Zavino

Turn your WordPress site into an MCP server, and let Claude actually run it.

Connect Claude Code, Claude Desktop, Cursor or any MCP client to your site and change it by asking — write articles, build Elementor pages, fix SEO, tidy Persian typography. Every change is logged, previewable, and reversible.

English · فارسی

What this is

Most "AI for WordPress" plugins generate text and paste it into an editor. Zavino does something different: it exposes your site as a Model Context Protocol server, so an AI client connects directly to the site and operates it through a real tool API — reading what is there, making changes, and verifying the result.

claude mcp add --transport http mysite https://example.com/wp-json/zavino/v1/mcp

Then, in Claude Code:

Read the three most recent posts, write a fourth in the same voice about X, give it a proper meta description, add it to the main menu, and leave it as a draft.

Zavino is the layer that makes that safe to say to a production site.

Why it exists

There are several WordPress MCP plugins now. They fall into two groups, and both leave the same gaps.

Zavino takes the position that these are not a trade-off. You can have the power tools and run on production, if every write is snapshotted first and a bad edit rolls itself back.

The four things that make it different

1. Elementor generation that actually works

Asking a model to emit raw Elementor JSON fails reliably, for a specific reason: it invents widgetType values. A widget type Elementor does not recognise renders as an empty box — no error, no warning, nothing in the log. The page just comes out wrong and nobody knows why.

Zavino solves this by reading Elementor's live widget registry on your site — core, Pro, and every addon pack you have installed — and exposing it as a tool, with each widget's accepted settings and their allowed values:

{
  "type": "eael-fancy-text",         // Essential Addons — only exists if you have it
  "title": "Fancy Text",
  "settings": [
    { "key": "eael_fancy_text_strings", "type": "repeater",
      "row_fields": [ { "key": "eael_fancy_text_string_content", "type": "text" } ] },
    { "key": "eael_fancy_text_effect", "type": "select",
      "accepts": ["typing", "slide-down", "zoom-in"] }   // ← the real options
  ]
}

The agent builds from that vocabulary instead of guessing. Anything it still asks for that does not exist is rejected with an explanation, rather than silently producing a blank section.

Elements are addressed by stable paths (1.0.2 = third widget, first column, second section), so an edit can target one heading without rewriting — and losing the styling of — the whole page.

2. Power tools you can run on production

Developer Mode gives an agent PHP execution, WP-CLI and file editing. What makes that survivable:

• Snapshot before every write. Posts, meta, options, taxonomy terms and files are captured first.
• dry_run on every destructive tool. Returns the diff, writes nothing.
• Automatic rollback. After a file write, Zavino loads your home page. If it now returns a 5xx, the file is restored from its backup and the agent is told. A PHP fatal error normally takes down wp-admin too — meaning the undo button is behind the very error it would fix. This closes that.
• PHP is syntax-checked before it reaches disk, not after the site is down.
• Refused outright: wp-config.php, .htaccess, db drop, site empty, core update, search-replace. Not because they are scary, but because nothing here can undo them.
• Off by default, behind a switch and a separate confirmation.

Every tool call — successful or not, by any agent, at any hour — lands in an audit log with a one-click Revert.

3. Genuinely bilingual, not just translated

The admin UI is in English and Persian with a real RTL stylesheet. More usefully, the tool descriptions themselves are bilingual — the text the model reads, which is what actually shapes output quality.

And there are Persian tools nothing else has:

zavino_fix_persian_text repairs all of it — on one post, or across everything after an import. HTML, shortcodes and URLs are left untouched.

4. A connection that actually connects

Search the WordPress support forums for any MCP plugin and you find the same thread over and over: "Couldn't reach the MCP server." The causes are environmental and invisible from the client — a stripped Authorization header, a security plugin blocking REST, a .well-known directory the web server handles itself.

The Connect screen runs ten checks from inside WordPress and tells you exactly which one is wrong and what to paste where:

✓ HTTPS                  The site is served over HTTPS.
✓ REST API               Reachable.
✗ Authorization header   Your server is stripping the Authorization header before
                         PHP sees it, so every agent will be rejected. Common on
                         Apache with CGI/FastCGI. Add this to .htaccess:

                           RewriteCond %{HTTP:Authorization} ^(.*)
                           RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

⚠ Install location       WordPress is in a subdirectory, so OAuth discovery may be
                         unreliable here. An API key works regardless.

Installing

Requirements: WordPress 6.4+, PHP 7.4+, HTTPS (except on localhost). No Composer, no build step, no external service.

1. Download the latest ZIP from Releases.
2. Plugins → Add New → Upload Plugin.
3. Activate, then open Zavino → Connect.
4. Fix anything the readiness checks flag.
5. Copy the command for your client.

Connecting a client

claude mcp add --transport http mysite https://example.com/wp-json/zavino/v1/mcp

{ "mcpServers": { "mysite": { "type": "http",
  "url": "https://example.com/wp-json/zavino/v1/mcp" } } }

Three ways to authenticate, in order of preference:

1. OAuth 2.1 — full authorization-code flow with PKCE, dynamic client registration, refresh-token rotation and resource-indicator audience binding (RFC 9728 / 8414 / 8707 / 9207). You approve each connection on a consent screen and can revoke it individually.
2. API key — a bearer token you create yourself, with per-key scopes. Works where OAuth discovery cannot, such as a subdirectory install.
3. Application password — WordPress's own credential. Simplest, but it carries the full authority of the account with no per-connection scoping.

Only users with manage_options can connect. This is not configurable, on purpose.

Safety model

Every tool call passes through the same fixed pipeline. Nothing opts out of it:

resolve tool → guard → validate arguments → snapshot → run → audit
                 │
                 ├── server enabled?
                 ├── tool switched on by the administrator?
                 ├── Developer Mode confirmed (if required)?
                 ├── does the credential carry the scope?
                 ├── does the WordPress user hold the capability?
                 ├── read-only mode?
                 └── within the rate limit?

Permissions are seven coarse scopes an administrator can reason about, not a hundred checkboxes nobody reads:

wp:read · wp:content · wp:media · wp:builder · wp:commerce · wp:site · wp:dev

The consent screen shows what each one means in plain language, and unticking one genuinely narrows the token.

Three levels of caution, escalating:

Chatting inside WordPress

Zavino → Chat runs the same agent loop against the same tools, without an external client. It uses your own Anthropic API key (claude-opus-5 by default) — usage bills to your account and nothing is proxied through a third party.

You do not need a key to use Zavino from Claude Code or Claude Desktop; those use your existing Claude subscription over MCP. The key is only for the in-dashboard chat.

Store it in wp-config.php to keep it out of the database entirely:

define( 'ZAVINO_ANTHROPIC_API_KEY', 'sk-ant-...' );

Instructions

House rules, written once, followed by every agent — Claude Code, the chat screen and scheduled tasks alike:

• Write in the second person. Address the reader as "you".
• Every article needs a featured image. If there is none, ask before publishing.
• Never state a statistic without a source. If you need one and do not have it, ask.

Injected at handshake time, so the agent has them before it starts rather than being corrected afterwards.

Automation

Saved prompts on a schedule — publish an article each morning, audit SEO weekly, tidy Persian typography after an import. Runs go through the same permission checks, logging and undo as anything you ask for by hand, with a step limit per run and automatic pausing after repeated failures.

Scheduling rides WP-Cron, which fires on page views — so on a quiet site tasks run late. The admin screen says so rather than pretending otherwise; use a real system cron if you need punctuality.

What ships today

Plus MCP resources (zavino://site/overview, zavino://elementor/widgets, zavino://site/content-map) and prompts (write an article, build a landing page, audit the site, fix SEO, translate content) — which most WordPress MCP plugins skip entirely.

Not shipped yet

Honest about the gaps. These are designed and hooked but not written:

• WooCommerce — products, orders, coupons, bulk pricing
• SEO — the SeoBridge for Yoast / Rank Math / SEOPress / AIOSEO exists and is wired into zavino_get_post, but the dedicated write tools are not built
• Block editor — parse/serialise tools for Gutenberg and FSE
• Multilingual — WPML / Polylang translation linking

Third-party code can register tool groups via the zavino_load_tool_groups action without patching the plugin.