# WP MCP Server — Let AI Work on WordPress. Keep Production Under Control.

Canonical: https://wpmcpserver.com/

WP MCP Server — Let AI Work on WordPress. Keep Production Under Control.
W WP MCP Server
Product ▾
WordPress MCP Server
Security model
Open source
Clients ▾
Claude
Cursor
Codex
For Agencies
Compare ▾
vs WPVibe
vs WordPress MCP Adapter
vs InstaWP
Pricing
Docs
GitHub
Install the open-source server
Start Cloud free
Menu
Open source · MIT licensed
Let AI work on WordPress. Keep production under control.
Built for agencies connecting Claude, Cursor, or Codex to client sites — every risky write needs approval from someone other than the requester.
Install the open-source server
Start Cloud free
Book an agency safety review →
Free and open source, permanently. No credit card. No credentials leave your infrastructure.
guarded change · example-blog
# 1. propose — dry-run only, apply=False by default
wp_mutate_option (option= "blogdescription" ,
new_value= "Spring Sale — 20% off" )
→ {previous, proposed, etag, change_digest }
# 2. propose a packet bound to that exact digest
packet_open (target= "option:blogdescription" ,
change_digest= "9f21ac…" )
→ status: proposed
# 3. a different identity approves it
packet_approve (packet_id= "a1b2c3" , approver= "connor" )
→ status: approved // requester ≠ approver
# 4. execute — refuses if payload or live state drifted
wp_mutate_option (…, apply= True , expected_etag= "…" )
→ digest verified · snapshot taken · write applied ✓
Works with the MCP clients you already use
Claude Code · Desktop · claude.ai
Cursor agent mode
Codex OpenAI
Windsurf + any MCP client
The problem
Nothing stops an agent, a requester, or a stolen session from touching production.
Give an AI agent SSH or admin access to a client site. Any one of these three can change production alone.
01
The agent itself
An agent can misread a value, grab the wrong ID, or act broader than intended. Nothing double-checks it before the write lands.
02
The person prompting it
The requester and the approver are usually the same person. Whoever's at the keyboard can ask for a change and authorize it too.
03
A compromised session
A leaked token or hijacked session inherits whatever access the agent had. Nothing else stands between it and production.
How guarded mode works
Every write follows the same five-step path, every time.
Named verbs are the front door. Raw code execution is a separate, harder-to-reach tier. Nothing writes without a packet someone other than the requester approved.
1
Recon
Read-only inspection of the site: core version, active plugins, options, post meta. Output is wrapped as untrusted content, so recon can never be read as instructions. No packet required, no write risk.
2
Propose & preview
Guarded verbs dry-run by default ( apply=False ). The response returns the previous value, the proposed value, an ETag, and a SHA-256 digest of the exact change. You see precisely what will change before it changes.
3
Independent approval
A policy engine auto-allows, requires approval, or hard-denies the Change Packet. When approval is required, the approver signs off on its exact digest. That approver can be someone other than whoever proposed the change.
4
Execute
apply=True refuses to run without an approved packet matching that exact payload and state. The prior value is backed up first — every write is a rollback if something goes wrong.
5
Verify
The engine reads the result back to confirm it matches. An optional re-check catches it if a cache or plugin quietly reverts the change later.
Why it's built this way
Six things that stay true no matter which AI client you use.
1
Nothing writes without approval
The agent proposes a change — you see the exact diff and target site before anything runs. A snapshot is taken first, so every write can be undone.
2
Credentials stay local
SSH keys, WordPress application passwords, and companion-plugin secrets stay on your infrastructure. Cloud authorizes and records — it never executes and never holds them.
3
Requester and approver can differ
The person who prompted the agent doesn't have to approve what it does next. A second person can sign off on a client site change.
4
Approvals bind exact payload + pre-state
An approval locks onto the packet's exact digest: the specific payload and the pre-change state together. Change the arguments, or let the live value drift, and the approval no longer applies.
5
One evidence trail across the fleet
The same packet ledger, policy model, and audit CLI apply across every client site an agency runs. One evidence trail, fleet-wide.
6
Works with tools you already use
Claude, Cursor, Codex, Windsurf, or anything else that speaks MCP — the governance model doesn't change per client.
