Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-wordpress list recent posts"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Model Context Protocol server for WordPress — content, SEO and marketing automation
A Model Context Protocol server that gives Claude (or any MCP-compatible LLM) direct access to a self-hosted WordPress site over its REST API.
Status: v1.2.0 release candidate — 73 tools, 373 tests, full release pipeline ready.
wp_health_check — verify connectivity, detect REST namespaces, detect MCP Bridge and SEO plugins
wp_posts_list — list with filters (status, search, author, categories, tags, date range, ordering, pagination)
wp_posts_get — fetch a single post by id with full content
wp_posts_create — create a draft (default) or any status (publish/future/private require publish tier)
wp_posts_update — partial update by id
wp_posts_publish — shortcut to set status=publish
wp_posts_schedule — schedule for future publication (date must be in the future)
wp_posts_delete — to trash by default; force+confirm for hard delete (MODE=full)
wp_posts_get_revisions — list revisions/autosaves of a post
wp_pages_list — list with filters (parent for hierarchy, status, search, author, ordering)
wp_pages_get — fetch a single page by id with full content
wp_pages_create — create with hierarchy (parent) and ordering (menu_order)
wp_pages_update — partial update including re-parenting
wp_pages_delete — to trash by default; force+confirm for hard delete
wp_media_list — list with filters (media_type, mime_type, search, date range, parent post)
wp_media_upload — upload from URL or base64; optional title/alt_text/caption/description; max 25 MB
wp_media_set_alt_text — update alt_text + caption + description for accessibility and SEO
wp_media_delete — to trash by default; force+confirm for hard delete
wp_taxonomies_list_categories — list with search, parent (hierarchy), hide_empty, ordering
wp_taxonomies_create_category — create with optional parent
wp_taxonomies_list_tags — list flat tags with post counts
wp_taxonomies_create_tag — create a tag
wp_taxonomies_assign_to_post — replace categories and/or tags on a post
wp_search_posts — full-text search via /wp/v2/search across posts, pages, CPTs, and terms
wp_seo_detect_provider — detect active provider (bridge / yoast / rankmath / null) and its capabilities
wp_seo_get_meta — read SEO meta for a post via the active provider
wp_seo_set_meta — write SEO meta (title, description, OG, Twitter, canonical, robots, JSON-LD, focus_keyword) via the active provider
wp_seo_analyze_post — readability (Flesch-Kincaid ES/EN/PT) + keyword density + headings hierarchy lint + length stats; optional focus_keyword for presence check
wp_seo_suggest_internal_links — ranked related-post suggestions from a keyword or post_id; title matches weighted 3x over excerpt + recency boost
wp_bulk_find_replace — find/replace literal substring across post content. Dry-run by default; apply with confirm token.
wp_bulk_update_seo — apply same SEO meta to many posts via active provider. Dry-run by default; apply with confirm token.
Both bulk tools require MODE=full (set MODE=full env var). The dry-run response includes the exact confirm_token you need to pass to actually apply the change.
wp_health_check (covered earlier) — REST namespaces + bridge + SEO plugin detection
wp_get_site_info — title, tagline, URL, language, timezone, sitemap URL, posts-per-page
wp_detect_page_builder — warn when Elementor/Divi/Beaver/WPBakery is active (their content can't be edited via posts tools)
wp_comments_list — filter by post/author/status/type
wp_comments_get — single comment with full author details
wp_comments_create — create or reply (parent)
wp_comments_update — moderate (approve/spam/trash) or edit
wp_comments_delete — trash or hard delete
wp_users_list — search, filter by role, who=authors
wp_users_get — single user
wp_users_get_current — whoami (current Application Password user)
wp_users_create — new user with role
wp_users_update — partial update including role changes
wp_users_delete — permanent delete with content reassignment (MODE=full)
wp_get_post_types — all registered post types (built-in + custom)
wp_get_taxonomies — all taxonomies (built-in + custom), optional type filter
wp_get_post_statuses — available post statuses
wp_get_site_capabilities — single-call summary of types + taxonomies + namespaces + plugin detection
wp_cpt_list — list any CPT (WooCommerce products, events, custom)
wp_cpt_get, wp_cpt_create, wp_cpt_update, wp_cpt_delete
wp_taxonomies_get_category / _update_category / _delete_category
wp_taxonomies_get_tag / _update_tag / _delete_tag
wp_blocks_list / _get / _create / _update / _delete — Gutenberg reusable block CRUD
wp_posts_get_revision — fetch one revision
wp_posts_restore_revision — rollback a post to an earlier state
wp_pages_get_revisions — list revisions of a page
wp_pages_get_revision / _restore_revision — same for pages
wp_media_get — full media metadata
wp_media_update — generic partial update of any media field
wp_update_site_settings — write title, tagline, timezone, language, posts_per_page, etc.
