Overview

The WordPress MCP Adapter implements a Model Context Protocol (MCP) server that bridges WordPress’s Abilities API to external agents and LLM-driven clients. It exposes a discoverable manifest of available abilities (from core, plugins, and themes) and provides a secure HTTP surface to invoke those abilities programmatically. This lets external tools and LLMs enumerate what your site can do and call actions in a structured, machine-friendly way.

This adapter is useful when you want to integrate WordPress functionality into automated workflows, chat assistants, or other systems that need to discover available capabilities and call them reliably. By standardizing discovery and invocation through MCP, it reduces ad-hoc integrations and makes it easier to build safe, auditable automation around WordPress sites.

Features

Programmatic discovery of WordPress abilities exposed by plugins, themes, and core
Standardized MCP-style manifest for capabilities discovery
HTTP API for invoking abilities with structured input and typed outputs
Authentication and request validation hooks to control which callers can invoke abilities
Logging and audit-friendly invocation patterns (arguments, caller, result)
Extensible to register new abilities or adapt custom Abilities implementations

Installation / Configuration

Note: these instructions assume a typical PHP/WordPress environment. Adjust build tools and paths to match your setup.

Clone the repository and install dependencies:

git clone https://github.com/WordPress/mcp-adapter.git
cd mcp-adapter
composer install

Copy and edit environment configuration:

cp .env.example .env
# Edit .env to set WORDPRESS_URL, AUTH_TOKEN, LOG_LEVEL, etc.

Example .env entries:

WORDPRESS_URL=https://example.com
AUTH_TOKEN=your-secret-token
PORT=8080
LOG_LEVEL=info

Run the server locally (PHP built-in web server):

# Serve from the public directory (adjust as needed)
php -S 0.0.0.0:8080 -t public

Optional: run with Docker (simple Dockerfile or compose). Example docker run usage:

docker build -t wp-mcp-adapter .
docker run -p 8080:8080 \
  -e WORDPRESS_URL=https://example.com \
  -e AUTH_TOKEN=your-secret-token \
  wp-mcp-adapter

Configuration notes:

WORDPRESS_URL: URL of the WordPress site the adapter queries/controls.
AUTH_TOKEN: shared secret used for simple bearer auth. Replace with a secure token or integrate an OAuth layer for production.
Expose TLS (HTTPS) in front of the adapter for secure transport.

Available Resources

The adapter exposes a small set of HTTP resources to support discovery and invocation. Replace {BASE_URL} with your adapter URL.

Method	Path	Purpose
GET	/manifest	Returns the MCP-style manifest listing available abilities and metadata
GET	/openapi.json	(Optional) OpenAPI spec for the exposed endpoints and data models
POST	/invoke	Invoke a named ability with JSON arguments
GET	/health	Basic health check for readiness

Authentication:

Use an Authorization: Bearer <AUTH_TOKEN> header (or the mechanism configured in .env).

Example discovery request:

curl -H "Authorization: Bearer ${AUTH_TOKEN}" \
  "${BASE_URL}/manifest"

Example invocation request (JSON body):

curl -X POST "${BASE_URL}/invoke" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${AUTH_TOKEN}" \
  -d '{
    "ability": "post.create",
    "args": {
      "title": "Hello from MCP",
      "content": "Generated content goes here.",
      "status": "draft"
    },
    "caller": "assistant-123"
  }'

Response is typically JSON containing result, status, and any error details.

Use Cases

LLM-driven content assistants: An AI assistant discovers a site’s content-creation ability and invokes a create-post ability to draft or publish posts.
Admin automation: Scheduled or event-driven systems call abilities like user provisioning, backup triggers, or theme activation without manual UI steps.
Multi-site orchestration: A central orchestration service discovers each site’s exposed abilities and invokes them consistently across many WordPress instances.
Testing and CI: Automated tests discover available test helpers or simulated abilities exposed by plugins and invoke them to set up test data.
Safe plugin integrations: Third-party tools can programmatically interact with plugin-provided functionality without direct database access—interactions are mediated and logged by the adapter.

Getting Started Tips

Start by listing the manifest to see what abilities are exposed and their required

WordPress MCP Adapter: MCP Server for Programmatic Abilities