Hubshop MCP Server

Eleven regional storefronts, a shared WooCommerce core, over a hundred plugins and six years of history. Most questions about a platform that size are archaeology, not programming: which region overrides this template, where does this price come from, what did this hook do before someone changed it. Answering one by hand costs an hour. Answering it wrong costs more.

hubshop-mcp is a Model Context Protocol server over that codebase, so an assistant can look for itself. Five tools — search and inspect the code, run WP-CLI, query the database through an SSH tunnel, drive the local environments — plus a set of written resources covering the parts of the platform that are not obvious from reading a file.

The point is where it runs. It works with Claude Code and with Codex, and it works with a model running locally through Ollama, which is the option that matters for a client. A codebase with a customer database behind it is not ours to hand to a vendor, and 'we promise not to train on it' is a policy, not a boundary. Pointed at a local model, the work happens on the machine and nothing leaves it.

It is also built so that a wrong answer cannot cost anything. Every tool result passes through one scrubber on the way out, and the database password is registered with it the moment credentials are read — so it cannot appear in that tool's output, or in any other tool's output either. Ad-hoc database access goes through a helper script that reads the password from a file only its owner can read, so it never lands in a response or in shell history. SQL is read-only unless writes are explicitly asked for, and the file and inspection tools are marked read-only to the client. Twenty test files hold that behaviour in place.

What it does not do is worth saying plainly, because the opposite is easy to imply. It is not a privacy filter. It scrubs the secrets it has been told about, not personal data it happens to read, and a query against a real database returns real customer rows. The protection is the arrangement, not a filter: read-only by default, and a local model when the data is sensitive.