How to Build a WordPress MCP Integration for AI Agents

Building a secure WordPress MCP integration allows developers to connect autonomous AI agents directly to their website’s backend, enabling seamless data sharing and action execution.

Traditionally, connecting an AI model to a custom database or content management system required building bespoke APIs, managing complex authentication flows, and writing custom integration layers for every single tool. The Model Context Protocol (MCP) changes this paradigm. Developed as an open standard, MCP establishes secure, standardized connections between AI-driven applications and non-public data sources. By turning your WordPress site into an MCP server, you can allow AI assistants like Claude Desktop to read your database, manage content, and execute administrative tasks directly through natural language commands. WordPress MCP integration should be evaluated in the context of the site’s current configuration and business-critical workflows.

In this comprehensive guide, we will walk through the core concepts of MCP, outline the system prerequisites, and build a fully functional integration that allows an AI agent to programmatically draft content on your site. When assessing WordPress MCP integration, test representative pages and integrations rather than relying on a single isolated check.

Understanding the Model Context Protocol (MCP) Architecture

Before writing code, it is essential to understand the chain of components that make this integration possible. The MCP ecosystem relies on four primary layers: A practical review of WordPress MCP integration should include compatibility, performance, security, and rollback considerations.

• MCP Client: The user-facing application hosting the AI model (such as Claude Desktop). The client initiates connections and requests tools or resources from the server.
• MCP Server: A lightweight application or process that exposes specific capabilities (tools, resources, and prompts) to the client. In this setup, your WordPress site acts as the MCP server.
• MCP Adapter: A translation bridge that sits between the MCP Client and your WordPress core. It translates standard MCP protocol primitives into WordPress-specific actions and vice versa.
• Abilities API: The architectural layer introduced in WordPress that allows core features and third-party plugins to register standardized, self-describing actions with strict input/output schemas. This is what the AI reads to understand what actions it can perform.

Prerequisites for Your WordPress MCP Integration

To follow this tutorial and establish a working connection, your development environment must meet the following requirements:

• WordPress Development Site: Running WordPress version 6.9 or higher (WordPress 7.0+ is highly recommended). URL rewriting must be enabled.
• HTTPS Enabled: WordPress requires a secure HTTPS connection to generate Application Passwords.
• Node.js: Installed on your local machine to run the remote proxy.
• Claude Desktop: Anthropic’s official desktop client, which acts as our MCP host.
• Postman: Or any API client of your choice to test the raw JSON-RPC handshakes.

Step 1: Installing the MCP Adapter and Verifying the Namespace

The first step is to turn your WordPress site into an active MCP server. This is achieved using the official WordPress MCP Adapter plugin.

Download the MCP adapter plugin ZIP file from GitHub, upload it to your WordPress site, and activate it. Once activated, the plugin registers a default endpoint at the following URL:

https://yoursite.com/wp-json/mcp/mcp-adapter-default-server

Because this endpoint requires authentication, visiting it directly or sending an unauthenticated request will return a 401 Unauthorized REST error:

{
  "code": "rest_forbidden",
  "message": "Sorry, you are not allowed to do that.",
  "data": { "status": 401 }
}

To verify that the adapter has successfully registered its routing namespace, query your site’s index endpoint (https://yoursite.com/wp-json/) in your browser or Postman. Look for the mcp and wp-abilities/v1 namespaces inside the namespaces array:

{
  "name": "WordPress Site",
  "namespaces": [
    "oembed/1.0",
    "mcp",
    "wp/v2",
    "wp-abilities/v1"
  ]
}

Step 2: Registering Custom Abilities via PHP

With the adapter active, we must register a specific “Ability” that our AI agent can discover and execute. We will build a custom plugin that registers an ability to create post drafts.

Create a new directory in your wp-content/plugins/ folder named my-mcp-test-plugin, and create a file inside it named my-mcp-test-plugin.php. Paste the following code:

<?php
/**
 * Plugin Name: My MCP Test Plugin
 * Description: Demonstration plugin for creating posts via MCP.
 * Version: 1.0.0
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

add_action( 'wp_abilities_api_init', 'kinsta_mcp_register_simple_draft_ability' );

/**
 * Registers a minimal ability to create post drafts.
 */
function kinsta_mcp_register_simple_draft_ability(): void {
    if ( ! function_exists( 'wp_register_ability' ) ) {
        return;
    }

    wp_register_ability( 'kinsta-plugin/create-draft', array(
        'category' => 'post',
        'label' => __( 'Create Post Draft', 'kinsta-mcp-draft' ),
        'description' => __( 'Creates a new post draft with a title and content provided by the AI agent.', 'kinsta-mcp-draft' ),
        'input_schema' => array(
            'type' => 'object',
            'properties' => array(
                'title' => array(
                    'type' => 'string',
                    'description' => __( 'The headline or title of the post draft.', 'kinsta-mcp-draft' ),
                ),
                'content' => array(
                    'type' => 'string',
                    'description' => __( 'The body text or content generated for the draft.', 'kinsta-mcp-draft' ),
                ),
            ),
            'required' => array( 'title', 'content' ),
        ),
        'permission_callback' => function(): bool {
            return current_user_can( 'edit_posts' );
        },
        'execute_callback' => function( array $args ): array {
            $post_id = wp_insert_post( array(
                'post_title'   => sanitize_text_field( $args['title'] ),
                'post_content' => wp_kses_post( $args['content'] ),
                'post_status'  => 'draft',
                'post_type'    => 'post',
            ) );

