AI edits WordPress. You decide what goes live.
WP MCP Server connects Claude Code, Cursor, and Codex to WordPress through typed actions — every write previewed, backed up, and approved by someone else first.
Every WordPress AI tool previews changes now. Almost none separate who requests one from who approves it.
wpguard-mcp is the open-source core. Named actions reach WordPress; raw code stays behind a separate gate. Every write needs a second person's sign-off.
Connect any MCP client in minutes
One streamable-HTTP endpoint. Claude Code, Cursor, Codex, or Windsurf connect with a single scoped bearer token.
Every site registered once
Connection details live in a local registry. No secrets stored there, and nothing syncs to us.
Direct reach for sites you run
Shells out to wp-cli over SSH — the only path to the raw-eval escape hatch, and even that stays gated.
Full control even without SSH access
A small WordPress plugin runs a hard-coded allowlist over HTTPS. No eval capability, enforced in PHP itself.
The layer that can write to your site never leaves your infrastructure.
Cloud is optional — it authorizes and records what Core already did. It cannot execute a mutation.
- Core runs on your infrastructure — Docker, pip, or your own host — and is the only thing that touches WordPress.
- Cloud stays out of the write path entirely.
- Pairing is outbound-only, so your firewall never opens an inbound port for us.
- Core checks Cloud's signature, packet digest, site, and approver role before trusting any remote decision.
WP MCP Core
Executes every guarded verb — packets, snapshots, verification, audit — all local, all free.
WP MCP Cloud
Authorizes and records. Approval inbox, policy templates, fleet-wide evidence, client reports.
Named actions are the front door. Raw PHP is a gated exit.
The AI's normal vocabulary is a closed set of typed tools, scoped by token and tiered by risk.
Nothing to approve
wp_recon, wp_get_option, and wp_get_post_meta return data only. No packet needed — nothing gets written.
wp_recon
wp_get_option
wp_get_post_meta
Every write previewed first
Each mutate verb previews the change, snapshots the old value, and refuses to run unapproved.
wp_mutate_option
wp_mutate_post_meta
wp_mutate_post_content
Locked, but still there
wp_eval runs arbitrary PHP for the rare case you need it — SSH and admin-scope only, same approval guard.
wp_eval
| Token scope | Reaches | Example holder |
|---|---|---|
| recon | Tier 1 read-only | A low-trust monitoring/analysis harness |
| mutate | Tier 1 + Tier 2 + packet lifecycle | A content-ops agent |
| admin | Everything, including Tier 3 wp_eval | You, for break-glass fixes |
A token that reaches above its scope gets a 403. Tier 3 carries a tighter rate limit than Tier 1 or 2, given raw eval's blast radius.
Every guarded write is bound to a Change Packet: the exact site, target, verb, arguments, and expected pre-change state.
Approval authorizes that specific packet. Change one field and the old approval no longer applies. Read the full Change Packet model →
The same approval gate, no matter which client drives it.
Claude
Claude Code, Claude Desktop, and claude.ai — all over MCP, all through the same gate.
Cursor
Cursor's agent mode drives the same guarded verbs, with the same approval required.
Windsurf and any other MCP-speaking client connect the same way, over the same endpoint.
Built for agencies running 10 to 100 client sites.
For agencies with at least two people to split requester and approver roles. Mixed hosting. A team already on Claude Code, Cursor, or Codex.
- Freelancers running several high-value WooCommerce or membership sites
- Hosting providers who want a governed agent interface across every customer site
- Enterprise WordPress teams that need change control without full-scale procurement
Most of this field previews changes now. Almost none require a second approver.
Connecting AI to WordPress is turning into a commodity. WP MCP Server adds the approval and evidence layer on top.
Official WordPress MCP Adapter
The standard, free way to expose WordPress Abilities to agents, built into WordPress core. WP MCP layers approval on top of it.
WPVibe
Broad WordPress action coverage with in-chat approval — a strong single-operator tool. WP MCP is built for teams that need a second approver.
InstaWP
Hosted sites and staging with MCP built in. WP MCP works across any host, including a client roster spread across many.
Install free. Approve your team's first change today.
Docker, pip, or a companion-plugin release — running locally in minutes.