To connect Claude, Cursor, VS Code, or another MCP client to a WordPress site you operate, install and activate the official WordPress MCP Adapter, then expose it either through WP-CLI over local STDIO or through an HTTPS HTTP transport. The adapter requires WordPress 6.9 or newer, PHP 7.4 or newer, and a functioning REST API. Use a narrowly permissioned WordPress user, test with a read-only operation, and treat every registered Ability as an action the connected agent may be able to discover.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a self-hosted WordPress MCP server actually is
The WordPress MCP Adapter is a bridge, not a replacement WordPress installation. WordPress core, plugins, and themes register functionality through the WordPress Abilities API. The adapter translates those registered Abilities into the three primitives understood by the Model Context Protocol: tools that an agent can call, resources that it can read, and prompts that can guide an interaction.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“Its job is to adapt Abilities registered by the Abilities API into the primitives supported by the Model Context Protocol (MCP) so that AI agents can discover and execute site functionality as MCP tools and read WordPress data as MCP resources.”
WordPress Developer Blog, February 4, 2026
That distinction matters when you run a video-games publication. Installing the adapter does not automatically create a universal set of editorial commands, nor does it grant an agent unrestricted access to every WordPress feature. The catalog depends on the Abilities registered by your WordPress version, active plugins, and active theme. A site with an Ability for reading posts may expose that operation; a site without a registered publishing Ability will not gain one merely because MCP is enabled.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
A self-hosted deployment keeps the WordPress application, database, media, credentials, and MCP process under your operational control. You still need to maintain PHP, WordPress, the adapter, HTTPS, backups, and user permissions. The client only receives the capabilities that the server exposes and that the authenticated WordPress account can use.
Prerequisites and compatibility
Check these items before installing the adapter:
| Requirement | What to verify | Why it matters |
|---|---|---|
| WordPress | Version 6.9 or newer | The current adapter documentation lists WordPress 6.9+ as the supported baseline. |
| PHP | Version 7.4 or newer | The adapter requires PHP 7.4+ on the WordPress server. |
| REST API | A normal authenticated REST request works | The HTTP transport and remote proxy rely on WordPress REST API operation. |
| Web server | nginx or Apache with HTTPS for remote use | A normal reverse proxy terminating HTTPS needs no adapter-specific setting beyond a working REST API. |
| WordPress account | A dedicated user with only the capabilities your agent needs | MCP actions execute in the context of this account. |
| Client | An MCP-capable application such as Claude, Cursor, or VS Code | The client must be able to launch a local MCP command or connect through the selected HTTP proxy. |
Confirm the versions from the WordPress dashboard under Tools > Site Health > Info or with your host’s PHP and WordPress management tools. Do not assume that a host’s advertised PHP version applies to the site’s actual PHP-FPM pool. If the REST API is blocked by a firewall, security plugin, maintenance mode, or authentication layer, fix that first.
Install and activate the MCP Adapter
- Obtain the latest release ZIP. Use the official WordPress MCP Adapter release rather than an unofficial fork. Keep the ZIP available so you can identify the exact version installed.
- Open the plugin uploader. In WordPress, go to Plugins > Add New Plugin > Upload Plugin, select the release ZIP, and choose Install Now.
- Activate it. Select Activate Plugin after installation. The adapter then exposes the Abilities that are registered by WordPress core, plugins, and the theme as MCP-discoverable interfaces.
- Check for conflicts. Visit Tools > Site Health and test a normal REST API request. If the site uses a security plugin or web-application firewall, review its logs for blocked authenticated REST requests.
- Create a dedicated MCP user. Do not start by connecting your personal administrator account. Create a user whose role and individual capabilities match the operations the agent must perform. A separate account makes revocation and auditing straightforward.
The adapter itself does not choose between local and remote transport. You make that choice when configuring the MCP client.
Choose STDIO or HTTP before configuring a client
| Decision area | WP-CLI over STDIO | HTTP with the remote proxy |
|---|---|---|
| Best fit | A development machine, staging site, or a client running on the same machine as WordPress | A publicly reachable or separately hosted WordPress installation |
| Process location | The MCP client launches WP-CLI, which launches the adapter in the WordPress installation | The @automattic/mcp-wordpress-remote proxy connects to WordPress over HTTP |
| Network exposure | No MCP listener needs to be exposed publicly | The site must accept HTTPS REST traffic from the proxy |
| Authentication | The local WP-CLI process runs as the configured WordPress user | Use a WordPress application password or a custom OAuth implementation |
| Operational burden | Maintain WP-CLI, PHP, the WordPress files, and local client configuration | Maintain the site, HTTPS, proxy configuration, and credential lifecycle |
| Control and data location | Commands and responses stay within the local process path | Requests and responses travel over the network between proxy and site |
For a local development copy, STDIO is usually the simpler and safer starting point. For a remote production site, HTTP is the practical choice, but it adds an internet-facing authentication and transport boundary that must be secured.
Set up a local server with WP-CLI and STDIO
The documented local pattern has the MCP client launch the wp executable. WP-CLI points at the WordPress installation, invokes the adapter’s serve command, selects a server definition, and identifies the WordPress user.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
1. Verify WP-CLI can load the site
From the machine that will run the MCP client, change to a shell with access to the WordPress files and confirm that WP-CLI can read the installation. The path supplied to --path must be the directory containing wp-config.php, not the public URL and not the parent directory of several sites.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches2. Add the MCP server entry to the client
Use the following minimum configuration pattern. Replace the path and user value with the local installation and the dedicated WordPress username. The braces in {admin_user} indicate a value to replace; they are not literal credentials.
{
"wordpress-mcp-server": {
"command": "wp",
"args": [
"--path=/path/to/your/wordpress/installation",
"mcp-adapter",
"serve",
"--server=mcp-adapter-default-server",
"--user={admin_user}"
]
}
}Each MCP client places this JSON in a different settings file or user-interface field. Claude, Cursor, and VS Code may use different labels for an MCP server, but the important values are the command wp and the five arguments shown above. Keep the JSON valid: the path must be readable by the process, the server name must match the adapter’s default server, and the user must exist in that WordPress installation.
3. Restart the client and inspect the connection
Fully restart the MCP client after saving its configuration if it does not reload server definitions automatically. A successful startup should show the server as connected or available. If the client reports that it cannot start the process, run the same wp command in a terminal to reveal PHP errors, a bad path, missing WP-CLI support, or a plugin activation problem.
4. Test a harmless read
Do not begin by asking an agent to publish, delete, or alter content. First request the client’s MCP tool list and then invoke one low-risk read operation. Confirm that the returned site data belongs to the intended environment, especially when a staging database is a copy of production.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Connect a remote site through HTTP
For a site that is not on the same machine as the MCP client, configure the @automattic/mcp-wordpress-remote proxy. The proxy provides the client-side connection while the adapter translates the site’s registered Abilities into MCP operations on the WordPress side.
1. Keep the WordPress site behind HTTPS
Terminate TLS at your normal nginx or Apache reverse proxy and ensure that authenticated REST requests reach WordPress intact. The adapter does not require a special reverse-proxy directive beyond standard REST API operation. Do not expose a plain-HTTP credential endpoint, and do not bypass certificate validation to make an initial test pass.
2. Select an authentication method
The supported practical choices are a WordPress application password or a custom OAuth implementation. Application passwords are appropriate when one dedicated WordPress account needs to authenticate the proxy. Generate the credential for that account, store it in the client or proxy’s secret store rather than in a shared document, and revoke it when the integration is retired.
Use custom OAuth when your organization already operates an OAuth authorization service and needs centralized consent, rotation, or policy enforcement. The OAuth implementation is your responsibility; the adapter does not turn an arbitrary WordPress installation into a complete identity provider.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →3. Configure the proxy with the site and credentials
Follow the remote package’s configuration format for the MCP client you are using. Supply the WordPress site’s HTTPS address, the selected authentication details, and the proxy command or launch method required by that client. Keep the remote endpoint restricted to the intended site; a typo that points to another WordPress installation can produce a valid connection to the wrong data.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
4. Validate the network path
- Confirm that the proxy can resolve the site hostname and complete TLS validation.
- Confirm that the REST API accepts the application password or OAuth access token.
- Check the web server and WordPress logs for the request and response status.
- Call
tools/listfrom the MCP client. - Run one read-only operation before enabling any workflow that changes content.
A successful HTTP connection proves transport and authentication, not that every desired editorial action exists. The available operations still come from the site’s registered Abilities.
Discover what the site actually exposes
After connecting, call the MCP tools/list method. Treat its response as the authoritative inventory for that site and account at that moment. Do not rely on a tutorial’s example tool names: another plugin, theme, WordPress release, or user role can change the catalog.
Core, plugin, and theme abilities
The adapter can expose Abilities registered by WordPress core, plugins, and themes. A plugin may add a tool for a custom post type, while a theme may register a presentation-related operation. Those additions are site-specific. Removing a plugin, changing a theme, or disabling an Ability can make a previously configured agent call fail.
Read versus write operations
Classify every discovered operation before allowing an agent to use it:
- Read: retrieves posts, settings, metadata, or other data without changing the site.
- Write: creates or edits content, settings, users, media, or taxonomies.
- Destructive: deletes data or performs an action that is difficult to reverse.
- External-effect: triggers email, publication, payment, webhook, or another service outside WordPress.
Begin with read operations. If a write operation is necessary for a controlled workflow, require explicit human approval in the client and use a dedicated account whose permissions exclude unrelated administration.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Security controls for a production WordPress MCP server
Use least privilege
Create a role or user profile that can perform only the required actions. An agent that drafts game reviews may need to read posts and create drafts, but it does not automatically need permission to install plugins, edit themes, manage users, or change site URLs. WordPress permissions remain the enforcement layer; MCP does not replace them.