wp_batch — execute up to 25 REST requests in one round-trip
Related MCP server: ItchWPMCP
TypeScript / Node ≥22, ESM modules
@modelcontextprotocol/sdk over stdio transport
Application Password authentication (native since WP 5.6)
Rate limiting (Bottleneck), retry with exponential backoff, in-memory LRU+TTL cache
Three operational modes: read-only / safe (default) / full
Audit log of all write operations
See docs/superpowers/specs/2026-06-01-mcp-wordpress-design.md for the full design.
npm install -g @iamsamuelfraga/mcp-wordpressOr via npx (no installation):
npx -y @iamsamuelfraga/mcp-wordpressGo to WP Admin → Users → Your Profile → Application Passwords. Enter a name (e.g., "Claude MCP") and click "Add New Application Password". Copy the 24-character password (formatted as 6 groups of 4 characters).
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS):
{
"mcpServers": {
"wordpress": {
"command": "npx",
"args": ["-y", "@iamsamuelfraga/mcp-wordpress"],
"env": {
"WP_URL": "https://your-site.com",
"WP_USER": "your_admin_username",
"WP_APP_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx",
"MODE": "safe"
}
}
}
}Restart Claude Desktop.
In Claude, ask: "Run a health check on my WordPress site." — you should see your site title, the detected REST namespaces, and whether SEO plugins are present.
For full SEO functionality (rendering meta description, Open Graph, Twitter Card, JSON-LD, and per-post robots directives in your site's <head>), install the MCP WordPress Bridge companion plugin on your WordPress site.
Download mcp-wordpress-bridge-X.Y.Z.zip from the Releases page.
In wp-admin, go to Plugins → Add New → Upload Plugin → choose the zip → Install → Activate.
No further configuration needed. The plugin auto-detects Yoast / Rank Math / AIOSEO / SEOPress and defaults to coexist mode (no double-rendering).
wp-config.php)define('MCP_BRIDGE_MODE', 'coexist'); // default: skip if another SEO plugin is active
// define('MCP_BRIDGE_MODE', 'override'); // always render our meta
// define('MCP_BRIDGE_MODE', 'disable'); // don't render anything (data layer only)Once installed, the MCP server detects the bridge via wp_health_check (look for bridge.installed: true). New REST endpoints become available under /wp-json/mcp/v1/*:
GET /info — plugin version, capabilities, detected SEO plugins
GET|POST|DELETE /seo/{post_id} — read/write/clear our SEO meta for a post
GET /plugins — active plugins list
GET /theme — active theme info
GET /permalinks — read-only permalink structure
GET /health — health check (no auth)
All settings via environment variables:
Variable | Required | Default | Description |
| yes | — | Base URL of your WordPress site |
| yes | — | WordPress username |
| yes | — | Application Password (24 chars, with or without spaces) |
| no |
|
|
| no | all | Comma-separated: |
| no |
| Requests per second cap |
| no |
| In-memory cache TTL |
| no |
|
|
| no |
|
|
| no |
| Per-request timeout |
| no |
| Where write ops are logged |
git clone https://github.com/iamsamuelfraga/mcp-wordpress.git
cd mcp-wordpress
npm install
npm run build
npm test# 1. Start the Dockerized WordPress
docker compose -f docker-compose.test.yml up -d
# 2. Seed WP and capture an Application Password (printed on stdout)
APP_PASSWORD=$(./tests/integration/wp-seed.sh)
# 3. Run integration tests
WP_URL=http://localhost:8080 \
WP_USER=admin \
WP_APP_PASSWORD="$APP_PASSWORD" \
npm run test:integration
# 4. Tear down
docker compose -f docker-compose.test.yml down -vThis project uses semantic-release to automate versioning, changelog generation, and publishing. Every push to main runs the release workflow:
Inspects commits using Conventional Commits (feat:, fix:, chore:, docs:, refactor:, etc.).
