Connect AI Assistants to Your WordPress Site Using MCP
The Model Context Protocol (MCP) lets you connect AI assistants like Claude Desktop directly to your WordPress sites. This enables AI-powered site management, allowing you to read, analyze, and manage your WordPress content using natural language conversations with your AI assistant.
Want to connect an assistant to your whole InstaWP account (managing sites, backups, plans across your team) instead of a single site? See Connect AI Assistants to Your Account (Account MCP).
In this documentation, we will explore:
- What is MCP?
- How to Enable MCP
- Connect in One Click (Add to agent)
- How to Connect Claude Desktop
- How to Connect Claude Code
- Using MCP with Your Site
- What Your AI Assistant Can Do (Tool Reference)
- Skills — Built-in Playbooks
- Memory — What Your Assistant Remembers
- Capabilities — Power Tools (Off by Default)
- Permissions & Safe Mode
- How to Disable MCP
- Troubleshooting
- FAQs
Let's get started 🚀
This feature is available in Sandbox plans and above. View Pricing here.
What is MCP?
Model Context Protocol (MCP) is a secure connection protocol that enables AI assistants to interact with your WordPress site. Enabling MCP installs InstaMCP, InstaWP's WordPress MCP server plugin, on your site and gives your assistant a token-authenticated connection to it.
InstaMCP ships 43 tools covering content, Gutenberg blocks, custom fields, taxonomies, media, plugins, themes and diagnostics — plus Skills (reusable playbooks the assistant follows for common jobs) and Memory (durable facts it remembers between sessions). Three power tools (execute_php, db_query, site_files) are off by default and only work once you switch them on.
Why Use MCP?
- Build and edit, not just read: Create pages, publish posts, upload media, set WooCommerce prices and ACF fields, install and update plugins — from a conversation
- AI that already knows the job: Built-in Skills teach the assistant how to build a Gutenberg page, work an Elementor/Bricks page, run a pre-launch QA pass, or clean up taxonomies
- Diagnostics without SSH:
site_logstails your WordPress debug log and PHP error log so the assistant can pin a fatal or a slow page - Secure by default: Token-based auth, WordPress role-based permissions, Safe Mode, and the riskiest tools disabled until you enable them
Who Should Use This Feature?
- Content Creators: Draft, publish, and organize content conversationally
- Developers & Agencies: Build pages, manage plugins/themes, debug fatals, and run repeatable playbooks across client sites
- Site Owners: Get insights and make safe changes without digging through wp-admin
How to Enable MCP
Follow these simple steps to enable MCP for your InstaWP site:
Step 1: Navigate to your Sites page in the InstaWP dashboard.
Step 2: Click on the Site name to navigate to the Site Details page and click on MCP Option in Sidebar.
Step 3: In the MCP configuration panel, toggle the Enable MCP switch to ON.
Step 4: Once enabled, InstaWP will automatically:
- Install and activate the InstaMCP WordPress plugin on your site
- Generate a secure 64-character authentication token
- Create your unique connection URL
Step 5: Copy the MCP Connection URL by clicking the copy button next to it.
| Field | Description |
|---|---|
| MCP Connection URL | Your unique, secure URL that connects Claude Desktop to your WordPress site. Keep this URL private as it contains your authentication token. |
Security Note: Your MCP connection URL contains a secure authentication token. Do not share this URL publicly. Anyone with this URL can access your site through AI assistants.
Connect in One Click (Add to agent)
Once MCP is enabled, the site's MCP tab shows a Connect WordPress to your AI agent panel — the fastest way to hook up an assistant. Instead of hand-editing a config file, pick your client and InstaWP does the rest: one click for the apps that support it, one copy for the CLIs that don't — and you always see exactly what will be added before anything happens.
