WPPilot — WordPress MCP Server, Elementor MCP and WooCommerce MCP

Point Claude Code, Codex, Cursor or Antigravity at your WordPress site and let it build, pages, block layouts, menus, taxonomies, media, SEO metadata, through typed abilities your permissions still govern.

WPPilot turns your WordPress site into an MCP server, built on the WordPress Abilities API and the official WordPress MCP Adapter. AI clients discover, inspect and execute typed WordPress abilities through a compact three-tool interface instead of loading hundreds of one-off endpoints into context.

The free plugin is the WordPress MCP server. WPPilot Pro turns that same endpoint into an Elementor MCP server, a WooCommerce MCP server, and a Bricks, Divi, Oxygen or WPBakery MCP server — one connection, whichever stack the site actually runs.

Looking for an Elementor, Divi or Beaver Builder MCP server?

This is it, with one server instead of one per plugin. The free plugin here is the WordPress MCP server: connection, authentication, safety and the whole core surface. WPPilot Pro adds the builder-aware layer on top of the same endpoint, so an agent that connects once can work in whichever editor the site actually uses:

Elementor MCP · Bricks MCP · Divi MCP · Beaver Builder MCP · Oxygen MCP · Breakdance MCP · WPBakery MCP · Etch MCP · Mosaic MCP

Beyond page builders, Pro also covers WooCommerce, Advanced Custom Fields, Meta Box, JetEngine, Pods, ACPT, WPForms, Gravity Forms, Fluent Forms, Formidable, Contact Form 7, Ninja Forms, Yoast SEO, Rank Math, AIOSEO, SEOPress, Polylang, Weglot, The Events Calendar, Tutor LMS, Paid Memberships Pro and BuddyPress. Full table below: 51 integrations.

MCP protocol support

WPPilot serves both protocol revisions during the migration window:

A request is served under the modern revision only when it carries modern per-request _meta; everything else reaches the adapter untouched. Existing users do not need to reconnect unless their client requires the newer revision.

server/discover is implemented and advertises both versions plus the capabilities actually registered on the site. Subscriptions, the tasks extension and logging are deliberately not advertised, WPPilot has no change-notification producer, so subscriptions/listen is not implemented.

For OAuth, Client ID Metadata Documents are the preferred registration mechanism; RFC 7591 Dynamic Client Registration remains available as a compatibility fallback. Application Passwords and access tokens stay independent fallbacks for clients that run no OAuth flow.

It is a control layer, not an AI wrapper. No AI model is bundled: external MCP clients bring their own model access, and policy is enforced server-side on your install.

What an agent can actually build

One prompt from you becomes hundreds of typed calls from the agent, each checked against your WordPress capabilities and the active safety profile before it runs.

Free covers the core surface: posts and pages, block-editor content, taxonomies, menus and menu locations, media with alt text, users, site settings including the front page, plus design documents, skills and a change ledger with rollback.

You do not have to phrase anything in a particular way. A client's first call is discovery, and WPPilot answers with every ability registered on your install plus a catalogue of the skills available for them, carrying one instruction: if a skill matches the request, load its full instructions before starting the work. So "rebuild the pricing page and keep our spacing" already pulls in the right build skill, the element schemas and your existing design tokens without you naming any of it. Write your own prompts; the routing is on the site.

The library is a shortcut, not a dependency. WPPilot ships a prompt library in wp-admin for the jobs people run most, and those prompts name the abilities they call rather than describing an outcome and hoping:

Create a new draft page titled "[PAGE TITLE]" using core Gutenberg blocks only.

How the write works, so you do not get halfway and stall:
1. wppilot/create-post, create the draft first. It defaults to draft; leave it there.
2. wppilot/gutenberg-create-pending-batch, core blocks cannot be written straight
   from the server, because the block editor's own JavaScript is what validates and
   serialises them.
3. wppilot/gutenberg-add-pending-change, queue the block tree against the new post.
4. wppilot/gutenberg-enable-batch-finalization, then
   wppilot/gutenberg-get-finalization-url, open that link and the batch commits.

That last part is the honest bit: core blocks are not a headless write. Anything the block editor validates in JavaScript needs a browser session to finalise, and the prompts say so rather than leaving you stuck at step three.

WPPilot Pro adds plugin-aware modules, page builders, WooCommerce, forms, custom fields, SEO, themes, each with its own ability chains. The full published library is at https://wppilot.co/prompts.

• 🌐 Website: https://wppilot.co
• 🧱 What it builds: https://wppilot.co/build
• 💬 Prompt library: https://wppilot.co/prompts
• 📚 Documentation: https://wppilot.co/docs
• 🔌 Client setup guides: https://wppilot.co/wordpress-mcp
• 𝕏 Release notes and build demos: https://x.com/WPPilotMCP

Quick start

1. Download the latest wppilot.zip from Releases and install it as wp-content/plugins/wppilot.
   A GitHub “Source code (zip)” download is not installable, it lacks vendor/ and uses the wrong folder name.
2. Activate WPPilot.
3. Open WPPilot → Configuration and leave Production Safe selected.
4. Open WPPilot → Connect, choose your AI client, and follow the OAuth or Application Password route.

