Connect AI Assistants to Your Account (Account MCP)
InstaWP's account-level MCP lets you connect AI assistants like Claude, Cursor, and ChatGPT to your entire InstaWP account over the Model Context Protocol (MCP). Instead of managing a single site, a connected agent can work across your account — list and create sites, manage backups, check plans and billing, and more — using natural-language requests, all scoped to your current team.
You stay in control: the Tool access panel lets you choose exactly what a connected agent is allowed to do, and it applies to every app you connect.
In this documentation, we will explore:
- Account MCP vs. Site MCP
- Enable MCP and Connect
- Control What Agents Can Do (Tool access)
- Available Capabilities
- Manage Connected Apps
- Security Notes
- FAQs
Let's get started 🚀
Account MCP vs. Site MCP
InstaWP offers MCP at two different levels — pick the one that matches what you want the AI to do:
| Account MCP (this page) | Site MCP | |
|---|---|---|
| Where | Account → Settings → MCP | A single site's MCP tab |
| Scope | Your whole InstaWP account / current team | One specific WordPress site |
| Good for | Managing sites, backups, plans and account-level tasks across your fleet | Reading and managing the content of one WordPress site |
Looking to connect an assistant to a single WordPress site instead? See Connect AI Assistants to Your WordPress Site Using MCP.
Enable MCP and Connect
Step 1: Log in to your InstaWP dashboard, open your account Settings, and select the MCP tab.
Step 2: Turn on Enable MCP for your account. MCP is disabled by default — once enabled, AI assistants can connect to your account and act on your current team.
Step 3: Copy your MCP Connection URL from the Connection Details section, then add it in your AI client (in Claude, for example: Settings → Connectors → Add custom connector, paste the URL, and approve the authorization screen).
Control What Agents Can Do (Tool access)
The Tool access panel is where you decide exactly what a connected AI agent is allowed to do on your account. Your choices apply to every app you connect.
- Read-only mode — When on, agents can view information but can never change anything. This is the safest setting for read/reporting workflows.
- Per-capability toggles — Enable only the capabilities an agent should have (see the full list below). Anything left off is simply not available to the agent.
- Available options are set by InstaWP for your account — The list of capabilities you can turn on is bounded by what InstaWP makes available to your account, so you may see more or fewer options than shown here.
- Save changes — Your selection only takes effect after you click Save changes.
Tip: Start with Read-only mode on (or only the capabilities you need) and expand access as you build trust in a workflow.
Available Capabilities
Depending on what InstaWP has enabled for your account, the Tool access panel can include:
| Capability | What it allows |
|---|---|
| Sites | List, create, update and delete sites. |
| PHP & WordPress versions | Change a site's PHP / WordPress version. |
| Backups | List and create site backups. |
| Billing & plans | View billing info and change plans. |
| Teams | Read team information. |
| Diagnostics | Read diagnostic information. |
Some accounts may additionally be offered sensitive capabilities, which are highlighted and off by default because they grant deeper access:
| Sensitive capability | What it allows |
|---|---|
| Credentials & secrets | Site credentials, magic-login links, SSH/SFTP keys and MCP tokens. |
| Shell & WP-CLI | Run arbitrary shell / WP-CLI commands. |
| Act inside sites | Read and write directly inside your WordPress sites (content, plugins, database). |
If you don't see the sensitive capabilities above, they aren't enabled for your account — that's expected. Shell and credential tools are turned off by default.
Manage Connected Apps
The Connected apps section lists every AI assistant you've authorized to access your account. If you no longer use an assistant — or want to cut off access immediately — remove it from this list. Turning off Enable MCP for your account disconnects everything at once.
Security Notes
- Off by default. Account MCP is disabled until you turn it on, and sensitive capabilities stay off until explicitly enabled.
- You set the boundaries. Use Read-only mode and the per-capability toggles to grant the minimum an agent needs.
- Scoped to your current team. A connected agent acts on the team you're currently working in.
- Revoke anytime. Disable MCP or remove a connected app to instantly revoke access.
FAQs
Is MCP on by default? No. Account MCP is disabled by default. You must enable it and connect an assistant before anything can access your account.
Why can't I see the Shell, Credentials, or "Act inside sites" options? Those are sensitive capabilities that InstaWP only offers to accounts that are enabled for them. If they're not shown, they're not available for your account.
How is this different from Site MCP? Account MCP works across your whole account/team (managing sites, backups, plans). Site MCP connects an assistant to the content of a single WordPress site. See Connect AI Assistants to Your WordPress Site Using MCP.
How do I stop an assistant from accessing my account? Remove it from Connected apps, or turn off Enable MCP for your account to disconnect everything.