WordPress MCP - AI Agent Access

Edited

Overview

BionicWP supports the WordPress Model Context Protocol (MCP), which allows AI agents such as Claude to securely connect to and manage your WordPress site. Once enabled, your AI agent can create posts, update pages, edit Elementor and Divi content directly, manage WooCommerce products and orders, moderate comments, install and update plugins, and much more — all from within the AI chat interface.

This article covers:

  • How to install Node.js and npm (required prerequisite)

  • How to enable and disable MCP from the BionicWP dashboard

  • How to create an application password in WordPress

  • How to configure your AI agent (Claude Desktop or Claude Code)

  • A full reference of all available MCP abilities

  • How to extend MCP with your own custom abilities

WordPress 6.9+ required. MCP requires WordPress 6.9 or later. All BionicWP-hosted sites meet this requirement automatically.

Plugin renamed. The abilities plugin is now called Site Manager MCP Abilities (previously BionicWP MCP Abilities). You'll see this name in your Plugins list in wp-admin. Functionality and the bwp/ ability prefix are unchanged.

Section 0: Installing Node.js and npm

The Claude Desktop and Claude Code MCP configurations use npx, which ships with Node.js. You must have Node.js (version 18 or later) installed before setting up your AI agent config.

Windows

  1. Go to nodejs.org and download the LTS installer (.msi) for Windows.

  2. Run the installer and follow the prompts. Leave all default options selected — this installs both node and npm.

  3. Once complete, open Command Prompt or PowerShell and verify the installation:

node --version
npm --version

Both commands should print a version number. If they do, you're ready to proceed.

Windows users: When configuring Claude Desktop on Windows, use npx.cmd instead of npx in the command field of your MCP config file. See Section 3 for details. If Claude Desktop reports 'npx.cmd' is not recognized, Node.js is either not installed or not on your system PATH — reinstall Node.js and fully quit and restart Claude Desktop (not just close the window) so it picks up the updated PATH.

Mac

There are two recommended ways to install Node.js on macOS:

Option A — Official installer (simplest)

  1. Go to nodejs.org and download the LTS installer (.pkg) for macOS.

  2. Open the downloaded file and follow the installation wizard.

  3. Open Terminal and verify:

node -v
npm -v

Option B — Homebrew (recommended for developers)

If you have Homebrew installed, run:

brew install node

Then verify in Terminal:

node -v
npm -v

Both options install node, npm, and npx together. You only need to complete one of them.

Section 1: Enabling MCP from the BionicWP Dashboard

Step 1 — Open the Site Detail Page

  1. Log in to your BionicWP dashboard at app.bionicwp.com

  2. Click on the site you want to connect to an AI agent

  3. On the site detail page, click the Advanced tab

  4. Scroll down to the WordPress MCP section

Step 2 — Enable MCP

  1. Click the toggle next to MCP Disabled to turn MCP on

  2. A confirmation dialog will appear — click Enable MCP to proceed

  3. BionicWP will automatically install two plugins on your site:

  • MCP Adapter — handles the connection between your site and AI agents

  • Site Manager MCP Abilities — exposes 65+ abilities to the AI agent

  1. Wait for the installation to complete. You will see progress messages for each step.

  2. Once installed, the MCP Enabled UI will appear with setup instructions.

Note: Installation typically takes 10–20 seconds. Do not refresh the page during this process.

Step 3 — Disable MCP

To remove MCP from a site:

  1. On the Advanced tab, click the green MCP Enabled toggle to turn it off

  2. A confirmation dialog will appear with a warning that this action will delete the plugins

  3. Click Remove MCP to confirm

  4. Both plugins will be deactivated and permanently deleted from your site

Important: Disabling MCP removes both plugins completely from the site. Any AI agent configs pointing to this site will stop working immediately.

Section 2: Creating a WordPress Application Password

To connect your AI agent, you need a WordPress Application Password. This is different from your regular login password and can be revoked at any time without affecting your main account.

Creating the Application Password

  1. Log in to your WordPress admin (wp-admin)

  2. Go to Users in the left menu, then click on your username or Profile

  3. Scroll down to the Application Passwords section near the bottom of the page

  4. In the New Application Password Name field, enter a descriptive name such as Claude AI or BionicWP MCP

  5. Click Add New Application Password

  6. WordPress will display the generated password once — copy it immediately

Important: You will not be able to view this password again after leaving the page. Store it somewhere safe, such as a password manager.

Revoking an Application Password

If you need to revoke access for an AI agent:

  1. Go to Users > Profile in WordPress admin

  2. Scroll to Application Passwords

  3. Find the password entry and click Revoke next to it

  4. The AI agent will immediately lose access to the site

Section 3: Configuring Your AI Agent

After enabling MCP and creating an application password, you need to add the site config to your AI agent. The BionicWP dashboard provides a ready-made config file you can download or copy.

