Read the tool list and the risk is right there: nameservers, MX records, DNS entries — an agent that misreads an instruction here takes a site off the internet, not just off the front page. WordPress.com's answer is the settings model: MCP can be disabled per account or per site, each tool group has separate read and write toggles, there is a site exception list, and any connected client can be revoked from Security → Connected Apps. That is the most complete permission surface of any hosted entry here, and it exists for a reason.
The endpoint WordPress.com runs at their public API. Four of its twelve tools are facades that bundle a whole area (content, site editor, account, site) and the rest are standalone, several of them explicitly destructive.
- Content authoring — create, read, update and delete posts, pages, comments, media, categories, tags and patterns
- Site editor context, read-only: the active theme, its colour palette, font sizes and other presets
- Site and account management — settings, statistics, plugins, activity, themes, profile and notifications
- Domain tools: search and purchase, edit DNS records, restore defaults, set nameservers or point mail at Google Workspace or iCloud
- Plan listings and pre-configured checkout URLs
OAuth 2.1 in the browser — PKCE, dynamic client registration, token rotation, no client secrets. MCP is included on every paid WordPress.com plan (Personal $9/mo, Premium $18, Business $40, Commerce $70) and on Jetpack-connected self-hosted sites.
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen