Introducing WordPress MCP v1.0.0: Connect ChatGPT to WordPress with MCP

by
August 30, 2026
AI Featured Research and Developmment

Today I am releasing WordPress MCP v1.0.0, the first public release of an open-source integration that connects ChatGPT to WordPress through the Model Context Protocol (MCP).

GitHub:

https://github.com/jooservices/wordpress-mcp

Release:

https://github.com/jooservices/wordpress-mcp/releases/tag/v1.0.0

WordPress MCP allows ChatGPT to securely interact with one or multiple WordPress websites to search content, read posts and pages, create drafts, update content, manage comments, upload media, and perform other WordPress operations directly from a ChatGPT conversation.

The project is designed around a simple architecture:

ChatGPT
    │
    │ MCP / HTTPS
    ▼
MCP Server
    │
    │ HTTPS / Scoped API
    ▼
WordPress Plugin
    │
    ▼
WordPress Core

Instead of exposing unrestricted WordPress credentials directly to ChatGPT, the WordPress plugin creates scoped connections while the MCP server provides the MCP tools, authentication and transport used by ChatGPT.

Table of Contents

What is WordPress MCP?

WordPress MCP consists of two components.

JOOservices ChatGPT Connector

The WordPress plugin runs inside WordPress and provides a scoped REST API under:

/wp-json/chatgpt-connector/v1/

It is responsible for:

  • connection management
  • WordPress permissions and scopes
  • connection tokens
  • rate limiting
  • audit logging
  • content operations
  • comment moderation
  • media access
  • protecting publishing and destructive operations

Connection tokens are shown only once when they are created and are stored in WordPress as SHA-256 hashes.

MCP Server

The MCP server sits between ChatGPT and WordPress.

It provides:

  • Streamable HTTP MCP transport
  • 14 WordPress-specific MCP tools
  • OAuth 2.1 authentication
  • Mixed authentication mode
  • multi-site WordPress support
  • Docker deployment
  • HTTPS deployment with Caddy
  • optional ngrok deployment for testing

A single MCP server can connect ChatGPT to multiple WordPress websites.

Requirements

For v1.0.0 you need:

  • WordPress 6.4 or newer
  • PHP 8.3 or newer
  • Node.js 22 or newer for the MCP server
  • Docker and Docker Compose for the recommended deployment
  • a ChatGPT account with Developer Mode
  • a public HTTPS URL for the MCP server when connecting it to ChatGPT

WordPress can continue using any MySQL or MariaDB version supported by WordPress.

Features in v1.0.0

WordPress MCP v1.0.0 provides 14 MCP tools.

Site management

wordpress_list_sites
wordpress_get_site

These tools allow ChatGPT to discover which WordPress websites are configured.

This is especially useful when a single MCP server manages multiple sites.

Posts and pages

wordpress_search_content
wordpress_get_content
wordpress_create_content
wordpress_update_content
wordpress_delete_content

ChatGPT can search, read, create, update and delete WordPress posts and pages.

Creating content defaults to draft.

Publishing requires a separate WordPress connection scope, which means a connection may be allowed to create drafts while being completely prevented from publishing them.

Deletion also defaults to moving content to the WordPress Trash.

Permanent deletion requires an explicit force operation.

Comments

wordpress_list_comments
wordpress_get_comment
wordpress_moderate_comment

ChatGPT can inspect WordPress comments and perform moderation operations such as:

  • approve
  • hold
  • mark as spam

The API intentionally excludes author email addresses from comment responses to reduce exposure of personally identifiable information.

Taxonomies

wordpress_list_terms

ChatGPT can retrieve WordPress categories and tags.

This is useful when creating or updating content because ChatGPT can work with the site’s real taxonomy instead of guessing category or tag names.

Media

wordpress_list_media
wordpress_get_media
wordpress_upload_media

ChatGPT can inspect media and upload files to WordPress.

Media uploads use base64 data.

v1.0.0 limits uploaded files to 10 MB decoded, while the MCP server accepts a maximum JSON request body of 15 MB.

Installing the WordPress Plugin

The easiest way to install v1.0.0 is to download the pre-built WordPress plugin from the GitHub release.

Download:

https://github.com/jooservices/wordpress-mcp/releases/download/v1.0.0/wordpress-chatgpt-1.0.0.zip

Then:

  1. Open WordPress admin.
  2. Go to Plugins → Add Plugin.
  3. Select Upload Plugin.
  4. Upload wordpress-chatgpt-1.0.0.zip.
  5. Install and activate JOOservices ChatGPT Connector.

Developers can alternatively install directly from the repository.

git clone https://github.com/jooservices/wordpress-mcp.git
cd wordpress-mcp/packages/wordpress-plugin

composer install --no-dev

Copy the plugin directory into:

wp-content/plugins/wordpress-chatgpt

and activate it from WordPress.

Creating a WordPress Connection

After activating the plugin, open:

WordPress Admin
→ ChatGPT
→ Create connection

Select only the permissions that ChatGPT should have.

The plugin generates a connection token.

Copy this token immediately.

The token is displayed only once and is not stored as plaintext by the WordPress plugin.

You will use it when configuring the MCP server.

WordPress Connection Scopes

Permissions are granted per connection.

Site

site.read

Allows access to basic WordPress site information.

Posts

posts.read
posts.create
posts.update
posts.publish
posts.delete

Pages

pages.read
pages.create
pages.update
pages.publish
pages.delete

Comments

comments.read
comments.moderate

Media

media.read
media.upload

This makes it possible to create very restricted integrations.

For example, a connection used primarily for writing articles could have:

site.read
posts.read
posts.create
posts.update
media.read
media.upload

without granting:

posts.publish
posts.delete

ChatGPT could then prepare and update articles but could neither publish nor delete them.

This is the configuration I recommend for most content workflows.

Deploying the MCP Server

The recommended production deployment uses Docker.

Clone the repository:

git clone https://github.com/jooservices/wordpress-mcp.git
cd wordpress-mcp

Create the production environment file:

cp .env.prod.example .env.prod

For a single WordPress website, configure:

WORDPRESS_URL=https://your-wordpress-site.com
WORDPRESS_CONNECTION_TOKEN=YOUR_CONNECTION_TOKEN

MCP_PUBLIC_URL=https://mcp.example.com
MCP_AUTH_MODE=mixed

Then start the MCP server:

make prod-up

By default, the MCP application listens on port 3000.

The MCP endpoint is:

https://mcp.example.com/mcp

and the health endpoint is:

https://mcp.example.com/health

HTTPS with Caddy

ChatGPT requires the remote MCP server to be accessible over HTTPS.

WordPress MCP includes a production Caddy configuration.

Configure:

MCP_DOMAIN=mcp.example.com
[email protected]

Then run:

make prod-https

Caddy handles HTTPS termination and Let’s Encrypt certificates.

For a production deployment, this is preferable to exposing the Node.js MCP server directly to the Internet.

Using ngrok for Testing

For development or temporary testing you can expose the MCP server through ngrok.

Configure:

NGROK_AUTHTOKEN=YOUR_NGROK_TOKEN
MCP_PUBLIC_URL=https://your-ngrok-domain.example

Then run:

make prod-tunnel

ngrok is useful for development and testing, but I recommend using a normal HTTPS endpoint for permanent production deployments.

Connecting the MCP Server to ChatGPT

Once the WordPress plugin and public MCP server are running, the next step is connecting the MCP endpoint to ChatGPT.

Enable Developer Mode in ChatGPT.

Then add a new connector using:

Name:
WordPress

Connector URL:
https://YOUR-MCP-HOST/mcp

Authentication:
Mixed

The connector URL must point to the /mcp endpoint and must correspond to the public URL configured by MCP_PUBLIC_URL.

Once the connector is created, enable it in a ChatGPT conversation.

You can then use normal language instead of manually calling individual MCP tools.

For example:

Show me my five latest WordPress posts.

or:

Find all posts about Laravel.

or:

Create a draft article titled "PHP 8.5 Features".

or:

Show me comments waiting for moderation.

or:

Upload this image to WordPress and use it for the article.

ChatGPT decides which WordPress MCP tools are necessary to complete the request.

Mixed Authentication

The recommended production authentication mode is:

MCP_AUTH_MODE=mixed

Mixed mode separates read operations from write operations.

Read tools can be discovered and used without requiring an OAuth link.

Write operations require OAuth authorization.

For example:

Show my latest posts

is a read request.

But:

Create a new draft

or:

Update post 123

or:

Delete post 123

requires authorization.

This provides a better experience than forcing authentication for every read operation while still protecting operations that modify WordPress.

WordPress MCP also supports:

oauth
static
none

oauth requires OAuth for all MCP requests.

static uses a static Bearer token and is mainly useful for compatible MCP clients or development scenarios.

none disables MCP authentication and should only be used during local development.

Never expose an unauthenticated MCP server publicly.

Multi-Site WordPress Support

One of the main features of v1.0.0 is native multi-site configuration at the MCP server level.

This does not mean WordPress Multisite specifically.

It means one MCP server can manage multiple independent WordPress installations.

