What It Is and What It Subjects (2026

The WordPress MCP Adapter is the plugin that transforms a WordPress site right into an MCP server: it takes the capacities registered on the website, by WordPress core and by plugins, and allows an AI client discover and run them as MCP tools. The project’s very own README calls it “the main WordPress package for MCP assimilation”, and because version 0. 7.0, released 2026 – 10 – 02, it sets up directly from the WordPress.org plugin directory.

What that indicates in practice: the Adapter ships no AI features and no web content devices of its own. What it exposes is whatever WordPress core, plugins or custom site code mark public, which can be greater than you anticipate. On a WordPress 7 1 2 website with one areas plugin energetic, its discovery device listed 51 capabilities, 5 of them long-term deletes.

This overview covers what the Adapter is today, what happened to Automattic’s initial project, what it subjected on an actual website, who can link, exactly how to maintain the checklist narrow, and your choices. If MCP itself is brand-new area, read the plain-English overview to what MCP is in WordPress first, then come back.

What the WordPress MCP Adapter is, and what took place to Automattic’s WordPress MCP

MCP, the Version Context Procedure, is an open standard that lets AI applications call external tools with one usual interface. The Adapter is WordPress’s implementation of the web server side, in the words of its directory site frequently asked question: “MCP Adapter is the server and transport layer. It does not provide any kind of AI includes itself.” WordPress.org publishes it as component of the AI Building Blocks for WordPress initiative.

What it offers originates from the Capacities API , a computer registry that landed in WordPress core in version 6 9 An ability is one called capability: keyed in input and result, an optional consent check, and the code that does the work. Core signs up a couple of abilities, plugins register much more, and the Adapter transforms the public ones into MCP devices, resources and triggers.

Is it the same thing as Automattic’s WordPress MCP? No. That GitHub database , an earlier Automattic task, is currently archived, and its README is blunt: “This database is deprecated and archived. It is no more preserved, and it is not the recommended way to include MCP assistance to WordPress.” The very same README names the MCP Adapter as “the approved plugin and Composer package for MCP integration in WordPress” and points viewers to the WordPress.com MCP paperwork for current setup.

Setup is routine: Plugins → Add Plugin, search “MCP Adapter”, install, trigger. It needs WordPress 6 9 or newer and PHP 7 4 or more recent. And after activation? Absolutely nothing to click: the admin food selection gains no MCP Adapter entrance, and on the Plugins display the MCP Adapter row has no Setups web link:

Exactly how the Adapter works, in plain words

On the Adapter’s default web server, every capability is private by default, and exclusive methods unnoticeable to MCP clients. A capacity comes to be obtainable just when it is marked public, either with the general public flag or the MCP-specific one (the MCP flag wins when both are established). The directory site frequently asked question mentions the regulation in four words: “No, exposure is opt-in.”

Here, the AI never ever obtains the capabilities themselves as its device checklist. It obtains precisely three: mcp-adapter-discover-abilities lists what is public, mcp-adapter-get-ability-info fetches one ability’s full schema, and mcp-adapter-execute-ability runs one. On the gauged website, tools/list returned those three while 51 capabilities sat behind them. The AI uncovers, checks, then executes, so tools/list stays at 3 schemas nonetheless lots of abilities the website has.

The circulation, as a picture:

One more layer matters: listing is not running. Before a revealed capacity runs, the Adapter checks its permission callback versus the WordPress user the customer checked in as. In the FAQ’s words, “approval checks still run versus the present user prior to anything implements.”

What it subjected on a genuine WordPress 7 1 2 website

On a WordPress 7 1 2 website with MCP Adapter 0. 7.0 and Secure Custom Area 6 9 5 energetic (2026 – 10 – 05, signed in as an administrator over HTTP, the discovery device returned 51 capacities: 3 signed up by WordPress core, 48 by Secure Personalized Fields, and nothing from anywhere else.

