MainWP MCP Server

A MainWP Labs project, powered by MainWP

Manage your whole WordPress network by talking to your AI assistant. MainWP MCP Server connects Claude, Cursor, OpenAI Codex, VS Code Copilot, and other MCP-compatible tools to your MainWP Dashboard, so you can ask in plain English:

"Which sites have pending plugin updates?"

"Update WooCommerce everywhere it's behind."

"Which client sites are disconnected right now?"

The server is a small program that runs on your own computer, alongside your AI tool. Nothing new is installed on your Dashboard or your child sites. Your Dashboard stays in control: it exposes only the tools you allow, and by default anything classified as destructive stops for your confirmation before it runs.

What You Can Do

• Site Management: List sites, check connection status, sync data, add or remove child sites

• Update Management: See pending updates across all sites, apply core/plugin/theme updates

• Plugin and Theme Control: View installed plugins and themes, activate or deactivate them

• Client Organization: Manage client records, assign sites to clients, track costs

• Bulk Operations: Sync, reconnect, or check connectivity across dozens of sites at once

Built for WordPress agencies and site managers who want AI assistance with their MainWP workflows.

Related MCP server: WP Pinch

Documentation

Full documentation lives at docs.mainwp.com/mcp-server:

• Quickstart with screenshots, if this is your first MCP server

• Setup for every AI client: Claude Desktop, Claude Code, Cursor, VS Code Copilot, OpenAI Codex, ZenCoder, and others

• Safety & Permissions: the confirmation flow, safe mode, and tool filtering

• Prompt Cookbook: ready-to-use prompts by task

• Configuration Reference and Troubleshooting

Quick Start

Requirements: Node.js >=20.19.0 and MainWP Dashboard 6.0+

1. Create an Application Password. This is a separate password WordPress issues for tools like this one; it never changes your login and you can revoke it at any time.

1. Log into your MainWP Dashboard as an administrator

2. Go to Users > Profile (click your username in the top right)

3. Scroll to the Application Passwords section

4. Enter a name like "MainWP MCP Server" and click Add New Application Password

5. Copy the generated password immediately (it is only shown once; spaces are fine either way)

Tip: Create a dedicated WordPress user for API access rather than using your main admin account. It keeps the audit trail clean and is easy to revoke later.

2. Add the server to your AI tool. For Claude Desktop and most other MCP clients, the config block looks like this:

{
  "mcpServers": {
    "mainwp": {
      "command": "npx",
      "args": ["-y", "@mainwp/mcp"],
      "env": {
        "MAINWP_URL": "https://your-dashboard.com",
        "MAINWP_USER": "admin",
        "MAINWP_APP_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Config file locations and variants for each client are in the client setup guide. Prefer a central credentials file, or manage several Dashboards? See the configuration reference.

3. Restart your AI tool and ask: "List all my sites". A working setup returns your child sites by name and URL.

Start bounded. You don't have to expose every tool on day one. Grant the smallest set your workflow needs and widen from there. See Restrict Available Tools.

For development, clone and build instead of npx:

git clone https://github.com/mainwp/mainwp-mcp.git
cd mainwp-mcp
npm ci
npm run build

Configuration

⚠️ Security Warning: SSL Verification

Setting MAINWP_SKIP_SSL_VERIFY=true disables SSL certificate verification, making your connection vulnerable to man-in-the-middle (MITM) attacks. Only use for local development with self-signed certificates or isolated test environments. Never use in production or on untrusted networks.

Instead of environment variables, you can use a settings.json file in the working directory or ~/.config/mainwp-mcp/settings.json; environment variables override file settings. Field names, the settings-to-variable mapping, and per-setting detail are in the Configuration Reference.

Tools

Around 60 tools, organized by category (the exact count varies by Dashboard version):

Tool names drop the mainwp/ namespace and use underscores: the ability mainwp/list-sites-v1 is the tool list_sites_v1. Naming rules, the built-in MCP resources (mainwp://abilities, mainwp://status, and friends), and namespace prefixing for third-party abilities are covered in Tools & Resources.

Safety

Operations classified as destructive (the deletion tools, plus any ability that does not declare itself non-destructive) use a two-step flow by default: the server returns a preview and a one-time token, your AI shows you what will be affected, and only your explicit approval executes it. Disabling the flow (MAINWP_REQUIRE_USER_CONFIRMATION=false) removes that gate. Safe mode (MAINWP_SAFE_MODE=true) blocks destructive operations entirely, and tool filtering can remove them from the AI's view altogether. The full model, including what safe mode does and does not protect against, is on Safety & Permissions; the underlying trust and credential model is in the Security Model.

Contributing

npm ci             # install dependencies
npm run dev        # run in watch mode
npm run inspect    # test with MCP Inspector
npm test           # run tests
npm run lint       # check code style
npm run format     # fix formatting

CI runs lint, format check, type check, tests, and build on every pull request.

When changing configuration options, update both the environment-variable table above and the docs-site configuration reference; they are maintained in parallel.

License

GPL-3.0. See LICENSE.