WordPress MCP: What It Is and How to Set It Up (2026)

The short answer: every WordPress.com site, free sites included, has MCP built in; a self-hosted site gets it through Jetpack with no plan requirement, through the MCP Adapter for desktop and CLI apps, or through a self-contained MCP plugin such as Easy MCP AI or a hosted relay such as WPVibe, and the Jetpack, Easy MCP AI and WPVibe routes all connect claude.ai and ChatGPT in the browser.

What WordPress MCP is, in plain terms 🔌

MCP (Model Context Protocol) is an open-source standard for connecting AI applications to external systems. In MCP terms, your AI app is the host, a connector inside it is the client, and a server exposes what a system can do as resources (data), prompts (templates) and tools, which are functions the AI model can execute.

WordPress MCP is a WordPress site acting as one of those servers. The tools are WordPress actions: list posts, create a draft, moderate a comment. WordPress’s own registry for this is the Abilities API (WordPress 6.9+): a standardized way to register and discover units of functionality with defined inputs, outputs and permissions.

WordPress’s own AI Client works the other way round: your site calls an AI provider. And “why not just use the REST API”? MCP hands the AI a typed, discoverable tool list with your login attached, so you don’t write the client; for a developer setup, see WPShout’s Cursor guide.

What changed in 2026, and which tutorials are now out of date 🗓️

Much of what ranks for this term predates this year’s moves. Five facts to calibrate against:

• The specification moved. The current MCP revision is 2026-07-28; WordPress’s MCP Adapter speaks exactly 2025-11-25 and 2026-07-28.
• The original plugin is archived. The Automattic “WordPress MCP” repository was archived on September 17, 2026 and is read-only; its README says it is no longer maintained and not the recommended way to add MCP support. The npm helper @automattic/mcp-wordpress-remote is a different package, still actively published (0.5.4, October 20, 2026), and the Adapter’s own guide uses it for desktop clients.
• The official route is now a normal plugin. The MCP Adapter has been on WordPress.org since early October 2026: version 0.7.1, 50,000+ active installs (installs may include dependency installs: plugin developers are told to require it), WordPress 6.9+ required.
• WordPress.com grew write access and self-hosted support. Its MCP server now has read and write tool groups, works on every WordPress.com site including free ones, and self-hosted sites connected through Jetpack use the same server with no Jetpack plan required.
• Old tutorials recommend dead software. A tutorial that still ranks on the first page for “wordpress mcp” walks readers through installing the archived Automattic repo. Before you follow a tutorial’s steps, check that it installs the MCP Adapter or a maintained plugin rather than the archived repo; a recent date alone does not prove that.

The routes to WordPress MCP 🛣️

Every route ends the same way: an AI app calling tools against your site, and the table below gives the Jetpack variant of the WordPress.com route its own row. Other MCP plugins exist beyond these routes.

Routes compared from each provider’s own documentation; the two on-site plugin routes were also connected to a WordPress site and prompted, and the table below gives every route in text.

WordPress.com’s MCP server

The zero-install route: one OAuth connection from your AI app reaches every site on your WordPress.com account. The catch: the access setting is account-wide, covering every site and every connected agent at once. WordPress.com’s Claude guide says writes need your confirmation before Claude runs them, but deleted media, categories and tags are permanent.

Self-hosted sites through Jetpack

The same WordPress.com server, reached through the WordPress.com account a Jetpack-connected site is linked to. MCP access is off by default and switched on under Jetpack > Jetpack AI; the site then gets the same tool catalog as a hosted site. The same account-wide setting and permanent-delete rules apply.

The MCP Adapter

WordPress’s own adapter plugin, part of the AI Building Blocks initiative: free GPL, WordPress 6.9 or newer. It is strictly the server and transport layer, adds no AI features and no wp-admin screens, and an ability is reachable over MCP only if it has been marked public; permission checks still run against the current user before anything executes.

