WordPress MCP: the complete guide

What is a WordPress MCP server?

A WordPress MCP server is a plugin or service that exposes your WordPress site to AI assistants through the Model Context Protocol, an open standard for connecting AI to external tools. Once connected, an assistant like Claude or ChatGPT can act on the site — publish posts, update WooCommerce products, run backups — instead of just writing text for you to paste.

The Model Context Protocol (MCP) was introduced by Anthropic in 2024 and is now an open specification implemented by clients from many vendors. An MCP server publishes a set of tools — discrete actions like "create a post" or "update a product price" — and an MCP client, the AI app you already use, discovers those tools and calls them with your approval.

On WordPress, that server can take several forms: a plugin on a self-hosted site, a built-in feature of a hosted platform, or an adapter maintained by the WordPress project itself. This guide covers how the connection works, what an agent can actually do with it, every option available in 2026, and how to set one up safely.

How does MCP work with WordPress?

An AI assistant connects to your site as an MCP client, over a transport called Streamable HTTP — ordinary HTTPS requests to one endpoint URL. The server answers with a list of tools it offers, each described in plain language. When you ask for something, the assistant picks a tool, calls it with the details filled in, and reads the result — a loop it repeats until the job is done.

Concretely, with Cowboy MCP the flow looks like this:

1. Your AI app sends a request to a single URL on your site — https://your-site.com/wp-json/cowboy-mcp/v1/endpoint.
2. The plugin describes its 203 tools: each has a name, a plain-language description, and a defined set of inputs.
3. The assistant chooses a tool and calls it. The plugin runs the action inside WordPress — with its permission checks and safety rails — and streams the result back.

How is that different from the WordPress REST API? The REST API is the raw interface: it exposes the site's data over HTTP, but every integration has to be programmed against specific routes in advance. MCP sits one level higher — it is self-describing, so an assistant that has never seen your site can discover what's possible and act. The two are complementary rather than rivals: Cowboy MCP registers its MCP endpoint as a REST route, so MCP traffic travels over infrastructure WordPress already ships with.

What can an AI agent actually do on a WordPress site?

With Cowboy MCP, an agent gets 203 tools that cover the whole site, not just content. It can draft and schedule posts, update plugins and themes, manage users, edit WooCommerce products and orders, run Wordfence security scans, trigger backups, read error logs, and repair database tables — real administrative work, executed directly on the site rather than described to you.

Area	Tools	Examples
Core WordPress and other integrations	111	Posts, pages, media, users, plugins, themes, settings, WP-CLI, error logs, database repair, caching, forms-plugin detection, SEO meta (Yoast SEO, Rank Math, All in One SEO, SEOPress), database checkpoints and undo
WooCommerce	40	Products, orders, refunds, coupons, stock, shipping zones, tax rates, sales reports
Wordfence	17	Security scans, firewall management, blocked IPs, live traffic
ACF	9	Field groups, custom fields, repeaters, options pages
Elementor	7	Templates, page builds, widget content
Beaver Builder	7	Page layouts with a node-by-node dry-run preview, modules and their settings, global settings
SiteOrigin Page Builder	12	Layouts edited whole or row by row, prebuilt layouts, widgets, Page Builder settings

Each integration lights up automatically when its plugin is active — there is nothing to configure. Most other page builders are supported too: a builder that keeps its layout in post content or post meta is edited through the standard post tools, with the same dry run and per-change undo. Three real prompts, to make it concrete:

• "Turn last week's webinar notes into a blog post and schedule it for Tuesday morning."
• "Put everything in the Summer collection 20% off through Friday and email me the week's revenue."
• "Scan the site and block every IP that failed login more than ten times today."

What are your options for a WordPress MCP server?

You have five realistic options in 2026: the official WordPress mcp-adapter plugin, WordPress.com's built-in MCP server on its hosted plans, broad AI plugins such as AI Engine that include an MCP server, plugins that route MCP traffic through a hosted relay service, and self-hosted plugins that serve MCP natively from your own server. They differ mainly in where the endpoint runs and who sits between your site and your AI.

Option	What it is	Where the endpoint runs
WordPress MCP Adapter (opens in new tab) (official)	Free, vendor-neutral adapter that bridges the WordPress core Abilities API to MCP — in the WordPress.org directory since October 2026; exposes the abilities a site registers and has no tools of its own	Your server
WordPress.com built-in MCP	MCP server included with WordPress.com's paid hosted plans — available only on that platform	WordPress.com
AI Engine (Meow Apps)	Broad AI plugin — chatbots, content generation, and more — that includes an MCP server among its features	Your server
Hosted-relay plugins	Plugins that pass MCP traffic through the vendor's hosted relay service between your AI client and your site	Your server, via a third-party relay
Cowboy MCP	Native, self-hosted MCP endpoint inside a free GPL-2.0 plugin — no Node.js proxy, no relay, no external service	Your server

All of these are legitimate choices. If you want to follow the direction WordPress core itself is heading, the official adapter is the neutral pick. If your site already lives on WordPress.com, the built-in server is the shortest path. If you want a chat-assistant suite that happens to include MCP, AI Engine covers far more than site management. Cowboy MCP's focus is narrower and deeper: one self-contained endpoint, 203 tools, and a safety layer built for letting an agent loose on a live site. It is free, open source, and built in the open — the about page has the maker and press facts. For a head-to-head look at any one of these, see Cowboy MCP compared against the alternatives. The comparison hub lists every MCP plugin in the WordPress.org directory with installs, rating, price model and undo support, and the head-to-heads with WPVibe and Easy MCP AI cover the two most-installed rivals after the official adapter in detail.

