Title: WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
Author: Bilal Naseer
Published: 13 Luglio 2026
Last modified: 2 Ottobre 2026
---
Ricerca i plugin
# WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
Di [Bilal Naseer](https://profiles.wordpress.org/bilalnaseer/)
[Scarica](https://downloads.wordpress.org/plugin/wsp-mcp-ai-agents-connector.2.9.3.zip)
* [Dettagli](https://it.wordpress.org/plugins/wsp-mcp-ai-agents-connector/#description)
* [Recensioni](https://it.wordpress.org/plugins/wsp-mcp-ai-agents-connector/#reviews)
* [Installazione](https://it.wordpress.org/plugins/wsp-mcp-ai-agents-connector/#installation)
* [Sviluppo](https://it.wordpress.org/plugins/wsp-mcp-ai-agents-connector/#developers)
[Supporto](https://wordpress.org/support/plugin/wsp-mcp-ai-agents-connector/)
## Descrizione
**WSP MCP is a free MCP plugin for WordPress.** It lets AI assistants like Claude,
ChatGPT, Cursor, Codex and Antigravity work directly with your website. Ask in plain
English and the AI does the work:
* “Write a blog post about our summer sale and save it as a draft.”
* “Find every page missing a meta description and suggest one.”
* “Show me this week’s WooCommerce orders and mark the shipped ones as completed.”
* “Add a Contact link to the main menu.”
Everything is built in. You don’t need another plugin, an account, or any coding.
Install it, copy your connection details, paste them into your AI app, and start
chatting.
You stay in control: every tool has its own on/off switch, anything that changes
your site is **off until you turn it on**, and the AI can only do what its WordPress
user is allowed to do.
Built and maintained by [WebSensePro](https://websensepro.com/). Guides and help:
[wspmcp.com](https://wspmcp.com/).
#### Watch: set it up in a few minutes
#### What is MCP?
MCP (Model Context Protocol) is the standard way AI assistants connect to other
apps. Think of it as a plug: once your WordPress site has an MCP plugin, any AI
app that supports MCP can read and update your site, with your permission.
#### Why WSP MCP?
* **100% free.** Every feature and every tool, no paid version.
* **Easy to connect.** A Connection page with ready-made setup for Claude, Cursor,
Codex, Antigravity, OpenClaw and OpenCode, with copy and download buttons. Cursor
users can connect in one click.
* **Safe by default.** Only read-only tools are on when you install. You pick what
else the AI can do.
* **See everything the AI did.** The Audit Log records every action: what, when,
and by whom.
* **Usage dashboard.** See how often the AI is used, which tools are most popular,
and how fast they respond.
* **Your data stays on your site.** Logs and stats are stored in your own database,
never sent anywhere.
#### What your AI can do (190+ tools)
**WordPress basics**
* Posts and pages: read, write, edit, delete
* Categories and tags
* Comments: read, approve, delete
* Media library: browse, upload images, edit titles and alt text
* Menus: create menus, add or reorder links, assign menu locations
* Users: list, create, edit
* Site settings: title, tagline, permalinks
* Plugins and themes: list, activate, switch
* Custom post types
* Site-wide search
**Works with your favorite plugins** (tools appear automatically when the plugin
is installed)
* **WooCommerce:** products, variations, orders, refunds, coupons, customers, sales
reports, low-stock alerts, reviews
* **Yoast SEO** and **Rank Math:** SEO titles, meta descriptions, focus keyphrases
* **Elementor:** read and edit page layouts, widgets, global colors and page settings
* **Ultimate Addons for Elementor:** widgets, header/footer templates, layouts
* **Advanced Custom Fields:** field groups, fields, values, post types, options
pages
* **Gravity Forms**, **Contact Form 7** and **WPForms:** forms, entries, notifications
For safety, the AI can’t add raw code (HTML, JavaScript or CSS) to your pages, and
sensitive store tools like refunds and customer data need a shop manager or administrator
account.
## Installazione
1. In WordPress, go to **Plugins > Add New**, search for “WSP MCP”, then install and
activate it.
2. Open **MCP > Settings** and switch on the tools you want your AI to use.
3. Open **MCP > Connection**, pick your AI app, and copy (or download) the setup it
shows.
4. Paste it into your AI app, then restart the app. Done. Ask it something about your
site.
## FAQ
### Is this really a free MCP plugin for WordPress?
Yes. WSP MCP is completely free and open source (GPL). Every tool, the Audit Log
and the dashboard are included. No account, subscription or outside service is needed.