Canonical MCP endpoint:

https://example.com/wp-json/mcp/wppilot

OAuth-authenticated clients use /wp-json/mcp/wppilot-oauth. Application passwords and access tokens both authenticate on the canonical route. The older /wp-json/mcp/mcp-adapter-default-server route still resolves as a legacy alias, but new configurations should use the canonical path above.

Supported AI clients

Claude Code · Claude Desktop · Claude on the web · Codex CLI · Codex desktop app · Cursor · VS Code · GitHub Copilot · Devin Desktop (formerly Windsurf) · Factory Droid · Antigravity CLI · Antigravity IDE · Zed · Cline · Roo Code · Kilo Code · Amazon Q · OpenCode · OpenClaw · Manus

Per-client setup guides: https://wppilot.co/wordpress-mcp

Authentication

Three methods, chosen on WPPilot → Connect:

• OAuth 2.1 with PKCE and dynamic client registration. Access tokens last 1 hour, refresh tokens 14 days, and every authorization is listed under Connected Apps in WordPress so it can be revoked individually. Recommended wherever the client can open a browser.
• Application Passwords as a fallback for clients that cannot run a browser flow. Sent as HTTP Basic.
• Access tokens — a long-lived Authorization: Bearer wpp_… credential for callers with no browser and no interactive session: the Claude Messages API MCP connector, the OpenAI Responses API mcp tool, cron jobs, automation platforms, curl. Created with an optional expiry, shown once, stored only as a SHA-256 digest, and revocable per token. It authenticates on the canonical /wp-json/mcp/wppilot endpoint, so the URL is the same one every other snippet uses.

An access token borrows the capabilities of the user who created it, and that check is re-run on every request rather than frozen at creation — demoting or deleting the user closes the token in the same moment.

None of the three is a product licence. WPPilot needs no activation key, entitlement check or subscription service to run.

Safety model

On top of the profile: WordPress user capabilities still apply, individual abilities can be switched off, destructive operations require an explicit confirmation flag, writes are rate-limited per credential, and supported changes are recorded in a redacted change ledger with rollback.

Every ledger entry names the agent behind the write, not only the WordPress user. Claude Code, Cursor and Codex usually connect as the same administrator, so the user alone cannot answer which of them made a change: the OAuth client id or application-password UUID can, and it is what the ledger records, alongside the client name the agent introduced itself with. A write with no agent behind it — wp-admin, WP-CLI, cron — is recorded as direct rather than credited to the last agent seen. OAuth client ids are stored hashed.

What the free plugin can do

103 registered abilities on a fresh install, plus one MCP prompt per skill you save. The WordPress ones are grouped under a single WordPress category in the Abilities screen and can be switched off individually.

Content creation is draft-first: an absent, blank or malformed status resolves to draft before any capability check, so nothing is published by accident. Capabilities are read from each post type's and taxonomy's own capability object, so a custom type declaring its own set is enforced on its own terms.

WPPilot Pro, 968 plugin-aware abilities

The free plugin in this repository is a complete WordPress MCP server: connection, authentication, safety profiles, Gutenberg workflows, diagnostics, change evidence and 103 abilities, including the whole WordPress core surface: content, taxonomies, media, comments, revisions, menus, user reads, allowlisted settings and the plugin/theme lifecycle. Free needs no licence, entitlement service or Pro install.

WPPilot Pro adds plugin-aware abilities across 51 integrations, typed operations that understand each plugin's own data model rather than writing generic content. Modules load only when their plugin is detected, and each loads in isolation, so a missing or broken plugin cannot stop the rest of the registry from registering.

Why plugin-aware matters

A page builder does not store a page as HTML. It stores an element tree, references to shared classes and design tokens, template rules and dynamic bindings. Writing generated markup into that store is how a layout stops opening in its own editor.

Pro gives the agent that builder's own vocabulary: bricks-patch-elements, elementor-create-atomic-widget, divi-apply-global-preset, etch-get-query-preview, so it can read a schema before it proposes a change.

Page builder MCP servers

One endpoint covers every builder below. The agent gets that builder's own
vocabulary rather than being handed raw HTML to guess at.

Elementor MCP

Reads and writes the Elementor element tree, global classes, design tokens and
dynamic tags. Writing generated markup into post_content does not change an
Elementor page — the layout lives in postmeta, and the free plugin refuses that
write by name rather than reporting a success that changes nothing.

Bricks MCP

Patches the Bricks element tree in place with bricks-patch-elements, so a
change to one section does not rewrite the page around it.

Divi MCP

Works with Divi modules and global presets through divi-apply-global-preset,
rather than flattening a layout into shortcodes.

Beaver Builder MCP

Beaver Builder keeps its layout in postmeta under _fl_builder_data, so writing
HTML into post_content changes nothing a visitor sees. Pro reads and writes
that store; the free plugin recognises the builder and refuses the write rather
than reporting a success that does nothing.

Oxygen MCP

Oxygen stores a JSON element tree in postmeta and renders from it, ignoring
post_content entirely. Pro's 37 abilities work against that tree.