Self-hosted or hosted — which should you pick?

Pick self-hosted if you want your content and credentials to stay on your own server: the AI client talks directly to your site, and no third party sees the traffic. Pick hosted if you're already on a platform that includes MCP and would rather not manage a plugin. The tradeoff is control and privacy on one side, convenience on the other.

The privacy question is concrete, not abstract. With a hosted or relayed setup, your requests — and often your content — pass through infrastructure someone else operates, which matters if you answer to GDPR, client contracts, or your own policies. With a self-hosted endpoint, the credentials live on your server and the audit trail stays local. On the other side of the ledger, a hosted platform handles uptime, TLS, and updates for you — real work you no longer own.

Cowboy MCP sits at the self-hosted end by design: the endpoint is native to the plugin, so there is no Node.js proxy running beside WordPress, no hosted relay in the path, and no external service involved. Requests go from your AI client straight to your server, and every call is logged there. For people who manage many sites, an optional hosted companion, Cowboy Hub, is in early access; the plugin never routes through it.

Do you need Node.js or coding skills?

No — not for the standard path. With Cowboy MCP you install the plugin from the WordPress directory, follow the guided setup in Settings → Cowboy MCP, and connect Claude, ChatGPT, Perplexity, Grok, the Gemini app, Muse, or the Codex app with one-click sign-in. There is no Node.js proxy to run, no JSON file to edit, no API key to copy, and no code to write. Terminal tools and code editors connect with one command or one button and the same one-click sign-in.

The no-terminal path uses an OAuth connector: click Add to Claude or Open ChatGPT, or open Perplexity, Grok or the Gemini app from the Connections tab (or add your site as a custom connector in the Codex app), then click Approve on your own site's consent screen. You choose what the app may do before it can do anything, and you can revoke it later in one click. It requires a public HTTPS site.

The terminal path is one command plus the same one-click sign-in, so there is no key to copy, store, or rotate. Settings → Cowboy MCP shows the exact command for your site. For Claude Code:

claude mcp add --transport http your-site https://your-site.com/wp-json/cowboy-mcp/v1/endpoint
claude mcp login your-site

The second line opens your browser to approve the connection on your site; local development sites work too. Codex, Gemini CLI, and Opencode follow the same pattern, and Cursor and VS Code install with one button. n8n has its own panel with the MCP Client Tool fields ready to copy. For scripts and CI, or for editors like Windsurf, Cline, and Zed, generate an API key instead (it's shown once and stored only as a one-way hash) and send it as a Bearer header. The same endpoint URL works in anything that speaks MCP over Streamable HTTP.

Is it safe to let an AI agent manage WordPress?

It can be, if the server enforces guardrails rather than trusting the model. Cowboy MCP layers six: safe mode confirms destructive actions, dry runs preview any change before it happens, an audit log records every call, a per-change undo journal reverses individual edits, database checkpoints restore your site's database tables, and rate limits cap a runaway agent at 120 requests per minute.

Each guardrail has a specific job:

• Safe mode — on by default; destructive tools wait for your explicit confirmation before running.
• Dry run — every write tool can report exactly what it would change without changing anything.
• Audit log — every tool call, error, and authentication event is recorded, filterable in wp-admin, and auto-pruned after 30 days.
• Undo journal — each change is captured individually, so one bad edit rolls back without touching the rest; the undo guide shows what can and cannot be reversed.
• Database checkpoints — one-click snapshots restore your site's database tables, and auto-checkpoint runs before risky operations like plugin updates.
• Rate limits and hashed keys — 120 requests per minute per key by default; keys are stored only as one-way hashes — the plain key can't be recovered from your database — and can be revoked individually.

Beyond those six, the most powerful operations stay behind power mode, which is off until a human administrator enables it in wp-admin, and sensitive options and dangerous database or WP-CLI commands are blocklisted outright. The security page walks through the whole model — including what can go wrong and what each guardrail does not cover.

How do you set one up?

Three steps, about five minutes. Install a WordPress MCP plugin, register the endpoint in your AI client, and approve the connection. With Cowboy MCP the plugin's guided setup walks you through each client's exact flow, and the two walkthroughs below cover the most common pairings — Claude and ChatGPT — step by step.

1. Install the plugin. In wp-admin, go to Plugins → Add New, search for "Cowboy MCP", and click Install then Activate. It's free on the WordPress.org plugin directory (opens in new tab) and needs WordPress 6.2+ and PHP 8.0+.
2. Connect your AI. Open Settings → Cowboy MCP and follow the guided setup — a button or one command, then one-click sign-in, for apps and terminal tools alike. For the full walkthroughs, see how to connect WordPress to Claude or how to connect WordPress to ChatGPT, or the table of every supported app with the plan each needs.
3. Ask for something real. Start with a read-only request — "which plugins have updates pending?" — then let it act. Safe mode checks with you before anything destructive runs.

If any term in this guide is unfamiliar, the glossary defines them all in plain English.

FAQ