Your most-used clients are shown as buttons up front (for example Add to Claude.ai, Add to Claude Code, Add to Cursor, Add to VS Code, and Install in GitHub Copilot), with the rest tucked under More clients. Depending on the client, the button does one of four things:
| Type | Clients | What the button does |
|---|---|---|
| One-click install | Cursor, VS Code (& Insiders), GitHub Copilot, Claude Code (v2.1.91+) | Opens the app through a deep link and triggers its own "add connector" consent dialog — approve it and you're connected. |
| Prefill | Claude.ai / Claude Desktop, ChatGPT | Prefills the app's Add custom connector dialog and copies the connection URL for you to paste. |
| Copy command (CLI) | Claude Code, Codex, Gemini | Copies the exact CLI command to paste into your terminal. |
| Copy config | Antigravity, Claude Desktop, Windsurf, Cline, Roo, Zed, Continue | Copies a ready-made JSON config block to drop into the client's MCP settings. |
Just click the button for your tool and follow the prompt it opens — no need to copy the URL by hand. Below the buttons, a Setup guides for AI clients panel covers 14 clients with a pre-filled connection snippet for each.
Security note: For a site, these buttons carry your site's private MCP token (the same one embedded in the connection URL), so the connection authenticates itself. Only use Add to agent on a device you trust — anyone who can use that agent can then reach your site.
Prefer to set things up manually, or using a client that isn't listed? Copy the MCP Connection URL above and follow the step-by-step instructions for Claude Desktop or Claude Code below.
How to Connect Claude Desktop
After enabling MCP in InstaWP, you need to configure Claude Desktop to connect to your WordPress site.
Prerequisites
- Claude Desktop application installed on your computer (Download Claude Desktop)
- MCP enabled on your InstaWP site (completed in the previous section)
- Your MCP connection URL copied to clipboard
Configuration Steps
Step 1: Open the Claude Desktop application on your computer.
Step 2: Go to Settings in Claude Desktop. You can usually find this in:
- Mac: Claude Desktop menu > Settings (or press
Cmd+,) - Windows: File menu > Settings (or press
Ctrl+,)
Step 3: In Settings, navigate to the Connectors section (or "Integrations" depending on your Claude Desktop version).
Step 4: Click the "Add Custom Connector" or "Add New Connection" button.
Step 5: In the connector configuration dialog:
- Name: Enter a descriptive name for your site (e.g., "My WordPress Site" or "Client Project Site")
- Connection URL: Paste the MCP connection URL you copied from InstaWP
Step 6: Click "Add" to establish the connection.
Step 7: Claude Desktop will test the connection and confirm if it's successful.
| ✅ Connection Successful! You should see your WordPress site listed in Claude Desktop's connectors. The status should show as "Connected" or "Active".
Verifying the Connection
To verify that Claude Desktop is properly connected to your WordPress site:
Step 1: Start a new conversation in Claude Desktop.
Step 2: Ask Claude a simple question about your site, such as:
- "Can you access my WordPress site?"
- "What posts are on my website?"
- "Tell me about my site structure"
Claude should be able to access your site information and respond with details about your WordPress content.
How to Connect Claude Code
Claude Code is the command-line interface (CLI) version of Claude, designed for developers who prefer working in the terminal. You can connect Claude Code to your InstaWP site using a simple terminal command.
Prerequisites
- Claude Code CLI installed on your computer (Learn about Claude Code)
- MCP enabled on your InstaWP site (completed in the "How to Enable MCP" section)
- Your MCP connection URL copied from InstaWP dashboard
Configuration Steps
Step 1: Open your terminal or command prompt.
Step 2: Run the following command to add your InstaWP site as an MCP connection:
claude mcp add --transport http mymcp <mcp_url>Replace <mcp_url> with your actual MCP connection URL copied from the InstaWP dashboard.
Example:
claude mcp add --transport http mymcp https://yoursite.instawp.io/insta-mcp?t=your-auth-token-hereStep 3: Claude Code will validate the connection and confirm it was added successfully.
| ✅ MCP Connection Added! Your WordPress site is now connected to Claude Code. You can start using Claude in your terminal to interact with your WordPress content.
Using Claude Code with Your Site
Once connected, you can use Claude Code in your terminal to interact with your WordPress site:
Start a conversation:
claudeExample queries:
- "Show me the latest posts from my WordPress site"
- "Analyze my site structure"
- "What plugins are installed on my site?"
