Summary

Written for production sites, with the guardrails to match.

Everything destructive is fenced: file writes are limited to .php, .css, .js, .json, .html and .txt inside the theme sandbox, every saved PHP file passes a syntax check before it lands, DELETE on posts and pages moves to trash rather than removing, plugin install and update need two-phase confirmation, and DB reads are SELECT-only with a 1000-row limit. Theme editing in particular is worth the plugin on its own — the draft, preview and publish steps are separate tools, so a bad edit never reaches the live theme.

What it is

The WordPress side of WPVibe: a GPL plugin you install on your site that exposes WordPress operations as MCP-callable REST endpoints. It pairs with the hosted WPVibe service, which handles OAuth, routing and tool registration.

What you get

`connect_site`, `site_info`, `list_sites` and `remove_site` manage which sites the assistant can reach
`rest_api` calls any WordPress REST endpoint over GET, POST, PUT or DELETE — the general path for content work
`read_file`, `edit_file`, `write_file`, `delete_file`, `list_files`, `search_files` and `get_file_outline` work on theme files, sandboxed to the active theme or its draft
`create_draft_theme`, `get_preview_url` and `publish_draft_theme` give theme edits a draft-preview-publish path; `create_classic_theme` scaffolds a new one
`run_wp_cli` dispatches 34 allowlisted commands through native PHP, so no wp-cli binary is needed
`upload_media` and `search_images` pull images from a URL or Unsplash into the media library
`discover_abilities`, `get_ability_info` and `run_ability` call abilities other plugins register under the WordPress Abilities API
`get_page_html` and `navigate` read the rendered site; `load_skill` supplies step-by-step instructions for common workflows

Requirements

WordPress 6.0 or newer (tested up to 6.9) and PHP 7.4 or newer on the site, plus the hosted service at mcp.wpvibe.ai. Setup is a one-click OAuth authorization from the plugin's admin page — no application password is pasted into a chat. Credentials are stored AES-256-GCM encrypted with a per-site salt.

Setup effort

One command — claude mcp add wpvibe https://mcp.wpvibe.ai/mcp