Log inSubmit server
Wpagent MCP logo

Wpagent MCP

Operate WordPress and WooCommerce through 58 MCP tools backed by signed, permission-controlled REST requests.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Wpagent MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "wpagent-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "wpagent-mcp"
      ],
      "env": {
        "WP_SITE_URL": "YOUR_VALUE_HERE",
        "WP_API_KEY_ID": "YOUR_VALUE_HERE",
        "WP_API_SECRET": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

The wpagent-mcp MCP server lets MCP-compatible clients manage WordPress and WooCommerce through the WpAgent bridge plugin. It sends directly signed REST requests from the client to the site using HMAC-SHA256, without routing site data through a third-party service. Use it for content, plugins, themes, media, users, store operations, audits, and selected WP-CLI tasks. Site owners control access with per-key permissions, including read-only keys.

Use cases

  • Manage WordPress plugins and themes
  • Publish and update posts, pages, and products
  • Administer WooCommerce orders and settings
  • Review site security, SEO, and performance
  • Moderate users, comments, and media

Key features

  • WordPress content and custom post type management
  • Plugin and theme installation and lifecycle controls
  • WooCommerce orders, settings, coupons, and tax tools
  • Media, users, comments, menus, and taxonomy management
  • Signed HMAC-SHA256 REST communication
  • Allowlisted WP-CLI access when explicitly enabled

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

7/7 checks healthy over the last 40d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 15d ago via OSV.dev · wpagent-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads235Package downloads in the last 30 days.
Last commit1mo agoMost recent push to the default branch.

How Wpagent MCP works

What wpagent-mcp MCP server does

The wpagent-mcp MCP server exposes WordPress administration and publishing functions to Claude and other MCP-compatible clients. It connects through the WpAgent plugin installed on the target WordPress site, rather than using WordPress credentials directly or sending requests through a hosted intermediary.

The available areas include plugin discovery and lifecycle management, posts, pages, products, custom post types, metadata, featured images, themes, menus, widgets, sidebars, taxonomies, terms, redirects, media, users, comments, and WooCommerce operations. WooCommerce coverage includes settings, orders, coupons, shipping zones, payment gateways, tax rates, and statistics. An audit function checks security, SEO, and performance practices and can apply automatic fixes.

How it works

The MCP client launches the package with npx, then provides the WordPress site URL and API credentials as environment variables. The server uses those values to call the WpAgent REST bridge. Each request includes an HMAC-SHA256 signature and a timestamp; requests older than five minutes are rejected.

Permissions are attached to the API key and checked for every route. A key configured as read-only therefore cannot be used for mutations. Calls are recorded in an audit log available in the WordPress administration area, and revoking a key takes effect immediately. Destructive operations should still be confirmed by the assistant, and the site should have a current backup.

Setup and configuration

Install and activate the WpAgent plugin on the WordPress site, then generate an API key in the WordPress admin. The key setup lets the site owner choose the permissions granted to the client. Starting with a read-only key is appropriate when testing access.

Configure the MCP client with these required values:

  • WP_SITE_URL: the site base URL without a trailing slash.
  • WP_API_KEY_ID: the key identifier displayed by the plugin.
  • WP_API_SECRET: the secret shown when the key is created.

WP_SITE_LABEL is optional and gives the connection a friendly name; if omitted, the hostname is used. Claude Desktop can run the server through an npx -y wpagent-mcp command, and Claude Code can add it with claude mcp add and the same environment variables.

Tools and capabilities

The wpagent-mcp MCP server covers both read and write workflows, subject to the permissions granted to its API key. Typical operations include searching WordPress.org for plugins or themes, installing and activating extensions, editing content, managing media, updating themes, changing menus, moderating comments, and administering users.

For stores, it can work with WooCommerce configuration and operational records. For site maintenance, it can run the supported audit checks and use allowlisted WP-CLI commands when enabled by the site owner.

Limitations and notes

The bridge does not provide arbitrary PHP execution, database access, or access to wp-config.php. WP-CLI is disabled by default. Enabling it requires the site owner to add define('WPAIA_ENABLE_WPCLI', true); to the server configuration, and the bridge still refuses commands such as db, eval, eval-file, shell, server, config, and package.

The server can delete content when instructed, so key permissions and confirmation behavior matter. The connection depends on the WpAgent plugin being installed and active, and the API secret must be retained because it is displayed only when the key is generated.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Wpagent MCP

wpagent-mcp is an MCP server that connects MCP-compatible clients to WordPress through the WpAgent bridge plugin, exposing tools for plugins, content, themes, media, users, WooCommerce, menus, audits, and selected WP-CLI commands. Requests use signed REST calls, with permissions controlled by the API key.

Install and activate the WpAgent plugin on WordPress, generate an API key, then configure your MCP client to run `npx -y wpagent-mcp` with `WP_SITE_URL`, `WP_API_KEY_ID`, and `WP_API_SECRET`. No separate package installation is required when the client fetches it with npx.

Yes, wpagent-mcp works with Claude Desktop through its MCP server configuration. Add an entry that runs `npx` with `-y wpagent-mcp`, then provide the WordPress URL, API key ID, and API secret as environment variables.

Yes, but WP-CLI is disabled by default and only allowlisted commands can run. The WordPress site owner must define `WPAIA_ENABLE_WPCLI` as true in `wp-config.php`; database, eval, shell, server, configuration, and package commands remain blocked.

Related MCP servers

All in E-Commerce All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewWpagent MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/wpagent-mcp?style=directory)](https://allmcps.com/mcp/wpagent-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/wpagent-mcp"><img src="https://allmcps.com/api/badge/wpagent-mcp?style=directory" alt="Wpagent MCP on AllMCPs" /></a>