WordPress MCP - AI Agent Access
Overview
BionicWP supports the WordPress Model Context Protocol (MCP), which allows AI agents such as Claude to securely connect to and manage your WordPress site. Once enabled, your AI agent can create posts, update pages, edit Elementor and Divi content directly, manage WooCommerce products and orders, moderate comments, install and update plugins, and much more — all from within the AI chat interface.
This article covers:
How to install Node.js and npm (required prerequisite)
How to enable and disable MCP from the BionicWP dashboard
How to create an application password in WordPress
How to configure your AI agent (Claude Desktop or Claude Code)
A full reference of all available MCP abilities
How to extend MCP with your own custom abilities
WordPress 6.9+ required. MCP requires WordPress 6.9 or later. All BionicWP-hosted sites meet this requirement automatically. |
Plugin renamed. The abilities plugin is now called Site Manager MCP Abilities (previously BionicWP MCP Abilities). You'll see this name in your Plugins list in wp-admin. Functionality and the bwp/ ability prefix are unchanged. |
Section 0: Installing Node.js and npm
The Claude Desktop and Claude Code MCP configurations use npx, which ships with Node.js. You must have Node.js (version 18 or later) installed before setting up your AI agent config.
Windows
Go to nodejs.org and download the LTS installer (.msi) for Windows.
Run the installer and follow the prompts. Leave all default options selected — this installs both
nodeandnpm.Once complete, open Command Prompt or PowerShell and verify the installation:
node --version
npm --versionBoth commands should print a version number. If they do, you're ready to proceed.
Windows users: When configuring Claude Desktop on Windows, use npx.cmd instead of npx in the command field of your MCP config file. See Section 3 for details. If Claude Desktop reports 'npx.cmd' is not recognized, Node.js is either not installed or not on your system PATH — reinstall Node.js and fully quit and restart Claude Desktop (not just close the window) so it picks up the updated PATH.
Mac
There are two recommended ways to install Node.js on macOS:
Option A — Official installer (simplest)
Go to nodejs.org and download the LTS installer (.pkg) for macOS.
Open the downloaded file and follow the installation wizard.
Open Terminal and verify:
node -v
npm -vOption B — Homebrew (recommended for developers)
If you have Homebrew installed, run:
brew install nodeThen verify in Terminal:
node -v
npm -vBoth options install node, npm, and npx together. You only need to complete one of them.
Section 1: Enabling MCP from the BionicWP Dashboard
Step 1 — Open the Site Detail Page
Log in to your BionicWP dashboard at app.bionicwp.com
Click on the site you want to connect to an AI agent
On the site detail page, click the Advanced tab
Scroll down to the WordPress MCP section
Step 2 — Enable MCP
Click the toggle next to MCP Disabled to turn MCP on
A confirmation dialog will appear — click Enable MCP to proceed
BionicWP will automatically install two plugins on your site:
MCP Adapter — handles the connection between your site and AI agents
Site Manager MCP Abilities — exposes 65+ abilities to the AI agent
Wait for the installation to complete. You will see progress messages for each step.
Once installed, the MCP Enabled UI will appear with setup instructions.
Note: Installation typically takes 10–20 seconds. Do not refresh the page during this process. |
Step 3 — Disable MCP
To remove MCP from a site:
On the Advanced tab, click the green MCP Enabled toggle to turn it off
A confirmation dialog will appear with a warning that this action will delete the plugins
Click Remove MCP to confirm
Both plugins will be deactivated and permanently deleted from your site
Important: Disabling MCP removes both plugins completely from the site. Any AI agent configs pointing to this site will stop working immediately. |
Section 2: Creating a WordPress Application Password
To connect your AI agent, you need a WordPress Application Password. This is different from your regular login password and can be revoked at any time without affecting your main account.
Creating the Application Password
Log in to your WordPress admin (wp-admin)
Go to Users in the left menu, then click on your username or Profile
Scroll down to the Application Passwords section near the bottom of the page
In the New Application Password Name field, enter a descriptive name such as Claude AI or BionicWP MCP
Click Add New Application Password
WordPress will display the generated password once — copy it immediately
Important: You will not be able to view this password again after leaving the page. Store it somewhere safe, such as a password manager. |
Revoking an Application Password
If you need to revoke access for an AI agent:
Go to Users > Profile in WordPress admin
Scroll to Application Passwords
Find the password entry and click Revoke next to it
The AI agent will immediately lose access to the site
Section 3: Configuring Your AI Agent
After enabling MCP and creating an application password, you need to add the site config to your AI agent. The BionicWP dashboard provides a ready-made config file you can download or copy.
