How to connect Claude Desktop to your WordPress site
Claude Desktop connects to a WordPress site through Cowboy MCP in one of two ways: a public HTTPS site uses the plugin's built-in OAuth Desktop Connector — no API key, approve once in your browser — while a local site (Local, Studio, MAMP, DevKinsta, wp-env) uses a small mcp-remote bridge with an API key. Both take minutes; this guide covers each. New to MCP? Start with the WordPress MCP server guide.
Which path do you need: public site or local site?
The Claude apps connect from Anthropic's cloud, so the only question is whether that cloud can reach your site. A public HTTPS address can be reached — use the one-click connector. A site on your own computer can't — use the bridge. The plugin works this out for you: when the site address looks local (localhost, a .local or .test hostname, a private IP), the Connection tab badges each client Works locally or Needs public URL and shows the bridge for Claude Desktop first.
| Where your site runs | How Claude connects | Credential |
|---|---|---|
| Public HTTPS site on any host | Claude Desktop → one-click Desktop Connector (OAuth sign-in) | No key to copy — approve once in the browser |
| Local site — Local, Studio, MAMP, DevKinsta, wp-env, any localhost | Claude Desktop → mcp-remote bridge on your computer | API key, read-only by default |
| claude.ai in the browser | Custom connector (same OAuth flow) | Public HTTPS only — a local site needs a tunnel |
Either way, install the free plugin first: Plugins → Add New, search for Cowboy MCP, Install and Activate, then open Settings → Cowboy MCP. Custom connectors require a Claude Pro, Max, Team, or Enterprise plan.
Connect a public WordPress site to Claude Desktop (one-click)
On a public HTTPS site there is no key to generate and no config file. Cowboy MCP includes its own OAuth 2.1 server, so your site is what Claude signs in to — three steps, all in the browser.
- 1
Turn on the Desktop Connector
On the Connection tab pick Claude Desktop and click Enable Desktop Connector — or flip Desktop Connector (“Allow connecting via Claude Desktop / web (OAuth)”) on the Settings tab. It's off by default.
- 2
Add it in the Claude app
Copy your connection link (your /wp-json/cowboy-mcp/v1/endpoint URL, shown on the tab). In the Claude desktop app go to Customize → Connections, click Add custom connector, paste the link, and click Add.
- 3
Approve access
Claude opens a sign-in page on your site. Log in as an administrator, choose an access level, and click Approve. That's it — you're connected.
What the consent screen shows
The approval page is served by your own site, not by Anthropic. It names the app (“Claude wants to connect”), says what it gets — “It will be able to read and manage your site through the MCP server, acting with your administrator permissions” — and which account you're authorizing as. Under Access level pick Full access — read and manage the site or Read-only — inspect the site, make no changes, then Approve or Deny. Only administrators can approve; no token exists until one does.
Approved apps then appear in a Connected apps table on the Connection tab. Click Edit on its Scope to switch between Full access, Read-only, and Custom… (a checklist of individual tools), or Revoke to cut it off immediately.
Connect a local WordPress site to Claude Desktop (mcp-remote bridge)
A site on your computer can't be reached from Anthropic's cloud — but Claude Desktop runs on that same computer and can start a local helper. The bridge is the standard open-source mcp-remote package, started on demand via npx; it connects only from your computer to the site. Nothing is exposed to the internet, no tunnel involved.
- 1
Create an API key
On the Connection tab pick Claude Desktop — on a local site it opens the bridge flow. Name the key, leave the scope on Read-only (preselected here; pick Full access only if Claude must make changes), click Generate API key, and copy it — it's shown once.
- 2
Add the bridge to Claude Desktop
Add the block below to claude_desktop_config.json (create the file if it doesn't exist), swap in your key, then fully quit and restart the Claude app. The tab renders it with your site already filled in.
- 3
Check it worked
Open a new chat in Claude Desktop and click the tools icon — your site (named after its hostname, e.g. mysite-local) should be listed. The first start can take a moment while the bridge downloads.
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json — Windows: %APPDATA%\Claude\claude_desktop_config.json
The bridge requires Node.js on your computer — npx fetches mcp-remote the first time. The Authorization header goes through an env variable so the space in “Bearer <key>” survives Claude Desktop's argument handling on Windows. Because the key sits in plain text in that file, prefer a read-only key, and revoke it when you stop using it.
