WordPress MCP Connector
WordPress MCP Plugin: Turn Your Site into an MCP Server
This free WordPress MCP plugin makes your site a Model Context Protocol server. ChatGPT, Claude, Cursor, and Windsurf can then read and change the site directly, with no pasting text between windows. WordPress core works out of the box, and so does any plugin that registers WordPress Abilities.
What makes it different
- Real OAuth, not a shared key
- Profiles decide what agents see
- Your server, no middleman
- Works with any plugin’s Abilities
- One endpoint, every client
- Free, with no upgrade path
In detail
What Each Part Does
Activate the plugin and the site you already run starts answering as an MCP server. There is nothing to host and no account to open.
How the Connection Is Made
One JSON-RPC 2.0 endpoint appears under wp-json on your own domain. Every client talks to that same address.
No middleware, no daemon, no outside service. The plugin has zero external dependencies, no Composer install, and no build step.
What an Agent Can Reach
The plugin's own tools cover WordPress core: posts, pages, media, comments, users, taxonomies, menus, plugins, themes, and settings. That is most of what an editor does in wp-admin, and it works on a bare site.
Anything beyond core arrives through WordPress Abilities, the mechanism WordPress 6.9 added so a plugin can describe what it does and who may use it.
Profiles, the Part That Matters
A profile sets what one connection can see. A content profile shows posts and media and nothing more. An administrative profile shows more. Build your own and you will likely land on the dozen tools you really use.
Abilities from other plugins begin switched off in every profile, Full Access included. You turn them on one profile at a time.
Authentication Done Properly
ChatGPT and Claude connect with OAuth 2.0 and PKCE, not a shared key pasted into a box. Enter your site address in the assistant, then sign in to WordPress.
From version 1.6.8 there is no client ID or secret to create beforehand. Each side identifies itself with a published metadata document, and the approval screen names the app asking and the domain behind it.
It runs on your server, not ours. The endpoint lives on your domain, you set the profiles, and none of your site passes through us.
What you get
Everything the Plugin Can Reach
Twenty-one items, all in the free plugin you install and run yourself.
Integrations and Security
- MCP server endpoint
- WordPress core tools
- Zero external dependencies
- ChatGPT via OAuth 2.0
- Claude via OAuth 2.0
- OAuth 2.0 with PKCE
- Capability checks on every call
- Admin-only authorization
- WordPress Abilities from any plugin
What Sets It Apart
- Real OAuth, not a shared key
- Profiles decide what agents see
- Your server, no middleman
- Works with any plugin’s Abilities
- One endpoint, every client
- Free, with no upgrade path
- Profile-based access control
- Encrypted client secrets
- Token expiry and refresh
- Cursor and Windsurf support
- Guided client setup
- Precise edits, previewed and reversible, and duplication of any page, post, or product as a draft
Ready to Install WordPress MCP Connector?
Budget about ten minutes. The setup guide walks through every screen.
Two Other Ways to Put an Agent Inside WordPress
Alternatives mostly sort into two camps. One is a developer library that needs code written before anything happens. The other is a bare server with a handful of endpoints and little else.
| What to compare | How it works here |
|---|---|
| Finished plugin vs developer library | You install it, choose a profile, and connect. The official WordPress adapter is a library for turning your own abilities into tools, so somebody writes and maintains PHP before an agent does anything useful. |
| OAuth for ChatGPT vs tokens only | ChatGPT signs in through OAuth here. A server that takes only bearer tokens or Basic Auth can be fine in Claude Desktop and Cursor, yet ChatGPT users stall at the first screen. |
| Opt-in abilities vs everything at once | Any plugin that registers WordPress Abilities gets tools here. Each one stays off until you enable it, and is tagged Write or Destructive if it can change things. Skip that gate and whatever the server exposes is open to every connection. |
| Scoped profiles vs all or nothing | A profile can give an agent a read-only connection. With no permission layer, a server offers everything the signed-in user can do, so a research-only link is impossible. |
| Encrypted secrets vs plaintext options | Client secrets are stored encrypted. A plugin that saves API credentials as plain text in the options table hands them over in every database export and nightly backup. |
| Self-hosted vs relay service | Your MCP client calls the REST API on your own site. No relay sits in between, so your content does not travel through anyone else. |
Cost
What It Costs
The plugin costs nothing. What you pay for is already on your bill.
