# WordPress

> Publish and manage a WordPress site from an agent over the REST API — posts, pages, media, plugins, themes.

[Canonical HTML page](https://top-mcps.com/mcp/wordpress) · [server.json](https://top-mcps.com/mcp/wordpress.json) · [methodology](https://top-mcps.com/about/methodology)

## Install

### Claude Desktop — `claude_desktop_config.json`

Paste under mcpServers. Fully quit and reopen Claude after editing.

```json
{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": [
        "-y",
        "@cavort-it-systems/wordpress-mcp"
      ],
      "env": {
        "WORDPRESS_SITE_URL": "${WORDPRESS_SITE_URL}",
        "WORDPRESS_USERNAME": "${WORDPRESS_USERNAME}",
        "WORDPRESS_PASSWORD": "${WORDPRESS_PASSWORD}"
      }
    }
  }
}
```

### Claude Code — `CLI or .mcp.json`

Run from your repo. Commit .mcp.json to share with your team.

```shell
# export WORDPRESS_SITE_URL=https://example.com
# export WORDPRESS_USERNAME=admin
# export WORDPRESS_PASSWORD=xxxx xxxx xxxx xxxx
claude mcp add wordpress -- npx -y @cavort-it-systems/wordpress-mcp
```

### Cursor — `.cursor/mcp.json`

Global path: ~/.cursor/mcp.json. Reload window after editing.

```json
{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": [
        "-y",
        "@cavort-it-systems/wordpress-mcp"
      ],
      "env": {
        "WORDPRESS_SITE_URL": "${WORDPRESS_SITE_URL}",
        "WORDPRESS_USERNAME": "${WORDPRESS_USERNAME}",
        "WORDPRESS_PASSWORD": "${WORDPRESS_PASSWORD}"
      }
    }
  }
}
```

### VS Code — `.vscode/mcp.json`

VS Code uses the "servers" key (not "mcpServers").

```jsonc
{
  "servers": {
    "wordpress": {
      "command": "npx",
      "args": [
        "-y",
        "@cavort-it-systems/wordpress-mcp"
      ],
      "env": {
        "WORDPRESS_SITE_URL": "${WORDPRESS_SITE_URL}",
        "WORDPRESS_USERNAME": "${WORDPRESS_USERNAME}",
        "WORDPRESS_PASSWORD": "${WORDPRESS_PASSWORD}"
      }
    }
  }
}
```

### Windsurf — `~/.codeium/windsurf/mcp_config.json`

Open via Cascade → hammer icon → Configure.

```json
{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": [
        "-y",
        "@cavort-it-systems/wordpress-mcp"
      ],
      "env": {
        "WORDPRESS_SITE_URL": "${WORDPRESS_SITE_URL}",
        "WORDPRESS_USERNAME": "${WORDPRESS_USERNAME}",
        "WORDPRESS_PASSWORD": "${WORDPRESS_PASSWORD}"
      }
    }
  }
}
```

### Cline — `cline_mcp_settings.json`

Open via the Cline sidebar → MCP Servers → Edit.

```json
{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": [
        "-y",
        "@cavort-it-systems/wordpress-mcp"
      ],
      "env": {
        "WORDPRESS_SITE_URL": "${WORDPRESS_SITE_URL}",
        "WORDPRESS_USERNAME": "${WORDPRESS_USERNAME}",
        "WORDPRESS_PASSWORD": "${WORDPRESS_PASSWORD}"
      }
    }
  }
}
```

### Continue — `~/.continue/config.json`

Continue uses modelContextProtocolServers with a transport block.

```json
{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "npx",
          "args": [
            "-y",
            "@cavort-it-systems/wordpress-mcp"
          ],
          "env": {
            "WORDPRESS_SITE_URL": "${WORDPRESS_SITE_URL}",
            "WORDPRESS_USERNAME": "${WORDPRESS_USERNAME}",
            "WORDPRESS_PASSWORD": "${WORDPRESS_PASSWORD}"
          }
        }
      }
    ]
  }
}
```

### Codex CLI — `~/.codex/config.toml`

Codex uses TOML. Each server is a [mcp_servers.<name>] subtable.

```shell
# ~/.codex/config.toml
[mcp_servers.wordpress]
command = "npx"
args = [
  "-y",
  "@cavort-it-systems/wordpress-mcp",
]
env = { WORDPRESS_SITE_URL = "${WORDPRESS_SITE_URL}", WORDPRESS_USERNAME = "${WORDPRESS_USERNAME}", WORDPRESS_PASSWORD = "${WORDPRESS_PASSWORD}" }
```

### Zed — `~/.config/zed/settings.json`

Zed calls them "context_servers". Settings live-reload on save.

```jsonc
{
  "context_servers": {
    "wordpress": {
      "command": {
        "path": "npx",
        "args": [
          "-y",
          "@cavort-it-systems/wordpress-mcp"
        ]
      },
      "env": {
        "WORDPRESS_SITE_URL": "${WORDPRESS_SITE_URL}",
        "WORDPRESS_USERNAME": "${WORDPRESS_USERNAME}",
        "WORDPRESS_PASSWORD": "${WORDPRESS_PASSWORD}"
      }
    }
  }
}
```

