GoBuildWP: WordPress MCP server and AI website builder for Claude, ChatGPT, Cursor and Codex

Current releases: GoBuildWP Free 1.18.6 / Pro 1.12.4. Pro requires Free 1.18.1 or newer; that minimum is not the latest Free release.

GoBuildWP turns your WordPress site into an MCP server. Connect Claude, ChatGPT, Claude Code, Codex, Cursor or any other MCP client, and an AI agent can build and edit pages, Elementor layouts, Gutenberg blocks, menus, media and SEO metadata, check PageSpeed and security, and read your WooCommerce store, all through typed WordPress abilities that your user permissions, a safety profile and an undoable change ledger still govern. The free plugin in this repository is a complete WordPress MCP server and a free Elementor MCP server. GoBuildWP Pro adds WooCommerce writes, the other page builders, SEO suites, safe updates and backups. GoBuildWP Cloud is an optional hosted link for many sites.

GoBuildWP was previously called WPPilot. It is the same plugin, with the same slug and settings, and existing installs keep working.

Website: https://gobuildwp.com · Docs: https://gobuildwp.com/docs · Client setup guides: https://gobuildwp.com/wordpress-mcp · Release notes and build demos on X: https://x.com/gobuildwp

What GoBuildWP does

GoBuildWP is a self-hosted WordPress MCP server built on the WordPress Abilities API and the official WordPress MCP Adapter. AI clients discover, inspect and run typed WordPress abilities through a compact three-tool interface instead of loading hundreds of one-off endpoints into context.

It is a control layer, not an AI wrapper. No AI model is bundled: your MCP client brings its own model access, and policy is enforced on your own server. The free plugin needs no licence, key or account.

What an agent can do with the free plugin alone:

• Build and edit the site: posts and pages, Gutenberg block content, block-theme templates, template parts, global styles and patterns, menus and menu locations, the front page, media with alt text, a site-wide header, and taxonomies.
• Edit Elementor pages: read the element tree, then add, edit, move, duplicate, reorder and delete elements. This is a free Elementor MCP server, with no Pro install needed.
• Design to a system: typed design tokens, saved designs, and checks that grade a built page for contrast, composition and layout.
• Audit and fix: WCAG 2.2 accessibility audits, content audits for broken links, orphan pages and missing meta descriptions, search and replace with undo, and an Elementor editability score.
• Check site health: Google PageSpeed Insights with no Google key needed, configuration-security checks, a log of PHP fatal errors, and status from your backup and security plugins.
• Read WooCommerce, SEO and form plugins: store reads plus a single-product editor, per-post SEO title, description and robots in seven SEO plugins, and form entries with contact details redacted.
• Undo: every supported write is recorded and can be undone one change at a time, as a batch, or as a whole agent session.

You do not have to phrase prompts in a particular way. A client's first call is discovery. GoBuildWP answers with every ability registered on your install, plus a catalogue of the skills available for them, so "rebuild the pricing page and keep our spacing" already pulls in the right build skill, the element schemas and your design tokens.

GoBuildWP also ships a prompt library in wp-admin: ten complete landing-page briefs, one per industry. Each has its own palette, type pairing, design signature and content facts, so a bakery and a law firm do not come out as the same page. Pick Elementor or the block editor and the brief is written for it. GoBuildWP Pro adds 300 more industry briefs.

Example: editing an Elementor page from Claude Code

This is an illustration of the sequence an agent follows, not a recorded transcript. You type:

On the About page, change the hero heading to "Family law in Leeds since 1998" and point the hero button at /contact.

The agent then makes these calls on your site:

Both edits are checked against your WordPress capabilities and the active safety profile before they run. They appear on GoBuildWP → Changes, attributed to the agent that made them, and wppilot/undo-session (or Undo session on that screen) reverses them.

Real results: full pages built through GoBuildWP

Each page below was built from one plain-language request through the real MCP, in native Elementor, saved as a draft and checked on desktop and mobile. Nothing was edited by hand afterwards. Full pages and the exact requests: gobuildwp.com.

SaaS homepage (Lumora)	Car showroom (Noir Motor House)	Bakery (Hearth & Crumb)
250 Elementor elements, checked at 1440 and 390 px	130 elements, checked at 1920 to 390 px	295 elements, checked at 1920 to 390 px

Inside WordPress: every change an agent makes is listed with a way back, and each site shows what is connected.

Changes and undo	Connect your AI client	Dashboard

How it compares to other WordPress MCP servers

WordPress MCP servers differ most in what happens after an agent writes: who confirms a destructive call, whether a change can be undone, and whether the server runs on your own site or through someone else's relay. GoBuildWP runs on your site, can require a person rather than the model to confirm destructive calls, and verifies every undo against the recorded before-image instead of assuming it worked.

