WP MCP Ultimate
A WordPress plugin with a built-in MCP server: 58 operations on posts, media, users, plugins and menus of the site
- 170 ★ on the repository
- Last commit
- GPL-2.0
Broad access
Why this level
- The agent creates, edits and deletes posts, media, users and site options as the application password owner
- Plugin operations change production code and the issued key opens admin-level functions
Install
- Works in
Manual install
Ask the owner to install the WP MCP Ultimate plugin in WordPress and generate a key under Tools, MCP Ultimate. Then add the server to the client config using the snippet from the dashboard. Run user, plugin and option operations only after the owner explicitly agrees.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent creates, edits and deletes posts, media, users and site options as the application password owner
- Plugin operations change production code and the issued key opens admin-level functions
This is third-party code. Review the repository files before installing.
What it does
The plugin turns the WordPress site itself into an MCP server. Once installed, the site exposes an MCP endpoint over streamable HTTP and the agent gets 58 operations: posts and pages, revisions, categories and tags, media files, users, plugins, menus, widgets, comments, options and system actions. No separate bridge plugins are needed. Access is protected by WordPress application passwords. For clients that require OAuth, such as web and mobile Claude, the plugin bundles an OAuth 2.1 authorization server with PKCE and dynamic client registration. An admin dashboard issues a key in one click, tests the connection and shows ready config snippets for Claude Code, Claude Desktop and Cursor. The plugin detects conflicts with the older MCP Adapter and MCP Expose Abilities plugins, and ships its own Abilities API polyfill for WordPress below 6.9.
Who it is for. WordPress site owners and administrators who want to manage content and settings through Claude Code, Cursor or Claude Desktop.
Good fit when
- Hundreds of posts and pages need one change and opening the admin area for each is a chore
- An agent has to upload media files and assemble a new page from them
- The web version of Claude should connect to the site through an OAuth connector
- The site is a staging copy and you want to see how an agent handles menus, widgets and comments
- On WordPress 6.7 or 6.8 MCP runs without separate adapter plugins
Not a fit when
- A production site without a backup: operations on users, plugins and options change data immediately
- The site runs WordPress below 6.7 or PHP below 8.0
- The task is limited to reading published content, which the public REST API already covers
Example request
Find all draft pages older than six months, show the list and move to trash the ones I confirmMCP
- Transport
- http
- Authentication
- API key
Limitations
It needs WordPress 6.7 or newer and PHP 8.0 or newer. By default the endpoint requires the edit_posts capability, and the rule can be changed through a filter. Plugins installed through MCP do not activate themselves and need a separate step. The agent acts as the user whose application password was issued, so it can only be limited by that user's role. The full list of operations and required capabilities is in docs/ABILITIES.md. Licence GPL-2.0-or-later.
How to disable. Deactivate and delete the plugin under Plugins, then revoke the application password and remove the server entry from the client config.
FAQ
How do I connect WordPress to Claude Code with WP MCP Ultimate?
Install the plugin, open Tools, MCP Ultimate and click Generate to create an application password. Copy the Claude Code config snippet from the same dashboard into the client settings.
Which sites are supported?
WordPress 6.7 and newer on PHP 8.0 and newer. For versions below 6.9 the plugin loads its own Abilities API polyfill.
Does it work with the web version of Claude?
Yes. For Claude Web and Claude Mobile connectors the plugin bundles an OAuth 2.1 server with PKCE and dynamic client registration. Point the connector at the MCP endpoint.
How does it differ from the MCP Adapter and MCP Expose Abilities plugins?
WP MCP Ultimate bundles its own MCP server and all operations in one plugin and warns about conflicts with the older adapters, so those are best disabled.
How is the MCP endpoint protected?
By default the edit_posts capability is required and login goes through a WordPress application password or OAuth 2.1 with PKCE. The access rule can be changed by a filter, and details are in SECURITY.md.
Discussion
No questions or reviews yet.
Related
MCP serversZapier's official MCP plugin: the agent gets actions across thousands of apps through your Zapier account
The MCP plugin connects agents to an AdminForth business app with user permissions and attribution for changes.
Discord MCP by cappyeo: a server with 200+ tools
Discord MCP (cappyeo)
A Discord MCP with over 200 typed tools: the agent handles messages, roles and moderation, builds a server from a plan, and writes default to preview mode
An MCP server for driving Windows: the agent opens apps, clicks and types, reads window and UI state, and works with files and PowerShell
Flow-Like MCP
Flow-Like
Flow-Like MCP nodes expose visual workflow functions to an agent over HTTP, with owner-selected tools and access
A Discord MCP for Claude and Cursor: the agent posts and searches messages and manages forums, channels, roles and webhooks through a bot token
README in short
A self-contained WordPress plugin that starts an MCP server with 58 operations. Setup takes three steps: upload the plugin, create an application password in the dashboard, copy the snippet into the client. Application passwords and OAuth 2.1 are supported. The project builds on work from the WordPress AI team, MCP Adapter and MCP Expose Abilities.