Bumps the version accordingly (patch / minor / major).
Updates CHANGELOG.md.
Publishes to npm as @iamsamuelfraga/mcp-wordpress.
Creates a GitHub Release with the companion plugin .zip attached.
To enable npm publishing, the repository owner must add an NPM_TOKEN secret in GitHub repo settings.
MIT © 2026 Samuel Fraga
Execute up to 25 WP REST requests in a single round-trip via /wp/v2/batch/v1. Use for performance when applying many independent writes. validation="require-all-validate" (default) rejects the batch if any request fails validation; "normal" runs everything best-effort.
Inputs: requests (required), validation.
Create a new reusable block. Content should be Gutenberg block markup (e.g., text). Status defaults to publish (reusable blocks are typically immediately available for embedding).
Inputs: title (required), content (required), slug, status.
Delete a reusable block. Default trash. force=true with confirm="DELETE_PERMANENTLY_" hard-deletes (MODE=full). WARNING: posts/pages referencing this block will show an empty block placeholder.
Inputs: id (required), force, confirm.
Fetch a single reusable block by id with full content (Gutenberg block markup).
Inputs: id (required), context.
List reusable Gutenberg blocks (post type wp_block). These are user-created reusable block compositions, used to insert the same content across multiple posts/pages.
Inputs: page, order, search, status, +2 more.
Partially update a reusable block. NOTE: editing a reusable block updates its content in every post/page that uses it.
Inputs: id (required), slug, title, status, +1 more.
Find and replace a literal substring across post content. Requires MODE=full. Dry-run by default (returns count + sample of changes). To apply, set dry_run=false and provide the confirm token returned by the dry-run. Operates on rendered post_content only; does not touch titles, excerpts, or meta.
Inputs: find (required), replace (required), status, confirm, +2 more.
Apply the same SEO meta to many posts at once. Requires MODE=full. Dry-run by default (returns count + sample). To apply, set dry_run=false with the confirm token from dry-run. Writes via the active SEO provider — fields unsupported by the provider are silently dropped.
Inputs: meta (required), filter (required), confirm, dry_run, +1 more.
Create a comment (or reply via parent). When author is omitted, author_name + author_email are required.
Inputs: post (required), content (required), date, author, +7 more.
Delete a comment. Default to trash (recoverable). force=true with confirm="DELETE_PERMANENTLY_" permanently deletes (requires MODE=full).
Inputs: id (required), force, confirm.
Fetch a single comment by id, including author email (edit context).
Inputs: id (required), context.
List comments with filters: post, parent, author, status (approved/hold/spam/trash/any), type, search, ordering. Hold status = pending moderation.
Inputs: page, post, type, order, +6 more.
Update a comment. Moderation actions: status=approved (publish), hold (pending), spam, trash. Can also edit content and author fields.
Inputs: id (required), status, content, author_url, +2 more.
Create a new item of any Custom Post Type. Required: post_type, title. Defaults to draft status. Pass meta object to set custom fields (subject to register_post_meta + show_in_rest registration on the WP side).
Inputs: title (required), post_type (required), meta, slug, +3 more.
Delete an item of any CPT. Default to trash. force=true with confirm="DELETE_PERMANENTLY_" for hard delete (requires MODE=full).
Inputs: id (required), post_type (required), force, confirm.
Fetch a single item of a Custom Post Type by id. post_type must match rest_base from wp_get_post_types.
Inputs: id (required), post_type (required), context.
List items of any registered Custom Post Type. The post_type parameter must match the rest_base value returned by wp_get_post_types (e.g., "product" for WooCommerce, "event" for The Events Calendar). For built-in posts/pages, prefer wp_posts_list / wp_pages_list.
Inputs: post_type (required), page, order, search, +3 more.
Partially update an item of any CPT. Only fields provided are changed.
