How to Connect AI Tools to WordPress Using MCP

To connect Claude or another AI client to WordPress, install the official MCP Adapter plugin from WordPress.org, give the AI its own low-privilege user with an Application Password, and add the server to your client’s MCP config. Do it on a staging copy first, because an AI client with write access can publish, edit and delete whatever that user is allowed to.

What MCP does for a WordPress site

Model Context Protocol (MCP) is an open standard that lets an AI client call tools on another system. For WordPress, the official route is two pieces. The Abilities API, added to WordPress core in 6.9, is a registry where core, plugins and themes declare what they can do. The MCP Adapter, a plugin maintained under the WordPress organisation, turns those registered abilities into MCP tools that a client such as Claude Desktop or Claude Code can call.

Two details matter before you start. First, abilities are private by default, so the AI sees nothing until an ability is deliberately marked public (by you or by a plugin that registers abilities). Second, the AI never gets more than the WordPress user it signs in as, so the user you choose is your main safety control.

Before you start

• A staging copy of the site, not production. Your host’s staging tool or a local copy is fine.
• WordPress 6.9 or newer, so the Abilities API is in core. On an older version, update first or check the adapter’s readme for what it needs.
• HTTPS on the site. WordPress only offers Application Passwords on secure connections, with an exception for local development environments.
• Node.js and npm on your computer if you use the proxy route below.
• A current backup you have actually tested restoring.

Step 1: Create a low-privilege user for the AI

Never connect an AI client with your own admin login. Create a separate user for it, for example “ai-assistant”, and give it the lowest role that does the job.

1. Go to Users, Add New, and create the user with a dedicated email address.
2. Set the role to Editor if you want the AI to draft and edit content. Use Contributor or a custom role if you only need drafts. Do not use Administrator.
3. Remember that Editors can edit and delete other people’s posts and pages. If that is too much, a custom role with fewer capabilities is safer.

Treat the role as the ceiling. Whatever this user can do, a confused or manipulated AI client can do too, including from text it reads on a page or in a comment.

Step 2: Create an Application Password

An Application Password is a separate credential for one app, so you can revoke it without changing the user’s real password.

1. Log in as the new user, or edit that user from an admin account.
2. Go to Users, Profile, and scroll to Application Passwords.
3. Enter a name that says what it is for, such as “claude-staging”, and click Add New Application Password.
4. Copy the password straight away. WordPress shows it once. Keep it in a password manager, not in a document or a chat.

If the Application Passwords section is missing, the site is probably not on HTTPS, or a security plugin or code snippet has switched the feature off.

Step 3: Install the MCP Adapter

On the staging site, go to Plugins, Add New, search for “MCP Adapter” and install and activate the one published by WordPress.org. With WP-CLI the equivalent is:

wp plugin install mcp-adapter --activate

The adapter on its own exposes very little. Its default server offers three generic tools to discover, inspect and run abilities, and only abilities marked public appear. You either install a plugin that registers abilities, or register your own. The adapter’s documentation on creating abilities explains the opt-in step. Check the plugin’s readme on WordPress.org for the current setup, because this project is changing quickly.

Step 4: Add the server to your AI client

There are two documented ways to connect. Pick the one that matches where your site lives.

Local site, using WP-CLI over STDIO

If WordPress runs on your own computer and WP-CLI is installed, the client can start the server itself. The adapter’s documentation gives this shape of config for Claude Desktop and similar clients:

{
  "mcpServers": {
    "wordpress": {
      "command": "wp",
      "args": [
        "--path=/path/to/your/wordpress/site",
        "mcp-adapter",
        "serve",
        "--server=mcp-adapter-default-server",
        "--user=ai-assistant"
      ]
    }
  }
}

Use the low-privilege user in --user, not an admin. The adapter’s documentation says that without a user the server runs unauthenticated with limited capabilities, and that this option sets which user permission checks run as. This route does not use an Application Password at all.

