Creating a post without a status produces a draft, which means an assistant that misunderstands an instruction produces something you can delete rather than something your readers already saw. Publishing is an explicit choice on the call. The per-call credentials are the other useful piece: the same server can write to several sites without a config file per site, though that does mean credentials appear in the request when you use it that way.
A small MCP server for WordPress publishing. Three operations cover the loop: create a post, read a page of posts, and update one you already made. Authentication uses a WordPress application password rather than the account password.
- `create_post` takes a `title`, `content` and an optional `status` of `draft`, `publish` or `private`, defaulting to `draft`
- `get_posts` reads posts with `perPage` and `page`, defaulting to 10 per page starting at page 1
- `update_post` edits an existing post by `postId`, changing title, content or status
- Credentials can come from the environment or be supplied in the call itself, so one server can address more than one site
Node.js 20.0.0 or higher, and a WordPress site with the REST API enabled. Clone, `npm install`, `npm run build`, then point the client at the built entry point. The three environment variables are `WORDPRESS_SITE_URL`, `WORDPRESS_USERNAME` and `WORDPRESS_PASSWORD`, which should hold an application password generated under Users > Security > Application Passwords rather than your login password.
Build from source — clone the repository and build it, then point your client at the binary