Skip to main content
Glama
deenesjakoruzh

WordPress MCP Server

Official
by Automattic
npmGitHub
TypeScript
MIT License
1,509
80
  • Apple
OverviewInspectNewEndpointsSchemaRelated ServersReviewsScore
Need Help?View Source CodeReport Issue

MCP WordPress Remote

A Model Context Protocol (MCP) server for seamless WordPress integration

Connect AI assistants like Claude Desktop to your WordPress sites with multiple authentication methods including OAuth 2.0, JWT tokens, and application passwords.

Features

  • MCP Authorization Specification Compliant - Implements MCP Authorization specification 2025-06-18
  • OAuth 2.1 with PKCE - Secure authorization code flow with PKCE (RFC 7636)
  • Resource Indicators - RFC 8707 compliance for token audience binding
  • Dynamic Client Registration - RFC 7591 support for automatic client registration
  • Protected Resource Metadata Discovery - RFC 9728 for automatic endpoint discovery
  • Multiple Authentication Methods - OAuth 2.1, JWT tokens, and WordPress application passwords
  • Persistent Token Storage - OAuth tokens stored securely with automatic validation
  • Multi-instance Coordination - Lockfiles prevent authentication conflicts
  • Automatic Token Management - Handles validation, refresh, and cleanup
  • Enhanced Error Handling - Detailed error messages with proper categorization
  • Comprehensive Logging - Structured logging with categories and levels
  • Complete MCP Support - Tools, resources, prompts, and more

Quick Start

Installation

npm install @automattic/mcp-wordpress-remote

Configuration

Add to your MCP client configuration (e.g., Claude Desktop's claude_desktop_config.json):

{ "mcpServers": { "wordpress": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote"], "env": { "WP_API_URL": "https://your-wordpress-site.com" } } } }

First Run

  1. Start your MCP client (Claude Desktop, etc.)
  2. Choose authentication method based on your preference:
    • OAuth 2.0 (default): Browser opens automatically for authorization
    • JWT Token: Set JWT_TOKEN environment variable
    • Application Password: Set WP_API_USERNAME and WP_API_PASSWORD
  3. Start using WordPress features in your AI assistant

WordPress MCP Plugin

You need to install the wordpress-mcp plugin on your WordPress website and enable MCP Functionality in Settings > MCP Settings.

Authentication Methods

OAuth 2.1 provides the most secure and user-friendly experience with full MCP Authorization specification compliance.

For Self-Hosted WordPress Sites:
{ "mcpServers": { "wordpress": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote"], "env": { "WP_API_URL": "https://your-wordpress-site.com", "OAUTH_ENABLED": "true" } } } }

MCP Authorization Specification Features:

  • OAuth 2.1 authorization code flow with PKCE (RFC 7636)
  • Resource Indicators (RFC 8707) for token audience binding
  • Dynamic Client Registration (RFC 7591) when supported
  • Protected Resource Metadata Discovery (RFC 9728)
  • Authorization Server Metadata Discovery (RFC 8414)

Benefits:

  • Full compliance with MCP Authorization specification 2025-06-18
  • Enhanced security with PKCE protection
  • One-time browser authorization
  • Tokens stored securely with automatic validation
  • Automatic endpoint discovery
  • No need to manage passwords
  • Automatic expiration handling

2. JWT Token Authentication

For server-to-server authentication or when OAuth is not available.

{ "mcpServers": { "wordpress": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote"], "env": { "WP_API_URL": "https://your-wordpress-site.com", "JWT_TOKEN": "your-jwt-token-here" } } } }

3. WordPress Application Passwords (Legacy)

Uses WordPress username and application password for basic authentication.

{ "mcpServers": { "wordpress": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote"], "env": { "WP_API_URL": "https://your-wordpress-site.com", "WP_API_USERNAME": "your-username", "WP_API_PASSWORD": "your-application-password", "OAUTH_ENABLED": "false" } } } }

To create an application password:

  1. Go to your WordPress admin dashboard
  2. Navigate to Users > Profile
  3. Scroll down to "Application Passwords"
  4. Create a new application password for MCP access

Advanced Configuration

Custom OAuth Settings

{ "mcpServers": { "wordpress": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote"], "env": { "WP_API_URL": "https://your-wordpress-site.com", "OAUTH_CALLBACK_PORT": "7665", "OAUTH_HOST": "127.0.0.1", "WP_OAUTH_CLIENT_ID": "your-custom-client-id" } } } }