### Which AI apps work with it?
Claude (desktop, web and mobile), ChatGPT, Cursor, Codex, Google Antigravity, OpenClaw,
OpenCode, and any other app that supports MCP.
### Do I need any other plugin, like the WordPress MCP Adapter?
No. Everything is built in.
### Is it safe?
Tools that change your site are off until you turn them on, and the AI can only
do what its WordPress user is allowed to do. You can see every action in **MCP >
Audit Log**, and you can create a new connection key at any time to cut off old
ones.
### How does the AI log in to my site?
The Connection page gives you a private key to paste into your AI app. Advanced
users can use a WordPress Application Password instead.
### I turned on new tools but my AI doesn’t see them.
AI apps load the tool list when they connect. Fully quit and reopen your AI app (
not just a new chat) and the new tools will appear.
### How do I connect WordPress with OpenClaw?
Watch the step-by-step video tutorial:
### How do I connect WordPress with Google Antigravity 2.0?
Watch the step-by-step video tutorial:
### How do I connect WordPress with Codex?
Watch the step-by-step video tutorial:
## Recensioni
### [Genuinely useful bridge between an AI agent and WordPress](https://wordpress.org/support/topic/genuinely-useful-bridge-between-an-ai-agent-and-wordpress/)
[luispico](https://profiles.wordpress.org/luispico/) 15 Settembre 2026 1 risposta
Genuinely useful bridge between an AI agent and WordPress — the CRUD abilities for
posts, pages, and SEO fields work exactly as documented, and the granular per-ability
toggle system (read vs. write, group by group) is the right way to do this: it gave
me confidence to actually turn it on. One thing I'd love to see down the line is
a single-post read ability with full content, any status — filed as issue #38 in
Github if useful. Appreciate the fast turnaround on support and the pace of development.
Keep it free forever!
### [Simple and Reliable Plugin](https://wordpress.org/support/topic/simple-and-reliable-plugin-4/)
[sdi90](https://profiles.wordpress.org/sdi90/) 10 Agosto 2026 1 risposta
Provides useful features, has a simple interface, and makes the overall experience
more convenient. A solid and reliable plugin.
### [The Time-saver is finally here!](https://wordpress.org/support/topic/the-time-save-is-finally-here/)
[Muhammad Ukasha](https://profiles.wordpress.org/muhammadukasha/) 16 Luglio 2026
1 risposta
For months, I was looking to automate publishing posts on my WP site and stumbled
upon this plugin. It genuinely saves time. Now I just give Claude a doc with an
image, and it automatically selects the category, sets the SEO title and meta description,
all without me touching the WP dashboard. Highly recommend it if you're looking
to connect an AI agent to your site.
### [Finally – a native, no-compromise MCP server for WordPress](https://wordpress.org/support/topic/finally-a-native-no-compromise-mcp-server-for-wordpress/)
[Zeeshan A.](https://profiles.wordpress.org/devzeeshanx/) 15 Luglio 2026 1 risposta
I've been waiting for a WordPress MCP solution that doesn't require juggling multiple
plugins or setting up a separate adapter service. This plugin delivers exactly that.
The big differentiator: The built-in native MCP server is the killer feature. You
activate the plugin, copy your connection details from MCP > Connection, and you're
done.No WordPress MCP Adapter, no external services, no Docker containers. It just
works.
### [Much needed AI MCP connector plugin](https://wordpress.org/support/topic/much-needed-ai-mcp-connector-plugin/)
[Adeel](https://profiles.wordpress.org/adeelraza_786hotmailcom/) 14 Luglio 2026
1 risposta
The plugin is easy to install and configure. It offers a practical way to connect
AI clients with WordPress and includes useful controls for managing the access.
It worked smoothly and the documentation made the setup process simple. Overall,
it's a solid plugin with good potential.
[ Leggi tutte le recensioni di 4 ](https://wordpress.org/support/plugin/wsp-mcp-ai-agents-connector/reviews/)
## Contributi e sviluppo
“WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents” è
un software open source. Le persone che hanno contribuito allo sviluppo di questo
plugin sono indicate di seguito.
