Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
FREEDOM251

Freedom251 › Blog › AI assistants

How to connect an AI assistant to WordPress with MCP

By Freedom251 Team · · 11 min read

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

You can connect an AI assistant to WordPress in one of three ways: use the hosted WordPress.com MCP endpoint for WordPress.com sites and Jetpack-connected self-hosted sites; install the official MCP Adapter on a fully self-hosted site; or use the separate WordPress.org MCP server for plugin-directory tasks. The hosted route needs browser-based OAuth 2.1 and lets you choose read-only or full access. The on-site adapter requires WordPress 6.9 or later and PHP 7.4 or later. Start with a read-only request, verify the assistant can see the intended site, and enable only the write tools you actually need.

What does MCP change when an AI assistant connects to WordPress?

Model Context Protocol (MCP) gives an AI client a standard way to discover WordPress tools, resources, and prompts. Instead of copying content into a chat, the assistant can request current site data through an MCP server. When it proposes an action, the client asks for authorization, invokes the corresponding WordPress tool, and returns the result to the model.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

WordPress’s official adapter maps registered WordPress abilities into discoverable MCP tools. The exact actions available depend on the server, the tools enabled by the client, and the WordPress user’s capabilities. A connection therefore does not automatically give an assistant unrestricted control: authorization, tool settings, roles, and capabilities all limit what it can read or change.

For WordPress.com, the documented server is https://public-api.wordpress.com/wpcom/v2/mcp/v1. A self-hosted adapter exposes capabilities from your own installation instead. The WordPress.org server is a separate service for developing and submitting plugins, not a general-purpose connection to your editorial site.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Which MCP connection route fits your WordPress site?

Identify where WordPress runs before configuring an AI client. Your hosting arrangement determines the endpoint, authentication method, maintenance work, and scope of the tools.

Route Where it runs Authentication What it can do Maintenance
WordPress.com MCP WordPress.com account sites Browser OAuth 2.1 with PKCE Read and write tools for connected sites, subject to selected access and capabilities Hosted; no plugin installation
Jetpack-connected self-hosted site Your site, connected to the WordPress.com service through Jetpack Browser OAuth 2.1 with PKCE Uses the same hosted endpoint and account-based site access Hosted MCP service; maintain the WordPress site and Jetpack connection
Official MCP Adapter Fully self-hosted WordPress installation Client and site configuration, using normal WordPress roles and capabilities Tools, resources, and prompts registered by the site You install, update, and secure the plugin
WordPress.org MCP server WordPress.org plugin-directory service Authorized application password Plugin guidelines, readme validation, submission status, and plugin submission Hosted service; intended for plugin developers

How do I tell which route I need?

  • Choose the hosted endpoint if the site is on WordPress.com.
  • Choose the same hosted endpoint if a self-hosted site is connected through Jetpack. A paid Jetpack plan is not required for this MCP service.
  • Choose the MCP Adapter if WordPress is fully self-hosted and you want tools to run from the site itself.
  • Choose the WordPress.org server only when your task concerns the plugin directory, such as validating a readme or checking a submission.

How do I connect a WordPress.com or Jetpack-connected site?

The hosted route is usually the fastest because you do not install a plugin. WordPress.com documents MCP access for every WordPress.com plan, including free sites. A self-hosted site connected through Jetpack can use the same service without a Jetpack plan.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Enable MCP access. Sign in to the WordPress.com account that controls the site and enable MCP access in the account settings. If you manage several sites, confirm that the account includes the site you intend to connect.
  2. Add the server URL. In the AI client’s MCP-server configuration, add https://public-api.wordpress.com/wpcom/v2/mcp/v1. Use the URL exactly as shown; it is an HTTPS endpoint and should not be replaced with a guessed REST path.
  3. Complete browser authorization. The client opens a WordPress.com authorization page. WordPress.com uses OAuth 2.1 with PKCE, dynamic client registration, token rotation, and expiring access tokens. Approve the request in the browser, then return to the AI application when it redirects back.
  4. Select an access level. Choose read-only access while evaluating the connection. Full access enables both read and write tools. The documentation also allows individual tools to be customized later, so enable only the write operations required for a defined workflow.
  5. Run a harmless read test. Ask the assistant to list recent posts or retrieve a page title. Check that the returned site, status, and content match the site you selected before attempting any edit, publication, deletion, or settings change.

What happens during WordPress.com authorization?

The browser flow keeps the user in control of the grant. The client receives expiring tokens rather than a permanent password, and token rotation limits the usefulness of an exposed token. You can revoke a connection later under Security → Connected applications in your WordPress.com account.

WordPress.com describes the boundary this way: “At no point in time is data shared between the MCP server and the LLM that you don’t have complete control over.” The practical control is the combination of the OAuth grant, the read-only or full-access choice, per-tool settings, and your WordPress permissions.