The Plugin
Free on WordPress.org. No per-site license, no paid tier holding features back. Put it on one site or fifty.
Your Hosting
It runs inside the WordPress site you already host. We run nothing in the middle, so there is nothing extra to pay for.
Your AI Tools
ChatGPT, Claude, Cursor, or Windsurf is billed by its own provider. We sit nowhere between you and them.
Prefer not to run it yourself? We manage WordPress for other companies. That is a separate service, not a license for this plugin.
Who WordPress MCP Connector Is For
Content Teams Publishing at Volume
Drafting, tagging, scheduling, and cleaning up old posts eat editorial hours. Give an agent a content profile, let it work through a batch, and spend your own time reviewing results instead of opening the same five screens per article.
Get StartedStores with Big Catalogs
The connector reaches your store through abilities that WooCommerce registers, and you switch each one on. What an agent may change there is whatever WooCommerce offers.
Get StartedAgencies Running Many Client Sites
Point an agent at one client site to audit metadata or tidy redirects, then move to the next. Each site keeps its own credentials and profile, so clients never share access, and cutting off one connection leaves the rest alone.
Get StartedHow to Get Started
1. Install and Pick a Profile
Add the plugin from the WordPress Plugin Directory and activate it. Open Settings, then MCP Connector, and choose the profile this connection will use.
Get Started2. Connect Your AI Client
ChatGPT and Claude take your site address as a custom connector, then ask you to sign in. Cursor, Windsurf, and other editors use a WordPress Application Password and the config that the Client Setup tab writes for you.
Get Started3. Put It to Work
Describe the job in ordinary words. The agent can call only the tools your profile permits, WordPress checks permissions on every call, and the result looks as if you had made the change yourself.
Get StartedFree on WordPress.org
MountDev AI MCP Connector for WordPress
Find it in the WordPress plugin directory, or inside your dashboard under Plugins, Add New. Cascadia Web Services publishes it for free under the GPL.
Documentation
The connection, what an agent can reach, profiles, sign-in, prerequisites, and what to check when a connection will not hold.
What Clients Say About Working with Cascadia
“I’ve always dreaded website management, but Cascadia has done an incredible job with my WordPress site, making it one less thing for me to worry about.”
“I’ve worked with Cascadia for several years now. They are always ready to help in any way I ask and can implement my ideas with ease. A company that values their clients!”
“Cascadia has been great to work with! We recently needed some updates, and Cascadia was quick to get them completed! We highly recommend Cascadia Web Services.”
“Cascadia is very responsive and we’re happy with them as our primary IT vendor.”
“They do great work, been using for years. Prompt responses to requests.”
Questions About WordPress MCP Connector?
Talk to usAsk us
Questions We Get Asked About This Plugin
Weighing other ways to connect an agent? The comparisons take the main options one by one.
Compare with Zapier, n8n, AI Engine, and MoreCompare with Zapier, n8n, and MoreCompare with Zapier and MoreStill have a question?
What is an MCP server, in plain terms?
It is a standard doorway into a system for an AI assistant. Without one, you carry text between windows by hand. With one, the assistant opens your posts, starts a draft, edits a product, or checks a setting on its own. This plugin turns your WordPress site into that doorway.
What is the Model Context Protocol?
Model Context Protocol, or MCP, is an open standard from Anthropic for how AI clients reach outside tools and data. Any vendor can adopt it, so one server serves many clients. That is why a single plugin works with ChatGPT, Claude, Cursor, and Windsurf without a separate integration for each.
What is a WordPress MCP plugin?
It is a plugin that lets your site speak the Model Context Protocol, so an AI assistant can use WordPress as a tool. This one adds a single endpoint on your own domain. The assistant can read posts, draft pages, and change settings, but only inside the permissions you set. It is free on WordPress.org.
Is there a WordPress MCP plugin that works with Claude?
