The multi-site addressing is the part that changes how you work: one connection, and a request can name which client's site it applies to, which turns "update the footer everywhere" into a single instruction. The performance and cache tools are the second reason to bother — they let the same assistant that publishes a post also check what it did to the site.
An MCP server over the WordPress REST API, aimed at people who administer sites rather than visit them. It authenticates with Application Passwords, and one installation can manage up to 50 sites with the site named in each call.
- Posts and pages: `wp_list_posts`, `wp_create_post`, `wp_update_post`, `wp_delete_post`, `wp_get_post_revisions`, and the matching set for pages
- Media: `wp_upload_media`, `wp_list_media`, `wp_update_media`, `wp_delete_media`
- Comment moderation: `wp_list_comments`, `wp_approve_comment`, `wp_spam_comment`, `wp_create_comment`, `wp_delete_comment`
- Taxonomies and users: `wp_list_categories`, `wp_create_category`, `wp_create_tag`, `wp_list_users`, `wp_create_user`, `wp_create_application_password`
- Site level: `wp_get_site_settings`, `wp_update_site_settings`, `wp_search_site`
- Caching and performance: `wp_cache_stats`, `wp_cache_clear`, `wp_cache_warm`, `wp_performance_stats`, `wp_performance_history`, `wp_performance_benchmark`, `wp_performance_alerts`, `wp_performance_optimize`, `wp_performance_export`
- Authentication handled in-band: `wp_test_auth`, `wp_get_auth_status`, `wp_switch_auth_method`
WordPress 5.6+ with the REST API enabled and Application Passwords available, then `WORDPRESS_SITE_URL`, `WORDPRESS_USERNAME` and `WORDPRESS_APP_PASSWORD`. Role matters: Editor or above for posts, pages, comments and media; an Author only reaches their own. Install as a Claude Desktop DXT extension, globally with `npm install -g mcp-wordpress`, or straight from `npx -y mcp-wordpress`; the package is `mcp-wordpress`. JWT, Basic Auth and API Key are supported alternatives to Application Passwords.
One command plus a key — npx -y mcp-wordpress, then supply credentials