Best WordPress MCP servers · vs Respira · vs Easy MCP AI · vs EMCP · vs Elementor's MCP · vs WPVibe · vs Royal MCP · vs AI Engine · vs the WordPress MCP Adapter · Undo and rollback, compared

What the free plugin can do

232 registered abilities, plus one MCP prompt per skill you save. The WooCommerce, SEO, form, backup, security and Site Kit abilities register only while their plugin is active, and developer abilities only under Developer Full Access, so a fresh install with none of those plugins registers 167 on the default profile. Each ability can be switched off individually on the Abilities screen.

Content creation is draft-first: an absent, blank or malformed status resolves to draft before any capability check, so nothing is published by accident.

Quick setup

1. Install the plugin

1. Download gobuildwp.zip and upload it in Plugins → Add New → Upload Plugin. The folder inside the archive is wppilot/, so the plugin installs as wp-content/plugins/wppilot. That is its internal id, kept so existing installs update in place. GitHub's own "Source code (zip)" download is not installable: it has no vendor/ and uses a versioned folder name. Older versions are on the releases page.
2. Activate GoBuildWP.
3. Open GoBuildWP → Configuration and leave Production Safe selected.
4. Open GoBuildWP → Connect and choose your AI client. The screen generates the exact configuration for that client, with your site's URL and a suggested server name (gobuildwp-<your-site>) filled in.

The MCP endpoints:

https://example.com/wp-json/mcp/wppilot         # application passwords and access tokens
https://example.com/wp-json/mcp/wppilot-oauth   # OAuth clients

The older /wp-json/mcp/mcp-adapter-default-server route still resolves as a legacy alias, but new configurations should use the paths above.

2. Connect your AI client

Replace example.com with your site and gobuildwp-example with any name you like. Hosted web apps (Claude on the web, ChatGPT and the Codex desktop app) connect from their own servers, so the site must be reachable over public HTTPS.

Claude Code (WordPress MCP for Claude Code)

claude mcp add gobuildwp-example --transport http https://example.com/wp-json/mcp/wppilot-oauth

Then run /mcp inside Claude Code and complete the browser sign-in.

Claude on the web and Claude Desktop. On the web, open Customize → Connectors → Add custom connector. In Claude Desktop, open Settings → Connectors → Add custom connector. Paste https://example.com/wp-json/mcp/wppilot-oauth and sign in. The Connect screen also offers a .mcpb bundle for Claude Desktop.

ChatGPT (WordPress MCP for ChatGPT). Open Settings → Apps → Advanced settings → Developer mode, then Create app, and use the OAuth URL above. This needs ChatGPT on the web and a site on public HTTPS. To reach several sites from ChatGPT through one link, use GoBuildWP Cloud.

Codex CLI

codex mcp add gobuildwp-example --url https://example.com/wp-json/mcp/wppilot-oauth
codex mcp login gobuildwp-example

In the Codex desktop app, open Settings from your account menu, add the URL as a remote MCP server and approve the browser sign-in.

Cursor: use the one-click button on the Connect screen, or add this to ~/.cursor/mcp.json or .cursor/mcp.json:

{
  "mcpServers": {
    "gobuildwp-example": { "url": "https://example.com/wp-json/mcp/wppilot-oauth" }
  }
}

VS Code and GitHub Copilot: add this to .vscode/mcp.json (VS Code 1.101 or later). Copilot CLI reads mcpServers instead, and the Connect screen generates that file too.

{
  "servers": {
    "gobuildwp-example": { "type": "http", "url": "https://example.com/wp-json/mcp/wppilot-oauth" }
  }
}

Everything else. The Connect screen also writes configuration for Gemini CLI and Qwen Code (which want httpUrl), Antigravity and Devin Desktop, formerly Windsurf (which want serverUrl), Factory Droid, Zed, Cline, Roo Code, Kilo Code, Amazon Q, OpenCode, OpenClaw, Kimi Code CLI, ZCode (GLM), Mistral Le Chat, Perplexity and Manus. Which route each takes: docs/ai-client-compatibility.md. Per-client guides: https://gobuildwp.com/wordpress-mcp.

Scripts, cron and APIs. The Claude Messages API MCP connector, the OpenAI Responses API mcp tool, automation platforms and curl use an access token, Authorization: Bearer wpp_…, on the canonical /wp-json/mcp/wppilot endpoint.

Same machine, no credential (stdio). A client running on the same machine as the site can start the MCP server itself over WP-CLI, with the same abilities, safety profile and confirmations:

claude mcp add gobuildwp-local -- wp --path=/var/www/html wppilot mcp serve --user=admin

Cursor and other clients that take a command can run wp with the arguments --path=/var/www/html wppilot mcp serve --user=admin. The Connect screen shows these with your path and login filled in.

