more-mcp

<p align="center"> <img src=".wordpress-org/banner-1544x500.png" alt="More MCP: Connect AI assistants to WordPress" width="100%"> </p> <p align="center"> <img src=".wordpress-org/icon-256x256.png" alt="More MCP logo" width="128" height="128"> </p> <h1 align="center">More MCP</h1> <p align="center"><strong>Give AI assistants a safe, authenticated way into WordPress.</strong><br>Self-hosted OAuth and API keys, per-tool capability checks, audit logging, and 111 always-on tools plus opt-in integrations.</p>

More MCP is a self-hosted Model Context Protocol server built into WordPress by Mordenhost. Claude, ChatGPT, Gemini, AI coding assistants, and any other MCP-compatible agent operate your site through typed, permission-checked tools — no screen scraping, no browser automation, no copy-paste.

Where a bare MCP bridge stops at exposing functions, More MCP is built for sites that are actually in production. Every request authenticates through OAuth 2.0 or an API key, hits a per-IP rate limit, and passes a WordPress capability check inside the tool handler before it touches anything. Interactions are logged for audit — tool names and argument keys, never the argument values. Nothing leaves your database: no license server, no telemetry, no callback to Mordenhost or anyone else.

A standard installation exposes 111 always-on tools for WordPress core, Gutenberg blocks, and outbound webhooks. Compatible plugins can add specialized tools once an administrator enables their integration, while ten high-impact plugin and theme lifecycle tools remain disabled until an administrator explicitly enables them. The live count depends on the active integrations and permissions and is shown in the Documentation panel, which reads the registry directly; every tool is reachable through the native MCP endpoint, the classic REST API, and the WordPress Abilities API on WordPress 6.9 or later.

Contents

• How it works
• Requirements
• Installation
• Tool inventory
• Plugin integrations
• Supported clients and platforms
• Security and privacy
• Frequently asked questions
• License

How it works

flowchart LR
    C["MCP clients"] --> M["Streamable HTTP MCP endpoint"]
    O["OAuth 2.0"] --> M
    K["More MCP API key"] --> M
    R["REST clients"] --> API["Classic REST API"]
    A["WordPress 6.9+ consumers"] --> AB["Abilities API"]
    M --> G["Authentication, rate limiting, and origin checks"]
    G --> T["Shared tool registry and handlers"]
    API --> T
    AB --> T
    T --> P["WordPress capability checks"]
    P --> W["WordPress core and Gutenberg APIs"]
    P --> I["Detected plugin integrations"]

All three public tool surfaces route into the same registry and handlers, so capability checks and tool behavior remain consistent. The primary endpoint is:

https://yoursite.com/wp-json/more-mcp/v1/mcp

OAuth discovery and authorization endpoints live at the domain root.

Why security matters

MCP tools can read, create, update, and delete WordPress data. More MCP protects that access with:

• OAuth 2.0 authorization code flow with PKCE and refresh-token rotation.
• Static API-key authentication for clients that do not support OAuth.
• Timing-safe credential comparison and authenticated session initialization.
• Origin validation and per-IP rate limiting of 60 requests per minute.
• WordPress capability checks inside every tool handler.
• Audit logging that records tool names and argument keys, never argument values.
• Read-after-write verification for mutation tools.
• Dry-run, confirmation, guard, and undo mechanisms on supported high-impact operations.
• Cache-Control: no-store across the More MCP namespace to prevent authenticated responses from being reused by URL-keyed edge caches.

At a glance

| Area | What More MCP provides | |---|---| | Authentication | OAuth 2.0 or a self-hosted More MCP API key | | Protocol | MCP 2025-11-25 over Streamable HTTP and JSON-RPC 2.0 | | Tool count | 111 always registered; 10 opt-in lifecycle tools; plus opt-in integration tools (live count shown in the Documentation panel) | | WordPress support | WordPress 5.8+; Abilities API integration on WordPress 6.9+ | | Runtime | PHP 7.4+; PHP 8.0+ recommended | | Data ownership | Credentials, tokens, sessions, and logs stay in your WordPress database | | Vendor coupling | None—no license server, telemetry, or More MCP cloud service |

Requirements

• PHP 7.4 or later. PHP 8.0+ is recommended — it is what the plugin is developed and tested against, and PHP 7.4 reached end of life in November 2022, so it no longer receives security fixes from the PHP project.
• WordPress 5.8 or later. Tested up to WordPress 7.0.
• MySQL 5.6+ or MariaDB 10.1+ — activation creates five tables.
• HTTPS, for any client using the OAuth connector flow. The OAuth 2.0 specification requires it, and Claude Desktop's native connector will not complete a handshake over plain HTTP. Static API-key auth works without it but sends the key in a header, so HTTPS is strongly recommended there too.
• Pretty permalinks must be enabled (Settings → Permalinks, anything other than "Plain"). The OAuth endpoints are served from domain-root rewrite rules, which do not exist under the plain permalink structure.
• WordPress 6.9 or later for the Abilities API surface. This is optional — the MCP endpoint and the REST API work on 5.8+ regardless.