Finding Your Config File

  1. On the Advanced tab, scroll to the WordPress MCP section

  2. Under Step 2, you will see a pre-filled JSON config block with your site URL already inserted

  3. Replace YOUR_USERNAME with your WordPress username

  4. Replace YOUR_APPLICATION_PASSWORD with the password you generated in Section 2

  5. Use either the Copy to Clipboard button or Download config.json button

Claude Desktop Setup

  1. Open Claude Desktop on your computer

  2. Go to Settings, then click Developer, then click Edit Config

  3. This opens the file claude_desktop_config.json in a text editor

  4. Find the mcpServers section (or create it if it does not exist)

  5. Paste your site config inside the mcpServers object — if you have other servers already configured, add this one alongside them

  6. Save the file

  7. Quit and restart Claude Desktop

  8. Look for the plug icon in the Claude interface — this confirms your site is connected

Your config will look like this (with your actual values filled in):

{

  "mcpServers": {

    "yoursite": {

      "command": "npx",

      "args": [

        "-y",

        "@automattic/mcp-wordpress-remote@latest"

      ],

      "env": {

        "WP_API_URL": "https://yoursite.com/wp-json/mcp/mcp-adapter-default-server",

        "WP_API_USERNAME": "your_username",

        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"

      }

    }

  }

}

Note: If you have multiple sites, add each one as its own entry inside mcpServers, alongside your existing entries — do not replace the whole file.

Claude Code Setup

  1. Open your terminal

  2. Run: claude mcp add

  3. Follow the on-screen prompts, or alternatively edit the config file manually

  4. The config file is located at ~/.claude/claude_code_config.json on Mac/Linux, or %APPDATA%\Claude\claude_code_config.json on Windows

  5. Paste the same JSON config into the mcpServers object

  6. Save and restart Claude Code

Windows users: If you use Claude Desktop on Windows, use npx.cmd instead of npx in the command field of the config.

Section 4: Available MCP Abilities

Once MCP is enabled, your AI agent has access to the following abilities on your WordPress site. These are provided by the Site Manager MCP Abilities plugin.

Posts

Ability Name

Description

Requires

bwp/get-posts

List or search posts with filters (status, category, author, pagination)

WordPress core

bwp/create-post

Create a new post with title, content, status, categories, tags, and meta

WordPress core

bwp/update-post

Update an existing post's content, status, categories, tags, or meta

WordPress core

bwp/delete-post

Move a post to trash or permanently delete it

WordPress core

Content Editing & Revert

These abilities let your AI agent make targeted edits to existing content — changing one paragraph or heading instead of rewriting the whole page — with a built-in way to undo the change if something goes wrong.

Ability Name

Description

Requires

bwp/get-post

Get a single post or page's raw editor content, plus which page builder (if any) it uses. Always called before editing.

WordPress core

bwp/search-posts

Search posts and pages by keyword, or look up by exact slug, to find the right post before reading or editing it.

WordPress core

bwp/edit-post-content

Make a targeted edit (find-and-replace, or add content before/after/at the start/end) instead of replacing the whole post. A safe restore point is saved automatically before the edit is made.

WordPress core

bwp/get-post-revisions

List a post's saved revisions — these are the restore points used to undo an edit.

WordPress core

bwp/restore-revision

Roll a post or page back to a previous revision.

WordPress core

bwp/get-post-diff

Compare two versions of a post's content (for example, before and after an edit) and get a readable diff instead of two full copies of the content.

WordPress core

bwp/duplicate-post

Clone a post or page as a draft, including its content, categories/tags, featured image, and Elementor data. Useful for testing an edit safely before publishing.

WordPress core

bwp/set-featured-image

Set or remove a post or page's featured image, from an image already in the media library.

WordPress core

Elementor

For sites built with Elementor, these abilities let your AI agent read and edit individual widgets directly, rather than working with the raw Elementor data.

Ability Name

Description

Requires

bwp/get-elementor-data

List every element on an Elementor page (with a short label for each), or get the full settings for one specific element.

Elementor

bwp/update-elementor-widget

Update the settings of a single Elementor element — a heading, a button, an image, and so on — without touching the rest of the page. A backup of the previous version is saved automatically.

Elementor

bwp/restore-elementor-backup

Undo the most recent bwp/update-elementor-widget edit on a post. Only the single most recent edit can be undone this way.

Elementor

Divi 5

For sites built with Divi 5 (the block-based version of Divi), these abilities let your AI agent read and edit individual sections, rows, and modules directly. Divi 4 (shortcode-based) content is not covered by these two abilities — use the Content Editing abilities above for Divi 4 sites instead.

Ability Name

Description

Requires

bwp/get-divi-blocks

List the structure of a Divi 5 page — every section, row, column, and module, with a short label for each.