Sign-in is a username and an Application Password over HTTPS; most desktop clients also need Node.js on your computer for the npx helper. Browser apps are the exception: per the Adapter’s own guide, the web versions of Claude and ChatGPT add connectors through an OAuth sign-in with no field for an Application Password, and WordPress includes no OAuth server, so they cannot connect on their own today; Claude’s request-header option was not tested here. On a stock WordPress 7.1.3 install, the reachable list held exactly three read-only core abilities (site info, user info, environment info); everything else arrives through plugins that register and publish abilities.

Easy MCP AI

Easy MCP AI is built by Themeisle, the team behind WPShout. The Easy MCP AI plugin is free and self-contained (30,000+ active installs): the MCP server runs in PHP on your own site (PHP 7.4+), with no hosted relay and no account to create. It runs its own MCP server and turns the WordPress abilities you enable (WordPress 6.9+) into MCP tools; it does not use the MCP Adapter, and its 280+ built-in tools work from WordPress 6.0. What a given site exposes is smaller than that: most core tools are on by default, a set of riskier ones start off, and the WooCommerce, SEO plugin and analytics integrations appear only when an admin enables and connects them; the page layout tools for Elementor, WPBakery and Flatsome load on their own when one of those builders is active.

Claude and ChatGPT are both documented clients; adding a custom MCP server in ChatGPT depends on your plan and workspace settings. Optional data providers (Semrush, SE Ranking, DataForSEO) bill their own accounts. The trade-off: a write credential is real power, and approvals for destructive actions stay off until you switch them on.

Hosted relays: WPVibe

WPVibe (by SeedProd) takes the opposite architectural bet: the MCP server is a hosted Cloudflare Worker that relays calls to your site’s REST API, where WordPress itself (or the optional free WPVibe plugin, for deeper operations) executes them as the WordPress user you authorized. Sign-in is a WordPress Application Password approved on WordPress’s own screen, stored encrypted (AES-256-GCM) on WPVibe’s servers. The catch: a third party sits in the path, and WPVibe’s security page states it directly: “We do not claim that site content never leaves your host.” Risky actions can require your approval; a confirmation step for every write is not documented.

Is WordPress MCP free?

The MCP Adapter and Easy MCP AI are free GPL plugins, but on every route the AI app you connect may bill you separately. WordPress.com MCP works on every WordPress.com site, free or paid, and Jetpack-connected sites need no Jetpack plan, though which tools a site gets can still depend on its plan; WPVibe has a capped free plan.

Quick setup: Easy MCP AI with a read-only token ⚙️

A tested, safe way to start on a self-hosted site: Easy MCP AI plus Claude Code, connected with a read-only API token. Live sites should use HTTPS, and OAuth requires it.

Step 1: Install the plugin

👉 Grab Easy MCP AI from WordPress.org (free, no account needed). Install and activate it.

Step 2: Create a read-only API token

Go to Easy MCP AI > Connections > API tokens and click Create token. The form opens on Full access with a 30-day expiry; switch it to Read-only. Read-only is wider than “posts only”: the AI reads whatever the connected user can read, REST API GET routes included, and gets no tool that writes site content. The token is shown exactly once, so store it like a password; the token in this walkthrough was bound to the site’s administrator, but on a live site bind it to a WordPress user whose role fits the job.

Step 3: Add the server to Claude Code

On the Dashboard, click Connect an AI client, pick Claude Code, then Use an API token instead: the card prints this command with your site URL filled in; replace YOUR_API_TOKEN with the token from Step 2:

claude mcp add --transport http wordpress https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp --header "Authorization: Bearer YOUR_API_TOKEN"Code language: JavaScript (javascript)

Run claude mcp list afterwards: the wordpress line should end in “Connected”.

Step 4: Test it with one prompt

Which posts on this site are still drafts, and which published post went up most recently? Don’t change anything.

With the WooCommerce tool group on, the read-only token exposed 94 tools; the number depends on the site and the credential. Claude answered with the site’s one draft post, “Holiday gift boxes 2026” (ID 7), and its most recent published post, “New harvest: Colombia Huila is back” (October 15, 2026). A follow-up asked for a new draft post. The reply began:

I couldn’t create the draft. Nothing was added or changed on the site.

The site’s post list and the checksums of its posts, postmeta, terms, term relationships and comments tables were identical before and after, and the Audit log recorded the session’s four tool calls, all reads.