Collaboratori
* [ Bilal Naseer ](https://profiles.wordpress.org/bilalnaseer/)
[Traduci “WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents” nella tua lingua.](https://translate.wordpress.org/projects/wp-plugins/wsp-mcp-ai-agents-connector)
### Ti interessa lo sviluppo?
[Esplora il codice](https://plugins.trac.wordpress.org/browser/wsp-mcp-ai-agents-connector/)
segui il [repository SVN](https://plugins.svn.wordpress.org/wsp-mcp-ai-agents-connector/),
segui il [log delle modifiche](https://plugins.trac.wordpress.org/log/wsp-mcp-ai-agents-connector/)
tramite [RSS](https://plugins.trac.wordpress.org/log/wsp-mcp-ai-agents-connector/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 2.9.3
* New: 5 Custom Post Type tools — list your custom post types, and list, create,
update and trash their items (works with any public custom post type, e.g. books,
events, portfolio). Off by default.
* New: About Us page under MCP.
* New: Settings, Connection and About Us links under the plugin name on the Plugins
screen.
* Improved: clearer plugin name, description and readme.
#### 2.9.2
* Minor updates.
#### 2.9.1
* New: Create User and Update User tools. Create User auto-generates a password
if none is supplied and defaults the role to subscriber; Update User edits email,
display name, role, or password. Require `create_users` / `edit_users`. OFF by
default.
* New: Update Site Info (title, tagline, admin email) and Update Permalink Structure
tools. Require `manage_options`. OFF by default.
* New: Activate Plugin and Deactivate Plugin tools. Require `activate_plugins`.
Deactivate Plugin refuses to deactivate this plugin, so the MCP connection cannot
cut itself off. OFF by default.
* New: Themes tool group — Read Themes and Switch Theme. Require `switch_themes`.
OFF by default.
* Changed: Plugin home and docs moved to wspmcp.com. The sidebar tutorial and abilities-
directory links now point there.
* Contributed by @dulaj44.
#### 2.9.0
* New: Navigation Menus ability group — nine tools to list menus and their items,
create and delete menus, add/update/remove menu items (custom links, posts, pages,
categories), list theme menu locations, and assign or unassign a menu to a location.
All require `edit_theme_options` (the same capability the WordPress menu editor
needs) and are OFF by default. Contributed by @dulaj44.
* New: Read Post tool (`wsp_get_post`) — fetch a single post by ID in any status(
draft, pending, private, trash) with its full content, so an AI agent can review
a draft before updating it. Requires `edit_posts` plus per-post read permission;
a Contributor cannot read another author’s private post. OFF by default. Contributed
by @dulaj44 (closes #38).
* Fixed: Permission-denied and not-found results from the new Read Post tool were
being recorded as successful calls in the Audit Log; they are now logged as denied/
error like every other tool.
* Fixed: Add Menu Item now rejects an `object_id` whose post type does not match
the requested `type` (e.g. `type: page` with a blog post ID) instead of silently
storing it.
#### 2.8.0
* New: One-click Claude Connector sign-in. The plugin now runs its own OAuth 2.1
authorization server, so you can connect Claude by pasting only the server URL
into Customize > Connectors > Add custom connector — no config file, no API key,
no request header. Claude sends you to this site’s own login page; whoever clicks
Allow connects as themselves, and Claude can then do only what that WordPress
account is permitted to do. **Off by default** — enable it from MCP > Connection.
The existing API key and Application Password methods are unchanged and do not
require it.
* New: Analytics & Performance Dashboard in **MCP > Analytics** — summary cards
for total requests, most-used tool, average response time, and error rate; a
per-category tool-usage breakdown with lightweight CSS progress bars; and a recent-
requests performance log. Built entirely on the existing Audit Log database (`
wp_wsp_mcp_audit_log`), which now also records each request’s ability category
and execution duration in milliseconds — no external service involved. Restricted
to administrators (`manage_options`).
* New: “Claude Connectors” tab on **MCP > Connection**, now the first tab, covering
the URL-only connection path above for claude.ai, Claude Desktop and Claude mobile(
they share one Connectors screen). The classic config-file method is kept as
its own tab.
* New: Configuration Generator on **MCP > Connection** — pick an AI tool (Claude
Desktop, Cursor, Codex, Antigravity, OpenClaw, OpenCode) and an authentication
method, and the correct config snippet is built live in your browser with a one-
click copy button. Application Password mode never sends your credentials to
the server; the header is computed client-side.
* New: **Download** button beside **Copy** on every snippet, saving the exact config
file directly. Cursor users also get a **Connect Cursor Automatically** button
using Cursor’s official one-click MCP install link.
