Free tools Windows power users keep installed
One-click scans. No signup required.
A self-hosted WordPress MCP server lets an AI client such as Claude, Cursor, or VS Code discover and use capabilities exposed by your own WordPress installation. The supported route is the official WordPress MCP Adapter: install it on WordPress 6.9 or newer with PHP 7.4 or newer, then serve it locally over WP-CLI/STDIO or expose it remotely through HTTP with the @automattic/mcp-wordpress-remote proxy.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Use STDIO when the client and WordPress run on the same machine or development environment. Use HTTP for a hosted site, with HTTPS, a narrowly scoped WordPress account, and application-password or custom OAuth authentication. The tools an agent can see are not universal; they come from Abilities registered by WordPress core, plugins, and themes on that site.
As an Amazon Associate I earn from qualifying purchases.
What a self-hosted WordPress MCP server does
The Model Context Protocol (MCP) is a standard way for an AI application to discover tools, resources, and prompts and then call them. WordPress supplies the underlying site functions through its Abilities API. The MCP Adapter translates those registered Abilities into MCP primitives, so an agent can inspect the catalog and invoke approved WordPress operations.
WordPress describes the adapter’s role as adapting “Abilities registered by the Abilities API into the primitives supported by the Model Context Protocol (MCP)” so agents can execute site functionality as tools and read WordPress data as resources. In practical terms, the adapter is a bridge, not a fixed bundle of editorial features. A fresh installation may expose only the Abilities provided by core; activated plugins and themes can add, change, or remove what appears in the catalog.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The request path
- Your AI client starts an MCP session.
- The adapter reports available tools, resources, and prompts based on the site’s registered Abilities.
- The client sends a tool call or resource request.
- WordPress executes it under the authenticated user and returns the result through MCP.
That final step is why the WordPress account matters. MCP does not bypass WordPress permissions. The agent receives whatever the selected user is allowed to do, so account design is part of the security boundary.
Prerequisites and design choices
Software requirements
- WordPress: version 6.9 or newer.
- PHP: version 7.4 or newer.
- REST API: the site’s REST API must work normally.
- WP-CLI: required for the local STDIO pattern.
- HTTPS: required when an MCP endpoint is reachable remotely. A normal nginx or Apache reverse proxy terminating HTTPS needs no special adapter setting beyond ordinary REST API operation.
Check the PHP and WordPress versions in your hosting control panel or with WP-CLI before installing anything. If REST requests already fail because of a firewall, maintenance mode, authentication layer, or broken permalink configuration, fix that first; the adapter depends on the same WordPress request stack.
Choose where the MCP process runs
| Question | Local WP-CLI/STDIO | Remote HTTP |
|---|---|---|
| Where does the MCP process run? | On the client computer or another local process that can run WP-CLI against the site files. | Through an HTTP-facing WordPress installation, normally reached via a proxy. |
| Typical use | Local development, staging, or a private workstation. | A production site or a client that cannot access the WordPress filesystem. |
| Authentication | A WordPress user passed to WP-CLI. | A WordPress application password or a custom OAuth implementation. |
| Exposure | No public MCP listener is required. | The site must be protected by HTTPS and normal web-server controls. |
| Maintenance | You maintain WP-CLI, PHP, WordPress, and the plugin on the machine running the command. | You maintain the web stack, HTTPS, WordPress, the plugin, and the remote proxy. |
For a single developer on a local checkout, STDIO is usually the smaller attack surface. HTTP is the practical choice when the AI client is elsewhere, but it adds identity, TLS, proxy, and rate-limiting responsibilities.
Install the official MCP Adapter
- Download the latest release ZIP of the official WordPress MCP Adapter.
- In WordPress administration, open Plugins → Add New Plugin → Upload Plugin.
- Select the release ZIP, choose Install Now, and then select Activate Plugin.
- Confirm that the site still serves normal REST API requests and that no security plugin or web-application firewall is blocking the adapter’s routes.
The adapter converts registered Abilities into MCP tools, resources, and prompts. Installing it does not guarantee a particular list of publishing, media, user, or commerce operations: the list is determined by the Abilities registered by the version of WordPress, plugins, and themes currently active on your site.
Create a dedicated WordPress user
Do not give an agent your personal administrator credentials. Create a separate user for MCP work and grant only the role or custom capabilities required for the tasks you intend to automate. A read-only workflow should use an account that cannot publish, delete, install plugins, change settings, or manage other users. If a workflow must publish, separate that account from one used for destructive maintenance.
Record which human owner is responsible for the account, rotate its credentials when staff or integrations change, and remove it when the integration is retired. WordPress authorization still applies to every call, so reducing capabilities here directly reduces the damage a compromised client or prompt could cause.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Set up a local server with WP-CLI and STDIO
STDIO means the MCP client starts a command and exchanges protocol messages through the process’s standard input and output. No public HTTP MCP endpoint is needed. The client must be able to run WP-CLI and access the WordPress installation identified by --path.