The core three are core/get-site-info , core/get-user-info and core/get-environment-info , and WordPress notes them public in its own code. 2 of them require the manage_options capability, which on a common site implies administrators; core/get-user-info answers any signed-in customer with their own profile.

The other 48 are public because Secure Custom-made Area says so: its code sets the MCP public flag on the capacities it signs up. The collection covers the plugin’s very own frameworks (field teams, fields, article kinds, taxonomies and alternatives pages) from listing and developing to importing, trashing and recovering. Five of them are permanent deletes; one describes itself as: “Completely erases an instance of SCF area team. This activity can not be reversed.” ⚠

Equally as noteworthy is what is missing: none of the 51 reviews or modifies blog posts, web pages, media or comments. The Adapter is a window; WordPress core and your plugins determine what is on the other side of it.

Who can use it: credentials, functions and an Editor’s view

Without qualifications, nothing enters: calling the endpoint with no verification responded to 401 and the message “Sorry, you are not enabled to do that.” With qualifications, the default HTTP transport asks just for a signed-in customer with the read ability, and a filter can increase that demand.

Signed in as an Editor (that customer’s own application password, 2026 – 10 – 05, discovery returned the same 51 abilities the administrator saw. With the filter from two sections down in position and one small custom-made capacity of the website’s very own made public, discovery revealed 19 read-only entrances, and each of the 19 was called as that Editor. Two ran: the Editor’s very own profile using core/get-user-info which customized capacity. The other 17 answered “Approval rejected”, among them the core site-info and environment-info capacities and every Secure Personalized Area listing, obtain and export.

2 means to attach: HTTP and WP-CLI

Over HTTP, the web server lives at / wp-json/mcp/mcp-adapter-default- web server Clients validate as a WordPress individual, and the basic credential is an application password, developed under Users → Profile → Application Passwords. By default, WordPress provides application passwords only on HTTPS websites and in neighborhood environments, they can not be used for standard logins, and they can be withdrawed from the same display. The kind, on the determined site:

Customers that just talk STDIO to a remote website can utilize the @automattic/ mcp-wordpress-remote proxy, which works on your very own computer system and transforms the customer’s STDIO website traffic into HTTP calls authenticated with those exact same application passwords. Prefabricated configurations for Claude Desktop, Cursor, Claude Code and VS Code live in the WordPress developer blog’s tutorial ; it precedes the directory site listing, so follow its client configs, not its mount actions.

On a local site, or any type of web server where you have WP-CLI , the very same web server speaks STDIO, with no HTTP and no application password included:

  wp mcp-adapter serve-- individual= admin-- web server= mcp-adapter-default-server  

The AI then functions as the customer named after -- customer , with exactly that user’s capacities. In a scripted session piped to that web server on the measured website (2026 – 10 – 05, tools/list returned the exact same 3 devices and an ability implemented successfully.

Just how to keep the exposure narrow

2 small bars do most of the job.

Lever one is the account. The programmer blog’s security section recommends a devoted user with minimal capacities for MCP gain access to, and read-only abilities for HTTP endpoints revealed over the internet. The Editor account above can run only 2 of the 19 read-only abilities it called.

Bar two is a filter that unpublishes what you do not desire reachable. The Adapter’s documents validates the system: a specific meta.mcp.public set to incorrect opts an otherwise public ability out of MCP. On the gauged website, this must-use plugin concealed every Secure Custom Fields capability that is not read-only:

 / **.
* Plugin Call: Limitation MCP Abilities.
* Summary: Maintains Secure Custom-made Area' read-only capabilities noticeable to MCP clients and conceals the ones that create or remove.
*/.
add_filter( 'wp_register_ability_args', feature ($ args, $ability_name) {
if (0 === strpos( $ability_name, 'scf/') & vacant( $args ['meta'] ['annotations'] ['readonly']) {
$ args ['meta'] ['mcp'] ['public'] = false;.
}
return $args;.
}, 10, 2;  

Save it as wp-content/mu-plugins/limit-mcp-abilities. php , starting the documents with an opening