Getting a certificate error? Local sites usually use a self-signed certificate that AI tools reject. Since the site runs on this same computer, use the plain http:// address instead — the connection never leaves your machine. The tab offers that variant only for loopback-shaped hosts (localhost, 127.0.0.1, .local, .test), never for a bare private IP that could be another machine. Avoid the NODE_TLS_REJECT_UNAUTHORIZED=0 workaround seen online: it disables certificate checks for everything that tool connects to.
What can Claude Desktop do once connected?
The same 168 tools every client gets: content and media, plugins and themes, users, the block editor, WooCommerce, Wordfence, ACF, Elementor, diagnostics, and a per-change undo journal with database checkpoints. The WordPress MCP guide has the full map.
Troubleshooting: Claude says it can't reach the server
Start with the Connection Doctor at the bottom of the Connection tab: click Run checks, then Copy report for a plain-text diagnosis you can paste to Claude or your host. It names the likely cause for each failure below; the same engine runs as wp cowboy-mcp doctor.
The connector needs a public hostname. The “Hostname publicly reachable” check warns when your site address is localhost, a .local/.test name, or a private IP — the Claude apps cannot reach those from Anthropic's cloud. Use the bridge for Claude Desktop, or a tunnel or staging URL for claude.ai.
HTTPS is required for the connector. A plain-http address fails the “Site uses HTTPS” check whenever the connector is on. Install an SSL certificate and update the WordPress Site Address — the OAuth discovery documents live at your site root under /.well-known/, and pretty permalinks must be on for /wp-json/ to resolve.
Host bot-filters and Cloudflare. If Cloudflare is challenging the request, add a WAF skip rule (or disable Bot Fight Mode) for /wp-json/cowboy-mcp/* and /.well-known/oauth-*. A ModSecurity-style firewall blocking JSON POSTs needs your host to allowlist POST /wp-json/cowboy-mcp/v1/endpoint; server-level Basic Auth must exclude /wp-json/cowboy-mcp/ and /.well-known/ (MCP clients can't send two Authorization headers); and a page cache returning HTML instead of JSON should exclude /wp-json/cowboy-mcp/.
The bridge needs Node.js. If the tools icon never shows your site, confirm Node.js is installed, that you fully quit and relaunched Claude Desktop after editing the file, and that the JSON still parses. A certificate error means the note above applies. And if a tool seems missing, check the credential's scope — a read-only key or connection hides every write tool by design.
Keeping an agent on a leash — safe mode, dry runs, undo, checkpoints, the audit log — is covered on the security page and in Is it safe to give AI access to WordPress?
Questions, answered.
Do I need an API key for Claude Desktop?
Not for a public HTTPS site: the Desktop Connector is an OAuth sign-in — add the endpoint URL as a custom connector, approve once on your own site, and no key is ever copied. A local site is the exception: the mcp-remote bridge authenticates with an API key stored in claude_desktop_config.json, so give it a read-only key unless it needs to make changes.
Does this work with claude.ai in the browser?
Yes, for a public HTTPS site — claude.ai uses the same custom-connector flow and the same consent screen on your site. It cannot reach a local site, because it connects from Anthropic's cloud. A tunnel works for temporary testing, but it exposes your whole dev site while it runs, and the WordPress Site Address must be set to the tunnel URL for the sign-in to work.
Can I use Claude Desktop with a site on Local or Studio?
Yes. Local, Studio, MAMP, DevKinsta, wp-env, and any other localhost setup work through the mcp-remote bridge — a small helper on your computer, so nothing is exposed to the internet and no tunnel is needed. The Connection tab detects a local site and shows the ready-to-copy config; if the self-signed certificate causes an error, use the plain http address it offers.
Is the OAuth connector safe?
It is designed to be. Your own site is the OAuth 2.1 authorization server — no third-party service in between — and no token is issued until a logged-in administrator clicks Approve. Tokens act as that administrator, stop working if they lose the role, are stored as hashes, and can be revoked from the Connected apps table. The connector is off by default, and Claude can never change the plugin's own settings through it.
Can I limit what Claude can do?
Yes. Every credential has a scope: choose Read-only on the consent screen or when generating the bridge key, or Custom… for a hand-picked list of tools, and change it later from the Connection tab. On top of that, safe mode asks before destructive actions, writes can be previewed as a dry run, every change lands in an undo journal, and an audit log records every call.
Ready to connect Claude Desktop to your WordPress site?
Install the free, open-source Cowboy MCP plugin, pick your path on the Connection tab, and Claude Desktop is working your site minutes later. It runs on any self-hosted WordPress site on version 6.2 or newer with PHP 8.0+. Prefer a different client? The same site connects to claude.ai and the Claude apps, Claude Code in the terminal, and Cursor too.