Yes, this one does. Add your site's MCP address as a custom connector in Claude, sign in to WordPress, and approve the request. It uses OAuth 2.0. ChatGPT connects the same way, while Cursor and Windsurf use a WordPress Application Password.
Is the plugin really free?
Yes. It sits in the WordPress Plugin Directory under GPL v3, with no paid tier, no trial, and no license key. Run it on as many sites as you like. Having us install and manage it is a separate, optional service.
Is connecting AI to WordPress safe?
That depends mostly on the account you connect as. Every tool call goes through the permission checks WordPress runs in wp-admin, so an agent never exceeds that role. Credentials are encrypted at rest, tokens expire, and you can pull access from inside WordPress at any time. The biggest decision is which profile each connection gets.
Which AI clients can I connect?
ChatGPT and Claude sign in with OAuth 2.0. Cursor, Windsurf, and other editors use WordPress Application Passwords. The endpoint is not tied to one vendor, so any MCP client that supports either method will work.
How do I connect ChatGPT?
Copy the address under Settings, MCP Connector. In ChatGPT, open Settings, then Connectors, and add a custom connector with that address. Leave any Client ID and Secret fields empty. Sign in to WordPress in the window that opens, approve, and then use the Access tab to decide what the assistant may do.
How do I connect Claude Desktop?
Take the address from Settings, MCP Connector. In Claude, go to Settings, Connectors, and add a custom connector with it, leaving Client ID and Secret blank. A WordPress sign-in window opens. Approve there, then set the assistant's limits on the Access tab.
Which plugins does it work with?
Any plugin that registers WordPress Abilities. Their abilities show up under Access, grouped by the plugin's own categories, and stay off until you enable them. The connector's own WordPress tools run on a plain site with nothing else installed.
What if none of my plugins register abilities?
You still have the connector's own tools for posts, pages, media, comments, users, taxonomies, menus, plugins, themes, and settings, which cover most editorial and admin work. Abilities only extend that list. A plugin that offers none triggers no errors or warnings. It simply adds nothing.
Can I limit what an AI agent is allowed to do?
Yes, in two layers. A profile picks which tools a connection sees, from read-only up to full access, and you can build your own. Beneath it, the WordPress role of the connecting account is a hard ceiling. Sign in as an editor and no profile will let the agent install a plugin.
Does any of my data leave my server?
Nothing goes to us or any third party. Your MCP client calls the REST API on your own site and gets answers straight back. Credentials and content stay on your server. The one outside party that sees your content is the AI client you chose, under the terms you accepted with it.
Do I need an API key?
Not from us, because there is no account to create. For ChatGPT and Claude you sign in to your own site and approve, with nothing to generate first. For Cursor, Windsurf, and other editors you create a WordPress Application Password in your user profile. Your site issues both, and your site revokes both.
How long do the sign-in tokens last?
Authorization codes expire after ten minutes, and PKCE ties each code to the client that asked for it, so an intercepted code is useless to anyone else. Access tokens last an hour. Refresh tokens last thirty days and rotate on renewal.
How do I cut off a connection?
Remove the Application Password or the OAuth grant inside WordPress and the connection stops. There is nothing else to rotate and nobody to email. Deleting the plugin, as opposed to deactivating it, also removes every credential and token it stored.
What are the requirements?
WordPress 5.8 or later and PHP 7.4 or later. Version 2.2.0 is tested up to WordPress 7.1.2, and tools from other plugins need WordPress 6.9 or later. Application Passwords work only on a site served over HTTPS, which most hosts now provide by default.
Can you set this up for me?
Yes. The install itself is quick. The part that deserves care on an important site is choosing a profile and a signing-in account for each connection. We can set it up under a managed plan or as a one-off job. Tell us what the agent should handle and we will take it from there.
How is this different from the official WordPress MCP adapter?
The adapter from the WordPress project is a developer library, and you write code to expose abilities as MCP tools. This plugin works from the admin screen, ships its own WordPress tools, offers OAuth for ChatGPT and Claude, and applies access profiles to any plugin's abilities. If you are building tools of your own, the adapter fits better. If you want an agent connected today, use this.