Finding Your Config File
On the Advanced tab, scroll to the WordPress MCP section
Under Step 2, you will see a pre-filled JSON config block with your site URL already inserted
Replace YOUR_USERNAME with your WordPress username
Replace YOUR_APPLICATION_PASSWORD with the password you generated in Section 2
Use either the Copy to Clipboard button or Download config.json button
Claude Desktop Setup
Open Claude Desktop on your computer
Go to Settings, then click Developer, then click Edit Config
This opens the file claude_desktop_config.json in a text editor
Find the mcpServers section (or create it if it does not exist)
Paste your site config inside the mcpServers object — if you have other servers already configured, add this one alongside them
Save the file
Quit and restart Claude Desktop
Look for the plug icon in the Claude interface — this confirms your site is connected
Your config will look like this (with your actual values filled in):
{ "mcpServers": { "yoursite": { "command": "npx", "args": [ "-y", "@automattic/mcp-wordpress-remote@latest" ], "env": { "WP_API_URL": "https://yoursite.com/wp-json/mcp/mcp-adapter-default-server", "WP_API_USERNAME": "your_username", "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx" } } } } |
Note: If you have multiple sites, add each one as its own entry inside mcpServers, alongside your existing entries — do not replace the whole file.
Claude Code Setup
Open your terminal
Run: claude mcp add
Follow the on-screen prompts, or alternatively edit the config file manually
The config file is located at ~/.claude/claude_code_config.json on Mac/Linux, or %APPDATA%\Claude\claude_code_config.json on Windows
Paste the same JSON config into the mcpServers object
Save and restart Claude Code
Windows users: If you use Claude Desktop on Windows, use npx.cmd instead of npx in the command field of the config. |
Section 4: Available MCP Abilities
Once MCP is enabled, your AI agent has access to the following abilities on your WordPress site. These are provided by the Site Manager MCP Abilities plugin.
Posts
Ability Name | Description | Requires |
|---|---|---|
bwp/get-posts | List or search posts with filters (status, category, author, pagination) | WordPress core |
bwp/create-post | Create a new post with title, content, status, categories, tags, and meta | WordPress core |
bwp/update-post | Update an existing post's content, status, categories, tags, or meta | WordPress core |
bwp/delete-post | Move a post to trash or permanently delete it | WordPress core |
Content Editing & Revert
These abilities let your AI agent make targeted edits to existing content — changing one paragraph or heading instead of rewriting the whole page — with a built-in way to undo the change if something goes wrong.
Ability Name | Description | Requires |
|---|---|---|
bwp/get-post | Get a single post or page's raw editor content, plus which page builder (if any) it uses. Always called before editing. | WordPress core |
bwp/search-posts | Search posts and pages by keyword, or look up by exact slug, to find the right post before reading or editing it. | WordPress core |
bwp/edit-post-content | Make a targeted edit (find-and-replace, or add content before/after/at the start/end) instead of replacing the whole post. A safe restore point is saved automatically before the edit is made. | WordPress core |
bwp/get-post-revisions | List a post's saved revisions — these are the restore points used to undo an edit. | WordPress core |
bwp/restore-revision | Roll a post or page back to a previous revision. | WordPress core |
bwp/get-post-diff | Compare two versions of a post's content (for example, before and after an edit) and get a readable diff instead of two full copies of the content. | WordPress core |
bwp/duplicate-post | Clone a post or page as a draft, including its content, categories/tags, featured image, and Elementor data. Useful for testing an edit safely before publishing. | WordPress core |
bwp/set-featured-image | Set or remove a post or page's featured image, from an image already in the media library. | WordPress core |
Elementor
For sites built with Elementor, these abilities let your AI agent read and edit individual widgets directly, rather than working with the raw Elementor data.
Ability Name | Description | Requires |
|---|---|---|
bwp/get-elementor-data | List every element on an Elementor page (with a short label for each), or get the full settings for one specific element. | Elementor |
bwp/update-elementor-widget | Update the settings of a single Elementor element — a heading, a button, an image, and so on — without touching the rest of the page. A backup of the previous version is saved automatically. | Elementor |
bwp/restore-elementor-backup | Undo the most recent bwp/update-elementor-widget edit on a post. Only the single most recent edit can be undone this way. | Elementor |
Divi 5
For sites built with Divi 5 (the block-based version of Divi), these abilities let your AI agent read and edit individual sections, rows, and modules directly. Divi 4 (shortcode-based) content is not covered by these two abilities — use the Content Editing abilities above for Divi 4 sites instead.