Authentication

Three methods, all chosen on GoBuildWP → Connect. None of them is a product licence.

• OAuth 2.1 with PKCE, recommended wherever the client can open a browser. Access tokens last 1 hour and refresh tokens 14 days, and every authorization is listed under Connected Apps so it can be revoked on its own. Client ID Metadata Documents are the preferred registration mechanism; RFC 7591 dynamic client registration remains as a fallback.
• Application Passwords, for clients that cannot run a browser flow. Sent as HTTP Basic.
• Access tokens for callers with no browser. Created with an optional expiry, shown once, stored only as a SHA-256 digest and revocable per token. A token borrows the capabilities of the user who created it, re-checked on every request, so demoting or deleting that user closes the token immediately.

MCP protocol support

GoBuildWP serves both protocol revisions during the migration window: the stateless 2026-07-28 revision (no initialize and no session; each request carries its version and client capabilities in _meta) and the legacy 2025-11-25 revision through the bundled MCP Adapter. Existing clients do not need to reconnect. server/discover advertises both. MCP Tasks shipped in Free 1.15.0 on the modern transport; it is on by default and can be disabled with the wppilot_mcp_tasks_enabled filter; cancelling a task does not undo writes it already completed. Full detail: docs/wordpress-mcp.md.

Free vs Pro vs Cloud

Free is this repository. Pro is a separate paid plugin that runs on top of Free (Free 1.18.1 or newer, and an active licence or trial). Cloud is an optional hosted gateway: every tool a site offers (Free, plus Pro where it is installed) is reachable through it, so the Cloud column lists only what Cloud itself adds. A dash means that edition adds nothing for that row.

Compare Free vs Pro · Pricing · All integrations

Elementor MCP: free Elementor editing

Editing an Elementor page is free. The Elementor abilities load automatically when Elementor 3.6 or newer is active and stay unregistered otherwise, so an agent is never offered a tool that cannot work on this site. Elementor Pro is not required.

Writing generated HTML into post_content does not change an Elementor page. The layout lives in postmeta as a typed element tree, and Elementor renders from that. These abilities work on the tree itself, and GoBuildWP refuses a post_content write to an Elementor page by name rather than reporting a success that changes nothing.

Both element models are supported: Elementor v4 atomic elements (e-div-block, e-heading, e-paragraph, e-button, e-image and the rest) and classic v3 widgets and containers. The free plugin also includes wppilot/elementor-audit-atomic-readiness, which reports how much of the site uses v4 atomic elements, and wppilot/elementor-audit-output, which scores how editable a page is. Full detail: docs/elementor-mcp.md.

What Pro adds on top. Composition: elementor-build-page builds a whole page from one compact description, and elementor-compile-spec and elementor-build-from-spec turn a reproduction spec into global classes and a matching tree. Reuse: templates, theme parts and display conditions, popups, global classes, v4 variables, and v3 global colours and typography. Content: Elementor Pro forms and submissions, dynamic tags, interactions and site-wide custom code. Free can edit an Elementor page; Pro can compose one. MCP for Elementor

WooCommerce MCP

Free: 13 WooCommerce abilities, on WooCommerce 9.0 or newer. An agent can check the store setup, list and read products, variations, categories, tags and store settings, read orders and customers (these two also need manage_woocommerce), and edit one product's name, description, prices and stock. The edit saves through WooCommerce, so its lookup tables and caches follow, and it can be undone from the Changes screen.

Pro adds 50 more: creating and deleting products, full product editing (SKU, categories, images, attributes), variable products, bulk prices and stock, order and customer writes, refunds, coupons, store settings, and sales and product-performance reports for a date range.

Every call is capability-checked against the connected WordPress user, so an agent connected as a shop manager cannot do what that account could not do by hand. Order status changes and anything touching money are classed destructive, so they need explicit confirmation and are recorded in the change ledger. Full detail: docs/woocommerce-mcp.md · MCP for WooCommerce

Gutenberg MCP and block themes

Block editing is in the free plugin. An agent can read and write block-editor content, and stage changes as a pending batch. Core blocks are validated and serialised by the block editor's own JavaScript, so staged batches are finalised in a browser tab through the Block Editor Queue rather than written blind. The plugin says so instead of failing silently.

