LabscoMCP early access ↗
bilalnaseerMCP SERVER

WSP WordPress MCP

A WordPress plugin that turns the site into an MCP server — posts, media, WooCommerce, ACF, Elementor and forms.

by bilalnaseer ↗CMS & Blog PublishingCommunity

LABSCO SUMMARY

Every ability is off until you turn it on, and every call is logged.

Two things make this safe enough to point an agent at a live site: writes stay unregistered by default across every suite, and the audit log records who called what and whether it was allowed, denied or errored — stored in your own database with nothing sent anywhere. The integration suites only appear when their plugin is active, so the tool list matches the site rather than a catalogue.

What it is

A WordPress plugin that ships its own MCP server at /wp-json/wsp-mcp/v1/mcp, with no companion plugin, adapter or Node bridge for clients that speak remote HTTP. Abilities are toggled individually in wp-admin, and each one enforces the WordPress capability it needs.

What you get

  • Core WordPress — read, create, update and delete posts and pages; categories and tags; comment moderation; users; site info and active plugins; content search
  • Media — list, get and count are reads; update, delete and upload are writes. wsp_upload_media accepts a public URL or base64 content, so a file attached to the chat goes straight into the library; wsp_get_media returns one attachment's metadata and wsp_list_media browses the library
  • Elementor — list pages, read the element tree, find and update elements, add widgets and containers, remove elements, plus advanced design tools for kit colours and fonts, widget schemas, element duplication and responsive breakpoints
  • WooCommerce — products and variations, orders and status changes, refunds, coupons, order notes, customers, sales reports, low-stock alerts and review moderation
  • Advanced Custom Fields — field groups, fields, values with dot-notation deep access, custom post types, taxonomies and options pages
  • Forms — Gravity Forms, WPForms and Contact Form 7 suites, each registered only when that plugin is active, with reads on by default and every write off
  • An audit log table records each tools/call with tool name, UTC timestamp, acting user, request IP and outcome; a daily cron prunes entries older than 90 days

Requirements

WordPress 6.9+ and PHP 7.4+ — the authors recommend 7.0.3 or 6.9.6+ so the recent core security fixes are in place. Install and activate the plugin, enable the abilities you want under MCP > Settings, then copy the pre-filled snippet for your client from MCP > Connection. Authenticate with a WordPress Application Password or the plugin's own API key sent as Authorization: Bearer. Cursor, Codex and Antigravity connect natively; Claude Desktop and OpenClaw go through the mcp-remote bridge, which needs Node.js 18+. GPL 2.0.

Setup effort

Follow the published steps