* Security: The OAuth server ships hardened after a pre-release review — it is
off until an administrator enables it, and switching it off disconnects anything
already connected; approving a connector requires an account that can edit posts,
so opening registration on your site does not open MCP access with it; the consent
screen names the exact address access will be sent to and warns that an application’s
name is self-assigned and unverified; the consent and error pages cannot be framed(
clickjacking); client registration is rate-limited and capped with automatic
pruning; and replaying a spent refresh token revokes the whole token family.
* Fixed: OAuth discovery on subdirectory installs (e.g. `https://example.com/test/`)
could leave a connected connector with “no tools available.” Discovery documents
are now served at every URL spelling this install can actually reach, and the
two-install-on-one-domain case is disambiguated with a base-path-aware issuer
identity.
* Fixed: On a site with other active plugins (however many, of whatever quality),
a stray PHP notice/warning printed by one of them during an ordinary WordPress
hook could land in front of this plugin’s JSON response and break every MCP client’s
JSON parser — Claude showed the connector as connected but with “no tools available,”
and it could also trigger a “headers already sent” warning on this plugin’s own
responses. A new output-buffer guard opens the instant this plugin’s own MCP
or OAuth endpoint is requested and discards any such stray output right before
the real JSON is sent, regardless of what else is installed on the site.
#### 2.7.1
* Security: Fixed a broken access control issue reported by Patchstack (Ananda
Dhakal) as “Authenticated (Contributor+) Broken Access Control”, affecting WSP
MCP <= 2.7.0, where the Update Post, Delete Post, Update Page, Delete Page, Update
Media, Delete Media and Set Featured Image tools only checked a broad primitive
capability (`edit_posts` / `delete_posts`) and not object-level permission. A
Contributor authenticating with their own Application Password could edit, publish,
unpublish or trash a post, page or attachment owned by an Administrator or Editor
once the write tool was enabled. All of these callbacks now load the target object
and enforce `current_user_can( 'edit_post', $id )` / `current_user_can( 'delete_post',
$id )`, restrict each tool to its expected post type, and require the post type’s
publish capability before accepting a `publish`, `future` or `private` status.
New shared helper file `includes/abilities/guard.php`.
#### 2.7.0
* New: Full Audit Log. Every MCP `tools/call` request is now recorded in a dedicated,
self-hosted database table (`wp_wsp_mcp_audit_log`) — tool name, timestamp, acting
user, request IP, and outcome (success, denied, or error). No external API or
paid service is involved.
* New: **MCP > Audit Log** admin page to browse, filter (by status or tool), and
clear the log. Restricted to administrators (`manage_options`), matching every
other MCP admin screen.
* New: Log entries older than 90 days (filterable via `wsp_mcp_audit_log_retention_days`)
are pruned automatically by a daily cron task, so the table stays lightweight.
#### 2.6.8
* Fixed: “Session not found or expired. Re-initialize.” on the very first request
after `initialize`. Clients that send `tools/list` immediately (Claude Desktop
via mcp-remote, and any fast script) landed in the same second as the `initialize`
that created the session, so the expiry-sliding UPDATE wrote the value already
stored and MySQL/MariaDB reported 0 changed rows — which the plugin read as a
missing session. A zero-row update is now confirmed with an existence check before
the session is rejected. Adding a delay before the second request is no longer
necessary. Fixes GitHub #30.
#### 2.6.7
* Fixed: The “Copy” buttons on the MCP > Connection page did nothing on sites served
over plain HTTP (such as local development hosts). The browser Clipboard API
is only available in a secure context (HTTPS or localhost), so the copy now falls
back to a hidden textarea when it is unavailable. All six client tabs are fixed.
* Changed: Each ability group header now shows a green “N Enabled” and a red “N
Disabled” pill instead of a single “enabled / total” badge, so partially-enabled
groups are obvious at a glance. Counts update live as you flip switches.
* New: Sidebar cards on the MCP > Settings and MCP > Connection pages linking to
our video tutorials and the full abilities directory at freewordpressmcp.com.
* Compatibility: Verified against WordPress 7.0.3. No plugin changes were required—
the kses and HTTP URL-validation fixes in that release are inherited through
core APIs. Because this plugin exposes tools to AI agents, we recommend running
WordPress 7.0.3 or 6.9.6+ so the SSRF and CSS-injection fixes are in place.
