The interesting choice here is the confidentiality gate: only blogs explicitly marked with the sticker are readable by the assistant, and the override to disable that check is documented as not recommended. Beyond that, the moving part is the background auth service — if tools disappear or the client asks you to authenticate again, check that service is running before touching the config.
A WordPress.com Reader integration published by Automattic. A small background service holds the OAuth session so the MCP server does not have to re-authenticate every time the desktop client restarts, and the whole thing is driven in plain language rather than by naming tools.
- Your Reader feed: recent posts from the blogs you follow, filtered by count or by day
- Notifications: unread counts, comments-only views, and marking them read
- Tags: posts from a tag, subscribing and unsubscribing, and listing the tags you follow
- Blogs: the list you follow, following and unfollowing, and recommendations for new ones
- A8C posts for Automattic company updates
- A confidentiality check that only allows AI access to blogs carrying the `p2_confidentiality_disabled` sticker
A WordPress.com account and a developer application you create, with the website URL set to http://localhost:3000 and the redirect URI to http://localhost:3000/auth/callback. Its Client ID and Client Secret go into `web-app/.env` as `WORDPRESS_CLIENT_ID` and `WORDPRESS_CLIENT_SECRET`, alongside `REDIRECT_URI`, `PORT`, `JWT_SECRET` and `MCP_SERVER_URL`. Node.js is required; `npm run setup` installs, builds, configures Claude Desktop and starts the auth service, after which you authorise in the browser.
Build from source — clone the repository and build it, then point your client at the binary