OfficialVerified

Wordpress Remote MCP Server

WordPress content and site management for AI through OAuth 2.1 and JWT tokens.

Data last scanned yesterday · Reviewed yesterday

78★ 180TypeScriptMIT

Overview

This server enables seamless integration between AI assistants and WordPress environments. It supports multiple authentication methods, including OAuth 2.1 with PKCE, JWT tokens, and WordPress application passwords, providing flexible connectivity for varied site configurations. The implementation adheres to several RFC standards, such as RFC 8707 for resource indicators and RFC 7591 for dynamic client registration. Users can manage persistent token storage, automatic token validation, and multi-instance coordination through configuration environment variables.

Our verdict

This server carries a high-risk score of 45/100, primarily because critical security components like the read-only mode and authentication mechanisms have not yet been editorially reviewed. While it offers advanced features for WordPress interaction, the lack of an official security audit makes it unsuitable for production environments with sensitive data until these aspects are formally verified.

Supports OAuth 2.1 with PKCE for secure authorization flows
Uses only nine direct dependencies to limit supply-chain surface area
Maintains an active development cycle with commits as recent as yesterday

Security score of 45 indicates significant unreviewed risk
Read-only mode and authentication methods lack formal security review
Not maintained by the official WordPress vendor

Setup

Claude Desktop

{
  "mcpServers": {
    "mcp-wordpress-remote": {
      "args": [
        "-y",
        "@automattic/mcp-wordpress-remote"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Compatibility

Client	Local	Docker	Remote	Read-only
Claude Desktop
Cursor
VS Code
Windsurf
ChatGPT

Frequently asked questions

›What WordPress plugin is required to use this MCP server?

You must install the MCP Adapter plugin on your WordPress site to register the required MCP server endpoint.

›Does this server support older WordPress MCP plugins?

Yes, it provides backwards compatibility for the deprecated wordpress-mcp plugin by supporting its specific endpoint if you provide a bare-domain WP_API_URL.

›How can I include custom headers like API keys in my requests?

You can include custom headers in all API requests by setting the CUSTOM_HEADERS environment variable using either a JSON-formatted string or a comma-separated list.

›What authentication methods are supported besides OAuth 2.1?

In addition to OAuth 2.1, you can use JWT tokens via the JWT_TOKEN environment variable or standard WordPress application passwords by setting WP_API_USERNAME and WP_API_PASSWORD.

›How does the server handle multiple instances and authentication?

The server utilizes lockfiles to coordinate multiple instances and prevent potential authentication conflicts.