WP MCP Plugin

A WordPress plugin that exposes a Model Context Protocol (MCP) server on your site, allowing AI agents to connect and interact with your content through the REST API.

Features

• Streamable HTTP transport — agents connect directly via your site URL
• Automatic route discovery — all REST API routes become MCP tools (posts, pages, media, users, WooCommerce, ACF, custom post types, etc.)
• OAuth 2.1 authentication — MCP clients authenticate automatically via browser login and consent (PKCE, no tokens to manage)
• Basic Auth support — also supports Application Passwords for clients that don't support OAuth
• Settings page — generate auth tokens and copy-ready config snippets in one click
• Endpoint filtering — allowlist/blocklist endpoints by category (Post Types, Taxonomies, Core, Plugin) or use Compact Mode
• Description control — per-category verbose/minimal tool descriptions to optimize token usage
• ACF support — detects Advanced Custom Fields and adds ACF parameters to writable routes
• Media uploads — supports base64 file uploads via MCP
• Zero configuration — activate and connect

Installation

1. Download the latest release
2. Upload the zip via Plugins > Add New > Upload Plugin (or extract to /wp-content/plugins/)
3. Activate the plugin through the Plugins menu
4. Go to Settings > MCP
5. Copy the config snippet for your MCP client

Client Configuration

The MCP endpoint is at:

https://your-site.com/wp-json/mcp/v1

OAuth 2.1 (Recommended)

MCP clients that support OAuth will authenticate automatically — they open your browser, you log in to WordPress and approve the connection. No tokens to copy or manage.

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "wordpress": {
      "url": "https://your-site.com/wp-json/mcp/v1"
    }
  }
}

Claude Code / Cursor

Add to .mcp.json:

{
  "mcpServers": {
    "wordpress": {
      "type": "streamable-http",
      "url": "https://your-site.com/wp-json/mcp/v1"
    }
  }
}

Basic Auth (Legacy)

For clients that don't support OAuth, you can use Application Passwords directly.

1. Go to Settings > MCP
2. Select a user and click Generate Connection
3. Copy the config snippet with the embedded auth token

Claude Desktop

{
  "mcpServers": {
    "wordpress": {
      "url": "https://your-site.com/wp-json/mcp/v1",
      "headers": {
        "Authorization": "Basic YOUR_TOKEN"
      }
    }
  }
}

Claude Code / Cursor

{
  "mcpServers": {
    "wordpress": {
      "type": "streamable-http",
      "url": "https://your-site.com/wp-json/mcp/v1",
      "headers": {
        "Authorization": "Basic YOUR_TOKEN"
      }
    }
  }
}

Use the Settings > MCP page to generate YOUR_TOKEN automatically. The token is shown only once — generate a new one if you lose it.

Settings

All settings are under Settings > MCP > Settings tab.

Endpoint Filtering

Control which REST API endpoints are exposed as MCP tools. Four modes are available:

In Allowlist and Blocklist modes, endpoints are grouped by category:

• Post Types — routes for registered post types (posts, pages, custom post types)
• Taxonomies — routes for registered taxonomies (categories, tags, custom taxonomies)
• Core — other /wp/v2/* routes (users, comments, settings, search, etc.)
• Plugin — non-core namespaces (/wc/v3/*, /acf/v3/*, etc.)

Each category has:

• A group checkbox to select/deselect all endpoints in the category
• An "Include new items" toggle — automatically includes newly discovered endpoints in that category (e.g. after installing a plugin or registering a custom post type)

Tool Descriptions

Control which tools get verbose descriptions vs minimal one-liners. Minimizing descriptions reduces token usage on every tools/list call.

The Allowlist and Blocklist modes use the same category-based grouping as endpoint filtering, with per-category "Include new items" toggles.

When switching to Allowlist mode for the first time, Post Types and Taxonomies are pre-selected as verbose, while Core and Plugin default to minimal.

How It Works

1. The plugin registers a REST API endpoint at /wp-json/mcp/v1
2. MCP clients discover OAuth metadata via /.well-known/oauth-protected-resource and authenticate through your WordPress login
3. When connected, the client discovers all registered WordPress REST routes
4. Each route becomes an MCP tool with its parameters derived from the endpoint schema
5. Tool calls are executed as internal REST API requests (no HTTP overhead)
6. The authenticated user's permissions apply to all operations

Tool Naming

Routes are converted to underscore-separated tool names:

Every tool accepts a method parameter to specify the HTTP verb (GET, POST, PUT, PATCH, DELETE).

Requirements

• WordPress 6.0+
• PHP 7.4+
• HTTPS recommended (required for Application Passwords on most setups)

License

PolyForm Strict License 1.0.0