Divi 5

bwp/update-divi-block

Update a single Divi 5 block (for example, one module's text) without replacing the whole page. A safe restore point is saved automatically before the edit is made.

Divi 5

Pages

Ability Name

Description

Requires

bwp/get-pages

List pages with status, parent, and search filters

WordPress core

bwp/create-page

Create a new page with title, content, parent, and meta

WordPress core

bwp/update-page

Update an existing page's content, status, or parent

WordPress core

bwp/delete-page

Move a page to trash or permanently delete it

WordPress core

Media

Ability Name

Description

Requires

bwp/get-media

List media library items with search and mime type filters

WordPress core

bwp/upload-media

Upload a file to the media library from a remote URL

WordPress core

Categories

Ability Name

Description

Requires

bwp/get-categories

List all post categories

WordPress core

bwp/create-category

Create a new category with name, slug, parent

WordPress core

bwp/update-category

Update an existing category

WordPress core

bwp/delete-category

Delete a post category

WordPress core

Tags

Ability Name

Description

Requires

bwp/get-tags

List all post tags

WordPress core

bwp/create-tag

Create a new tag

WordPress core

bwp/delete-tag

Delete a tag

WordPress core

Navigation Menus

Ability Name

Description

Requires

bwp/get-menus

List all registered menus and their items

WordPress core

bwp/add-menu-item

Add an item to a navigation menu

WordPress core

bwp/delete-menu-item

Remove an item from a navigation menu

WordPress core

Users

Ability Name

Description

Requires

bwp/get-users

List users with optional role and search filters

WordPress core

bwp/create-user

Create a new user with username, email, password, and role

WordPress core

bwp/update-user

Update a user's email, display name, role, or password

WordPress core

Comments

Ability Name

Description

Requires

bwp/get-comments

List comments filtered by status (pending, approved, spam)

WordPress core

bwp/moderate-comment

Approve, unapprove, trash, spam, or delete a comment

WordPress cor

SEO Meta

Ability Name

Description

Requires

bwp/get-seo-meta

Read Yoast or RankMath SEO title, meta description, and focus keyword for a post

Yoast SEO or RankMath

bwp/update-seo-meta

Write Yoast or RankMath SEO fields for a post or page

Yoast SEO or RankMath

Post Meta

Ability Name

Description

Requires

bwp/get-post-meta

Read post meta fields — useful for Divi, WPBakery, or custom fields

WordPress core

bwp/update-post-meta

Write post meta fields — covers Divi, WPBakery, ACF, and custom fields

WordPress core

Advanced Custom Fields (ACF)

Ability Name

Description

Requires

bwp/get-acf-fields

Get all ACF field values for a post or page

ACF plugin

bwp/update-acf-fields

Update ACF field values for a post or page

ACF plugin

bwp/get-acf-field-groups

List all registered ACF field group definitions

ACF plugin

WooCommerce — Products

Ability Name

Description

Requires

bwp/get-products

List or search products with status, category, and pagination filters

WooCommerce

bwp/create-product

Create a simple product with price, SKU, stock, and categories

WooCommerce

bwp/update-product

Update an existing product's price, stock, status, or details

WooCommerce

bwp/delete-product

Trash or permanently delete a product

WooCommerce

bwp/get-product-categories

List WooCommerce product categories

WooCommerce

bwp/create-product-category

Create a new product category

WooCommerce

WooCommerce — Orders & Coupons

Ability Name

Description

Requires

bwp/get-orders

List orders with status, customer, and pagination filters

WooCommerce

bwp/get-order

Get full detail for a single order, including its line items (new)

WooCommerce

bwp/update-order

Update order status or add a note (optionally notify customer)

WooCommerce

bwp/create-coupon

Create a percent or fixed discount coupon with expiry and limits

WooCommerce

Site Settings

Ability Name

Description

Requires

bwp/get-site-settings

Read site title, tagline, URL, admin email, timezone, theme, and WordPress version

WordPress core

bwp/update-site-settings

Update site title, tagline, admin email, timezone, date format, or posts per page

WordPress core

Plugins

Ability Name

Description

Requires

bwp/list-plugins

List all installed plugins with name, version, and active status

WordPress core

bwp/activate-plugin

Activate an installed plugin by its plugin file path

WordPress core

bwp/deactivate-plugin

Deactivate an active plugin

WordPress core

bwp/install-plugin

Install a plugin from the WordPress.org repository by slug

WordPress core

bwp/update-plugin

Update an installed plugin to its latest available version

WordPress core

bwp/list-updates

Check for available updates for plugins, themes, and WordPress core

WordPress core

Site Health & Cache

Ability Name

Description

Requires

bwp/get-site-health

Run WordPress Site Health checks and return results grouped by severity

WordPress core

bwp/get-cache-status

Report which caching plugins are actively integrated with bwp/clear-cache, which other active plugins look cache-related but aren't yet, and whether an external object cache is in use