            if ( is_wp_error( $post_id ) ) {
                return array(
                    'success' => false,
                    'error'   => $post_id->get_error_message()
                );
            }

            return array(
                'success' => true,
                'message' => __( 'Draft saved successfully!', 'kinsta-mcp-draft' ),
                'post_id' => $post_id
            );
        },
        'meta' => array(
            'mcp' => array(
                'public' => true,
            ),
            'show_in_rest' => true,
        ),
    ) );
}

Activate this plugin from your WordPress dashboard. This code registers the kinsta-plugin/create-draft ability, defines its required schema (title and content), enforces user permissions via current_user_can('edit_posts'), and marks it as public for the MCP server.

Testing the WordPress MCP Integration with Postman

Before configuring our desktop AI client, we should perform a manual handshake using Postman to verify that our WordPress MCP integration is operating correctly.

Step 1: Generate an Application Password

Navigate to Users > Profile in your WordPress dashboard. Scroll down to the Application Passwords section, enter a name (e.g., “Postman MCP Test”), and click Add New Application Password. Copy the generated 24-character password immediately.

Step 2: Test the Handshake

In Postman, create a new POST request to your default MCP server endpoint:

https://yoursite.com/wp-json/mcp/mcp-adapter-default-server

Configure the following settings:

• Authorization: Select Basic Auth. Enter your WordPress username and the generated Application Password as the password.
• Headers: Add Content-Type: application/json and Accept: application/json, text/event-stream.
• Body: Select raw > JSON and enter the following initialization payload:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-03-26",
    "capabilities": {},
    "clientInfo": {
      "name": "postman",
      "version": "1.0"
    }
  }
}

Click Send. You should receive a 200 OK response containing the server’s capabilities and an mcp-session-id header. Copy the value of this header.

Step 3: Discover the Ability

To verify that your custom draft ability is visible to the protocol, send another POST request with the same authentication and headers, adding your mcp-session-id header, with the following JSON body:

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "mcp-adapter-discover-abilities",
    "arguments": {}
  }
}

The response should display your registered kinsta-plugin/create-draft ability inside the tools list.

Step 3: Connecting Claude Desktop to Your WordPress Site

To allow Claude Desktop to communicate with your WordPress site, we use the official @automattic/mcp-wordpress-remote proxy. This package handles the translation of standard input/output (STDIO) streams from Claude into authenticated HTTP requests.

Open Claude Desktop, navigate to Settings > Developer > Edit Config. This will open your claude_desktop_config.json file. Paste the following configuration, replacing the placeholders with your actual site details and Application Password:

{
  "mcpServers": {
    "wordpress-kinsta": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://yoursite.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "your-wp-username",
        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx",
        "OAUTH_ENABLED": "false"
      }
    }
  }
}

Save the file and restart Claude Desktop completely (ensure it is closed from your system tray, not just the window).

When you reopen Claude Desktop, navigate back to Settings > Developer. You should see wordpress-kinsta listed as an active, running local MCP server. You can now prompt Claude in natural language: “What tools are available on my WordPress site?” or “Create a post draft about the future of headless CMS architectures.”

Limitations and Gutenberg Block Formatting

While the basic integration works flawlessly, developers will quickly run into a formatting limitation: by default, the content generated by the AI is inserted as raw HTML. Because our plugin utilizes wp_insert_post() directly, the resulting draft will not be structured into native Gutenberg blocks.

To overcome this limitation, you can instruct the AI agent within your prompt to format its output using Gutenberg block comments. For example:

“Create a post draft about web performance. Format the entire content body using native Gutenberg block markup, wrapping paragraphs in <!– wp:paragraph –> and headings in <!– wp:heading –> comments.”

When Claude executes the ability with this structured payload, WordPress will successfully parse the comments, rendering a perfectly structured block layout when you open the draft in the Gutenberg editor.

Infrastructure Requirements for Agentic WordPress Sites

Transitioning your WordPress site into an agentic hub changes its traffic profile. Unlike human visitors who browse pages sequentially, an AI agent can fire dozens of API requests in a matter of seconds. Furthermore, these requests bypass page caching entirely, hitting your PHP threads and database directly with every handshake.

To prevent timeouts and database lockups during intensive AI operations, your site needs a high-performance hosting infrastructure. Kinsta’s isolated container technology, scalable PHP workers, and built-in Application Performance Monitoring (APM) tools ensure that your server can handle the bursty, un-cached workloads generated by active AI agents. Additionally, Kinsta’s enterprise-grade firewall and DDoS protection secure your exposed MCP endpoints from malicious automated scanning, keeping your agentic workflows safe and responsive.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.