AI tools are moving beyond generating text. With the Model Context Protocol (MCP), an AI client can discover and use capabilities exposed by another system. For WordPress, this means an AI assistant can work with approved site functionality instead of only telling you what code to write.

The official WordPress MCP Adapter bridges the WordPress Abilities API and MCP. It can expose approved WordPress abilities as MCP tools, resources and prompts for compatible AI clients.

What is MCP?

Model Context Protocol is an open standard for connecting AI applications to external systems. An MCP server describes the tools and resources it provides, while an MCP client can discover those capabilities and call them when needed.

How WordPress MCP works

Modern WordPress uses the Abilities API as the foundation. An ability represents a specific capability that can be discovered and executed in a standardized way. The MCP Adapter translates eligible WordPress abilities into MCP-compatible interfaces.

The adapter does not automatically give an AI access to every WordPress function. Abilities must exist, exposure is controlled, and WordPress permission checks still apply.

What you need before connecting MCP to WordPress

Step 1: Install the WordPress MCP Adapter

The MCP Adapter is distributed as a WordPress plugin. Download the latest release from the official WordPress MCP Adapter repository and install it like a normal plugin.

1. Open Plugins → Add New Plugin.
2. Choose Upload Plugin.
3. Upload the MCP Adapter ZIP file.
4. Install and activate the plugin.

If you use WP-CLI:

wp plugin install https://github.com/WordPress/mcp-adapter/releases/latest/download/mcp-adapter.zip --activate

After activation, the adapter creates a default MCP server named mcp-adapter-default-server.

Step 2: Check the default MCP endpoint

For HTTP connections, the default server is available at:

https://your-domain.com/wp-json/mcp/mcp-adapter-default-server

Replace your-domain.com with your actual WordPress domain. Do not treat this endpoint as an unauthenticated public API.

Step 3: Control which WordPress abilities are exposed

This is one of the most important parts of an MCP WordPress setup.

WordPress abilities are not automatically exposed simply because they exist. The MCP Adapter uses an opt-in exposure model and applies permission checks for the authenticated user.

Step 4: Connect a local WordPress site with STDIO

STDIO is useful when WordPress is running locally and your AI client can execute WP-CLI commands.

{
  "wordpress-mcp-server": {
    "command": "wp",
    "args": [
      "--path=/path/to/your/wordpress/installation",
      "mcp-adapter",
      "serve",
      "--server=mcp-adapter-default-server",
      "--user=admin"
    ]
  }
}

Change the WordPress path and username to match your local environment. The AI client launches WP-CLI, and WP-CLI starts the MCP Adapter server.

Step 5: Connect a remote WordPress site over HTTP

For a production website hosted on a server, HTTP is generally the more practical transport. The official WordPress documentation also describes using the @automattic/mcp-wordpress-remote proxy for remote connections.

{
  "wordpress-mcp-server": {
    "command": "npx",
    "args": [
      "-y",
      "@automattic/mcp-wordpress-remote@latest",
      "https://your-domain.com/wp-json/mcp/mcp-adapter-default-server"
    ]
  }
}

The exact authentication configuration depends on your client and WordPress setup. For production sites, use a dedicated WordPress account with only the permissions required for the MCP workflow.

Step 6: Test the connection

Once the MCP server is connected, ask your MCP client to discover the available WordPress capabilities.

Start with read-only operations before allowing an AI agent to create, update, delete, publish or modify important site data.

What can you build with WordPress MCP?

Security: Do not skip this part

MCP can give an AI system the ability to perform real actions. That makes access control critical.

• Use a dedicated WordPress user. Avoid using your main administrator account for routine AI automation.
• Expose only what you need. Do not make unnecessary abilities available.
• Start read-only. Test discovery and read operations before enabling writes.
• Review permissions. MCP requests still need to pass WordPress permission checks.
• Protect production. Use HTTPS, strong authentication, backups, staging and monitoring.
• Audit write actions. Give publishing and data-changing workflows clear boundaries and rollback procedures.

Common MCP WordPress mistakes

Using an outdated WordPress version

The current MCP Adapter relies on the WordPress Abilities API in WordPress 6.9 and newer.

Expecting every WordPress function to appear automatically

MCP exposes registered and exposed abilities, not an unrestricted copy of the WordPress admin.

Giving AI administrator access immediately

This creates unnecessary risk. Use the minimum permissions required for the workflow.

Confusing MCP with an AI model

MCP is a protocol. The MCP Adapter is the bridge between WordPress abilities and that protocol. Neither one is the AI model itself.

Final thoughts

Connecting MCP to WordPress is a practical way to build AI-assisted WordPress workflows. The official MCP Adapter provides a standardized bridge between WordPress abilities and MCP-compatible clients, while WordPress permissions and opt-in exposure give developers control over what an AI agent can access.

Useful official resources:

• WordPress MCP Adapter on GitHub
• MCP Adapter Getting Started Documentation
• WordPress Developer Blog: From Abilities to AI Agents