Ability Name | Description | Requires |
|---|---|---|
bwp/get-divi-blocks | List the structure of a Divi 5 page — every section, row, column, and module, with a short label for each. | Divi 5 |
bwp/update-divi-block | Update a single Divi 5 block (for example, one module's text) without replacing the whole page. A safe restore point is saved automatically before the edit is made. | Divi 5 |
Pages
Ability Name | Description | Requires |
|---|---|---|
bwp/get-pages | List pages with status, parent, and search filters | WordPress core |
bwp/create-page | Create a new page with title, content, parent, and meta | WordPress core |
bwp/update-page | Update an existing page's content, status, or parent | WordPress core |
bwp/delete-page | Move a page to trash or permanently delete it | WordPress core |
Media
Ability Name | Description | Requires |
|---|---|---|
bwp/get-media | List media library items with search and mime type filters | WordPress core |
bwp/upload-media | Upload a file to the media library from a remote URL | WordPress core |
Categories
Ability Name | Description | Requires |
|---|---|---|
bwp/get-categories | List all post categories | WordPress core |
bwp/create-category | Create a new category with name, slug, parent | WordPress core |
bwp/update-category | Update an existing category | WordPress core |
bwp/delete-category | Delete a post category | WordPress core |
Tags
Ability Name | Description | Requires |
|---|---|---|
bwp/get-tags | List all post tags | WordPress core |
bwp/create-tag | Create a new tag | WordPress core |
bwp/delete-tag | Delete a tag | WordPress core |
Navigation Menus
Ability Name | Description | Requires |
|---|---|---|
bwp/get-menus | List all registered menus and their items | WordPress core |
bwp/add-menu-item | Add an item to a navigation menu | WordPress core |
bwp/delete-menu-item | Remove an item from a navigation menu | WordPress core |
Users
Ability Name | Description | Requires |
|---|---|---|
bwp/get-users | List users with optional role and search filters | WordPress core |
bwp/create-user | Create a new user with username, email, password, and role | WordPress core |
bwp/update-user | Update a user's email, display name, role, or password | WordPress core |
Comments
Ability Name | Description | Requires |
|---|---|---|
bwp/get-comments | List comments filtered by status (pending, approved, spam) | WordPress core |
bwp/moderate-comment | Approve, unapprove, trash, spam, or delete a comment | WordPress cor |
SEO Meta
Ability Name | Description | Requires |
|---|---|---|
bwp/get-seo-meta | Read Yoast or RankMath SEO title, meta description, and focus keyword for a post | Yoast SEO or RankMath |
bwp/update-seo-meta | Write Yoast or RankMath SEO fields for a post or page | Yoast SEO or RankMath |
Post Meta
Ability Name | Description | Requires |
|---|---|---|
bwp/get-post-meta | Read post meta fields — useful for Divi, WPBakery, or custom fields | WordPress core |
bwp/update-post-meta | Write post meta fields — covers Divi, WPBakery, ACF, and custom fields | WordPress core |
Advanced Custom Fields (ACF)
Ability Name | Description | Requires |
|---|---|---|
bwp/get-acf-fields | Get all ACF field values for a post or page | ACF plugin |
bwp/update-acf-fields | Update ACF field values for a post or page | ACF plugin |
bwp/get-acf-field-groups | List all registered ACF field group definitions | ACF plugin |
WooCommerce — Products
Ability Name | Description | Requires |
|---|---|---|
bwp/get-products | List or search products with status, category, and pagination filters | WooCommerce |
bwp/create-product | Create a simple product with price, SKU, stock, and categories | WooCommerce |
bwp/update-product | Update an existing product's price, stock, status, or details | WooCommerce |
bwp/delete-product | Trash or permanently delete a product | WooCommerce |
bwp/get-product-categories | List WooCommerce product categories | WooCommerce |
bwp/create-product-category | Create a new product category | WooCommerce |
WooCommerce — Orders & Coupons
Ability Name | Description | Requires |
|---|---|---|
bwp/get-orders | List orders with status, customer, and pagination filters | WooCommerce |
bwp/get-order | Get full detail for a single order, including its line items (new) | WooCommerce |
bwp/update-order | Update order status or add a note (optionally notify customer) | WooCommerce |
bwp/create-coupon | Create a percent or fixed discount coupon with expiry and limits | WooCommerce |
Site Settings
Ability Name | Description | Requires |
|---|---|---|
bwp/get-site-settings | Read site title, tagline, URL, admin email, timezone, theme, and WordPress version | WordPress core |