Managing Connections
List all MCP connections:
claude mcp listRemove a connection:
claude mcp remove mymcpNote: The connection name "mymcp" in the command is a label you choose to identify this connection. You can use any name that helps you remember which site it connects to (e.g., "production-site", "client-blog", etc.).
Using MCP with Your Site
Once connected, you can manage your WordPress site through natural language conversations.
Things to Try
Content
- "Show me my latest 5 blog posts"
- "Create a draft 'Pricing' page with a hero, a three-column feature grid, and an FAQ"
- "Find every post mentioning 'WordPress 6.8' and update the version to 7.0"
- "Set the featured image on my last three posts from these URLs"
Site building
- "Build me an About page using the site's theme colours"
- "Edit the hero heading on my Elementor home page"
- "Switch to Twenty Twenty-Five, verify the site still renders, and roll back if it breaks"
Store & custom fields
- "Put every product in the Summer category on a 20% sale"
- "Fill the ACF
subtitlefield on all Services pages"
Maintenance & diagnostics
- "Why is my homepage throwing a 500?"
- "Update all plugins one at a time and check the site still loads after each"
- "Audit the site before launch — drafts, missing alt text, empty SEO meta"
Best Practices
- Be specific: Name the page, post, or plugin you mean
- Ask for a draft first: "Create it as a draft" gives you a review step before anything goes live
- Ask it to verify: "…and check the page renders" makes the assistant confirm its own work
- Use Safe Mode on sites that matter: it blocks delete operations entirely (see Permissions & Safe Mode)
What Your AI Assistant Can Do (Tool Reference)
InstaMCP exposes 43 tools. The 40 standard tools are available as soon as you connect; the 3 Capabilities tools are listed but inert until an admin enables them.
| Area | Tools | What it covers |
|---|---|---|
| Content (9) | discover_content_types, list_content, get_content, get_content_by_slug, find_content_by_url, create_content, update_content, patch_content, delete_content | Posts, pages and custom post types. Large posts are fetched line-by-line, and patch_content does sed-style search-and-replace so long articles can be edited without resending the whole body. |
| Gutenberg blocks (2) | discover_blocks, validate_blocks | Reads the blocks actually registered on your site and validates block markup before it's saved, so pages don't land with "this block contains unexpected or invalid content". |
| Custom fields / meta (2) | get_meta, set_meta | Typed writes routed through WooCommerce (WC_Product->save(), keeping the price lookup table in sync), ACF (update_field), or plain post meta — each value read back and reported as verified. Supports dry runs. Secret-looking values are redacted on read. |
| Taxonomies (9) | discover_taxonomies, get_taxonomy, list_terms, get_term, create_term, update_term, delete_term, assign_terms_to_content, get_content_terms | Categories, tags and custom taxonomies. |
| Plugins (3) | plugin_info, plugin_operations, plugin_files | Search wordpress.org, install, activate, update, delete, and read/write plugin files. |
| Themes (3) | theme_info, theme_operations, theme_files | Install, switch, update, delete themes and edit theme files. |
| Media (3) | media_upload, media_attach, media_metadata | Upload from a URL or base64, set featured images, and manage alt text, captions and descriptions. |
| Skills (4) | skill_list, skill_get, skill_save, skill_delete | Reusable playbooks the assistant consults when a task matches. |
| Memory (4) | memory_save, memory_list, memory_get, memory_delete | Durable per-site facts. |
| Diagnostics (1) | site_logs | Read-only tail of the WordPress debug log and PHP error_log, filterable by level (fatal / error / warning / notice / deprecated) and search term, with secrets redacted. It does not read web access logs. |
| Capabilities (3, off by default) | execute_php, db_query, site_files | Power tools an admin must switch on. |
PHP file safety:
theme_files,plugin_filesandsite_filessyntax-check PHP before writing it and reject a write that wouldn't parse.execute_phpsnapshots every auto-included PHP file (themefunctions.php, active plugin entry files, mu-plugins, drop-ins,wp-config.php) and automatically rolls back any file its run leaves broken — so a bad edit can't fatal your site and lock the assistant out.
