Wordpress MCP Server
WordPress content and site management through conversational AI interactions.
Data last scanned today · Reviewed today
Overview
The WordPress MCP Server provides an interface for managing WordPress sites using natural language. It functions as a bridge between AI clients and your WordPress instance, allowing users to perform administrative tasks and content management directly through AI conversations rather than traditional admin panels. Built with JavaScript and TypeScript, the tool is actively maintained with frequent updates and a documented CI/CD pipeline. It includes support for various deployment options, including Docker, to facilitate integration into existing development workflows.
Our verdict
This server carries a high-risk rating with a security score of 45/100. The primary security concern is that it lacks a read-only mode, meaning every installation is granted full write access to your WordPress site by default. Given this lack of granular permission control and the absence of OAuth support, it should be used with extreme caution on production environments and is best suited for isolated testing or development setups.
- Small supply-chain footprint with only four direct dependencies.
- Active development status with a commit as recent as yesterday.
- Comprehensive documentation provided in the repository.
- Distributed under the permissive MIT license.
- Lacks a read-only mode for restricted operations.
- Does not support OAuth authentication for secure access.
- Maintained by the community rather than the official WordPress vendor.
Setup
{
"mcpServers": {
"mcp-wordpress": {
"args": [
"-y",
"mcp-wordpress"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| wp_approve_comment | Approves a pending comment. | medium |
| wp_cache_clear | Clear cache for a WordPress site. | medium |
| wp_cache_info | Get detailed cache configuration and status information. | low |
| wp_cache_stats | Get cache statistics for a WordPress site. | low |
| wp_cache_warm | Pre-warm cache with essential WordPress data. | medium |
| wp_create_application_password | Creates a new application password for a user. | medium |
| wp_create_category | Creates a new category. | medium |
| wp_create_comment | Creates a new comment on a post. | medium |
| wp_create_page | Creates a new page. | medium |
| wp_create_post | Creates a new WordPress post with comprehensive validation and detailed success feedback including management links. | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What are the core requirements to use this server?
You need WordPress version 5.6 or higher with the REST API enabled, the latest version of Claude Desktop, and an Application Password generated from your WordPress user profile.
›Can I manage multiple WordPress sites at once?
Yes, this server supports managing up to 50 WordPress sites from a single installation.
›What is the recommended installation method for most users?
The recommended method is using the Claude Desktop Extension (DXT) file, which allows for installation through the Claude Desktop interface without needing the command line.
›How do I provide my WordPress credentials to the server?
You can provide your credentials by defining the WORDPRESS_SITE_URL, WORDPRESS_USERNAME, and WORDPRESS_APP_PASSWORD environment variables in your Claude Desktop configuration file or a local .env file.
›What alternative installation methods are available for power users?
Power users can utilize NPX to run the server directly, perform a global npm installation, or deploy via Docker.
Badge
Maintain this server? Add the live badge to your README.