Webmastery Site Toolkit for MCP
_{Give your AI agent editorial control over WordPress.}

Quickstart | Abilities | Requirements | Connect | Verify | Security | Full docs

Webmastery Site Toolkit for MCP is a WordPress plugin that adds MCP-powered abilities for AI agents and MCP clients. It works with the official MCP Adapter: the adapter provides the transport layer, and this plugin registers the WordPress abilities an agent can call.

Use it to let an agent draft or update content, manage media and comments, inspect site health, review SEO metadata, audit plugins and users, and gather safe site context without handing your personal admin account to the agent.

For release history, see CHANGELOG.md.

Without this plugin

With this plugin

Who This Is For

• WordPress site owners who want safe AI-assisted content workflows.
• Developers building MCP workflows around WordPress.
• Technical editors and administrators managing content, SEO, and site operations.

Quickstart

1. Install and activate the MCP Adapter plugin.
2. Install and activate Webmastery Site Toolkit for MCP from the latest GitHub release.
3. Create a dedicated WordPress user for the agent. Use Editor for normal content work.
4. Create an application password for that user.
5. Configure your MCP client with @automattic/mcp-wordpress-remote.
6. Ask the client to call mcp-adapter-discover-abilities.

The complete setup guide, client-specific examples, and full ability tables live on the project documentation page.

Abilities

Every ability uses WordPress capability checks. An Editor account can handle day-to-day editorial workflows; Administrator-only abilities are intentionally separate because they expose site configuration, installed plugin metadata, or account audit details.

Area	What the agent can do	Typical role
Posts and pages	Create, list, read, update, restore, trash, bulk publish, bulk trash, and patch targeted content	Author or Editor
Blocks and revisions	Inspect Gutenberg block paths/hashes, replace one block, list revisions, restore a revision	Author or Editor
Post meta	Read, update, and delete safe custom fields; write supported Yoast SEO and SEOPress metadata	Author or Editor
Custom post types	Discover eligible public CPTs and generate list/get/create/update/delete abilities	CPT capability map
Taxonomy	List, get, create, update, and delete categories and tags	Subscriber to Editor
Comments	List, reply, update, approve, hold, trash, or mark spam	Editor
Media	List, inspect, update, upload public image URLs, set featured images, and delete media	Author or Editor
Content hygiene	Find orphaned media, posts/pages missing featured images, and stuck scheduled posts	Author or Editor
Site info	Return safe public site, current-user, and environment context	Subscriber
SEO and webmaster signals	Analyze content, inspect and write supported Yoast/SEOPress metadata, read Yoast scores, inspect generated Yoast head data, and check sitemap/webmaster signals	Author to Administrator
Plugins, users, health, security, performance, backups, database	Audit or manage sensitive site areas with explicit admin capabilities	Administrator

For the exact ability names, input behavior, and required capabilities, use the full ability reference.

Requirements

Requirement	Version
WordPress	6.9+
PHP	8.0+
MCP Adapter	Latest
Yoast SEO	Optional; enables Yoast metadata, score, generated head, and sitemap diagnostics
SEOPress	Optional; enables SEOPress metadata inspection/writes and site overview diagnostics

Self-hosted WordPress is required. This works on WordPress installs where custom plugins can be added, including most managed hosts. It does not work on WordPress.com Free, Personal, or Premium plans.

Install

Install the MCP Adapter first, then install this plugin.

git clone https://github.com/DanielBoring/webmastery-site-toolkit-for-mcp.git webmastery-site-toolkit-for-mcp
zip -r webmastery-site-toolkit-for-mcp.zip webmastery-site-toolkit-for-mcp --exclude='webmastery-site-toolkit-for-mcp/.git/*'

Upload webmastery-site-toolkit-for-mcp.zip in WP Admin > Plugins > Add New > Upload Plugin, then activate it.

Connect Your MCP Client

All local stdio clients use the same three environment variables. Set WP_API_URL to the full MCP Adapter endpoint for your site.

{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://your-site.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "ai-editor",
        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Codex uses TOML instead of JSON:

[mcp_servers.wordpress]
command = "npx"
args = ["-y", "@automattic/mcp-wordpress-remote@latest"]

[mcp_servers.wordpress.env]
WP_API_URL = "https://your-site.com/wp-json/mcp/mcp-adapter-default-server"
WP_API_USERNAME = "ai-editor"
WP_API_PASSWORD = "xxxx xxxx xxxx xxxx xxxx xxxx"

Other clients mostly differ by config file location and root key. See the full setup guide for Claude Code, Claude Desktop, VS Code Copilot, Copilot CLI, Codex, Windsurf, Gemini CLI, and ChatGPT notes.

Verify

Ask your MCP client to call mcp-adapter-discover-abilities. It should show the MCP Adapter discovery tools plus this plugin's webmastery-site-toolkit-for-mcp/* abilities.

Try a few safe checks:

• webmastery-site-toolkit-for-mcp/list-posts - "List the 5 most recent published posts."
• webmastery-site-toolkit-for-mcp/get-site-info - "Get safe public context for this WordPress site."
• webmastery-site-toolkit-for-mcp/webmaster-verification-status - "Check public Google and Bing webmaster verification signals."
• webmastery-site-toolkit-for-mcp/plugin-audit - "Audit installed plugins." Requires an Administrator service account.

If discovery shows fewer abilities than this repo documents, the connected WordPress site is running an older deployed copy of the plugin. Update the site plugin, then run discovery again.

Security

• Use a dedicated service account, not your personal account.
• Use Editor for routine content work and a separate Administrator account only for sensitive audits or plugin management.
• WordPress capability checks gate every ability.
• Deletes for posts and pages move content to trash; media deletion is permanent.
• Block and partial-content edits can use hash preconditions and fail when a target is missing, ambiguous, or stale.
• Site info abilities deliberately avoid secrets, filesystem paths, salts, auth keys, and raw server internals.
• plugin-audit, user-access-audit, database-health, performance-status, backup-status, security-audit, and site-health-check are Administrator-only.

Read the full security model before giving an agent Administrator credentials.

Contributing

New abilities and feature requests are tracked in GitHub Issues. The project follows Semantic Versioning; see CONTRIBUTING.md for release and QA expectations.