WordPress Abilities API: on WordPress 6.9+, every InstaMCP tool is also registered via
wp_register_ability(), so the official WordPress MCP Adapter and other Abilities-aware plugins can see and invoke them. On older WordPress versions this is a no-op and everything works as before.
Skills — Built-in Playbooks
Skills are reusable Markdown playbooks. When your request matches a skill's description, the assistant loads that playbook and follows it — so it gets multi-step jobs right the first time instead of improvising.
15 skills ship with InstaMCP:
| Skill | What it does |
|---|---|
| Build a Gutenberg page | Builds showcase-grade pages from native Gutenberg blocks, validated before the first save |
| Build or edit a page-builder page | Works Elementor and Bricks pages by writing the builder's own data and regenerating its CSS |
| Build, edit & resolve feedback on an InstaStudio site | Handles HTML-first "source-rendered" sites served by the InstaStudio plugin, including pin feedback |
| Build a site from a brief | Populates a new or staging site's pages, posts, terms and media from a content plan — draft-first |
| Bulk content operations | Applies the same change safely across many posts |
| Set product prices, ACF fields, and SEO meta | Typed, dry-run-first, verified writes via set_meta |
| SEO meta + schema pass | Audits and improves titles, meta descriptions, slugs, and adds basic schema |
| Media + featured images | Uploads, alt text, and attaching/featuring images correctly |
| Tidy and reorganize taxonomies | Merges duplicates, renames, reassigns content, removes orphans |
| Manage 301/302 redirects | Adds or audits redirects after slug changes or a migration |
| Safe plugin update | Check → update → verify the site still renders |
| Safely switch or test a theme | Install/switch with a render check and one-step rollback |
| Diagnose a slow or broken site | Read-only investigation: logs, active plugins/theme, root cause |
| Pre-launch / handoff content QA | Go-live audit: drafts, broken internal links, missing alt/featured images, empty SEO meta |
| Create a Skill | How the assistant authors a new skill of your own |
Managing skills
Skills are managed on your site in WP Admin → Settings → InstaMCP → Skills:
- Disable any built-in skill you don't want offered
- Allow (or block) agent-authored skills — when allowed, the assistant can save its own playbooks for your site (e.g. "remember how we build client landing pages") and reuse them later
Built-in skills are read live from the plugin, so a plugin update ships new and improved playbooks automatically.
Memory — What Your Assistant Remembers
Memory gives your assistant durable, per-site facts it can recall in a future conversation — site conventions, your preferences, project decisions, and reference pointers. Without it, every new chat starts from zero.
Useful things to tell it to remember:
- "Remember that our brand colours are #0F62FE and #161616"
- "Remember that all new posts go out under the 'Editorial' category and stay as drafts"
- "Remember the client prefers Bricks, not Elementor"
Memory is stored on your own site, scoped to that site only, and you can ask the assistant to list, read, or delete entries at any time.
Capabilities — Power Tools (Off by Default)
Three tools give an assistant deep access. They're always listed over MCP so an assistant can discover them and tell you how to enable them — but each is off by default and returns a "here's how to enable me" error until an admin turns it on. All three require an administrator token, and their write operations are additionally blocked by Safe Mode.
Turn them on in WP Admin → Settings → InstaMCP → Capabilities:
| Tool | Modes | What it does |
|---|---|---|
Execute PHP (execute_php) | Off / On | Runs arbitrary PHP in full WordPress context. Hard 30-second limit per call; returns the return value, output and warnings. Broken auto-included files are automatically rolled back. |
Database Query (db_query) | Off / Read-only / Read & write | Runs a single SQL statement. Read-only allows SELECT/SHOW/DESCRIBE/EXPLAIN (bare SELECTs get an automatic LIMIT); read & write also allows INSERT/UPDATE/DELETE/DDL. Multi-statements, file I/O (LOAD DATA, LOAD_FILE, INTO OUTFILE) and SLEEP/BENCHMARK are blocked in both modes. |
Site Files (site_files) | Off / Read-only / Read & write | Read, list and write WordPress config and drop-in files via a strict allowlist: wp-config.php, .htaccess, wp-content/mu-plugins/**, the drop-ins (object-cache.php, advanced-cache.php, db.php, maintenance.php) and wp-content/uploads/**. Writes create a timestamped backup and honour DISALLOW_FILE_EDIT/DISALLOW_FILE_MODS; wp-config.php secrets are redacted on read. |
⚠️ Enable with care.