The same prompt through the MCP Adapter

For contrast, the identical prompt went through MCP Adapter 0.7.1 on WordPress 7.1.3, signed in with an administrator Application Password (live sites need HTTPS for Application Passwords). The client received three meta tools, and the only reachable abilities were the three read-only core ones: site info, user info, environment info. Claude’s answer, “I can’t answer that with the access I have,” is the Adapter working as designed: until a plugin registers and publishes abilities, a stock WordPress 7.1.3 site offers nothing that lists posts.

Common gotchas

• Stripped headers. Some Apache setups remove the Authorization header before WordPress sees it, some hosts’ firewalls block /wp-json/ requests, and some hosts and security plugins turn Application Passwords off; Easy MCP AI’s Dashboard diagnostics and the Adapter’s site-owner guide cover these.
• Plain permalinks. If a site uses plain permalinks, /wp-json/ addresses do not work at all.
• Stale tool lists. Clients can keep the tool list they loaded when they connected, so after changing a credential’s access, restart the MCP connection in your AI client so it refreshes the list.

What the AI can do to your live site, and how to keep it in bounds 🔒

On every route, site operations run as a WordPress user, with that user’s capability checks; WordPress.com and Jetpack also expose a few tools that act on the WordPress.com account itself, such as buying plans or managing domains. Bind the connection to a user whose role fits the job. An AI connected as an Editor cannot do what an Editor cannot do.

Start read-only, and grant write scopes when a workflow proves it needs them. Since 2.1.0, Easy MCP AI can also call the REST API routes of WordPress and your other plugins as the connected user, and each route’s own permission check decides. Switching a tool off removes that tool, not every route to the action.

Prompt injection is the category risk to plan for. The MCP specification warns that tools “represent arbitrary code execution and must be treated with appropriate caution”. Text the AI reads (comments, form entries, imported posts, product reviews) can carry instructions, and an AI with write scopes can be steered by them. Keep untrusted-content tasks on read-only tokens and a human in the loop for anything that publishes.

Easy MCP AI’s Audit log records every MCP tool call while it is on (it is on by default), and this is what the read-only session above left behind: two wp_list_posts calls (drafts, then the three latest published posts) and two wp_list_disabled_tools calls, all successful and with no changes recorded. One note on the Audit log’s “(self-service)” tag: Easy MCP AI applies it whenever an admin binds a key to their own account, even for a key created under Connections > API tokens.

Turn on Ask before destructive actions under Easy MCP AI > Settings > Access & safety and Easy MCP AI pauses its own delete, uninstall and other destructive tools for your approval; the switch is off by default, and even when it is on, tools on its Never ask for list (unless also on Always ask for), the site’s approval filter and API keys marked Unattended can skip the pause.

On the Adapter route, the kill switch is Users > Profile > Application Passwords > Revoke, and its guide’s advice applies to every route: try new abilities on a staging copy first, and keep regular backups.

Finally: run one MCP plugin per site. Two plugins answering OAuth discovery can confuse AI clients; Easy MCP AI’s own connect card says to disable other MCP plugins when a connection fails.

Which route should you pick? 🎯

No single winner, because the routes solve different problems:

• Pick the WordPress.com server if your sites live on WordPress.com and you want MCP without installing another plugin.
• Pick the Jetpack route if you are self-hosted, already run Jetpack, and want browser AI apps with no extra plugin.
• Pick the MCP Adapter if you work in desktop or CLI clients, run WordPress 6.9+, and want the MCP layer WordPress.org publishes and other plugins are told to depend on.
• Pick Easy MCP AI if you want browser apps and desktop clients on a self-hosted site with no relay in the middle, a large built-in tool set (WooCommerce, SEO fields, analytics) and a free plugin, and you are willing to switch on destructive-action approvals yourself.
• Pick a hosted relay such as WPVibe if you want browser AI apps on a self-hosted site without installing an MCP server, and you accept a third party in the request path plus daily call caps.

Whichever route you take, start with its narrowest access, one test prompt, and any activity log it keeps switched on.

Which route fits your site, and what is the first job you would hand to an AI?