Inputs: id (required), post_type (required), meta, slug, +4 more.
Detect whether Elementor, Divi, Beaver Builder, or WPBakery (visual page builders) are active. These store content outside of post_content, which limits what the MCP can edit. Requires the mcp-wordpress-bridge companion plugin to enumerate plugins.
Inputs: no named parameters.
List all available post statuses (built-in: publish/draft/pending/private/future and any custom statuses).
Inputs: no named parameters.
List all post types registered on this site, including built-in (post, page) and custom (WooCommerce products, ACF CPTs, etc.). Returns rest_base, hierarchy, supported features, taxonomies. Use this before wp_cpt_* tools.
Inputs: no named parameters.
High-level summary of what this WP install supports: list of post types (slugs only), taxonomies (slugs only), REST API namespaces, whether the mcp-wordpress-bridge plugin is installed. Useful as a single "what can I do here?" probe.
Inputs: no named parameters.
Read site-level configuration: title, tagline, URL, language, timezone, date/time formats, posts-per-page, sitemap URL, and admin email (if accessible). Combines /wp-json/ root with /wp-json/wp/v2/settings (admin-only). Sitemap URL points to the native /wp-sitemap.xml (WP 5.5+).
Inputs: no named parameters.
List all taxonomies registered on this site, including custom (e.g., product_cat for WooCommerce). Optional type filter to list only taxonomies associated with a given post type.
Inputs: type.
Verify connectivity, authentication, and capabilities of the configured WordPress site. Returns reachability, REST API namespaces, and whether the MCP Bridge companion plugin is installed.
Inputs: no named parameters.
Delete a media item. Default sends to trash (recoverable). Pass force=true with confirm="DELETE_PERMANENTLY_" to permanently delete (requires MODE=full). Note: WP's native UI offers no trash recovery for media by default — many sites have ATTACHMENT_DEFAULT_TRASH disabled. Verify your site's behavior before relying on the trash.
Inputs: id (required), force, confirm.
Fetch a single media item by id with all metadata: dimensions, file size, thumbnails, alt text, caption, attached post.
Inputs: id (required), context.
List media library items with filters. Filter by media_type (image/video/audio/file), exact mime_type (e.g. "image/png"), search text, date range, or parent post. Returns normalized media including source_url and thumbnails.
Inputs: page, after, order, before, +6 more.
Update accessibility and descriptive metadata of a media item: alt_text (required), caption and description (optional). Useful for bulk SEO improvements on existing media. Empty alt_text is allowed (explicitly clearing).
Inputs: id (required), alt_text (required), caption, description.
Generic partial update of media item fields: title, alt_text, caption, description, attached post, slug, status. Use wp_media_set_alt_text for the focused alt+caption+description tool when that's all you need.
Inputs: id (required), post, slug, title, +4 more.
Upload a file to the WordPress media library. Provide EITHER url (the server will fetch the URL and forward the bytes) OR data (a base64-encoded string) with filename and mime_type. Optional metadata: title, alt_text, caption, description, post (attach to a post). Max 25 MB.
Inputs: url, data, post, title, +5 more.
Create a new page. Default status="draft" (safe). Supports hierarchy via parent (page id) and ordering via menu_order. Publish/future/private require publish tier.
Inputs: title (required), content (required), date, meta, +8 more.
Delete a page. Default sends it to the trash (recoverable). Pass force=true with confirm="DELETE_PERMANENTLY_" to permanently delete (requires MODE=full). Deleting a parent page with children: WP behavior is to orphan children (their parent becomes 0); the MCP does not auto-cascade.
Inputs: id (required), force, confirm.
Fetch a single page by ID with full content. Use context=edit (default) for raw fields, context=view for the public rendered version only.
Inputs: id (required), context.
Fetch a single revision of a page by id.
Inputs: page_id (required), revision_id (required).
List revisions/autosaves of a page.
Inputs: page_id (required).
List pages with filters. Pages support a hierarchy via parent (use parent=N to list direct children of page N, parent=0 for top-level). Default orders by menu_order ascending — the typical navigation order.
Inputs: page, order, author, parent, +4 more.
Restore a previous revision of a page (writes revision title/content/excerpt back to the parent page).