execute_php— andsite_filesin read & write mode, which can drop an executable mu-plugin — give the connected assistant root-equivalent control over WordPress. Enable them on sandbox, staging and development sites, or when you fully trust the client you've connected. Leave them off on production.
Prefer to enable them from the command line? Use the web terminal or SSH:
wp option update insta_mcp_execute_php_enabled 1
wp option update insta_mcp_db_query_mode read # off | read | read_write
wp option update insta_mcp_site_files_mode read # off | read | read_writePermissions & Safe Mode
Your MCP connection URL carries a token tied to a WordPress user, and it inherits exactly that user's role and capabilities. There is no way for MCP to do something the underlying user couldn't do in wp-admin.
| WordPress role | Permission scopes | What it can do |
|---|---|---|
| Administrator | mcp:admin, mcp:delete, mcp:write, mcp:read | Everything, including the Capabilities tools once enabled |
| Editor | mcp:delete, mcp:write, mcp:read | Edit and publish any content |
| Author | mcp:write, mcp:read | Create and publish their own content only |
| Contributor | mcp:read | Create drafts |
| Subscriber | mcp:read | Read-only |
Two extra controls live in WP Admin → Settings → InstaMCP:
- Safe Mode (General tab) — blocks all delete operations, and gates the write side of the Capabilities tools. A good default for any site you care about.
- API Tokens tab — create additional tokens (optionally for a different, lower-privileged WordPress user, with an expiry), see when each was last used, and revoke any of them. Giving an assistant an Editor or Author token is the simplest way to limit what it can reach.
How to Disable MCP
If you want to disable MCP and disconnect AI access to your site:
Step 1: Go to your Sites page and click the ellipsis button next to your site.
Step 2: Select MCP from the menu.
Step 3: Toggle the Enable MCP switch to OFF.
Step 4: InstaWP will automatically:
- Deactivate the MCP WordPress plugin
- Remove the plugin from your site
- Invalidate your connection token
| 🔒 Security: Once disabled, the previous connection URL will no longer work. Claude Desktop will lose access to your site immediately. If you enable MCP again, a new connection URL with a different token will be generated.
Step 5: (Optional) Remove the connector from your AI assistant:
For Claude Desktop:
- Go to Settings > Connectors
- Find your WordPress site connector
- Click "Remove" or "Delete"
For Claude Code:
- Run:
claude mcp remove mymcp
Troubleshooting
Connection Issues
Problem: Claude Desktop shows "Connection Failed" or cannot connect to my site.
Solutions:
- Verify that MCP is enabled in your InstaWP dashboard
- Ensure you copied the complete connection URL, including the token parameter
- Check that your site is active and not suspended
- Try regenerating the connection by disabling and re-enabling MCP
Problem: Claude Desktop says it cannot access my site content.
Solutions:
- Verify the connection status in Claude Desktop Settings > Connectors
- Make sure your site is accessible (not in maintenance mode)
- Try reconnecting by removing and re-adding the connector in Claude Desktop
- Check that the MCP plugin is active on your WordPress site
Problem: Claude Code shows an error when adding the MCP connection.
Solutions:
- Verify you copied the complete connection URL with the authentication token
- Check that Claude Code CLI is properly installed and up to date
- Ensure the URL is properly quoted if it contains special characters
- Try the command with the full URL in quotes:
claude mcp add --transport http mymcp "https://..."
Access Level Issues
Problem: Claude Desktop has limited access or cannot perform certain actions.