1. Confirm WP-CLI access
From the machine that will run the MCP process, verify that WP-CLI can load the installation and authenticate the selected user. The exact shell command depends on your existing WP-CLI setup, but the path must point to the WordPress root containing wp-config.php. Resolve filesystem permissions and PHP errors before adding MCP configuration.
2. Add the MCP server entry
Use the following minimum configuration pattern in the MCP client’s server configuration. The location and filename of that configuration vary by client, so use the client’s current MCP settings screen or configuration-file convention.
{
"wordpress-mcp-server": {
"command": "wp",
"args": [
"--path=/path/to/your/wordpress/installation",
"mcp-adapter",
"serve",
"--server=mcp-adapter-default-server",
"--user={admin_user}"
]
}
}Replace /path/to/your/wordpress/installation with the absolute path to the site and replace {admin_user} with the WordPress username dedicated to this integration. The braces in the example indicate a value to substitute; they are not a command-line placeholder that WP-CLI will resolve automatically.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors3. Restart the client and watch the process output
Fully restart the AI client after saving its MCP configuration. A successful startup should launch wp mcp-adapter serve without PHP fatal errors, an unknown-command error, or a permissions failure. If the client reports that the server exited immediately, run the same command in a terminal from the WordPress directory and fix the first error shown there.
4. Keep STDIO output clean
MCP messages travel over the process’s standard streams. Shell wrappers, debugging statements, PHP notices, and plugin output written to standard output can corrupt the protocol stream. Send diagnostics to a log or standard error instead, and run the command in the same PHP environment in which the adapter was installed.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Connect Claude, Cursor, or VS Code
Each client has its own way to register an MCP server, but the integration data is the same: a server name, the wp executable, the argument list above, and permission for the client to launch the process.
- Open the client’s MCP or extensions settings.
- Add a new local server and choose a command-based or STDIO transport.
- Paste the
wpcommand and arguments, or import the equivalent JSON object. - Save the entry and restart the client if it does not rescan servers automatically.
- Open the client’s tool or capability view and confirm that the WordPress server appears as connected.
Do not copy a configuration intended for an HTTP server into a STDIO field. Conversely, an HTTP client needs a URL and authentication flow; it cannot run a local wp command unless it has access to the WordPress filesystem and PHP environment.
Verify the connection safely
Connection status alone is not proof that the right user or capabilities are active. Verify in this order:
- List capabilities: call MCP
tools/list(or use the client’s equivalent capability browser). - Check identity: confirm that the available operations match the dedicated WordPress user’s role.
- Run a low-risk read: request a harmless site or content read operation.
- Review the result: confirm that returned data is from the intended site and does not include information the client should not receive.
- Test a write only when necessary: use a disposable draft or staging site first, and verify the resulting WordPress audit trail.
The catalog is site-specific. Core, plugins, and themes may register different Abilities on different sites, and updates can change the catalog. Treat tools/list as the current contract rather than assuming that a tool seen in a tutorial exists on your installation.
Expose a self-hosted site over HTTP
Use HTTP when the AI client cannot run WP-CLI against your server. The documented pattern uses the @automattic/mcp-wordpress-remote proxy to connect an MCP client to the WordPress adapter over the web.
1. Keep WordPress behind HTTPS
Terminate TLS at nginx, Apache, or your managed reverse proxy and ensure the public WordPress URL is HTTPS. The adapter does not require a special reverse-proxy mode; it relies on the site’s ordinary REST API operation. Preserve the request method, authorization headers, and response body when forwarding traffic. Test the REST API from outside the server before troubleshooting MCP.
Recommended Free Tools
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
2. Choose authentication
The remote proxy can authenticate with a WordPress application password or with a custom OAuth implementation. Application passwords are tied to a WordPress user and can be revoked independently, making them a practical option for a controlled integration. Store the credential in the client or proxy’s secret store, never in a public repository, chat transcript, or browser-visible configuration.
Use custom OAuth when your organization already has an identity and consent system that must mediate access. Implement it so that the resulting WordPress identity is still limited to the capabilities the agent needs. Do not treat OAuth as a substitute for least privilege.
3. Configure the remote proxy
Install and configure @automattic/mcp-wordpress-remote according to the proxy’s current release instructions, supplying the HTTPS WordPress address and the selected authentication method. The proxy becomes the MCP-facing process; WordPress remains the system that authorizes and executes the underlying Abilities.
4. Restrict the public surface
- Allow only HTTPS; redirect or reject plaintext HTTP.
- Use a dedicated MCP user with the smallest practical capability set.
- Apply normal web-server and firewall controls to administrative and REST traffic.
- Rate-limit or monitor the proxy where your infrastructure supports it.
- Keep WordPress, PHP, the adapter, and the proxy updated.
- Revoke the application password immediately if it appears in logs or is no longer needed.