WPBakery MCP

WPBakery is the exception that keeps its layout in post_content, as nested
shortcodes. Pro parses and edits those shortcodes instead of replacing the
markup around them.

Breakdance, Etch and Mosaic MCP

Breakdance (33 abilities), Etch (60) and Mosaic (36) each expose their own
element model. Etch has the largest surface of any builder in Pro.

Gutenberg MCP

Block editing is in the free plugin, not Pro: parse, insert, move and
replace blocks in the core block tree, with reusable blocks and patterns.

WooCommerce MCP

Products, variations, orders, coupons and stock as typed abilities rather than
raw REST calls. An agent can query the catalogue, create a variable product with
its attributes and variations, adjust stock, read orders and add order notes —
each one capability-checked against the connected WordPress user, so an agent
connected as a shop manager cannot do what that account could not do by hand.

Order status changes and anything touching money are classed destructive, so
they require explicit confirmation and are recorded in the change ledger with
rollback, the same as every other write.

Beyond integrations

• Persistent agent memory, approved context that carries between sessions, so an agent does not relearn your stack every conversation.
• Human approval queue, holds an agent write until a person approves it, with email notification. The agent receives a structured “pending” response, not a false success.
• Integration health reporting: see which modules loaded, which were skipped, and why.
• Plugin-aware skill packs, guided sequences that encode the read-before-write workflow for the plugins you run.

Compare Free vs Pro · Pricing · All integrations

WPPilot Pro is a commercial plugin and is not distributed from this repository.

FAQ

What is a WordPress MCP server, and is this one a server or a client?
A server. Your site exposes typed WordPress abilities over MCP at https://example.com/wp-json/mcp/wppilot, and the AI client you already use connects to it. No model is bundled and no key is stored here; the client brings its own model access.

Is there an Elementor MCP server? What about Bricks, Divi, Beaver Builder, Oxygen, Breakdance, WPBakery, Etch and Mosaic?
Yes, through WPPilot Pro, which registers builder-aware abilities on the same endpoint. A page builder stores an element tree, shared classes, design tokens and dynamic bindings rather than HTML, so Pro gives the agent that builder's own vocabulary instead of writing markup into a store that will not open in its editor.

Is there a WooCommerce MCP server?
Yes, in WPPilot Pro. Products, variations, orders, coupons and stock become typed abilities on the same endpoint, capability-checked against the connected WordPress user — an agent connected as a shop manager cannot do what that account could not do by hand. Anything touching money is classed destructive, so it needs explicit confirmation and lands in the change ledger with rollback.

Do I need Pro to use this?
No. The free plugin in this repository is a complete WordPress MCP server with 103 abilities, and it needs no licence, activation key or entitlement service. Pro is additive.

How does it relate to the WordPress Abilities API and the official MCP Adapter?
It is built on both. The Abilities API is where abilities are registered, and the MCP Adapter is bundled to serve the legacy protocol revision. WPPilot adds the parts an adapter does not: authentication, safety profiles, confirmation gates, rate limiting, a change ledger with rollback, and the abilities themselves.

How do I connect WordPress to Claude, Cursor or Codex?
Claude Code, Claude Desktop, Claude on the web, Codex CLI and desktop, Cursor, VS Code, GitHub Copilot, Devin Desktop, Factory Droid, Antigravity CLI and IDE, Zed, Cline, Roo Code, Kilo Code, Amazon Q, OpenCode, OpenClaw and Manus. Setup guides: https://wppilot.co/wordpress-mcp.

Is it safe to point an agent at a production site?
That is what the safety model is for. Read Only blocks every write, Production Safe blocks raw PHP, WP-CLI, filesystem, database and extension installation, destructive calls require an explicit confirmation flag, WordPress capabilities still apply on top, and supported changes are recorded in a ledger you can roll back. Start on Read Only and verify one call before enabling any write.

Is there a Gutenberg MCP server — can an agent write native blocks?
Partly, and the plugin says so rather than failing silently. Core blocks are validated and serialised by the block editor's own JavaScript, so writes are staged as a pending batch and finalised through a browser session.

Is it on WordPress.org?
No. Distribution is GitHub releases for the free plugin and wppilot.co for Pro. Install wppilot.zip from Releases; the GitHub "Source code" archive is not installable.

Requirements

• WordPress 6.9 or newer
• PHP 8.0 or newer
• HTTPS for any remotely reachable connection
• WPPilot Chat additionally requires WordPress 7.0 and an AI provider configured through the WordPress AI Client

Privacy

The MCP endpoint is self-hosted; there is no WPPilot relay. When WPPilot Chat is used, WordPress sends conversation history, selected attachments, site instructions, tool definitions and relevant tool results to the AI provider you configured. Suggested policy text is available in Settings → Privacy → Policy Guide.

Documentation

In-repo: docs/ARCHITECTURE.md · docs/SAFETY.md · SECURITY.md

Security

Report suspected vulnerabilities privately, see SECURITY.md. Do not open a public issue for a vulnerability, and never include production credentials or customer data.

Licence

GPL-2.0-or-later. See LICENSE and LICENSES/ for the full SPDX texts.