### ChatGPT — `ChatGPT → Apps directory`

WordPress doesn't ship a hosted HTTPS endpoint today. ChatGPT supports remote MCP servers only — to use this server in ChatGPT you'll need to deploy it to a public HTTPS URL first (e.g. via Cloudflare Workers or Vercel) or wait for an official remote build.

```none

```

## At a glance

- **Maintainer:** Community (cvrt-jh)
- **Transport:** stdio
- **Auth model:** API key
- **Required secrets:** WORDPRESS_SITE_URL, WORDPRESS_USERNAME, WORDPRESS_PASSWORD
- **Supported clients:** Claude, Cursor, VS Code, Windsurf, Any MCP-compatible client, WordPress 5.6+
- **License:** MIT
- **Language:** TypeScript
- **Latest version:** latest
- **Last verified:** 2026-09-17
- **GitHub stars:** 3 (fetched 2026-10-15T10:09:13.506Z)
- **Score:** 50/100 (rubric 2026-09 — see https://top-mcps.com/about/methodology)
- **Source:** https://github.com/cvrt-jh/wordpress-mcp
- **Homepage:** https://developer.wordpress.org/rest-api/

## Tools & permissions

Showing 12 of 200 tools the server reported on `tools/list`. The rest exist and are not listed here.

| Tool | Description | Args | Side effects |
|------|-------------|------|--------------|
| `list_sites` | List the WordPress sites this server manages. Every other tool needs one of these ids. | `—` | read |
| `wp_list_posts` | List posts with optional filters. | `—` | read |
| `wp_create_post` | Create a post. | `—` | write |
| `wp_update_post` | Update an existing post. | `—` | write |
| `wp_delete_post` | Trash a post, or delete permanently with force=true. | `—` | write |
| `wp_create_page` | Create a page. | `—` | write |
| `wp_list_media` | List media library items. | `—` | read |
| `wp_update_media` | Update media title, alt text and caption. | `—` | write |
| `wp_list_plugins` | List installed plugins. | `—` | read |
| `wp_activate_plugin` | Activate an installed plugin (routes via the companion plugin). | `—` | write |
| `wp_activate_theme` | Switch the active theme. | `—` | write |
| `wp_update_settings` | Update site title, tagline, timezone and date format. | `—` | write |

## Security & scope

- **Access scope:** read-write
- **Sandbox:** No sandbox. Point it at a staging site first — this server can change the active theme on a live site.
- **Gotchas:**
  - An application password inherits the WordPress user's full capabilities. Create a dedicated user with the narrowest role that still does the job rather than using an administrator.
  - `wp_activate_theme` and the plugin activate/deactivate tools change what visitors see immediately, with no preview and no undo.
  - `wp_delete_post` trashes by default but takes `force=true` for a permanent delete. Make sure the agent never has a reason to pass it.

## Quick answer

**What it does.** Wraps the WordPress REST API: `wp_create_post` / `wp_update_post` / `wp_delete_post`, the matching page family, `wp_list_media` and media metadata, taxonomy CRUD, comment moderation, `wp_list_plugins` and activate/deactivate, theme listing and activation, and `wp_get_settings` / `wp_update_settings`.

**Best for:**
- Drafting and publishing posts and pages
- Managing several WordPress sites from one server
- Media library metadata cleanup
- Comment moderation at volume
- Plugin and theme inventory across a fleet

**Not for:**
- Teams that require a vendor-maintained server
- Page-builder layouts (Elementor, Divi) that live outside the REST API
- Sites where application passwords are disabled by policy

## Description

WordPress runs a large share of the web and has no first-party MCP server; this community one is the most complete option we could verify. It speaks the WordPress REST API with an application password and exposes 200 tools across posts, pages, users, media, categories, tags, comments, plugins, themes and site settings — including multi-site support, where every tool takes a `site` argument.

## Why it matters

It is the one entry in this category that edits a site most of the web already runs, and it does it without a page builder or a proprietary API — an application password and the REST API that ships with WordPress 5.6 and later. The multi-site design (`list_sites` first, then a `site` argument on everything) also makes it usable for an agency managing a fleet.

## Key features

- 200 tools verified by probe on v3.0
- Multi-site: `list_sites` then a `site` argument on every tool
- Application-password auth, no OAuth app to register
- Token-optimised responses (the README reports ~95% smaller payloads)
- MIT

## FAQ

### Does WordPress ship an official MCP server?

Not as a package this directory could verify. The options are community-built wrappers around the REST API, and this is the most complete one we could run and probe — 200 tools on v3.0.

### What is an application password?

A per-application credential WordPress has generated natively since 5.6, created under Users → Profile. It authenticates REST API calls without exposing your login password, and can be revoked on its own.

### Do all 200 tools work on a stock install?

No. Core REST endpoints cover posts, pages, media, taxonomies, comments and users. Some plugin and theme operations route through the companion `cvrt-mcp-endpoints` plugin because the core routes are commonly blocked by hosts.

### Can it edit an Elementor or Divi page?

Not meaningfully. Page-builder layouts are stored in formats the REST API treats as opaque content. It can change the post record; it cannot rearrange the builder's sections.

## Changelog

- **2026-09-17** — Refreshed install snippets and fact sheet; verified for 2026.