What commands configure common MCP clients?

Use the client’s own MCP configuration flow after adding the hosted endpoint. The following commands are the documented examples for two clients.

Claude Code

claude mcp add --transport http wpcom-mcp https://public-api.wordpress.com/wpcom/v2/mcp/v1

After adding the server, run /mcp inside Claude Code to start the browser authentication process. Complete the WordPress.com authorization page and return to the client.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Codex

codex mcp add wpcom-mcp --url https://public-api.wordpress.com/wpcom/v2/mcp/v1

Authentication is automatic when available. If it does not start, run:

codex mcp login wpcom-mcp

Cursor, VS Code, Gemini, and Perplexity

These clients use their own MCP-server configuration screens or files. Add the same server URL, select the HTTP transport when the client asks for one, and follow the browser authorization prompt. Do not paste a WordPress password into a client field intended for OAuth; the hosted route is designed to authorize in the browser.

How do I connect a fully self-hosted WordPress site with the MCP Adapter?

Use the official MCP Adapter when WordPress is not hosted on WordPress.com and is not connected through Jetpack. The WordPress Learn lesson identifies it as an official plugin maintained by the WordPress AI Team. Its documented prerequisites are WordPress 6.9 or higher and PHP 7.4 or higher.

  1. Check the environment. In the WordPress dashboard, open Tools → Site Health and verify the WordPress version, PHP version, HTTPS status, and available administrator access. Upgrade the site before installing if it does not meet the documented minimums.
  2. Download the plugin package. Obtain mcp-adapter.zip from the official MCP Adapter GitHub Releases page. Keep the original ZIP so you can verify which release you installed and reproduce the setup if you need to roll back.
  3. Upload it in WordPress. Open Plugins → Add New Plugin → Upload Plugin, choose mcp-adapter.zip, select Install Now, and activate the plugin after WordPress reports a successful installation.
  4. Configure your MCP client. The adapter runs on your site, so use the endpoint and authentication details supplied by the adapter’s release documentation and your client. Do not assume that the WordPress.com URL works for an on-site installation.
  5. Confirm capabilities. Ask for a read-only operation first. The adapter exposes abilities registered by the site, and the available tool list can differ from one installation to another depending on active plugins and configuration.

Can the adapter edit posts and settings?

It can expose tools, resources, and prompts from inside WordPress, but access is constrained by the registered abilities and standard WordPress capabilities. The Automattic wordpress-mcp documentation says default MCP operations require administrator privileges. Connect only clients you trust, and use a dedicated WordPress account with the narrowest role that still supports the workflow.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What should self-hosted administrators maintain?

  • Keep WordPress, PHP, the MCP Adapter, and related plugins within their supported versions.
  • Use HTTPS and protect the WordPress dashboard and hosting account with strong authentication.
  • Review which abilities are registered and whether another plugin adds write-capable tools.
  • Monitor logs and user activity for unexpected requests, especially after enabling write operations.
  • Test updates on a staging site when the assistant is part of a publishing or commerce workflow.

How is the WordPress.org MCP server different?

The WordPress.org MCP server is not a way to manage posts on your production site. It is designed for plugin-directory development: reading plugin guidelines, validating readmes, checking submission status, and submitting plugins.

The quick setup requires an MCP-compatible client, a WordPress.org account, and Node.js 18 or later:

Rank #3
Sale
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord | 6.35mm Jack, Durable Design, Stage and Home Studio Use, Low Noise Shielded Electric Cord for Bass, Keyboard, Amp, Mixer
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
npx -y @wporg/mcp

For a manual configuration, the handbook gives this endpoint: https://wordpress.org/wp-json/mcp/wporg. The configuration uses the variables WP_API_URL, WP_API_USERNAME, and WP_API_PASSWORD. The password value is an application password issued after authorization, not your normal WordPress.org login password.

WordPress.org shows the application password once after authorization. Store it in the client’s secure secret storage immediately; if it is lost, issue a replacement and remove the old credential wherever it was saved.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How should I choose read and write permissions safely?

Start with the smallest useful scope and expand only after a successful read test. A connection that can list posts does not need permission to publish, delete, change users, or alter site settings.

Use a staged permission plan

  1. Discovery: connect with read-only access and ask the assistant to identify the site name, recent posts, and available tools.
  2. Drafting: allow creation or update tools only if your workflow requires the assistant to save drafts. Keep publication disabled.
  3. Review: have a human inspect the generated content, links, metadata, and status before any publishing action.
  4. Publishing: enable the minimum write tools needed for the approved process, and use an account whose WordPress capabilities match that process.
  5. Retirement: revoke the client when the project ends or when a device, account, or token may have been exposed.

Why do WordPress roles matter?

