Recommended Free Tools
Model Context Protocol (MCP) is a shared way for AI applications to discover and use tools offered by external services. With WordPress, the connection can use WordPress.com’s hosted MCP server or a site-level integration called the WordPress MCP Adapter. Neither route automatically gives an AI client unrestricted access: available actions depend on the server, its configuration, and the connected user’s permissions.
How MCP connects an AI client to WordPress
MCP defines a common interface between an AI application (the client) and a server that provides tools or data. A compatible client can discover the tools a server makes available and call them when appropriate. In a WordPress setup, the server determines which WordPress capabilities are exposed, while authentication and WordPress permissions govern what the connection can do.
As an Amazon Associate I earn from qualifying purchases.
MCP is therefore a connection protocol, not a switch that automatically makes every post, setting, plugin, or administrative action available to an AI. The WordPress.org Plugin Developer Handbook also notes that plugin developers remain responsible for their code, whether it was AI-assisted or written by hand: Plugin Developer Handbook.
Choose a WordPress connection path
| Option | Best fit | How access is controlled |
|---|---|---|
| WordPress.com hosted MCP server | Eligible WordPress.com accounts and self-hosted sites connected through Jetpack | Account authorization through OAuth 2.1; revoke a client in Connected Apps |
| WordPress MCP Adapter | Site owners or developers who want an integration on a WordPress site and control over exposed abilities | Only selected abilities are exposed; WordPress permission checks apply to the current user |
These are distinct architectures, and their available tools should not be assumed to be identical. WordPress.com’s hosted service provides its own tool catalog; the adapter maps selected WordPress Abilities API capabilities into MCP tools and resources. See the WordPress Developer Blog explanation of the MCP Adapter.
WordPress.com’s hosted MCP server
The documented endpoint is https://public-api.wordpress.com/wpcom/v2/mcp/v1. An account owner enables MCP in WordPress.com account settings, adds the server in a supported MCP client, and completes authorization in a browser. WordPress.com documents OAuth 2.1, including PKCE, dynamic client registration, and rotating tokens. A custom client needs to implement the documented authorization and authenticated-request flow; users of a preconfigured client generally need only add the server and authorize it. See WordPress.com’s MCP documentation and its custom-client guide.
According to WordPress.com’s access documentation, last updated September 21, 2026, MCP is available on paid WordPress.com plans; a free site can use it during its first 30 days after creation. A self-hosted site connected through Jetpack needs Jetpack AI or Jetpack Complete for this hosted route. These are eligibility conditions, not a claim about plan prices. Check the current WordPress.com MCP documentation for any changes.
WordPress MCP Adapter on a site
The adapter connects MCP to abilities registered through the WordPress Abilities API. Once installed and activated, it registers a default MCP server and adapter abilities. Compatible clients can discover exposed capabilities as tools and read WordPress data made available as resources. The WordPress developer article describes installation from the project’s GitHub releases; the WordPress MCP Adapter plugin listing describes HTTP and STDIO transports and compatibility with MCP revisions 2025-11-25 and 2026-07-28. Installation details and protocol support can change, so consult the current listing and release information before setting it up.
Exposure is opt-in: the adapter does not publish every registered ability automatically. WordPress permission checks still apply for the current user, and developers can build a custom server to choose which abilities it exposes. The adapter is the more configurable route, but that control also means the site owner or developer must decide carefully what to expose.
How to connect an AI client
Using WordPress.com’s hosted server
- Confirm that the account or Jetpack-connected site meets WordPress.com’s current MCP eligibility requirements.
- Enable MCP in WordPress.com account settings.
- Add the documented server endpoint,
https://public-api.wordpress.com/wpcom/v2/mcp/v1, in a supported MCP client. - Complete the browser-based authorization prompt, then use the tools the server makes available to that client.
- To disconnect the client later, open account Security → Connected Apps and revoke its access.
For a client you are developing yourself, follow WordPress.com’s custom-client documentation for dynamic registration, authorization code with PKCE, token exchange, and bearer-token requests. Do not embed a client secret in a distributed desktop or command-line application.
Using the site-level adapter
- Install and activate the WordPress MCP Adapter using the current method documented in the plugin listing and its release information.
- Register or identify the WordPress abilities the site should make available, then explicitly expose only those intended for MCP use.
- Configure the client to connect using a transport supported by the adapter and the client. The plugin listing describes HTTP and STDIO transports.
- Test with a dedicated, limited WordPress user and verify that the expected permission checks prevent access to anything outside that user’s capabilities.
Exact client configuration depends on the client, transport, and adapter version; the plugin listing and project documentation are the appropriate references for current implementation details.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security: limit what the AI connection can do
An MCP client can only use what its server exposes, but an exposed ability may still change site data. Treat the connection as an integration that needs the same deliberate access design as other WordPress tools.
- Start read-only. The adapter’s developer guidance recommends beginning with a small set of non-destructive, read-only abilities and expanding only after testing.
- Use least privilege. Give MCP access to a dedicated WordPress user with only the capabilities needed for the intended tasks.
- Review permission callbacks. Developers should verify that each exposed ability enforces appropriate checks for the current user.
- Be cautious with consequential actions. Do not expose destructive or powerful abilities to clients that have not been audited and tested.
- Review AI-generated changes. An AI-generated edit is not automatically safe or correct. WordPress.org says plugin developers are responsible for all code and that submissions are reviewed under the same rules regardless of how the code was produced.
For the hosted WordPress.com route, account owners can revoke a connected client from Security → Connected Apps. For a custom adapter setup, review the user account, exposed abilities, and client configuration whenever access should change.
Best Value
- easy to use
- Free app
- Compatible with all devices
- It gives the best comparison between ten different hosts
Which WordPress MCP option should you use?
- Choose WordPress.com’s hosted server if you use an eligible WordPress.com account or a qualifying Jetpack-connected site and want the hosted authorization flow.
- Consider the MCP Adapter if you need a site-level integration and want to select which registered abilities are available to an MCP client.
- Do not choose on the assumption that one is universally best. Hosting, current eligibility, desired control, authentication, and the tools each server actually exposes determine the fit.
WordPress.org also documents a separate MCP server for plugin-development tasks such as looking up guidelines, validating readme files, checking status, and submitting plugins. It assists with those workflows; it does not replace plugin review or the developer’s responsibility for submitted code. See the Plugin Developer Handbook.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