bwp/update-site-settings | Update site title, tagline, admin email, timezone, date format, or posts per page | WordPress core |
Plugins
Ability Name | Description | Requires |
|---|---|---|
bwp/list-plugins | List all installed plugins with name, version, and active status | WordPress core |
bwp/activate-plugin | Activate an installed plugin by its plugin file path | WordPress core |
bwp/deactivate-plugin | Deactivate an active plugin | WordPress core |
bwp/install-plugin | Install a plugin from the WordPress.org repository by slug | WordPress core |
bwp/update-plugin | Update an installed plugin to its latest available version | WordPress core |
bwp/list-updates | Check for available updates for plugins, themes, and WordPress core | WordPress core |
Site Health & Cache
Ability Name | Description | Requires |
|---|---|---|
bwp/get-site-health | Run WordPress Site Health checks and return results grouped by severity | WordPress core |
bwp/get-cache-status | Report which caching plugins are actively integrated with bwp/clear-cache, which other active plugins look cache-related but aren't yet, and whether an external object cache is in use | WordPress core |
bwp/clear-cache | Flush the object cache and trigger a full cache purge for WP Rocket, LiteSpeed, Autoptimize, and Cache Engine | WordPress core |
bwp/clear-cache-url | Purge the cache for a single URL or path instead of the whole site (new — Cache Engine sites only) | Cache Engine |
Section 5: Extending MCP with Custom Abilities
The Site Manager MCP Abilities plugin is built on top of the WordPress Abilities API, which is natively included in WordPress 6.9+. You can register your own custom abilities by adding PHP code to your theme's functions.php file or by creating a small custom plugin.
Basic Structure
Every custom ability needs two things: a category registration (once per plugin) and one or more ability registrations. Both must be hooked into specific WordPress action hooks.
<?php |
Key Concepts
Ability name: Use the format category/verb-noun, for example my-plugin/get-data or my-plugin/send-email. The name must be unique across all registered abilities.
input_schema: Defines what parameters the AI agent must provide. Uses JSON Schema format. Always specify required fields so the AI knows what is mandatory. If an ability takes no input at all, omit input_schema entirely rather than passing an empty object — some MCP clients reject an empty-but-present schema.
output_schema: Describes the shape of the data your ability returns. Helps the AI agent understand and use the result correctly.
execute_callback: The PHP function that runs when the ability is invoked. It receives $input as an array based on your input_schema — note that if input_schema was omitted, your callback may be called with no arguments at all, so give the parameter a default: function( $input = [] ). Return an array or a WP_Error on failure.
permission_callback: Controls who can execute this ability. Always implement this. Use current_user_can() with an appropriate capability such as manage_options, edit_posts, or a custom capability.
meta: The mcp => public => true flag is required for the MCP Adapter to expose this ability to AI agents. Without it, the ability is registered in WordPress but not visible over MCP.
Using WP_Error for Failures
If your ability encounters an error, return a WP_Error object instead of an array. The MCP adapter will automatically convert this into an error response the AI agent can understand.
'execute_callback' => function( $input ) { |
Checking for Optional Plugins
If your ability depends on a third-party plugin such as WooCommerce or ACF, always check that the plugin is active before running your code:
'execute_callback' => function( $input ) { if ( ! function_exists( 'wc_get_product' ) ) { return new WP_Error( 'woocommerce_missing', 'WooCommerce is not active.' ); } // Your WooCommerce logic here }, |
Recommended: Create a Standalone Plugin
For anything beyond a quick test, we recommend creating a dedicated plugin file rather than adding abilities to functions.php. This makes it easier to update, share with the BionicWP team, or distribute to multiple sites.
<?php /** * Plugin Name: My Custom MCP Abilities * Description: Custom MCP abilities for my site. * Version: 1.0.0 */ if ( ! defined( 'ABSPATH' ) ) exit; add_action( 'wp_abilities_api_categories_init', function() { wp_register_ability_category( 'my-site', [ 'label' => 'My Site', 'description' => 'Custom abilities for my site.', ]); }); add_action( 'wp_abilities_api_init', function() { // Register your abilities here }) |
Need help building custom abilities? Contact BionicWP support for more examples and advanced patterns. |
