Claude WP Bridge

A WordPress plugin that exposes your site as MCP tools accessible from Claude Code. Manage pages, theme files, and plugins directly from your terminal — no FTP, no wp-admin, no custom REST endpoints needed.

Designed to be the single plugin you need for Claude Code → WordPress integration. It replaces ad-hoc REST endpoint plugins by using the official WordPress Abilities API as the transport layer.

How it works

Claude Code (MCP client)
    ↕  @automattic/mcp-wordpress-remote  (STDIO → HTTP proxy)
WordPress MCP Adapter  (official plugin, already on your site)
    ↕  WordPress Abilities API  (WP 7.0+)
Claude WP Bridge  (this plugin — registers the actual tools)

Claude Code sees 3 fixed MCP tools from the adapter:

• mcp-adapter-discover-abilities — lists all available tools
• mcp-adapter-get-ability-info — schema for a specific tool
• mcp-adapter-execute-ability — runs any tool with parameters

This plugin registers 10 WordPress Abilities under the claude/ namespace, which the adapter exposes automatically.

Requirements

Installation

1. Install the official MCP Adapter

Install and activate the MCP Adapter plugin on your WordPress site. This is the transport layer — Claude WP Bridge won't work without it.

2. Install Claude WP Bridge

First install (bootstrap): The plugin can't install itself, so the first time must be manual. Two options:

• wp-admin: Go to Plugins → Add New → Upload Plugin, upload a ZIP of this repository, and activate.
• cPanel File Manager / FTP: Upload claude-wp-bridge.php to wp-content/plugins/claude-wp-bridge/claude-wp-bridge.php and activate from Plugins.

Updates: Once active, Claude can update the plugin itself using claude/upload-file to overwrite the PHP file. No deactivation needed — the new code loads on the next request.

3. Create an Application Password

1. Go to Users → Your Profile in wp-admin
2. Scroll to Application Passwords
3. Enter a name (e.g. Claude Code) and click Add New Application Password
4. Copy the generated password — you won't see it again

4. Configure Claude Code

Create or edit .claude/settings.json in your project:

{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": ["@automattic/mcp-wordpress-remote"],
      "env": {
        "WORDPRESS_USERNAME": "your-wp-username",
        "WORDPRESS_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx",
        "WORDPRESS_URL": "https://your-site.com"
      }
    }
  }
}

Note: Use the Application Password (spaces included), not your login password.

Install the proxy if needed:

npm install -g @automattic/mcp-wordpress-remote

5. Verify

Open Claude Code in your project directory and run:

What WordPress abilities are available?

Claude will call mcp-adapter-discover-abilities and list all registered tools.

Available tools

All tools are under the claude/ namespace and require admin-level authentication.

Example Claude Code session

You: What pages does my site have?
→ mcp-adapter-execute-ability("claude/list-pages", {"status": "publish"})

You: Show me the HTML of the Home page (ID 34)
→ mcp-adapter-execute-ability("claude/get-page", {"page_id": 34})

You: Add a newsletter section before the footer in the Home page
→ [Claude reads the page, modifies the HTML, calls update-page]
→ mcp-adapter-execute-ability("claude/update-page", {"page_id": 34, "content": "..."})

You: List the CSS files in my theme
→ mcp-adapter-execute-ability("claude/list-theme-files", {"ext": "css"})

You: Update style.css to change the primary color to #e63946
→ [Claude reads the file, edits it, writes it back]
→ mcp-adapter-execute-ability("claude/update-theme-file", {"path": "style.css", "content": "..."})

You: What plugins are installed and which ones are inactive?
→ mcp-adapter-execute-ability("claude/list-plugins", {"status": "any"})

You: Activate the contact-form-7 plugin
→ mcp-adapter-execute-ability("claude/manage-plugin", {"plugin": "contact-form-7/wp-contact-form-7.php", "action": "activate"})

You: Deploy my updated plugin file
→ mcp-adapter-execute-ability("claude/upload-file", {"path": "plugins/my-plugin/my-plugin.php", "content": "..."})

Security notes

• All abilities require manage_options or edit_pages capability — only admins can use them
• The update-page ability bypasses WordPress kses filtering by design, so raw HTML/CSS/JS is preserved. Only grant Application Passwords to trusted users.
• The upload-file ability is restricted to plugins/ and themes/ subdirectories — it cannot write outside wp-content/
• Path traversal (../) is stripped from all file path inputs

Compatibility

Tested with:

• WordPress 7.0
• MCP Adapter 0.5.0
• PHP 8.3

License

MIT