WooCommerce Integration

For WooCommerce-specific tools and reports:

{ "mcpServers": { "wordpress": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote"], "env": { "WP_API_URL": "https://your-wordpress-site.com", "WOO_CUSTOMER_KEY": "ck_your-consumer-key", "WOO_CUSTOMER_SECRET": "cs_your-consumer-secret" } } } }

Environment Variables

VariableDescriptionDefaultRequired
WP_API_URLWordPress site URL-✅
OAUTH_ENABLEDEnable OAuth authenticationtrue-
OAUTH_CALLBACK_PORTOAuth callback port7665-
OAUTH_HOSTOAuth callback hostname127.0.0.1-
WP_OAUTH_CLIENT_IDCustom OAuth client ID--
OAuth Endpoints
OAUTH_AUTHORIZE_ENDPOINTOAuth authorization endpoint-✅ (for custom OAuth)
OAUTH_TOKEN_ENDPOINTOAuth token endpoint-✅ (for custom OAuth)
OAUTH_AUTHENTICATE_ENDPOINTOAuth authenticate endpoint--
MCP OAuth 2.1 Settings
OAUTH_FLOW_TYPEOAuth flow type (authorization_code or implicit)authorization_code-
OAUTH_USE_PKCEUse PKCE (required for OAuth 2.1)true-
OAUTH_DYNAMIC_REGISTRATIONEnable dynamic client registrationtrue-
OAUTH_RESOURCE_INDICATORUse resource indicators (RFC 8707)true-
Configuration
WP_MCP_CONFIG_DIRConfig directory override~/.mcp-auth-
LOG_FILELog file path--
LOG_LEVELLog level (0-3)2-
Legacy Authentication
JWT_TOKENJWT token for authentication--
WP_API_USERNAMEWordPress username (legacy)--
WP_API_PASSWORDWordPress app password (legacy)--
WOO_CUSTOMER_KEYWooCommerce consumer key--
WOO_CUSTOMER_SECRETWooCommerce consumer secret--

Disable OAuth

To use only JWT or Basic Auth:

{ "env": { "OAUTH_ENABLED": "false", "JWT_TOKEN": "your-jwt-token" } }

Development Mode

For development and testing, you can use the local repository:

Setup

  1. Clone the repository:
    git clone https://github.com/Automattic/mcp-wordpress-remote.git cd mcp-wordpress-remote
  2. Install dependencies:
    npm install
  3. Build the project:
    npm run build

Configuration

Configure your MCP client to use the local version:

{ "mcpServers": { "wordpress": { "command": "node", "args": ["/path/to/your/mcp-wordpress-remote/dist/proxy.js"], "env": { "WP_API_URL": "https://your-wordpress-site.com" } } } }

Development Workflow

  • Watch mode: npm run build:watch - Automatically rebuilds on file changes
  • Testing: npm test - Run the test suite
  • Type checking: npm run check - Run TypeScript and Prettier checks

Token Management

OAuth Token Storage

Tokens are automatically stored in:

~/.mcp-auth/wordpress-remote-{version}/

Manual Management

# View stored tokens ls -la ~/.mcp-auth/wordpress-remote-*/ # Clear all tokens (forces re-authentication) rm -rf ~/.mcp-auth/wordpress-remote-*/ # Clear tokens for specific version rm -rf ~/.mcp-auth/wordpress-remote-0.2.1/

Token Security

  • Secure file permissions (600) on all token files
  • Automatic token validation before each request
  • Expired token cleanup during startup
  • Version isolation - each version stores tokens separately

Multi-Instance Support

The proxy automatically coordinates between multiple instances:

  • Lockfiles prevent simultaneous OAuth flows
  • Process coordination ensures only one authentication at a time
  • Graceful waiting when another instance is authenticating
  • Automatic cleanup of stale locks

If you see "waiting for other instance" messages, this is normal behavior.