Architecture:

                       ┌─ WordPress Site A
                       │
ChatGPT → MCP Server ──┼─ WordPress Site B
                       │
                       └─ WordPress Site C

Instead of WORDPRESS_URL and WORDPRESS_CONNECTION_TOKEN, configure WORDPRESS_SITES.

Example:

WORDPRESS_SITES=[
  {
    "id": "blog-a",
    "name": "Blog A",
    "url": "https://a.example.com",
    "token": "TOKEN_A"
  },
  {
    "id": "blog-b",
    "name": "Blog B",
    "url": "https://b.example.com",
    "token": "TOKEN_B"
  }
]

Each WordPress installation has:

  • its own plugin installation
  • its own connection
  • its own token
  • its own scopes

ChatGPT can discover configured sites with:

wordpress_list_sites

and then target a particular WordPress installation.

For example:

Show the latest five posts from Blog A.

or:

Create this article as a draft on Blog B.

This allows a single ChatGPT connector to operate across several WordPress websites without deploying a separate MCP server for every site.

Audit Log

Operations that modify WordPress are recorded by the plugin.

Open:

WordPress Admin
→ ChatGPT
→ Audit Log

to inspect mutating operations performed through the connector.

This is particularly useful when ChatGPT is allowed to:

  • create content
  • update content
  • delete content
  • moderate comments
  • upload media

Content Recovery

WordPress MCP relies on standard WordPress revisions when content is updated.

If an incorrect update occurs, open the post in WordPress and use:

Post
→ Revisions

to restore an earlier version.

Deletion also uses WordPress Trash by default rather than immediately deleting content permanently.

These defaults intentionally make AI-assisted content management less destructive.

Security Recommendations

For production installations:

  • always use HTTPS
  • use mixed or oauth MCP authentication
  • keep MCP_AUTH_DISABLED=false
  • grant only the WordPress scopes actually required
  • avoid giving publishing permission unless necessary
  • avoid giving deletion permission unless necessary
  • store WordPress connection tokens in environment variables or a secrets manager
  • never commit connection tokens into Git
  • rotate a connection token if it may have been compromised

Each WordPress website should use its own connection token.

WordPress MCP never exposes those site tokens through wordpress_list_sites or the MCP /health endpoint.

Local Development

A complete local development environment is included.

Create the environment file:

cp .env.example .env

Start the stack:

make up

The development environment provides:

WordPress:
http://localhost:8080

MCP:
http://localhost:3000/mcp

Health:
http://localhost:3000/health

The Docker development stack includes:

  • MariaDB 11.4
  • WordPress with PHP 8.3
  • Node.js 22 MCP server

Additional commands include:

make install
make ci
make test
make integration
make down
make plugin-release

All development and CI commands run through Docker.

Development Quality

The v1.0.0 CI pipeline checks both sides of the integration.

For the WordPress plugin:

  • Laravel Pint
  • PHPCS
  • PHPStan
  • PHPUnit

For the MCP server:

  • TypeScript build
  • Vitest

Integration tests are also available for testing the complete MCP-to-WordPress flow.

Example Workflow

A practical workflow can look like this:

You:
Find my existing posts about Laravel repositories.

ChatGPT:
→ searches WordPress using MCP
→ returns matching posts

You:
Create a new article based on our discussion,
but save it as a draft.

ChatGPT:
→ creates the post
→ WordPress keeps it as draft

You:
Add this image and update the article.

ChatGPT:
→ uploads media
→ updates the post

You:
Show me the final content before publishing.

ChatGPT:
→ reads the resulting WordPress post
→ returns it for review

If the connection does not have posts.publish, ChatGPT cannot publish the article even if asked to.

Publishing remains under WordPress permission control.

Why I Built WordPress MCP

The goal of this project is not simply to make WordPress callable through an API.

WordPress already has APIs.

The goal is to provide a controlled bridge between conversational AI and WordPress where:

  • ChatGPT receives purpose-built tools rather than unrestricted API access
  • WordPress remains responsible for WordPress permissions
  • connections use explicit scopes
  • write operations can be protected separately from reads
  • operations can be audited
  • multiple WordPress websites can share one MCP server
  • content creation defaults to safer WordPress behavior such as drafts and Trash

The result is a workflow where WordPress can become part of a ChatGPT conversation without giving the AI unrestricted control over the website.

Open Source

WordPress MCP is open source under the MIT license.

Source code:

https://github.com/jooservices/wordpress-mcp

v1.0.0 release:

https://github.com/jooservices/wordpress-mcp/releases/tag/v1.0.0

Documentation:

https://github.com/jooservices/wordpress-mcp/tree/v1.0.0/docs

Issues and contributions are welcome through GitHub.

This is the first public release, and future releases will continue improving WordPress coverage, MCP integration, security and developer experience.

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

You may also like