WP Manifestindependent plugin directory
manifest / ai / wp-mcp-ultimate

WP MCP Ultimate WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA #7 in AI

WordPress MCP Ultimate — Full MCP server with 58 WordPress abilities. Connect WordPress to any AI via Model Context Protocol.

★ 169stars
712release downloads
≈60active sites
v1.1.0latest · 7mo ago

Install

Download wp-mcp-ultimate-1.1.0.zip From the v1.1.0 release on GitHub, Mar 28, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/agricidaniel/wp-mcp-ultimate/releases/download/v1.1.0/wp-mcp-ultimate-1.1.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WP MCP Ultimate

Blog: Full setup guide and demo

Connect WordPress to AI in one click. A self-contained MCP (Model Context Protocol) server plugin with 58 WordPress abilities -- manage posts, pages, media, users, plugins, menus, comments, and more through any MCP-compatible AI client. No other plugins needed.

Quick Start

  1. Install the plugin: Upload the zip file via Plugins > Add New > Upload Plugin, or clone this repository into wp-content/plugins/.
  2. Generate an API key: Go to Tools > MCP Ultimate in your WordPress admin and click Generate to create an Application Password.
  3. Configure your AI client: Copy the MCP server config snippet shown on the dashboard into your AI client's configuration file.

Authentication: Application Passwords work everywhere. For clients that require OAuth (Claude Web custom connectors, Claude Mobile), the plugin also bundles an OAuth 2.1 authorization server with PKCE and dynamic client registration -- point the connector at the MCP endpoint and it discovers everything automatically. See the Setup Guide. By default, reaching the MCP endpoint requires the edit_posts capability (filterable), and plugin installs no longer auto-activate; both are covered in SECURITY.md.

Features

  • 58 WordPress abilities covering content, media, users, plugins, menus, widgets, comments, options, and system management
  • MCP protocol v2025-06-18 compliance
  • Streamable HTTP transport
  • Application Password auth and a bundled OAuth 2.1 server (PKCE + dynamic client registration) for Claude Web/Mobile connectors
  • Admin dashboard with API key management, one-click generation, and connection testing
  • Config export snippets for Claude Code, Claude Desktop, and Cursor
  • Conflict detection for legacy plugins (MCP Adapter, MCP Expose Abilities, Abilities API)
  • Abilities API polyfill for WordPress < 6.9

Requirements

  • PHP 8.0 or higher
  • WordPress 6.7 or higher

Documentation

  • Setup Guide -- Detailed installation and configuration instructions
  • Abilities Reference -- Complete list of all 58 abilities with descriptions and required capabilities

Credit

Built on work from the WordPress AI team, MCP Adapter, and MCP Expose Abilities plugins.

Contributing

PRs welcome. Please open an issue first to discuss.

License

GPL-2.0-or-later. See LICENSE for the full text.


Author

Built by Agrici Daniel - AI Workflow Architect.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.0 latest
Mar 28, 2026 7mo ago
wp-mcp-ultimate-1.1.0.zip
657
Feb 28, 2026 8mo ago
wp-mcp-ultimate.zip
55

Active-site estimate ≈60 comes from the median of recent superseded releases. Method.

A grade

Security

WP MCP Ultimate 2.0.0 · audited by WP Registry

No security issues found.

Audited release
2.0.0
Findings
none
Worst severity
—
Content hash
4e6358cb1db746bf16b36a9d…

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.