MainWP

What MainWP MCP server does

The MainWP MCP server gives AI clients an interface to a self-hosted MainWP Dashboard, which in turn manages a network of WordPress child sites. It is intended for agencies and freelancers handling multiple sites from one dashboard. The server runs on the same computer as the AI tool and does not require installing software on the MainWP Dashboard or child sites.

Available operations depend partly on the Dashboard version, with roughly 70 tools documented across supported versions. The server can list, synchronize, connect, add, reconnect, and remove child sites. It can also inspect pending WordPress core, plugin, theme, and translation updates and apply those updates.

How it works

An MCP-compatible client starts the server locally, typically with npx -y @mainwp/mcp. The process uses MAINWP_URL, MAINWP_USER, and MAINWP_APP_PASSWORD to authenticate with the MainWP Dashboard over HTTPS. The application password is created in the Dashboard and can be revoked independently of the normal login password.

The MainWP MCP server exposes tools that the AI client can call in response to natural-language requests. For example, a user can ask for a list of managed sites, identify disconnected client sites, or find sites where WooCommerce is behind on updates. The server communicates with the Dashboard rather than connecting directly to each child site.

Safety behavior is built into the workflow. By default, deletion of sites, plugins, or themes produces a preview and waits for approval. On Dashboard 6.3 and later, updates also follow this approval pattern. Safe mode can block destructive operations entirely, and allow or block lists can control which tools are visible to the AI client.

Setup and configuration

Use Node.js 20.19 or newer, a MainWP Dashboard version 6.0 or newer, HTTPS access to that Dashboard, and an MCP-compatible AI client. Some capabilities require a newer Dashboard version; the project’s quickstart identifies those version dependencies.

Create an Application Password under Users > Profile > Application Passwords in MainWP. The setup example uses a dedicated API account and stores the Dashboard URL, username, and application password in the client’s MCP configuration. After restarting the client, a request such as “List all my sites” can verify the connection.

Claude Code has a separate plugin installation method that installs the server, an agent skill, and ten /mainwp:* workflow commands. Its credentials still come from the environment. Client-specific configuration locations and additional settings are covered by the project documentation.

Tools and capabilities

The MainWP MCP server supports these documented areas:

• Site listing, synchronization, connectivity checks, addition, reconnection, and removal
• Core, plugin, theme, and translation update discovery and application
• Plugin and theme inventory, activation, deactivation, and deletion
• Client record management, site assignment, and cost tracking
• Agency, client, and site notes, skills, and memories on Dashboard 6.3 and later
• Network summaries, site reports, security audits, and update plans

Tool availability varies with the MainWP Dashboard version. Tool visibility can also be narrowed with configuration allow and block lists.

Limitations and notes

The server requires an accessible MainWP Dashboard and does not replace MainWP itself. It is not a direct connection to child sites. Dashboard version differences affect which tools are available, especially knowledge features and update approval behavior.

Approval is the default protection for destructive actions, not a guarantee that every operation is blocked until confirmation. Safe mode is available when destructive operations should be disabled. Credentials remain in the user’s environment and are sent to the configured Dashboard; users should manage and revoke the Application Password as needed.

The MainWP MCP server is licensed under GPL-3.0. The repository includes development commands for tests, linting, formatting, building, and MCP Inspector checks, but running those commands is relevant to contributors rather than normal client setup.