#### 2.6.6
* New: Direct file upload for media. `wsp_upload_media` (Upload Media) now accepts
base64 file content via a new `data` parameter — an MCP client can upload a file
attached to the chat straight into the media library without first hosting it
at a public URL. The `url` parameter still works as before; pass either one.
An optional `mime_type` hint and `data:` URI prefixes are supported. Only image
types (jpg, png, gif, webp) are allowed, decoded bytes are written through `media_handle_sideload()`,
and the tool still requires `upload_files`. Fixes GitHub #17.
#### 2.6.5
* New: Elementor Advanced Design Tools — 11 tools for high-fidelity design workflows:
get/update active kit, regenerate CSS, get widget schema, duplicate/move element,
convert CSS to Elementor settings, get/update page settings, copy styles, and
get breakpoints. All off by default under the “Elementor” group. Security: write
tools run settings through `wsp_elementor_sanitize_settings()` (strips `custom_css`,`
custom_attributes`, and dynamic keys); `update-active-kit` and `regenerate-css`
require `manage_options`, the rest require `edit_posts`.
#### 2.6.4
* New: WPForms suite — 12 tools (Lite and Pro) covering forms (list, get, describe-
schema, get-form-stats, create, update-settings, add-field, update-field, delete)
and Pro entries (list, get, delete). All write tools off by default under the“
WPForms” group; only registered when WPForms is active. Uses WPForms’ native
capabilities: `wpforms_view_forms` / `wpforms_edit_forms` for forms and `wpforms_view_entries`/`
wpforms_edit_entries` for entries.
#### 2.6.3
* New: Contact Form 7 suite — 10 tools covering forms (list, get, create, update,
delete), Flamingo entries (list, get, moderate), form validation, and integrations
status. All write tools off by default under the “Contact Form 7” group; only
registered when CF7 is active. Uses CF7’s native capabilities `wpcf7_edit_contact_forms`
and `wpcf7_delete_contact_forms`; `get-integrations` requires `manage_options`.
#### 2.6.2
* Docs: documented the complete 18-tool Gravity Forms suite (forms, entries, notifications,
confirmations) across the readme, plugin docs, and changelog; the 2.6.1 notes
under-reported it as 11 tools and omitted the notification, confirmation, and
form-settings write tools. Corrected the capability name to `gravityforms_create_form`.
No behavioral code changes.
#### 2.6.1
* New: Gravity Forms suite — 18 tools covering forms (list, get, create, update,
delete, update settings), entries (list, get, update, delete with trash/permanent),
notifications (get, create, update, delete), and confirmations (get, create,
update, delete). All write tools are off by default; list-forms and get-form
are on by default. Uses Gravity Forms’ own granular capabilities (`gravityforms_edit_forms`,`
gravityforms_create_form`, `gravityforms_view_entries`, etc.). Only registered
when Gravity Forms is active (`class_exists('GFAPI')`).
* Docs: added a video tutorial to the plugin description and three connection walkthrough
videos (OpenClaw, Google Antigravity 2.0, Codex) to the FAQ.
#### 2.6.0
* New: Ultimate Addons for Elementor (UAE) tool suite — 45 tools covering widgets(
list, check usage, activate, deactivate, bulk toggle), templates (list, get,
create, duplicate, update, trash, restore Header/Footer/Blocks templates), layout
building (add sections, add columns, move elements, build from JSON), and settings(
UAE settings, theme info, extensions, design-system tokens). All off by default
and only registered when UAE is active.
* Fixed: adding an Elementor column no longer creates a container instead — the
type validation in the add-container handler now accepts the `column` type.
* Security: all UAE string inputs are sanitized with `wp_kses_post()`; each tool
enforces a strict capability check (`edit_posts`, `publish_posts`, or `manage_options`).
#### 2.5.0
* New: Full media library tool suite. Adds six media tools — List Media (browse/
search by type, keyword, or date), Count Media (counts grouped by MIME type plus
a total), Update Media (title, alt text, caption, description), Delete Media (
permanent), Upload Media (from a URL), and Upload Media From URL — and repurposes
Get Media to return the full metadata of a single attachment by ID. Every tool
is off by default and toggled from MCP > Settings.
#### 2.4.1
* Security: ACF field-value write tools no longer accept raw code. Every value
written via `update_field()` — for posts, users, terms, and options — is now
recursively sanitized (arrays walked; each string run through `wp_kses_post()`)
so `