WordPress.com's own MCP endpoint — write posts, read site design context, and manage domains and DNS.
LABSCO SUMMARY
Read the tool list and the risk is right there: nameservers, MX records, DNS entries — an agent that misreads an instruction here takes a site off the internet, not just off the front page. WordPress.com's answer is the settings model: MCP can be disabled per account or per site, each tool group has separate read and write toggles, there is a site exception list, and any connected client can be revoked from Security → Connected Apps. Those controls exist for exactly that reason.
The endpoint WordPress.com runs at their public API. Four of its twelve tools are facades that bundle a whole area (content, site editor, account, site) and the rest are standalone, several of them explicitly destructive.
OAuth 2.1 in the browser — PKCE, dynamic client registration, token rotation, no client secrets. MCP is included on every paid WordPress.com plan (Personal $9/mo, Premium $18, Business $40, Commerce $70) and on Jetpack-connected self-hosted sites.
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen
USE CASES
Create a post, attach media and set categories through one content tool instead of a browser session.
Read the site's design context — palette, font sizes, presets — before generating blocks, so the output fits the design instead of fighting it.
Set the DNS records for Google Workspace or iCloud Mail in one call, with the defaults restorable if it goes wrong.
List the sites the account can touch across WordPress.com and Jetpack-connected installs before granting write access.
Listed in project docs. Your client may show a different list.
wpcom-mcp-content-authoringSTRAP facade: create/read/update/delete posts, pages, comments, media, categories, tags, block patterns, synced patterns, plus free-text content-search on a WordPress.com site. 35 operations (posts.list/get/create/update/delete, pages.*, comments.*, media.*, categories.*, tags.*, patterns.list/get, synced-patterns.list/get, content-search).
wpcom-mcp-site-editor-contextSTRAP facade (read-only): query site design context — theme.active, theme.presets (color palette, font sizes/families, gradients, spacing), theme.styles (applied theme.json styles), blocks.allowed (registered block types with style variations).
wpcom-mcp-accountSTRAP facade: manage the authenticated user's WordPress.com account — profile.get/update, notifications.get/update, inbox.get, achievements.get, domains.list/get/dns_records/set_primary, connections.get, security.get, currency.preview/change. Operates on the calling user, no wpcom_site required.
wpcom-mcp-siteSTRAP facade: manage a WordPress.com site — settings.get/update, statistics.get, plugin.list, activity.get, theme.list/set, monitor.status/activate/deactivate, newsletter.status/get_settings, account-protection.status/activate/deactivate, manage-site.status/launch/set-visibility.
wpcom-user-sitesStandalone: list the authenticated user's accessible sites across WordPress.com and self-hosted Jetpack-connected sites; discover site IDs before calling site-scoped tools.
wpcom-domain-purchaseStandalone: search available domains and generate checkout links for registration on WordPress.com; returns matching domains with prices and pre-built checkout URLs.
wpcom-domain-update-dns-recordsStandalone (destructive): add or remove DNS records (A, AAAA, ALIAS, CAA, CNAME, MX, NS, SRV, TXT) for a single custom domain.
wpcom-domain-restore-default-dns-recordsStandalone: restore WordPress.com default A records (apex IPs) or default www CNAME for a custom domain.
wpcom-domain-update-nameserversStandalone (destructive): set nameservers for a single custom domain; caller must manage the site the domain is connected to.
wpcom-domain-set-mail-serviceStandalone (destructive): configure DNS records on a domain for an external mail service — Google Workspace, iCloud Mail, Office 365, or Zoho Mail. Overwrites existing MX and related records.
wpcom-checkout-urlStandalone: generate a pre-configured WordPress.com checkout URL for one or more products or a subscription renewal; payment happens in the browser, not via the tool.
wpcom-plans-listStandalone (read-only): list WordPress.com plans with prices and per-tier feature lists.
BEFORE YOU INSTALL
12 tools named in the project's documentation.
INSTALLATION
Add the endpoint to your client, then approve the OAuth consent screen.
https://public-api.wordpress.com/wpcom/v2/mcp/v1MCP servers
emzimmer
5unnykum4r
cvrt-jh