WordPress MCP: How to Connect Your Site to Claude, ChatGPT and AI Agents

"Ask Claude to draft this week's posts." "Ask ChatGPT which plugins need updating." "Let an agent fix the broken links." A year ago these were demos. With the Abilities API in WordPress 6.9 and the official MCP Adapter, they are something you can set up on your own site in an afternoon.

This guide explains what WordPress MCP is, how the official MCP Adapter works, how to connect Claude Desktop, Claude Code, Cursor or VS Code step by step, the security rules you should not skip, and a second, read-only kind of MCP that answers the question most site owners actually ask their AI: what changed on my site, and did anything break?

What is MCP?#

The Model Context Protocol (MCP) is an open standard for connecting AI applications to outside systems. An MCP server offers three kinds of things to an AI client:

• Tools: actions the AI can call, such as "get site info" or "create a draft post".
• Resources: data the AI can read as context, such as a log or a configuration.
• Prompts: ready-made templates for common workflows.

Claude Desktop, Claude Code, ChatGPT, Cursor and VS Code all act as MCP clients. Once a WordPress site runs an MCP server, any of them can discover what the site offers and use it.

How WordPress supports MCP: Abilities API + MCP Adapter#

WordPress builds MCP support in two layers.

1. The Abilities API (WordPress core, since 6.9). An ability is one thing a site can do, registered with a unique name, a typed input and output schema, a permission check and a function that does the work. Core, themes and plugins register abilities once, and they become discoverable from PHP, JavaScript and the REST API. WordPress 6.9 ships three core abilities: core/get-site-info, core/get-user-info and core/get-environment-info.

2. The MCP Adapter (official package). Part of the WordPress AI team's AI Building Blocks initiative, the adapter turns registered abilities into MCP tools and resources. When the adapter plugin is active it creates a default server named mcp-adapter-default-server with three tools that let an AI agent work in layers:

• discover abilities: what can this site do?
• get ability info: what input does this ability need?
• execute ability: run it.

Earlier community experiments, including Automattic's original wordpress-mcp plugin, have been superseded by this official adapter, so build on the adapter for anything new.

One rule to know straight away: abilities are not exposed to the default MCP server unless they are marked public for MCP (a meta.mcp.public flag in their registration). Plugins that support MCP set this for you. For the three core abilities, a few lines of code with the wp_register_ability_args filter switch it on. That opt-in design is a security feature: nothing is reachable by AI unless a developer chose it.

How to connect your WordPress site to Claude, Cursor or VS Code#

Step 1: Install the MCP Adapter#

Download the MCP Adapter plugin from the releases page of its GitHub repository (github.com/WordPress/mcp-adapter), upload it under Plugins > Add New > Upload Plugin, and activate it. Plugin developers can instead add it to their own plugin with Composer (composer require wordpress/mcp-adapter).

Step 2: Choose a transport#

• STDIO, for a local site. The AI app starts the server through WP-CLI on your computer. Simple and fast, but only for sites on your machine.
• HTTP, for a live site. The AI app talks to your site's MCP endpoint (/wp-json/mcp/mcp-adapter-default-server) through the @automattic/mcp-wordpress-remote proxy, which needs Node.js on your computer. It authenticates with a WordPress application password: create one under Users > Profile > Application Passwords.

Step 3: Add the server to your AI app#

In Claude Desktop, open Settings > Developer, click Edit config and add your server to the mcpServers object in claude_desktop_config.json. For a live site over HTTP, the entry looks like this:

{
  "mcpServers": {
    "my-wordpress-site": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://yoursite.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "ai-agent",
        "WP_API_PASSWORD": "your application password"
      }
    }
  }
}

For a local site over STDIO, the command is wp with these arguments: --path pointing to your WordPress folder, then mcp-adapter serve --server=mcp-adapter-default-server --user=your-username.

Restart Claude Desktop; the server should appear under Local MCP servers with a running status.

• Cursor: Settings > Cursor Settings > Tools and MCP > Add Custom MCP, same configuration.
• Claude Code: add the same mcpServers block to .mcp.json in your project, or to .claude.json in your home folder.
• VS Code: create .vscode/mcp.json and use a servers object instead of mcpServers, with the same content.

Step 4: Test it#

Ask: "Get the site info from my WordPress site." The AI should call discover, find core/get-site-info, execute it and answer with your site name, URL and settings. If it does, everything is wired up.

WordPress.com sites can connect AI agents without application passwords, through WordPress.com's own connector, which uses OAuth 2.1.

What can AI agents do on WordPress through MCP?#

Exactly what your installed abilities allow, and nothing more. Today that ranges from site and environment information (core) to content drafting, media handling and plugin-specific tasks as more plugins register abilities. Expect the list to grow quickly: every plugin that registers abilities with the MCP flag becomes something your AI can use.

WordPress MCP security: rules you should not skip#

An MCP client acts as a logged-in WordPress user. Treat it like giving someone a login:

• Create a dedicated user for AI access with the lowest role that does the job. Never connect as your main administrator on a production site.
• Use one application password per AI app, so you can revoke a single integration without touching the others.
• Start read-only. Expose reporting and diagnostic abilities first; add write abilities (publishing, deleting, changing settings) only when you trust the workflow.
• Check permission callbacks in custom abilities: each should require the minimum capability, never allow everyone for destructive actions.
• Prefer staging for experiments. Let an agent loose on a WordPress staging site before production.
• Keep an audit trail and watch the site. When an AI can change content and settings, you want to know what changed, when, and whether anything broke as a result.

The other kind of WordPress MCP: ask what changed#

The MCP Adapter lets AI act on your site. Most site owners also want the reverse: AI that can tell them about their site. What changed this week? Did last night's plugin updates break anything? Is the checkout button still there? Which pages lost their meta description?

WordPress itself cannot answer that, because it does not keep a history of how your pages looked and worked. A monitoring service can.

MyKavo runs an MCP server for exactly this. Connect it to ChatGPT or Claude and ask in plain English:

• "What changed on my site this week, most serious first?"
• "Did anything break after last night's WordPress updates?"
• "Show me the details of the critical change on the pricing page."
• "What are the worst issues in my latest site audit?"
• "Which AI crawlers visited my site this month?"

How it differs from the MCP Adapter:

• Read-only by design. Every MyKavo tool (workspace summary, websites, changes, change details, scans, site audit and AI crawler visits) only reads. An AI connected to MyKavo cannot change your site, so you can connect it without the risk assessment above.
• No application passwords. You sign in with OAuth, and you can disconnect an app at any time.
• History and proof. Answers come from MyKavo's baselines: before and after values, screenshots and the update that caused each change.

The MCP connection is part of the Pro and Agency plans, and new accounts can try Pro free for 14 days. The free MyKavo WordPress plugin shows the connection address right in wp-admin on those plans, next to everything else: Safe Updates after every plugin, theme and core update, the "did it crash?" check, one-click rollback and silent-disaster alerts.

Use both: the MCP Adapter so AI can do work on your site, and MyKavo so AI (and you) can see what that work, and every update, changed.

Summary#

WordPress MCP connects AI tools to your site through two official layers: the Abilities API in core since 6.9 and the MCP Adapter plugin that exposes public abilities as MCP tools. Install the adapter, pick STDIO for local sites or HTTP with an application password for live ones, add the server to Claude Desktop, Claude Code, Cursor or VS Code, and test with core/get-site-info. Connect as a dedicated low-privilege user, start read-only, and keep watching what changes. For questions about what changed and what broke, connect a monitoring MCP such as MyKavo alongside it.