the only way to say "don't touch these" is a literal sentinel value. None of this is a bug exactly โ it's what a full form POST implies โ but it's hostile to anything that wants to change one field.
So no tool here ever hands a partial array to a VirtueMart model. Every write is either a read-modify-write of the whole object or a targeted update on one column, and that constraint is why the surface is shaped the way it is: prices are set one row at a time rather than as a set, and categories and manufacturers get their own tools rather than being fields on the product update.
The shop configuration is a harder version of the same problem, and the answer there was to not offer the write at all. VirtueMart's configuration save re-reads the settings file and replaces the parameter set wholesale, so writing two settings resets every other setting in the shop to its shipped default โ and reports success. There's a tool to read the configuration and deliberately no tool to write it.
The audit for products that exist but aren't there
VirtueMart's products table has no product name column. The name, the descriptions, the meta tags and the URL slug all live in a separate per-language table, and the query that fetches a product joins the two with an INNER JOIN. A product row whose language row is missing therefore isn't untranslated โ it's absent. It won't appear on the site, it won't appear in the admin list, and nothing anywhere logs that it happened.
The language-table audit looks for exactly that, along with the reverse case and any language table the shop's own active-languages setting says should exist but doesn't. It's read-only, it takes one call, and on an older shop that has changed languages at some point it's usually the most interesting thing this add-on will tell you.
Joomla 5 only, and keep VirtueMart current
VirtueMart 4.x refuses to install on Joomla 6 โ that's its own installer's decision, not this add-on's โ so on a Joomla 6 site these tools report VirtueMart as not installed and stop there. If you're running a VirtueMart shop, you're on Joomla 5, and that's fine.
Separately, and more urgently: update VirtueMart to 4.8.0 or later if you haven't. Versions below 4.4.10 carry a documented remote-code-execution chain, and versions below 4.8.0 ship a payment plugin with an order-status flaw the vendor's own release notes tell you to fix by updating or removing the plugin. No CVE was assigned for that second one, which means no vulnerability feed and no security dashboard will flag it for you โ you have to know. It's a free update from a GPL project, so there's no reason to sit on it.
Permissions and security
Some of VirtueMart's surface is deliberately absent here, and it's worth knowing which parts so you don't go looking.
There's no file or image upload of any kind. The remote-code-execution chain mentioned above ran through VirtueMart's product-image upload path, and 4.8.0 was still hardening it, so this add-on doesn't rebuild that surface at all. Payment and shipping plugin parameters hold live gateway keys, so they're redacted everywhere โ not just in what's returned, but as things you can filter or sort by, because a filter on a secret column reads it one character at a time. There's no tool that can alter a database table's structure, even though VirtueMart's own custom-fields screen can. And orders can be read and moved between statuses but not created, because creating one properly needs a fully primed shopping cart that only VirtueMart's checkout can build.
The scoped table reader is read-only, restricted to VirtueMart's own tables, and validates every column name against the live schema. It can't reach Joomla's tables, and it has no path to a raw query.
Open source
GPL-2.0-or-later, the same license as Joomla itself. Source lives on GitHub.
Add comment