WordPress MCP Server
WordPress content and taxonomy management via natural language AI commands.
Data last scanned today · Reviewed today
Overview
This server provides a suite of tools for interacting with WordPress sites directly through MCP-compliant interfaces. It features comprehensive support for content management, allowing users to list, create, update, and delete posts, pages, and custom post types, alongside intelligent URL resolution and summary generation.
Our verdict
With a security score of 35/100, this server is classified as high-risk. The primary security concern is that it lacks a read-only mode, meaning every installation provides full write access to your WordPress environment. Given that it is community-maintained rather than official and lacks a detected license, it is recommended only for experienced users managing development or testing environments where write operations are intended.
- Supports multi-site management in one instance
- Covers all content types and taxonomies
- Small supply-chain surface with only eight dependencies
- High security risk due to no read-only mode
- Missing license creates unclear legal usage terms
- Community-maintained without official vendor support
Setup
{
"mcpServers": {
"mcp-wp": {
"args": [
"-y",
"@instawp/mcp-wp"
],
"command": "npx"
}
}
}Paste into .cursor/mcp.json (project) or ~/.cursor/mcp.json (global), then reload Cursor. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| list_sites | List all configured WordPress sites | low |
| get_site | Get details about a specific site configuration | low |
| test_site | Test connection to a specific WordPress site | low |
| list_content | List any content type with filtering and pagination | low |
| get_content | Get specific content by ID and type | low |
| create_content | Create new content of any type | medium |
| update_content | Update existing content of any type, including targeted partial edits | medium |
| delete_content | Delete content of any type | high |
| discover_content_types | Find all available content types on your site | low |
| find_content_by_url | Smart URL resolver that can find and optionally update content from any WordPress URL, including targeted partial edits | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What authentication is required to connect to my WordPress site?
You must use WordPress Application Passwords to authenticate the connection. You can follow the WordPress core integration guide to generate the necessary credentials.
›Does this server support managing multiple WordPress websites?
Yes, the server supports multi-site management, allowing you to list, test, and interact with multiple sites from a single instance using a site_id parameter.
›Can I perform SQL queries directly on my WordPress database?
Yes, the server includes an execute_sql_query tool, but it is restricted to read-only queries and requires a custom endpoint setup on your WordPress site.
›Are custom post types and taxonomies supported?
Yes, the unified content and taxonomy management tools are designed to work with all content types and taxonomies available on your site, including custom ones.
›Can I upload media from my local machine?
Yes, you can upload local files by providing a file path to the create_media tool, or you can import media directly from a remote URL.
Badge
Maintain this server? Add the live badge to your README.