Inputs: page_id (required), revision_id (required).
Partially update an existing page by id. Only provided fields are changed. Status transitions to publish/future/private require the publish tier. Use parent to re-parent the page in the hierarchy.
Inputs: id (required), date, meta, slug, +9 more.
Create a new blog post. Default status is "draft" (safe). Use status="publish" to publish immediately (requires publish tier), or status="future" with date to schedule.
Inputs: title (required), content (required), date, meta, +9 more.
Delete a post. Default sends it to the trash (recoverable). Pass force=true with confirm="DELETE_PERMANENTLY_" to permanently delete (requires MODE=full).
Inputs: id (required), force, confirm.
Fetch a single blog post by ID. Returns the normalized post with full content (rendered HTML). Use context=edit (default) to include raw fields when available; context=view for the public-facing rendered version only.
Inputs: id (required), context.
Fetch a single revision of a post by id. Use wp_posts_get_revisions to list revisions, then this to read a specific one's content for diffing or restoration.
Inputs: post_id (required), revision_id (required).
List revisions of a post (autosaves + manual revisions). Returns each revision with id, parent post id, author, dates, and rendered title/content/excerpt. Read-only.
Inputs: post_id (required).
List blog posts with filters: status, search, author, categories, tags, date range, ordering. Returns normalized post summaries (id, title, excerpt, slug, status, dates, author, taxonomies). Use wp_posts_get to fetch full content.
Inputs: page, tags, after, order, +7 more.
Publish an existing post by id (sets status to "publish"). Shortcut for wp_posts_update with status="publish". Requires publish tier.
Inputs: id (required).
Restore a previous revision of a post. Reads the revision content + title + excerpt, then writes them back to the parent post. The previous state of the parent becomes a new revision automatically.
Inputs: post_id (required), revision_id (required).
Schedule a post for future publication by setting status="future" and date. The date must be in the future. Requires publish tier.
Inputs: id (required), date (required).
Partially update an existing post by id. Only fields provided are changed. Status transitions to publish/future/private require the publish tier.
Inputs: id (required), date, meta, slug, +9 more.
Full-text search across posts, pages, custom post types, and terms via the WP /wp/v2/search endpoint. Returns a lightweight result shape (id, title, url, type, subtype). Filter by type=post (default search target) or type=term (taxonomies). For richer content fetch the hit by id via wp_posts_get / wp_pages_get.
Inputs: query (required), page, type, subtype, +1 more.
Run SEO/content analysis on a post: readability (Flesch-Kincaid in ES/EN/PT), keyword density, headings hierarchy lint, content length stats. Optionally pass focus_keyword to get presence stats (in title, first paragraph, headings) and density of that exact term.
Inputs: post_id (required), language, focus_keyword.
Detect which SEO provider is active for this WordPress site (bridge / yoast / rankmath / null) and report its capabilities. Use this before calling wp_seo_set_meta to know what fields will actually be persisted and rendered.
Inputs: no named parameters.
Read the current SEO meta for a post (title, description, OG, Twitter, canonical, robots, JSON-LD, focus_keyword). The meta is read from whichever SEO provider is active — call wp_seo_detect_provider first to know which one.
Inputs: post_id (required).
Write SEO meta for a post via the active provider. Pass any subset of: title, description, og_title, og_description, og_image (URL), og_type, twitter_card, canonical (URL), robots ({noindex,nofollow,noarchive,nosnippet,noimageindex}), json_ld_article (object), focus_keyword. Fields not supported by the active provider are silently ignored — call wp_seo_detect_provider to know which features apply.
Inputs: meta (required), post_id (required).
Suggest internal links: given a keyword or a post_id, returns a ranked list of related published posts to link to. Ranking weights: title matches (3x) > excerpt matches (1x) + recency boost. The source post is excluded when post_id is provided.
Inputs: limit, status, keyword, post_id.
Replace the categories and/or tags of a post. The arrays REPLACE existing taxonomies (use wp_posts_get first if you want to preserve existing terms and add to them).
Inputs: post_id (required), tag_ids, category_ids.
Create a new blog category. Supports hierarchy via parent (category id). The name is required; slug auto-generated from name if omitted.