Free, self-hosted, and fully featured

More MCP is fully featured in its free, GPL-licensed release. There is no Pro version — all tools ship in the wp.org plugin, and updates go through the standard WordPress plugin updater.

Your credentials stay on your server. More MCP runs entirely inside WordPress: API keys, OAuth tokens, and session state all live in your own database. More MCP makes no outbound connections to any vendor server — no license check, no telemetry, no traffic beacon. If you prefer to keep AI inference local too, Ollama and LM Studio are first-class platforms alongside Claude, ChatGPT, and Gemini.

Tool inventory

Every installation registers 111 always-on tools: 87 WordPress core tools, 21 Gutenberg block tools, and 3 outbound-webhook tools (none are gated on a third-party plugin). Opt-in integrations add more tools once an administrator enables them (WooCommerce alone adds 29), and ten plugin/theme lifecycle tools appear only when an administrator enables them. Exact live counts are shown in the Documentation panel, which reads the registry directly.

WordPress Core (87 tools):

• Posts - create, read, update, delete, search, count (any registered public post type, featured images supported)
• Pages - full CRUD with parent page support
• Post Types - discover all registered public post types on the site
• Post Revisions - list revision history and roll a post back to any prior version
• Media - browse, upload from URL or base64, update alt text/caption/title/description, set as featured image, delete
• Comments - create, read, delete; full moderation suite (list pending, approve, mark spam, trash)
• Users - display names and roles (emails and usernames are not exposed)
• Categories & Tags & Custom Taxonomies - create, update (rename/re-slug/edit/move), delete, assign, count, discover all registered taxonomies
• Term Meta - read, update, delete raw wp_termmeta values. For SEO fields on a term, use the SEO Meta tools below instead: Yoast keeps taxonomy SEO in an option and All in One SEO in its own table, so neither is reachable through term meta
• Menus - list menus, list menu items, create / update / delete / reorder menu items
• Post Meta - read, update, delete custom fields (works with ACF, MetaBox, JetEngine, Pods, CPT UI)
• SEO Meta - read and write title/description/focus keyword/noindex/canonical/OG/Twitter fields on posts and terms, across six SEO plugins (Yoast SEO, Rank Math, All in One SEO, SEOPress, Slim SEO, The SEO Framework). Each field is routed to wherever the detected plugin actually stores it; a field that plugin does not store is refused by name rather than written to a plausible-looking key that would save cleanly and change nothing on the page
• Site Info - site name, description, WordPress version, timezone
• Site Status - full site health snapshot (WordPress version, PHP version, active theme, active plugins, cron activity) for AI-driven pre-write validation
• Error Log - read recent PHP error log entries so AI agents can diagnose silent failures without shell access
• Cron Schedule - list scheduled WP cron events with next-run timestamps and hook names
• Connection Health - MCP session diagnostic returning route, auth method, session ID, and More MCP version details for any authenticated caller
• Plugins & Themes - list installed plugins and themes with active status
• Theme Appearance - get active theme, read/write theme mods (gated by admin toggle + allowlist), read/write Custom CSS
• Render Context - list the templates a post can be rendered with (resolved live, so it covers the active theme's page templates, a block theme's custom templates, and Elementor's Canvas / Full Width / Theme options) and set which one renders a given post. A value outside the resolved list is refused by name rather than stored, because WordPress would accept any string and silently fall back to the default at render time
• Search - full-text content search across post types
• Permalink Structure - read and update permalink settings (gated by admin toggle)
• Options - read allowlisted core options, read full plugin settings by slug (sensitive keys redacted), and write to allowlisted options when an admin enables it

Plugin and theme management (10 tools, opt-in)

Disabled by default. Enable "Allow AI to manage plugins and themes" under Settings → Access to expose these; while the toggle is off they are not listed to MCP clients at all.

These tools change the code running on your site, not just its content, so they are gated more tightly than anything else in the plugin:

• Every write requires the matching WordPress capability, re-checked inside the handler
• Every write requires a two-part confirmation: confirm=true AND confirm_slug echoing the exact target. A call without confirmation returns a preview of what would change, so the first call is always a dry run
• wp_install_plugin accepts WordPress.org slugs only — package URLs are rejected rather than downloaded, and the preview shows name, author, version, and active-install count so a typo-squat is visible before you confirm
• More MCP cannot deactivate or delete itself; the more_mcp_protected_plugins filter protects others
• Deleting a plugin requires deactivating it first — deletion is irreversible, so deactivation is the checkpoint
• Sites whose filesystem needs FTP/SSH credentials are refused rather than prompted; credentials must never travel through MCP arguments
• Every operation returns the state read back afterwards, so an upgrader that silently no-ops is visible rather than reported as success

Plugins: list pending updates, activate, deactivate, update, install (wp.org), delete. Themes: list status with pending updates, activate (switch), update, delete.

Plugin integrations (conditional)

More MCP detects compatible plugins and can expose specialized MCP tools for them. Each integration is off by default and requires two things before its tools appear: the host plugin must be active, and an administrator must enable that integration under More MCP → Settings → Access → Plugins. This opt-in is a deliberate safety gate — activating a plugin never silently widens the agent's reach until you turn the integration on. The toggle lives in the denylisted more_mcp_settings op