STDIO versus HTTP: which should you use?
| Decision factor | STDIO | HTTP with remote proxy |
|---|---|---|
| Best fit | Local development, staging, or a workstation with filesystem access. | Remote production sites and clients running outside the server. |
| Data location | WordPress data is accessed by a local process. | Requests and responses cross the network to the hosted WordPress site. |
| Credential model | Local WP-CLI user selection. | Application password or custom OAuth. |
| Network exposure | No MCP listener needs to be public. | Requires HTTPS and careful proxy/web-server configuration. |
| Operational burden | Maintain local PHP, WP-CLI, WordPress, and plugin versions. | Maintain server software, TLS, REST availability, WordPress, plugin, and proxy. |
| Failure modes | Wrong path, missing WP-CLI command, PHP mismatch, or polluted STDIO output. | TLS, DNS, proxy routing, authentication, firewall, and REST/API failures. |
Choose based on control and data location, not on the number of tools advertised by a client. Both transports ultimately expose the Abilities available to the authenticated WordPress user.
WordPress.com and the hosted alternative
WordPress.com provides a hosted MCP endpoint at https://public-api.wordpress.com/wpcom/v2/mcp/v1 and protects it with OAuth 2.1. A self-hosted site connected through Jetpack with an eligible Jetpack AI or Jetpack Complete plan uses that same hosted endpoint; there is no separate Jetpack MCP endpoint.
This hosted route changes the operational model: the MCP endpoint is operated by WordPress.com rather than by your own PHP and web stack. It can be useful when you prefer managed authentication and endpoint availability, but it is not the same as running the adapter locally on your server. Compare where requests are processed, which account grants access, and which service you must maintain before choosing it.
Security and governance checklist
Before enabling writes
- Start with read-only or low-impact capabilities and inspect the result.
- Use staging or a disposable draft for the first write test.
- Define which actions require human approval, especially publishing, deletion, user management, plugin changes, and settings changes.
- Document the MCP user, transport, endpoint, and credential owner.
For ongoing operation
- Review the output of
tools/listafter WordPress, plugin, or theme updates. - Monitor WordPress and web-server logs for unexpected calls or authentication failures.
- Rotate application passwords and remove unused credentials.
- Keep backups and a tested restore path before allowing destructive operations.
- Separate development, staging, and production users and endpoints.
- Do not send secrets, private customer records, or unnecessary personal data to a general-purpose AI client.
An MCP connection is an automation interface, not a separate security domain. WordPress roles, capabilities, REST controls, TLS, credential storage, backups, and logging remain the controls that determine what can happen.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteTroubleshooting common failures
“Unknown command: mcp-adapter”
WP-CLI cannot see the adapter command. Confirm that the plugin is installed and activated in the WordPress installation named by --path. Run WP-CLI from that site, check for a PHP fatal error, and verify that the command is being executed with the same PHP binary used by WordPress.
The client cannot start the server
Check that the client can execute wp by its configured name or absolute path, that the WordPress path is readable, and that the selected user exists. Test the complete command manually. A shell profile that works interactively may not be loaded by a desktop client, so use absolute executable paths when necessary.
The server starts, but no tools appear
Call tools/list and inspect the adapter log. An empty or small catalog can be legitimate if no plugin or theme has registered additional Abilities. It can also indicate that the wrong WordPress installation, environment, or user is being used. Compare the site URL, active extensions, and account capabilities with the intended setup.
HTTP authentication fails
Verify the application-password username and secret, the HTTPS hostname, and whether a proxy or firewall strips authorization headers. Confirm that the WordPress REST API works for the same account. For custom OAuth, check token audience, expiry, scopes, and the WordPress identity produced after login.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Requests fail only through a reverse proxy
Check TLS termination, forwarded host and protocol headers, request methods, authorization headers, and response-body handling. Compare a direct internal request with the public HTTPS request. Because the adapter uses normal REST operation, a discrepancy usually points to proxy, firewall, or WordPress REST configuration rather than an MCP-specific setting.
The client receives malformed protocol data
For STDIO, look for PHP notices, deprecation warnings, shell banners, or plugin debugging output written to standard output. Move diagnostics to logs or standard error, then restart the client. For HTTP, inspect whether an intermediary is replacing the MCP response with an HTML login page, error page, or redirect.
Version and capability expectations
The current WordPress.org plugin listing identifies support for MCP protocol revisions 2025-11-25 and 2026-07-28. A client and adapter still need to negotiate a compatible protocol version, so keep both sides current and consult the client’s compatibility message when a session fails during initialization.
Do not promise a fixed feature list in documentation for your own site. Record the output of tools/list after installation, then repeat the check after core, plugin, and theme updates. The registered Abilities—not the adapter alone—determine whether an agent can read content, create drafts, publish, manage media, or perform other operations.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
A repeatable deployment plan
- Upgrade or provision WordPress 6.9+ and PHP 7.4+.
- Confirm the REST API and HTTPS behavior.
- Install and activate the latest MCP Adapter release ZIP.
- Create a dedicated, least-privilege WordPress user.
- Choose STDIO for local filesystem access or HTTP for remote access.
- Configure the local WP-CLI command or the remote proxy and authentication.
- Connect the AI client and call
tools/list. - Run a low-risk read against the intended site.
- Test any write in staging or as a disposable draft, then define approval rules.
- Monitor logs, rotate credentials, and recheck capabilities after updates.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