On a block theme, the free block themes abilities edit Global Styles, templates and template parts (header, footer), the site's own patterns and block navigation menus through WordPress's own REST controllers, and every change can be undone. Block Notes let an agent leave a note on a block for a person and read the ones they resolved. Pro adds modules for GenerateBlocks, Kadence Blocks, Spectra and Spectra One. MCP for Gutenberg

Page builder MCP servers: Bricks, Divi, Beaver Builder, Oxygen, Breakdance, WPBakery, Etch and Mosaic

One endpoint covers every builder below, and each builder registers only when it is installed. A page builder does not store a page as HTML: it stores an element tree, references to shared classes and design tokens, template rules and dynamic bindings. Writing generated markup into that store is how a layout stops opening in its own editor, so GoBuildWP gives the agent each builder's own vocabulary instead.

• Bricks MCP: patches the Bricks element tree in place with bricks-patch-elements, so a change to one section does not rewrite the page around it.
• Divi MCP: works with Divi modules and global presets (divi-apply-global-preset) rather than flattening a layout into shortcodes.
• Beaver Builder MCP: Beaver Builder keeps its layout in postmeta (_fl_builder_data), so HTML in post_content changes nothing a visitor sees. Pro reads and writes that store; Free recognises the builder and refuses the write.
• Oxygen MCP: Oxygen renders from a JSON element tree in postmeta and ignores post_content. Pro works against that tree.
• WPBakery MCP: WPBakery keeps its layout in post_content as nested shortcodes. Pro parses and edits those shortcodes instead of replacing the markup around them.
• Breakdance, Etch and Mosaic MCP: each exposes its own element model. Etch has the largest surface of any builder in Pro.

Where each builder keeps its layout, and what that means for an agent: docs/page-builder-mcp.md.

WordPress SEO with an AI agent

• Free: read and set one post's SEO title, meta description and robots in Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework, Slim SEO and SmartCrawl. Each write goes through the plugin's own storage the way its editor does, and can be undone. Where a plugin cannot store something (Slim SEO has no follow flag; SEOPress has no per-post "force index"), the ability says so. The free content audit finds broken internal links, orphan pages, thin content, missing meta descriptions and structured-data problems across the site.
• Pro: focus keywords, canonicals, social previews, schema, redirects and bulk SEO. wppilot/content-fix-plan turns audit findings into reviewable fixes (link retargets, redirects, related links for orphans, drafted meta descriptions), and wppilot/content-fix-apply applies only the items you choose, each as its own undoable change.
• Cloud with Pro: a Search Console report per site (clicks, impressions, click rate and position for top pages and queries), read through each site's own Site Kit by Google.

WordPress AI SEO automation

PageSpeed and site performance

• Free: wppilot/pagespeed-check runs Google PageSpeed Insights on any page of the site, mobile, desktop or both, and returns Lighthouse scores for performance, SEO, accessibility and best practices, lab metrics, Core Web Vitals field data and the opportunities that save the most time. No Google key is needed: Site Kit by Google answers when it can, GoBuildWP Cloud's proxy otherwise, and a key of your own is optional. Diagnostics include scoped performance checks.
• Pro: abilities for caching and optimization plugins (purge, read and change settings, warm and measure pages) and a PageSpeed fix loop: wppilot/pagespeed-fix-plan names the one cache setting that addresses the largest opportunity it can, and wppilot/pagespeed-fix-step applies that one setting with confirmation, purges, re-runs PageSpeed, and rolls the change back in the same call if the score dropped or something broke.

WordPress AI speed optimization

WordPress security checks

• Free: configuration-security checks in Diagnostics, and read-only status from Wordfence and Solid Security: firewall mode, scan schedule and results, open findings by severity, and lockouts. IP addresses are reduced to their network, other people's logins are masked, and licence keys and secrets are never read. The site issues log records the PHP fatal errors behind "There has been a critical error on this website", with the plugin or theme they came from.
• Pro: wppilot/security-harden-plan proposes a hardening profile as current → proposed changes with reasons; wppilot/security-apply-settings applies it with confirmation, reads each setting back, runs checks before and after, and rolls everything back if a check regresses. Pro can also block and unblock IPs and start a scan.

Safe updates and backups

• Free: activate, deactivate and update plugins and themes with explicit confirmation. Activation, deactivation and theme switches can be rolled back; updates are recorded as not reversible, with how to undo them manually. Backup status and history come from UpdraftPlus, Duplicator, BackWPup and All-in-One WP Migration, with no archive paths, download links or storage credentials returned.
• Pro: wppilot/safe-update updates one plugin or theme at a time: it requires a recent successful backup (24 hours by default), zips a rollback copy, checks the site's pages before and after, and rolls back automatically when a page breaks. A safe update can be undone for 7 days. wppilot/backup-trigger starts a backup in UpdraftPlus, BackWPup or All-in-One WP Migration (Duplicator is read only). An optional setting refuses destructive or critical calls until a fresh backup exists.
• Limits: GoBuildWP does not store backups or restore them. Starting a backup queues it in your backup plugin; it does not prove the backup completed or that it can be restored.