Inputs: name (required), slug, parent, description.
Create a new blog tag. Tags are flat (no parent). The name is required; slug auto-generated from name if omitted.
Inputs: name (required), slug, description.
Delete a category (WP REST has no trash for terms — always permanent). Required: confirm="DELETE_CATEGORY_". Requires MODE=full. Posts in this category are NOT deleted; they lose the category assignment.
Inputs: id (required), confirm (required).
Delete a tag (always permanent — no trash). Required: confirm="DELETE_TAG_". Requires MODE=full.
Inputs: id (required), confirm (required).
Fetch a single category by id.
Inputs: id (required).
Fetch a single tag by id.
Inputs: id (required).
List blog categories with filters: search, parent (for hierarchical children), hide_empty (categories with no posts), ordering. Returns terms with post counts.
Inputs: page, order, parent, search, +3 more.
List blog tags. Tags are flat (no hierarchy). Returns terms with post counts. Filter by search text or hide tags with zero posts.
Inputs: page, order, search, orderby, +2 more.
Update a category. Can change name, slug, description, or re-parent.
Inputs: id (required), name, slug, parent, +1 more.
Update a tag. Can change name, slug, or description.
Inputs: id (required), name, slug, description.
Update site-wide settings (title, tagline, URL, language, timezone, default category, posts_per_page, etc.). Requires manage_options capability. Treats this as a publish-tier change because it affects every visitor to the site.
Inputs: url, email, title, language, +9 more.
Create a new WordPress user. Required: username, email, password. Optional: name, first_name, last_name, url, description, roles. Roles default to subscriber.
Inputs: email (required), password (required), username (required), url, +8 more.
Delete a user (WP REST has no trash for users — always permanent). Required: id, reassign (user id to inherit deleted user's content), confirm="DELETE_USER_". Requires MODE=full.
Inputs: id (required), confirm (required), reassign (required).
Fetch a single user by id. Edit context returns email, locale, capabilities (requires manage_options).
Inputs: id (required), context.
Return the user associated with the Application Password used to authenticate. Useful for "whoami" checks and discovering current role/capabilities.
Inputs: no named parameters.
List users. Filter by search text, roles (comma-separated array), who=authors (only users who have published posts). Context=edit returns email + locale + capabilities (requires manage_options).
Inputs: who, page, order, roles, +4 more.
Partially update a user by id. Can change profile fields, password, or roles. Self-update permitted; updating other users requires elevated capabilities.
Inputs: id (required), url, name, slug, +8 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 73 tools
Most tools have clearly distinct resource+action pairs, and descriptions explicitly disambiguate overlapping areas (e.g., wp_media_update vs wp_media_set_alt_text, wp_cpt_* vs wp_posts_*). A few near-duplicates like wp_posts_publish/schedule vs wp_posts_update exist, but they are shortcuts with clear purposes.
The dominant pattern is wp_<resource>_<action> (e.g., wp_pages_get, wp_taxonomies_create_tag), which is consistent and readable. However, there are notable exceptions: a cluster of wp_get_* tools (wp_get_site_info, wp_get_post_types, wp_get_taxonomies), plus standalone wp_health_check, wp_batch, wp_search_posts, and wp_detect_page_builder, mixing conventions.
At 73 tools, the server is extremely large and likely overwhelming for agents to navigate efficiently. While WordPress is a broad domain, many tools are thin wrappers or convenience shortcuts (e.g., wp_posts_publish, wp_media_set_alt_text) that could be consolidated without losing functionality.
The tool set provides comprehensive CRUD coverage for posts, pages, media, comments, users, taxonomies, CPTs, and blocks, plus SEO, site settings, batch operations, search, and health checks. It covers the full lifecycle of WordPress content management with no obvious dead ends.
Free MCP server for WordPress: Claude and ChatGPT connect with OAuth. No account, cap or API key.
Hosted WordPress MCP server for Claude, ChatGPT and Cursor, with each action switched per account.
Manage WordPress blogs and WooCommerce shops from Claude, ChatGPT, Cursor and other MCP apps.
Security-first WordPress MCP server. 129 tools for Claude, ChatGPT, Gemini. Free on wp.org.