On self-hosted installations, MCP calls are still subject to normal WordPress roles and capabilities. An administrator account can have much broader reach than an editor account, so granting an assistant administrator-level credentials increases the impact of a compromised client or mistaken instruction. The adapter’s default operations requiring administrator privileges make this review especially important.

How do I test an MCP connection without risking content?

Use a predictable sequence that proves identity, scope, and results before touching production content.

  1. Ask the assistant to report the connected site name and URL, then compare both with the dashboard you intended to authorize.
  2. Request a list of the five most recent posts without asking for edits. Confirm titles, statuses, and dates against WordPress.
  3. Inspect the client’s discovered tool list. Note which tools are read-only and which can write, publish, delete, or change settings.
  4. If drafting is needed, create a clearly labeled test draft rather than editing a live post. Verify the author, status, revision, and content in the dashboard.
  5. Remove or revoke the test connection after validation if it is not going straight into regular use.

A successful response proves that the transport and authorization work; it does not prove that every tool is safe or that the assistant will interpret an ambiguous instruction correctly. Treat every write request as an operation to review.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What are the most common connection problems?

The client cannot reach the server

Check that you entered the hosted URL exactly, including https:// and the full /wpcom/v2/mcp/v1 path. For a self-hosted adapter, confirm that the plugin is active and that your client is using the adapter’s documented on-site endpoint rather than the WordPress.com endpoint. A firewall, maintenance mode, or missing HTTPS certificate can also prevent an on-site server from responding.

Authorization loops or expires immediately

Complete the browser flow in the same account and browser session that you intend to use. Expiring tokens and token rotation are normal for WordPress.com OAuth; restart login through the client instead of reusing an old token. If the connection remains stuck, revoke it under Security → Connected applications and authorize a fresh connection.

The assistant can read but cannot write

Read-only access intentionally disables write tools. Reopen the account’s MCP settings and grant only the required write tools, then verify that the connected WordPress user has the corresponding capability. On a self-hosted adapter, an administrator-only operation will fail for a user without the required role even when the MCP transport is healthy.

The wrong site appears

Hosted access is tied to the WordPress.com account and its connected sites. Disconnect the client, sign in with the account that owns the intended site, and repeat authorization. For self-hosted WordPress, inspect the site URL in the client configuration and run the identity test before making changes.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The WordPress.org command fails

Confirm that Node.js 18 or later is installed and that you are using a WordPress.org account. This server is for plugin-directory work; it will not expose posts, pages, or settings from a separate production WordPress installation.

How should teams operate an AI-to-WordPress connection?

Document the endpoint, account, access level, enabled tools, and owner for every connection. Keep a short change record when you add a write capability or change the WordPress role used by the client.

  • Separate experimentation from production by using a staging site or a dedicated draft workflow.
  • Require human review for publication, deletion, user changes, and settings changes.
  • Rotate or revoke access when staff, devices, or client configurations change.
  • Limit prompts and tool permissions to the content area the assistant is responsible for.
  • Review plugin and WordPress updates for compatibility before applying them to a self-hosted adapter.

For hosted WordPress.com connections, the service removes plugin-installation work but leaves account and tool-scope decisions with you. For an on-site adapter, you gain local control over registered abilities but take responsibility for updates, server security, and capability reviews.

Which route should you use?

Use the hosted WordPress.com endpoint when you want the simplest setup for WordPress.com or Jetpack-connected sites. Install the official MCP Adapter when a fully self-hosted site must expose its own registered WordPress abilities and you can maintain the required software versions. Use the WordPress.org server only for plugin-directory development. In every case, authenticate through the intended account, begin read-only, test against the correct site, and expand write access one tool at a time.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Frequently Asked Questions

Can I connect ChatGPT to WordPress with MCP?

Only an AI client that supports MCP server connections can use these endpoints. Check the client’s current MCP or connected-tools settings, add the appropriate WordPress server URL, and follow that client’s authorization flow; the WordPress endpoint alone does not add MCP support to an application that lacks it.

What does OAuth 2.1 with PKCE protect in this setup?

PKCE binds the browser authorization response to the client instance that began the login, reducing the risk of an intercepted authorization code being reused. WordPress.com also rotates tokens and expires access tokens, so a token should be treated as temporary access rather than a permanent site password.

Can one AI client use both a hosted WordPress.com server and a self-hosted adapter?

Yes, if the client supports multiple MCP servers, add each server with a distinct name and authenticate them separately. Keep the names explicit, such as a site name or environment, so a request intended for staging cannot be mistaken for a production request.

What should I do if an application password for the WordPress.org server is exposed?

Revoke that application password in your WordPress.org account and create a replacement. Update the MCP client’s secure secret entry, then test a harmless plugin-directory request before using submission or validation tools again.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

AI assistantsAutomationMCPself-hosted WordPressWordPressWordPress.com

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.