Solution:
- Check the role of the WordPress user your token belongs to — an Author token can only edit its own posts (see Permissions & Safe Mode)
- If deletes are failing, Safe Mode is probably on (WP Admin → Settings → InstaMCP → General)
- If the assistant reports that
execute_php,db_queryorsite_filesis disabled, that's expected — enable it under Capabilities
Problem: The connection URL returns my site's homepage HTML instead of connecting.
Solutions:
- This can happen right after an InstaMCP plugin update if rewrite rules were dropped. Update to the latest InstaMCP version (WP Admin → Plugins → Check for Updates), which re-flushes them automatically
- As an immediate fix, re-save your permalinks (WP Admin → Settings → Permalinks → Save Changes)
Token or URL Issues
Problem: My connection URL doesn't work after some time.
Solutions:
- Connection URLs are invalidated when you disable MCP
- If you suspect the token is compromised, disable and re-enable MCP to generate a new token
- Do not share your connection URL publicly
FAQs
Can I connect multiple AI assistants to the same site?
Yes. The connection URL shown in the InstaWP dashboard can be reused across multiple clients, and you can also create additional tokens under WP Admin → Settings → InstaMCP → API Tokens — one per client, each with its own label, optional expiry, and its own WordPress user. That way you can revoke one assistant's access without disconnecting the others.
Does enabling MCP affect my site's performance?
No, MCP installs a lightweight WordPress plugin that only responds when accessed through the MCP protocol. It does not impact your regular site visitors or site performance.
Can I use MCP with non-InstaWP WordPress sites?
MCP is currently designed specifically for InstaWP sites. The feature requires InstaWP's infrastructure to install and configure the MCP plugin automatically.
What data can Claude Desktop access through MCP?
Whatever the WordPress user behind your token can access: posts, pages and custom post types, taxonomies, media, custom fields, plugin and theme information and files, and the WordPress error logs. Passwords are never exposed (WordPress stores them hashed), and values that look like secrets — tokens, API keys, wp-config.php credentials — are redacted by default.
Direct database access (db_query) and config-file access (site_files) are off unless an administrator enables them under Capabilities.
Can the assistant edit my theme or install plugins?
Yes, with an administrator token: it can install, activate, update and delete plugins and themes, and read/write their files. PHP is syntax-checked before it's written, so a bad edit is rejected rather than saved. Enable Safe Mode if you want deletes blocked.
What are Skills, and do I have to set them up?
No setup needed — 15 built-in Skills ship with the plugin and the assistant picks the right one automatically. You can disable any of them, and allow the assistant to save its own, under WP Admin → Settings → InstaMCP → Skills.
Does the assistant remember things between conversations?
Yes — Memory stores durable facts on your site (conventions, preferences, decisions) that it can recall in a later chat. Ask it to list or delete entries any time.
Will my MCP connection work if I migrate my site?
If you migrate your site to a different hosting provider or domain, you will need to disable and re-enable MCP to generate a new connection URL for the new location.
Is there a limit to how many requests Claude can make to my site?
There are no specific rate limits mentioned for MCP connections, but excessive API requests may be subject to standard WordPress API rate limiting or InstaWP's fair use policies.
Can I restrict what Claude Desktop can do with my site?
Yes, three ways, and they stack:
- Issue a lower-privileged token — create a token for an Editor, Author or Contributor user under WP Admin → Settings → InstaMCP → API Tokens (optionally with an expiry date)
- Turn on Safe Mode — blocks all delete operations
- Leave Capabilities off —
execute_php,db_queryandsite_filesare disabled unless you enable them
Can I use both Claude Desktop and Claude Code with the same site?
Yes! You can connect the same InstaWP site to both Claude Desktop and Claude Code using the same MCP connection URL. Both will have the same level of access to your WordPress content.
| 💡 Did you know - You can also access your site files using SFTP/SSH for manual file management. Learn about SFTP/SSH.
Related Articles
- Enable SFTP & SSH - Access your site files directly
- Site Tools - Explore other site management tools
- Local Mount - Mount your site locally for development
- Integrate Apps - Connect other third-party tools