WordPress MCP Server

Instructions

Implementation Reference

• src/index.ts:532-563 (handler)

  The handler function for the 'delete-user' tool. It performs a DELETE request to the WordPress /wp-json/wp/v2/users/{userId} endpoint with force=true and reassign={reassignId} parameters to delete the user and reassign their content.

  async ({ siteUrl, username, password, userId, reassignId }) => {
    try {
      await makeWPRequest<any>({
        siteUrl,
        endpoint: `users/${userId}`,
        method: "DELETE",
        auth: { username, password },
        params: {
          force: true,
          reassign: reassignId
        }
      });
      
      return {
        content: [
          {
            type: "text",
            text: `Successfully deleted user ${userId}. Posts have been reassigned to user ${reassignId}.`,
          },
        ],
      };
    } catch (error) {
      return {
        content: [
          {
            type: "text",
            text: `Error deleting user: ${error instanceof Error ? error.message : String(error)}`,
          },
        ],
      };
    }
  }

• src/index.ts:525-531 (schema)

  Zod input schema for the 'delete-user' tool defining parameters: siteUrl, username, password, userId (string/number/'me'), reassignId.

  {
    siteUrl: z.string().url().describe("WordPress site URL"),
    username: z.string().describe("WordPress username"),
    password: z.string().describe("WordPress application password"),
    userId: z.union([z.string(), z.number(), z.literal("me")]).describe("User ID or 'me' for current user"),
    reassignId: z.number().describe("ID of the user to reassign posts to"),
  },

• src/index.ts:522-564 (registration)

  Registration of the 'delete-user' tool via server.tool() with name, description, input schema, and inline handler function.

  server.tool(
    "delete-user",
    "Delete a WordPress user",
    {
      siteUrl: z.string().url().describe("WordPress site URL"),
      username: z.string().describe("WordPress username"),
      password: z.string().describe("WordPress application password"),
      userId: z.union([z.string(), z.number(), z.literal("me")]).describe("User ID or 'me' for current user"),
      reassignId: z.number().describe("ID of the user to reassign posts to"),
    },
    async ({ siteUrl, username, password, userId, reassignId }) => {
      try {
        await makeWPRequest<any>({
          siteUrl,
          endpoint: `users/${userId}`,
          method: "DELETE",
          auth: { username, password },
          params: {
            force: true,
            reassign: reassignId
          }
        });
        
        return {
          content: [
            {
              type: "text",
              text: `Successfully deleted user ${userId}. Posts have been reassigned to user ${reassignId}.`,
            },
          ],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text",
              text: `Error deleting user: ${error instanceof Error ? error.message : String(error)}`,
            },
          ],
        };
      }
    }
  );

• src/index.ts:157-194 (helper)

  Shared utility function makeWPRequest used by the delete-user handler (and other tools) to make authenticated HTTP requests to the WordPress REST API.

  // Helper function for making WordPress API requests
  async function makeWPRequest<T>({
    siteUrl, 
    endpoint,
    method = 'GET',
    auth,
    data = null,
    params = null
  }: {
    siteUrl: string;
    endpoint: string;
    method?: 'GET' | 'POST' | 'PUT' | 'DELETE';
    auth: { username: string; password: string };
    data?: any;
    params?: any;
  }): Promise<T> {
    const authString = Buffer.from(`${auth.username}:${auth.password}`).toString('base64');
    
    try {
      const response = await axios({
        method,
        url: `${siteUrl}/wp-json/wp/v2/${endpoint}`,
        headers: {
          'Authorization': `Basic ${authString}`,
          'Content-Type': 'application/json',
        },
        data: data,
        params: params
      });
      
      return response.data as T;
    } catch (error) {
      if (axios.isAxiosError(error) && error.response) {
        throw new Error(`WordPress API error: ${error.response.data?.message || error.message}`);
      }
      throw error;
    }
  }