Product model
Core is free forever. Cloud is optional.
Core is the local execution and enforcement engine. Cloud is the collaboration, policy, and evidence layer on top of it — it never executes a mutation itself.
Free · open source
WP MCP Core
The MCP endpoint, guarded named verbs, local packets and approvals, snapshots, verification, and the audit CLI. Genuinely useful with nothing else installed.
See what's free forever →
Paid · control plane
WP MCP Cloud
Approval inbox across every site, team roles, policy templates and inheritance, a centralized evidence timeline, and client-ready reports. Cloud authorizes and records — the local core still enforces and executes.
See Cloud pricing →
Later
WP MCP Enterprise
SSO/SCIM, custom retention and data residency, a private control plane, and customer-managed keys. SLA-backed support for hosting providers and platform-scale fleets.
Read the trust architecture →
The evidence
Evidence a competitor can't hand-wave.
Human-in-the-loop review and dry-run previews are common across WordPress AI tools now. What's tested here is what happens when something tries to go wrong.
An agent tries to alter the wrong WordPress option — and is refused before anything is touched.
An approved packet's argument is tampered with after approval — the digest no longer matches, and it's refused.
The live value changes after preview, before execution — the stale ETag is refused, and the write never happens.
A guarded mutation writes without an approved packet at all — PacketRequiredError , no write, no snapshot, nothing touched.
See the safety mechanics on GitHub →
What "guarded" means concretely
"Guarded" means apply=True raises PacketRequiredError unless an approved packet exists for that exact site, target, payload, and pre-change state.
Every dry-run returns a SHA-256 digest over the site, verb, target, normalized payload, and current ETag. That digest-bound approval can't be reused for different values, targets, or stale state.
Start where you are
Three doors in.
◆
For agencies
Run more client sites per operator , with independent approval, cross-site policy, and one evidence trail across the fleet.
See the agency page →
◇
For Claude, Cursor, or Codex users
Connect the AI client you already use to client WordPress sites without giving up production control.
Claude →
Cursor →
Codex →
◈
For security review
Understand the guarded-mode mechanism, the change-packet integrity model, and exactly what WP MCP Cloud can and can't see.
Read the security model →
How it compares
Evaluating alternatives? Factual, sourced comparisons.
WP MCP Server isn't trying to out-breadth every WordPress + AI tool. Here's exactly where it differs from three you're likely already looking at.
vs WPVibe
Action breadth vs. independent governance. WPVibe covers more single-tool ground today — WP MCP separates requester from approver across a team.
Compare →
vs WordPress MCP Adapter
The official Adapter is the standard, free connectivity layer. WP MCP adds approval, evidence, and policy on top of it — same foundation, different job.
Compare →
vs InstaWP
Hosting-bundled MCP vs. host-neutral governance — for agencies whose client sites aren't all on one host.
Compare →
Pricing
Governance priced by the sites you protect.
Core safety is free and open source, permanently. Cloud adds collaboration, policy, and evidence — priced by governed sites, however many changes you make.
Community
Developers and OSS adoption
$0
✓ Unlimited local sites, no Cloud required
✓ All local recon and guarded verbs
✓ Local packets, snapshots, audit CLI
Install the open-source server
Most popular
Agency
Built for a 5-person agency team
$79 /mo
✓ 25 governed sites, 5 seats
✓ Approval inbox, policy templates
✓ 1-year evidence retention, client reports
See full pricing
Founding offer: 50% off for 12 months.
First 20 agencies only, no setup fee.
Claim the founding rate →
Give AI a way to work on WordPress that survives an audit.
Install Core locally in minutes, or bring Cloud in when a second approver or fleet-wide evidence matters.
Install the open-source server
Start Cloud free
W WP MCP Server
The guarded WordPress MCP server for production sites. Independent approval, exact payload binding, and an evidence trail for every AI-assisted change.
⬡ Core is MIT-licensed and free forever
Product
WordPress MCP Server
Security model
Open source
Pricing
Clients
Claude
Cursor
Codex
Compare
vs WPVibe
vs WordPress MCP Adapter
vs InstaWP
Solutions
For Agencies
Trust
Security
Threat model & disclosure
Resources
Docs
GitHub
© 2026 WP MCP Server
Sign in
GitHub