WP Manifestindependent plugin directory
manifest / ai / mcp-for-wordpress

MCP for WP, Elementor and more by Tropk.ai WP Registry grade A-. Low-severity findings · 2 findingsWP RegistryLow-severity findings · 2 findingsOpen the reportA-

Connect WordPress to Claude.ai, Lovable, Cursor, Windsurf. 500+ pre-built tools across content, Elementor, Rank Math SEO, ACF, WooCommerce and ops. OAuth 2.1 with dynamic client registration — no API keys, no headers, one-click connect.

★ 33stars
46release downloads
≈10active sites
v0.5.5latest · 3mo ago

Install

Download mcpforwordpress0.5.5.zip From the v0.5.5 release on GitHub, Jul 22, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tropk-ai/mcp-for-wordpress/releases/download/v0.5.5/mcpforwordpress0.5.5.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Wordpress MCP by Tropk.ai

Turn any WordPress site into a Model Context Protocol (MCP) server for Claude.ai, ChatGPT, Cursor, Windsurf, mcp-inspector and other AI assistants. Built on the official WordPress 6.9 Abilities API. 500+ tools out of the box.

What it does

  • Single endpoint at /wp-json/webinhood-mcp/v1/mcp
  • Full OAuth 2.1 (Dynamic Client Registration, PKCE S256, refresh-token rotation, revocation) — no API keys, no Authorization headers
  • 500+ abilities across: Posts / Pages / CPTs, Elementor, Rank Math, ACF, WooCommerce, Internal Link Juicer, Gutenberg/FSE, cache, cron, security, roles, media
  • Visual onboarding wizard — pick the AI assistant, paste a URL, click "test"
  • Audit log + per-post snapshots before any destructive write
  • Confused-deputy guard, Origin allowlist, three-bucket rate limiter, atomic-widget safety

Install

  1. Download the latest release zip
  2. WP Admin → Plugins → Add New → Upload Plugin → choose the zip → Install Now → Activate
  3. The wizard opens automatically — follow the 3 steps

Requirements: WordPress 6.9+, PHP 8.1+.

Connecting

The wizard walks you through it. The short version:

  • In Claude.ai or ChatGPT, open Settings → Connectors → Add custom connector
  • Paste https://YOUR-SITE/wp-json/webinhood-mcp/v1/mcp
  • Click "Link", sign in to WordPress, click "Allow"

That's it. OAuth handles the rest.

Licensing

The plugin's source code is GPL-3.0-or-later. You can use, modify, redistribute and (per GPL) commercially exploit the code, provided derivative works stay GPL.

The name "Wordpress MCP by Tropk.ai" and the Tropk.ai brand marks are trademarks of Tropk.ai. Forks/derivatives must rename — please don't ship a clone under our brand.

Bundled third-party packages retain their own licenses:

Package License
wordpress/abilities-api GPL-2.0-or-later
wordpress/mcp-adapter GPL-2.0-or-later
wordpress/php-mcp-schema GPL-2.0-or-later
msrbuilds/elementor-mcp (vendored) GPL-3.0-or-later
bjornfix/* (vendored) GPL-2.0-or-later
angie/acf (vendored) GPL-3.0-or-later
automattic/jetpack-autoloader GPL-2.0-or-later

Contributing

Issues + PRs welcome at https://github.com/tropk-ai/wordpress-mcp. If you fork, please open an issue first so we can avoid duplicate work.

Credits

See CREDITS.md for the vendored sources and their authors.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.5.5 latest
Jul 22, 2026 3mo ago
mcpforwordpress0.5.5.zip
34
Jun 27, 2026 4mo ago
mcpforwordpress0.5.4.zip
12

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

A- grade

Security

MCP for WP, Elementor and more by Tropk.ai 0.5.5 · audited by WP Registry

Low-severity findings only.

2 low
Audited release
0.5.5
Findings
2
Worst severity
low
Content hash
6bb6a21156ec2f0db95cf6aa…

Findings

  • low Public /diagnostic exposes PHP/server and ability inventory

    information_disclosure

    GET tropk-mcp/v1/diagnostic uses permission_callback __return_true and returns php_version, SERVER_SOFTWARE, WP version, ability/tool registration status, CORS allowed_origins, and OAuth route map. Useful recon / unnecessary production diagnostic surface (dev_tool style).

    src/Diagnostics/DiagnosticEndpoint.php:27-110

  • low Public /whoami echoes cookie user email/login/roles

    information_disclosure

    GET tropk-mcp/v1/whoami is __return_true and returns user_login, user_email, roles, and capability flags for get_current_user_id(). Any request that carries WP auth cookies (same-origin or credentialed CORS) discloses account PII without an explicit capability gate.

    src/Diagnostics/DiagnosticEndpoint.php:36-65

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.