Troubleshooting

Authentication Issues

OAuth browser doesn't open:

  • Check if port 3000 is available
  • Try a different port with OAUTH_CALLBACK_PORT
  • Manually open the URL shown in logs

OAuth authorization fails:

  • Verify WordPress site has MCP plugin installed and enabled
  • Check WordPress admin user permissions
  • Try clearing tokens and re-authenticating

JWT authentication fails:

  • Verify JWT token is valid and not expired
  • Check token format and encoding
  • Ensure WordPress site supports JWT authentication

Basic Auth fails:

  • Verify username and application password
  • Check application password is active
  • Ensure user has sufficient permissions

Connection Issues

API endpoint not found:

  • Verify WordPress MCP plugin is installed and activated
  • Check plugin is enabled in WordPress admin
  • Confirm WP_API_URL is correct

Permission denied:

  • Check user permissions in WordPress
  • Verify authentication credentials
  • Review WordPress user roles

Port Conflicts

If port 3000 is already in use:

{ "env": { "OAUTH_CALLBACK_PORT": "8080" } }

Multi-instance Messages

"Waiting for other instance" messages are normal when multiple MCP clients start simultaneously. The system coordinates authentication to prevent conflicts.

Log Analysis

Enable detailed logging:

{ "env": { "LOG_LEVEL": "3", "LOG_FILE": "/path/to/logfile.log" } }

Log levels:

  • 0 - Errors only
  • 1 - Warnings and errors
  • 2 - Info, warnings, and errors (default)
  • 3 - Debug, info, warnings, and errors

Security Features

  • Secure OAuth flow with state parameters and PKCE
  • Token encryption with secure file permissions
  • Automatic validation before each API request
  • Expired token cleanup and refresh handling
  • Multi-instance coordination prevents authentication conflicts

Why Use MCP WordPress Remote?

  1. Multiple Authentication Methods - Choose what works best for your setup
  2. Enhanced Security - OAuth 2.0 with persistent token storage
  3. Better User Experience - One-time setup with automatic token management
  4. Multi-Instance Support - Works reliably with multiple MCP clients
  5. Comprehensive Logging - Detailed logs for troubleshooting
  6. Easy Setup - No global installation required with npx

Requirements

  • Node.js 22+ (required for fetch API support)
  • WordPress site with wordpress-mcp plugin
  • WordPress user account with appropriate permissions

License

GPL v2 or later

Contributing

Contributions welcome! This project is maintained by Automattic Inc.

Support

Need help? Check the troubleshooting section or open an issue.

This server cannot be installed

-
security - not tested
A
license - permissive license
-
quality - not tested

How are these scores calculated?

remote-capable server

The server can be hosted and run remotely because it primarily relies on remote services or has no dependency on the local environment.

Acts as a bridge between local MCP clients and WordPress websites, enabling communication with WordPress through simple REST API requests rather than keeping open connections.

  1. Requirements
    1. WordPress MCP plugin
      1. Why
        1. Usage
          1. Environment Variables
          2. Configuration in MCP Clients
        2. @todo

          Related MCP Servers

          • Shopify MCP Server

            siddhantbajaj
            -
            security
            A
            license
            -
            quality
            This MCP server connects clients with Shopify store data, enabling retrieval of product and customer information via exposed tools.
            Last updated -
            4
            Python
            MIT License

          • Lodestar MCP Server

            kanlanc
            -
            security
            F
            license
            -
            quality
            This is an MCP server that facilitates building tools for interacting with various APIs and workflows, supporting Python-based development with potential for customizable prompts and user configurations.
            Last updated -
            Python

          • WooCommerce MCP Server

            techspawn
            -
            security
            A
            license
            -
            quality
            WooCommerce MCP Server enables interaction with WooCommerce stores through the WordPress REST API. It provides comprehensive tools for managing all aspects of products, orders, customers, shipping, taxes, discounts, and store configuration using JSON-RPC 2.0 protocol.
            Last updated -
            56
            JavaScript
            MIT License
            • Apple
            • Linux

          • mcprouter

            chatmcp
            -
            security
            A
            license
            -
            quality
            A proxy service that connects MCP clients to remote MCP servers, allowing users to use server keys from MCP.so to access remote resources without running their own server.
            Last updated -
            37
            3
            TypeScript
            MIT License
            • Apple

          View all related MCP servers

          MCP directory API

          We provide all the information about MCP servers via our MCP API.

          curl -X GET 'https://glama.ai/api/mcp/v1/servers/Automattic/mcp-wordpress-remote'

          If you have feedback or need assistance with the MCP directory API, please join our Discord server