Remote or staging site, using a proxy and an Application Password

For a site on a server, the adapter’s documentation points to the @automattic/mcp-wordpress-remote proxy, which runs on your computer and talks to the site’s REST API using an Application Password:

{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://staging.example.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "ai-assistant",
        "WP_API_PASSWORD": "your-application-password"
      }
    }
  }
}

Replace the URL, username and password with your own. The config file is plain text, so keep it out of version control and out of screenshots. Using @latest means the proxy can change under you, so once it works, consider pinning the version you tested.

Claude Code

Claude Code adds stdio servers from the command line. The form is claude mcp add, then a name, then --, then the command that starts the server. For the local WP-CLI route that looks like this:

claude mcp add --transport stdio wordpress -- wp --path=/path/to/your/wordpress/site mcp-adapter serve --user=ai-assistant

Restart the client after changing its config, then check the server shows as connected. Claude’s documentation lists the current commands, including how to view and remove servers.

Step 5: Test with a read-only request first

Your first request should only look, never change anything. Ask the client to list the abilities available on the site, or to summarise the titles of your five most recent posts. If it answers correctly, the connection and the user’s permissions are working.

Then test the boundary on purpose. Ask for something the user should not be allowed to do, such as changing a site setting, and confirm it is refused. If it succeeds, the role is too powerful. Fix that before going further.

Only after that, try one small write, such as saving a draft post. Check it in the dashboard. Prefer drafts over publishing so that a person always makes the final call.

What an AI client with write access can do

An AI client acts with its user’s permissions, and it does not understand your business. It can overwrite a page, trash posts, change menus or alter fields in a way that looks reasonable and is wrong. It can also be misled by instructions hidden in content it reads, such as a comment or a pasted web page. Practical limits:

• Use a role that cannot install plugins, edit users or change settings.
• Keep production read-only for the AI until you have run the same task on staging several times.
• Take a backup before any bulk task, and review what changed afterwards.
• Do not expose customer data, orders or private fields to a tool you have not read the data terms for. Content you send a model leaves your server.

When it does not connect

• 401 Unauthorized: the username or Application Password is wrong, or something strips the Authorization header. Some hosts, caching layers and security plugins do this. Test the same credentials against /wp-json/wp/v2/users/me with a REST client. If that also fails, the problem is the site, not the AI client.
• No Application Passwords option: the site is not on HTTPS, or a plugin or snippet has disabled the feature.
• 403 or a blocked request: a firewall rule or security plugin is blocking the REST API. Check its logs for the route, then allow that route narrowly instead of switching the protection off.
• 404 on the server URL: the adapter is not active, the permalink structure needs saving again, or the server ID in the URL is wrong. Run wp mcp-adapter list to see the real server IDs.
• Connects but sees no tools: nothing has been marked public. Abilities are private until opted in.

Clean up afterwards

When a test is finished, go back to Users, Profile, Application Passwords and revoke the one you made. Create a fresh one when you next need it. If you are done with the experiment, deactivate the adapter and delete the AI user. If you use Elementor, the Elementor MCP workflow guide covers the page builder specifics.

If you would rather not wire this into a live site yourself, you can have us wire this up safely for your site, on staging first.

FAQ

Do I need a plugin to connect Claude to WordPress?

For the official route, yes. The MCP Adapter plugin is what turns WordPress abilities into MCP tools. Third-party servers exist that call the REST API directly, but check who maintains one and what it can do before you give it a login.

Should I use an admin account?

No. Use a dedicated user with the lowest role that does the task, and an Application Password you can revoke.

Is it safe to try on a live site?

Not first. Try it on staging, with a read-only request, and keep a tested backup. Move to production only for tasks you have already run safely on staging.

Does this work with clients other than Claude?

MCP is an open standard, so any MCP-compatible client can use the same server. The config format differs between clients, so follow your client’s own documentation for where to put it.