Provides shop tools for WooCommerce sites, allowing management of products, stock, coupons, and orders through the MCP server.
Enables AI-driven management of WordPress sites through a bridge plugin, covering content, pages, templates, menus, media, SEO, maintenance, plugins, users, options, REST routes, activity logs, and undo, with permission levels and confirmation safeguards.
Provides SEO capabilities for sites using Yoast SEO, including managing SEO fields and performing page audits.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@WP MCP publish my latest draft post on site A"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Let an AI run your WordPress sites, from zero to production, over MCP only. No visual editor, no plugin UI to learn: the AI gets 14 well-described tools (117 site actions) for design, SEO, maintenance, plugins, content, shop and forms, with permission levels, two-step confirmation, undo and an activity log.
Claude.ai / Claude Code / Cursor / any MCP client
│ Streamable HTTP (stateless) · OAuth 2.1 + PKCE · API keys
▼
┌────────────────────┐ signed HTTPS (HMAC) ┌──────────────────────┐
│ WP MCP gateway │ ────────────────────────────────► │ WP MCP Bridge plugin │ site A
│ (Node/TypeScript) │ ────────────────────────────────► │ (PHP 8.1+, light) │ site B
│ tokens, levels, │ └──────────────────────┘ site C
│ rate limits, log │
└────────────────────┘Question | Answer |
One connection for many sites? | Yes. The AI app connects once to the gateway; every tool takes a |
Connection that does not drop? | Tokens live in the gateway (SQLite), not in |
Safe by default? | Four levels ( |
Heavy on the WordPress site? | No. The plugin is one signed endpoint plus handlers; it does nothing until you pair a gateway. |
Details: docs/architecture.md.
Related MCP server: WordPress MCP Server
Run the gateway (Node 22.13+; Docker also works, see docs/install.md):
cd gateway && npm ci && npm run build
WPMCP_PUBLIC_URL=https://mcp.example.com npm startOpen /admin, enter the setup token printed in the log, choose an owner password.
Install the plugin on each site: zip plugin/wp-mcp-bridge, upload it in Plugins → Add New, activate. Go to Tools → WP MCP Bridge and create a pairing code.
Connect the site in the gateway admin panel (Connect a site: URL + pairing code). Give it a unique name.
Connect your AI: Claude.ai (Settings → Connectors → Add custom connector → https://mcp.example.com/mcp) or Claude Code:
claude mcp add --transport http wp https://mcp.example.com/mcpDetails and API-key setup: docs/connect.md.
Tool | Covers |
| Start here: connected sites, overview of a site, who am I, schema of any action |
| Posts, pages, custom types, categories/tags, comments, revisions |
| Templates and parts (header/footer), CSS sections, design tokens, menus, homepage, branding, themes, theme files |
| Library, upload (base64 or https URL), alt text |
| Yoast / Rank Math / SEOPress / built-in fields, page audit, robots.txt, sitemap, redirects, JSON-LD |
| Real rendered HTML, element tree, stylesheets of any page |
| Health, updates, DB backup/restore, logs, caches, DB cleanup, search-replace, cron, maintenance mode |
| List, search, install, activate, deactivate, delete |
| Users and roles (admin), site options with secret redaction |
| Discover and call any REST route (WooCommerce, forms, custom) with levels derived from route and method |
| WooCommerce products/stock/coupons/orders; CF7, Gravity, WPForms, Fluent Forms |
| What happened (gateway + site), and undo by revision |
Full list: docs/TOOLS.md. The AI also receives instructions at connect time, guide resources, ready prompts (build a site, SEO audit, maintenance, publish a post, redesign a page) and can read the activity log.
Risk | Defence |
A read-only key leaks private data |
|
AI deletes or installs something | Destructive actions are two-step ( |
Server-side request forgery | Gateway connects through a guarded DNS lookup (blocks private/loopback/link-local/metadata at connect time), never follows redirects. The plugin applies the same rules to downloads. |
Prompt injection from site content | Results containing site text carry a |
Rogue OAuth app | Public clients only, PKCE S256 required, redirect allow-list (https / loopback / editor schemes), consent page shows the redirect domain, registration and token endpoints are rate limited, owner can lower or revoke instantly. |
Stolen refresh token | Rotation with reuse detection: replaying an old token ends the whole chain. |
One noisy client starves the rest | Separate buckets per connection, per write, and per site. |
A bad theme edit kills the site | PHP is syntax-checked; the front page is probed afterwards and the change is auto-reverted on a server error. |
Read docs/security.md for the full model and honest limits.
npm test # gateway (109 tests) + plugin checks (94) in one go
npm run docs # regenerate docs/TOOLS.md from spec/ops.jsonspec/build-spec.mjs is the single source of truth for every action (level, arguments, confirmation). scripts/sync-spec.mjs copies the generated ops.json to the gateway and the plugin; a test fails if the copies drift.
License: MIT.
This server cannot be deployed
Manage WordPress blogs and WooCommerce shops from Claude, ChatGPT, Cursor and other MCP apps.
Run all of WordPress from Claude, ChatGPT or Cursor: SEO, security, your WooCommerce shop and Elementor pages, on up to 10 websites in one connector. Start free. SEO: titles, descriptions and focus keywords for every page, post and product. Security & updates: core, plugin and theme updates with a live test, site health and HTTPS checks, users and roles. WooCommerce shop: products, prices, orders, coupons and customers. Elementor and many more page builders: texts, links and images. Blog posts, pages, media, comments and menus. 10 websites in one connector: all your sites in the same chat. Deploy (Agency): build a site locally and push it to your own server. Just say it: "Write SEO titles for every product." "Install all updates and check that the site still works." "Show today's orders and create a weekend coupon." You choose what your AI may change, with one switch. Install the free AlphaBridge MCP plugin from WordPress.org, connect and approve on your own site. No account, no key to copy.
Build a WordPress site with AI from a brief, then export to Elementor or Gutenberg.
Manage a WordPress site from your AI assistant: read, search, propose edits, Search Console data.
