WordPress Remote MCP Proxy: Setup for Claude Desktop, Cursor and Other Apps
Lets Claude Desktop and other stdio-only apps talk to the MCP endpoint on your WordPress site, signing in with OAuth, a JWT or an application password.
This is a small proxy from Automattic. It runs on your computer and passes your assistant's requests to the MCP endpoint that the WordPress MCP Adapter plugin adds to your site. The tools you get are whatever the plugin and your other plugins expose, so the proxy has no tool list of its own. You do not need it if your app can connect to an HTTP address and sign in the way your site requires. The README says to connect directly in that case.
Good for
- WordPress site owners who want Claude Desktop to work with their own site
- Developers whose AI app can only launch local commands
- Teams whose site needs OAuth, JWT or custom headers that the app cannot send
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install mcp-wordpress-remote
Claude Code
- 1
Copy this prompt.
Add the mcp-wordpress-remote server to Claude Code. Run this command: claude mcp add wordpress -e WP_API_URL=https://your-wordpress-site.com/wp-json/mcp/mcp-adapter-default-server -e OAUTH_ENABLED=true -- npx -y @automattic/mcp-wordpress-remote Ask me for WP_API_URL, OAUTH_ENABLED and only put the values in that config, nowhere else. Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires Node.js, MCP Adapter plugin on the site.
Install the MCP Adapter plugin on your WordPress site first, then set WP_API_URL to your site's endpoint. OAUTH_ENABLED=true opens your browser to sign in. For a JWT token set JWT_TOKEN instead. For an application password set WP_API_USERNAME and WP_API_PASSWORD, and set OAUTH_ENABLED to false.
From the project README. Source.
Tools
Lists what your site lets the assistant do
Returns the WordPress abilities your site has made public. Your site's MCP Adapter plugin supplies this tool, not the proxy.
Try: “What can you do on my WordPress site?”
Read ·
mcp-adapter-discover-abilitiesShows how one site action works
Fetches the details and inputs for one ability before the assistant uses it.
Try: “Show me how to create a draft post on my site.”
Read ·
mcp-adapter-get-ability-infoRuns a site action
Runs one of the public abilities with the inputs you give it. What it changes depends on the abilities your site and plugins expose.
Try: “Run the ability that creates a draft post titled Spring Sale.”
Write ·
mcp-adapter-execute-ability
Read from the source code
Permissions
medium risk · 2 things to watch
Medium risk
What it can do depends on your site, because the proxy passes everything to the plugin and acts as the WordPress user you sign in as. Use an application password or account with the narrowest WordPress role the job needs.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only mode
Watch out for
It can change your site as the user you sign in as
Any ability your site exposes can be run with that user's permissions. Sign in as an editor rather than an administrator unless you need more. raw.githubusercontent.com
Secrets live in your client config file
An application password or JWT token in the config is readable by anyone with access to that file. Prefer the OAuth option, and do not commit the config to git. raw.githubusercontent.com
Security advisories
No published security advisories as of Nov 1, 2026.
Technical details
| Talks to | Your WordPress site (WP_API_URL) |
|---|---|
| Sign-in and keys | OAuth tokens are stored on your computer by the proxy. Application passwords and JWT tokens sit in the env block of your client config. |
| Scopes |
|
Questions
Is the WordPress Remote MCP proxy official?
Yes. It is published by Automattic, the company behind WordPress.com, and the MCP Adapter README points to it for connecting over HTTP.
Do I need this proxy?
Only if your AI app cannot connect to an HTTP address, cannot sign in the way your site requires, or must go through a proxy. Otherwise connect the app straight to your site's endpoint, as the README describes.
What do I need on the WordPress site?
The MCP Adapter plugin must be active. It adds the endpoint at /wp-json/mcp/mcp-adapter-default-server that you point the proxy at.
How do I sign in?
Pick one of three ways: OAuth in your browser, a JWT token, or a WordPress username with an application password. The README recommends OAuth.
How is it different from the WordPress MCP Adapter?
The adapter is a plugin that lives on your site and creates the MCP endpoint. This proxy runs on your computer and connects an app to that endpoint. You install the plugin first, then add the proxy only if your app needs it.
Can it run read-only?
The README does not document a read-only mode. Limit it by signing in as a WordPress user with a low role.
Information
updated Nov 2, 2026
- Publisher
- Official
- Package
@automattic/mcp-wordpress-remote- Registry
- npm
- Transport
- stdio
- Version
- 0.5.4
- License
- MIT
- Last commit
- Oct 28, 2026
- Open issues
- 2
Other WordPress MCP servers
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 2Hide
- raw.githubusercontent.com · raw.githubusercontent.com
- raw.githubusercontent.com · raw.githubusercontent.com