How to connect your WordPress site to VS Code
GitHub Copilot can operate your WordPress site from the same editor where you build the theme or plugin — running WP-CLI, reading the PHP error log, clearing caches, and moving content without leaving your project. Install the free Cowboy MCP plugin, click Install in VS Code, and approve the sign-in in your browser. No API key to paste, no config to hand-write, and it works on a local site as well as a live one. New to MCP? Start with the WordPress MCP server guide.
What can Copilot do on your WordPress site once it's connected?
Once connected, Copilot's agent mode acts on your WordPress site with real tools — it does the work itself instead of printing commands for you to paste. Ask in plain English in the Chat view and it can run WP-CLI, tail the error log while you reproduce a bug, flush the cache after a deploy, update plugins behind a checkpoint, or move content between pages. Cowboy MCP exposes 203 WordPress tools that Copilot calls directly over HTTP.
How do you connect VS Code to WordPress in three steps?
Connecting takes three steps and no hand-written config. Install the free Cowboy MCP plugin, click Install in VS Code on the Connections tab under Settings → Cowboy MCP, and approve the one-click sign-in that opens in your browser. There's no key to copy or keep safe, and nothing is allowed until you click Approve on your own site.
- 1
Install the free plugin
In WordPress, go to Plugins → Add New, search for Cowboy MCP, and click Install then Activate.
- 2
Click Install in VS Code
Open Settings → Cowboy MCP, pick VS Code on the Connections tab, and click Install in VS Code. VS Code opens and adds your site as an HTTP MCP server — its /wp-json/cowboy-mcp/v1/endpoint URL — with no file to edit. Prefer the file? Add a servers entry to .vscode/mcp.json with "type": "http" and the same URL.
- 3
Sign in and approve
Start the server when VS Code asks. Your browser opens a sign-in page on your site — pick full access, read-only, or a custom list of tools, and click Approve. Back in VS Code, open the Chat view in Agent mode and your site's tools are ready; the Configure Tools button in the chat input shows them.
The Connections tab confirms the moment VS Code signs in. VS Code may ask you to confirm each tool call the first time — that's its own guardrail, on top of Cowboy MCP's. Using Cursor instead? It has its own Add to Cursor button with the same sign-in.
Why does VS Code work on a local site when cloud apps don't?
Because VS Code runs on your computer, not in a vendor's cloud. Cowboy MCP publishes a Streamable HTTP endpoint as an ordinary WordPress REST route at /wp-json/cowboy-mcp/v1/endpoint, so VS Code reaches your site directly — no proxy, no relay, no Node.js bridge, and no third-party service in between. The plugin is itself the MCP server; Copilot's agent is the MCP client.
That is why Local, Studio, MAMP, DevKinsta, wp-env and Docker sites all work with no public URL and no tunnel: the sign-in happens in your own browser on the same machine. For a headless or CI setup — a build pipeline that should run without a browser — create an API key on the Connections tab and put it in a headers entry as Authorization: Bearer. One endpoint serves every client, so a terminal tool like Claude Code or Codex can share the same site.
Is it safe to point Copilot at a production site?
Yes, with the same guardrails the plugin applies to every client. Safe mode is on by default, so destructive tools ask before they run. Any write can be previewed as a dry run, every change lands in an undo journal you can roll back, a database checkpoint can be taken before a risky job, and requests are rate-limited to 120 per minute. Copilot gets the access you approve — read-only for a client site is a good default — and you can revoke it any time; it all runs on your own server. More on security →
Questions, answered.
Which GitHub Copilot plan do I need?
Any, including Copilot Free. MCP servers are part of agent mode in VS Code on every individual plan. On Copilot Business and Enterprise, an administrator has to enable the MCP servers policy for the organization before the server appears. Your site does not need a public address, because VS Code runs on your computer.
Do I need an API key or a config file?
No. Install in VS Code adds the server for you, and the sign-in happens in your browser on your own site — nothing to paste or keep safe. The config file is there if you prefer it: a servers entry in .vscode/mcp.json for one project, or in your user profile through the MCP: Open User Configuration command for every project. An API key in an Authorization header is for headless or CI use.
Does this work with Cursor or other VS Code forks?
Yes. Cursor has its own Add to Cursor button on the Connections tab and the same browser sign-in — see the Cursor guide. Windsurf, Cline, Zed and other editors take the config block from the plugin's readme: the endpoint URL plus an Authorization: Bearer header with an API key. One endpoint serves every editor, so switching editors never means reconnecting the site.
Can Copilot edit theme and plugin files on my live site?
Yes, when you ask it to. The file tools write inside wp-content, syntax-check every PHP file before it lands, and keep mu-plugins off limits unless an administrator turns on Power mode, so a broken edit can't lock you out. Each change goes into the undo journal, and a database checkpoint can be taken first. Most developers still edit code locally in the editor and use the connection for WP-CLI, logs and content.
Copilot says no tools are available — why?
A short list is normal: Cowboy MCP exposes two gateway tools, cowboy_discover and cowboy_run, instead of loading every schema into Copilot's context — ask it to “discover tools for WooCommerce”. Check that the server is enabled under Configure Tools in the chat input. If even those two are missing, the connection's scope is probably empty: check it under Connected apps on the Connections tab. Still nothing? Ask in the support forum (opens in new tab).
I get a 401 or 403 when connecting — what's wrong?
Run the Connection Doctor on the Connections tab. A 401 with a Basic Auth prompt means server-level password protection answers before WordPress — exclude /wp-json/cowboy-mcp/ and /.well-known/ from it. A 403 or 503 from Cloudflare is a bot challenge; a 403 or 406 mentioning ModSecurity is a firewall blocking JSON POSTs. Still stuck? Paste the report into the support forum (opens in new tab).
Ready to connect VS Code to your WordPress site?
Install the free plugin, click Install in VS Code, approve the sign-in, and Copilot is working on your site minutes later — local or live. It works on any self-hosted WordPress site running version 6.2 or newer on PHP 8.0+. The same site also connects to Cursor, Claude Code, and n8n.