Recommended Free Tools
Separate environments
Connect the client to staging while developing prompts and workflows. Use a different user and credential for production. Never assume that a staging copy is harmless: it may contain production API keys, private drafts, customer data, or real email integrations.
Protect credentials
- Store application passwords and OAuth secrets in the client’s secret storage or an operating-system credential manager.
- Do not place credentials in a repository, shared MCP configuration, prompt, issue tracker, or chat transcript.
- Revoke and recreate credentials after a device is lost, a team member leaves, or a configuration is exposed.
- Audit WordPress and web-server logs for unexpected REST requests.
Control network access
Use HTTPS, restrict administrative access at the firewall or reverse proxy where practical, and allow only the proxy or client networks that need to connect. A public HTTP transport should be treated like any other authenticated production API: rate-limit it where appropriate, monitor failures, and keep WordPress and PHP patched.
Review the catalog after updates
WordPress, plugins, and themes can add, remove, or change Abilities. Re-run tools/list after an update and verify that write and destructive operations still match your policy. A capability that did not exist during initial testing should not become available to an agent unnoticed.
Troubleshoot common setup failures
| Symptom | Likely cause | Action |
|---|---|---|
| Client says the command cannot be started | The wp executable is not on the client’s PATH, or the client has no permission to execute it |
Run wp --info in the same environment and use an absolute executable path if the client requires one. |
| WP-CLI reports that WordPress cannot be loaded | The --path value is wrong, inaccessible, or points to a directory without wp-config.php |
Correct the filesystem path and verify file permissions for the account launching the client. |
mcp-adapter is an unknown command |
The adapter is not installed or is inactive in that WordPress installation | Activate the official adapter plugin and run the command again from the same path. |
| HTTP authentication fails | Expired application password, malformed OAuth token, wrong username, or a security layer blocking REST authentication | Generate a new credential, verify the account, inspect web-server and WordPress logs, and test the REST API independently. |
| Tools list is empty or unexpectedly short | No relevant Abilities are registered, the user lacks their required capabilities, or a plugin/theme that provided them is inactive | Inspect active extensions, user capabilities, and the tools/list response; do not assume a fixed catalog. |
| Connection works but a write call is rejected | The account lacks the required WordPress capability, or the Ability validates the input and refuses it | Read the returned error, verify the intended permission and input, and avoid granting administrator access merely to bypass the failure. |
| Requests time out through HTTP | Reverse proxy timeout, blocked outbound access, slow WordPress operation, or a firewall rule | Check proxy and PHP logs, confirm the route is reachable over HTTPS, and test a small read operation before increasing timeouts. |
| Agent reaches the wrong site | Copied configuration points to another local path or hostname | Run a read operation that returns the site name or URL, then correct the path or endpoint before any write operation. |
WordPress.com and Jetpack are a hosted alternative
If you do not want to operate the MCP transport yourself, WordPress.com exposes the hosted endpoint https://public-api.wordpress.com/wpcom/v2/mcp/v1 and protects it with OAuth 2.1. A self-hosted site connected through Jetpack with an eligible Jetpack AI or Jetpack Complete plan uses that same hosted endpoint; there is no separate Jetpack MCP endpoint.
This hosted route changes the control and maintenance model. WordPress.com operates the endpoint and OAuth service, while your site remains self-hosted only if you continue to host WordPress yourself and connect it through the eligible service. Choose it when reducing transport operations is more important than keeping the MCP process and authentication path entirely on infrastructure you manage. Choose the official adapter with STDIO or the remote proxy when you need direct control over the server process, credentials, and network boundary.
Protocol and maintenance considerations
The current WordPress.org plugin listing states support for MCP protocol revisions dated 2025-11-25 and 2026-07-28. Client compatibility can still vary: an MCP client may implement only part of a revision or expose different configuration controls. Keep the adapter and client versions documented together, and retest after upgrading either one.
- Record the WordPress, PHP, adapter, WP-CLI, proxy, and MCP client versions.
- Back up the site before changing WordPress, PHP, or plugins.
- After an update, verify that the REST API still works and that the adapter starts.
- Run
tools/listand compare the result with your approved capability inventory. - Repeat a harmless read test, then separately test any approved draft-only workflow.
- Review logs and revoke obsolete credentials.
A practical rollout plan
For most teams, the lowest-risk sequence is:
- Install the adapter on staging with WordPress 6.9+ and PHP 7.4+.
- Create a dedicated low-privilege user.
- Connect locally over STDIO if the client and staging site share a machine.
- Inspect
tools/listand document every capability that appears. - Test read operations with known, non-sensitive content.
- Introduce one narrowly scoped write workflow, such as creating a draft, only after human review is in place.
- Move to production with a separate user, separate credentials, HTTPS, logging, and a rollback plan.
- Use HTTP and the remote proxy only when the client cannot run WP-CLI locally or the site is hosted elsewhere.
The result is a WordPress MCP server whose behavior is determined by the adapter, the site’s registered Abilities, the transport you selected, and the permissions of the authenticated user. That combination—not the presence of an MCP label alone—determines what an AI client can discover and do.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