WordPress core

bwp/clear-cache

Flush the object cache and trigger a full cache purge for WP Rocket, LiteSpeed, Autoptimize, and Cache Engine

WordPress core

bwp/clear-cache-url

Purge the cache for a single URL or path instead of the whole site (new — Cache Engine sites only)

Cache Engine

Section 5: Extending MCP with Custom Abilities

The Site Manager MCP Abilities plugin is built on top of the WordPress Abilities API, which is natively included in WordPress 6.9+. You can register your own custom abilities by adding PHP code to your theme's functions.php file or by creating a small custom plugin.

Basic Structure

Every custom ability needs two things: a category registration (once per plugin) and one or more ability registrations. Both must be hooked into specific WordPress action hooks.

<?php

// Step 1: Register a category (once per plugin)
add_action( 'wp_abilities_api_categories_init', function() {
    wp_register_ability_category( 'my-plugin', [
        'label'       => 'My Plugin',
        'description' => 'Custom abilities for my plugin.',
    ]);
});

// Step 2: Register your ability
add_action( 'wp_abilities_api_init', function() {
    wp_register_ability( 'my-plugin/do-something', [
        'label'               => 'Do Something',
        'description'         => 'Performs a custom action.',
        'category'            => 'my-plugin',
        'input_schema'        => [
            'type'       => 'object',
            'properties' => [
                'message' => [ 'type' => 'string' ],
            ],
            'required'   => [ 'message' ],
        ],
        'output_schema'       => [
            'type'       => 'object',
            'properties' => [
                'result' => [ 'type' => 'string' ],
            ],
        ],
        'execute_callback'    => function( $input ) {
            return [ 'result' => 'You said: ' . $input['message'] ];
        },
        'permission_callback' => function() {
            return current_user_can( 'manage_options' );
        },
        'meta'                => [
            'mcp' => [ 'public' => true, 'type' => 'tool' ],
        ],
    ]);
});

Key Concepts

Ability name: Use the format category/verb-noun, for example my-plugin/get-data or my-plugin/send-email. The name must be unique across all registered abilities.

input_schema: Defines what parameters the AI agent must provide. Uses JSON Schema format. Always specify required fields so the AI knows what is mandatory. If an ability takes no input at all, omit input_schema entirely rather than passing an empty object — some MCP clients reject an empty-but-present schema.

output_schema: Describes the shape of the data your ability returns. Helps the AI agent understand and use the result correctly.

execute_callback: The PHP function that runs when the ability is invoked. It receives $input as an array based on your input_schema — note that if input_schema was omitted, your callback may be called with no arguments at all, so give the parameter a default: function( $input = [] ). Return an array or a WP_Error on failure.

permission_callback: Controls who can execute this ability. Always implement this. Use current_user_can() with an appropriate capability such as manage_options, edit_posts, or a custom capability.

meta: The mcp => public => true flag is required for the MCP Adapter to expose this ability to AI agents. Without it, the ability is registered in WordPress but not visible over MCP.

Using WP_Error for Failures

If your ability encounters an error, return a WP_Error object instead of an array. The MCP adapter will automatically convert this into an error response the AI agent can understand.

'execute_callback' => function( $input ) {
    $post = get_post( $input['post_id'] );

    if ( ! $post ) {
        return new WP_Error( 'not_found', 'Post not found.' );
    }

    return [ 'title' => $post->post_title ];
},

Checking for Optional Plugins

If your ability depends on a third-party plugin such as WooCommerce or ACF, always check that the plugin is active before running your code:

'execute_callback' => function( $input ) {

    if ( ! function_exists( 'wc_get_product' ) ) {

        return new WP_Error( 'woocommerce_missing', 'WooCommerce is not active.' );

    }

    // Your WooCommerce logic here

},

Recommended: Create a Standalone Plugin

For anything beyond a quick test, we recommend creating a dedicated plugin file rather than adding abilities to functions.php. This makes it easier to update, share with the BionicWP team, or distribute to multiple sites.

<?php

/**

 * Plugin Name: My Custom MCP Abilities

 * Description: Custom MCP abilities for my site.

 * Version: 1.0.0

 */

if ( ! defined( 'ABSPATH' ) ) exit;

add_action( 'wp_abilities_api_categories_init', function() {

    wp_register_ability_category( 'my-site', [

        'label'       => 'My Site',

        'description' => 'Custom abilities for my site.',

    ]);

});

add_action( 'wp_abilities_api_init', function() {

    // Register your abilities here

})

Need help building custom abilities? Contact BionicWP support for more examples and advanced patterns.