wordpress-mcp is archived
Automattic WordPress MCP alternative: where to go after the archive.
Looking for an Automattic WordPress MCP alternative? Automattic archived its wordpress-mcp plugin on GitHub on 17 September 2026 and asks people not to install it on new sites. If a site still runs it, there are three ways forward: the official MCP Adapter, WordPress.com's hosted MCP, or a self-hosted server such as GoBuildWP. This page maps what the old plugin did onto each, then walks through moving a JWT-based client to OAuth 2.1.
What we checked, and when. On 29 September 2026 the repository page carried GitHub's banner “archived by the owner on Sep 17, 2026”, the GitHub API reported archived: true with a last push that day, and the newest release was v0.2.5 from 24 July 2025. Other write-ups give different dates for the deprecation; the archive date above is GitHub's own.
The plugin being retired
What wordpress-mcp did before it was archived
wordpress-mcp was Automattic's early MCP server for self-hosted WordPress. It added two routes to the REST API, a WordPress-style one at /wp/v2/wpmcp and a JSON-RPC 2.0 one at /wp/v2/wpmcp/streamable, and issued its own JWT tokens, valid for one to 24 hours, from a settings screen.
Claude Desktop reached it through a Node.js proxy, @automattic/mcp-wordpress-remote, which also carried the WooCommerce support. VS Code could call the streamable route directly with a bearer token. An experimental switch added three generic tools that could discover and run any REST endpoint, with separate switches for create, update and delete.
None of it was built on the Abilities API, which is why Automattic moved development to the MCP Adapter once the Abilities API reached WordPress core in 6.9.
Feature map
Each old feature, and where it lives now
The old plugin's column comes from its v0.2.5 README. The Adapter and WordPress.com columns come from their own documentation, read on 29 September 2026.
| Feature | wordpress-mcp (archived) | MCP Adapter | WordPress.com MCP | GoBuildWP |
|---|---|---|---|---|
| Status | Archived on 17 September 2026 and read-only. Last release v0.2.5, July 2025. | Maintained by WordPress. v0.7.0 is in the WordPress.org plugin directory (checked 2 October 2026); not part of core. | Hosted by WordPress.com and in service. | Maintained. GoBuildWP Free 1.18.6 is current. |
| Endpoint | /wp-json/wp/v2/wpmcp and /wp-json/wp/v2/wpmcp/streamable on your site. | A server you register on your site; stdio through WP-CLI or HTTP. | public-api.wordpress.com, reached through your WordPress.com account; Jetpack for self-hosted sites. | /wp-json/mcp/wppilot-oauth for OAuth clients and /wp-json/mcp/wppilot for Application Passwords, on your site. |
| Sign-in | JWT tokens of 1 to 24 hours made in Settings > WordPress MCP, or Application Passwords through the proxy. | WordPress authentication such as Application Passwords; OAuth only as your own code. | OAuth 2.1 with PKCE against WordPress.com. | OAuth 2.1 with PKCE, expiring access tokens with a scope, or an Application Password. |
| Claude Desktop | An npx @automattic/mcp-wordpress-remote entry in claude_desktop_config.json, with a JWT or username and password in env. | stdio through WP-CLI, or a remote proxy for a live site. | The WordPress.com connector in Claude's Connectors Directory. | A custom connector pointed at the OAuth endpoint, or the .mcpb bundle. Only its access-token entry runs through the mcp-remote bridge. |
| What the agent can call | Built-in tools plus three experimental generic REST tools that can run any REST endpoint. | Whatever abilities plugins register, once marked public. | The tools in WordPress.com's tools reference, in read and write groups. | 232 typed abilities in Free; Pro adds 89 plugin integrations. |
| Write controls | Switches for create, update and delete on the REST CRUD tools; the user's capabilities apply. | Each ability's own permission callback. No profile layer. | Read and write groups; the agent must ask and send user_confirmed: true before a write. | Read Only, Production Safe or Developer Full Access, a switch per ability, and an optional person-confirms mode. |
| Prompts | MCP prompts through prompts/list and prompts/get. | Prompt-type abilities become MCP prompts. | Not documented by WordPress.com. | Skills served as MCP prompts and skill:// resources. |
| WooCommerce | Through the mcp-wordpress-remote proxy, not the plugin itself. | WooCommerce's own Developer Preview abilities, when enabled. | Not in WordPress.com's MCP tools reference. | Free: 13 store reads and a basic product edit. Pro: 52 more. |
| Record and undo | Not documented in the v0.2.5 README. | Observability hooks; no log screen and no undo. | WordPress.com Activity Log; deleted posts go to trash for 30 days. | A redacted change ledger per credential, and undo for supported writes that checks the restore. Writes made through Elementor's and WooCommerce's own MCP servers are recorded too. |
| Many sites | Not documented in the v0.2.5 README. | One server per site; on a multisite network each site keeps its own sessions. | One WordPress.com account reaches every site it manages. | One connection per site, or one GoBuildWP Cloud link for many, free for 3 sites; with Pro, Cloud offers reviewed plugin/theme updates with backup options and eligible file-recovery attempts. |
Weighing more than these four routes? The best WordPress MCP server comparison puts every option on one table. Running several sites, GoBuildWP Cloud adds reviewed bulk plugin updates with backup options, backup status for every site and one safety policy across sites.
Three ways forward
Which Automattic WordPress MCP alternative fits which site
You write plugins
Use the MCP Adapter. Register your own abilities with the Abilities API, mark the ones clients may see as public, and keep full control of what each does. Sign-in, logging and undo stay yours to build.
The site is on WordPress.com, or Jetpack-connected
WordPress.com's hosted MCP needs nothing installed on the site, signs in with OAuth 2.1 and records changes in the Activity Log. It needs a paid WordPress.com plan, or Jetpack AI or Complete on a self-hosted site.
A self-hosted site you want an agent to run
GoBuildWP runs on the site itself, on any host, with typed abilities, safety profiles, a change ledger and undo. It is what this page walks through below; the steps work the same on staging first.
Migration
Move from wordpress-mcp to GoBuildWP in five steps
Do it on staging first if you have one. Nothing here touches content; it swaps the connection.
List what your agents use today
Open Settings > WordPress MCP and note which tools and CRUD switches are on, which tokens exist, and which clients use them. If an agent leans on run_api_function to reach a plugin's REST route, write that job down: it is the part with no direct equivalent.
Install GoBuildWP Free beside it
GoBuildWP needs WordPress 6.9 or newer and PHP 8.0 or newer. It serves its own routes under /wp-json/mcp/, so it does not take over the old plugin's /wp/v2/wpmcp endpoint.
Start in Read Only
Set the site's safety profile to Read Only before connecting anything, so the first session can list and read but not write.
Add a parallel client entry
Keep the old connection as a temporary fallback and add a separately named GoBuildWP connection with its own credential. Record the client build and authentication method; the examples illustrate configurations, not tested coexistence.
Verify each required task before retiring the old route
For every recorded job, verify discovery, an allowed read and a denied action. If it writes, run a bounded staging write, native/public readback and the supported recovery path. Record unsupported generic REST jobs and edition/dependency gaps. Only after the required workflows pass should you revoke the old credentials and deactivate the archived plugin.
Client configuration
The config change for Claude Desktop and VS Code
Old entries are the ones wordpress-mcp's README gave. New entries are the shape GoBuildWP's Connect screen generates; it fills in your real domain.
{
"mcpServers": {
"wordpress-mcp": {
"command": "npx",
"args": [
"-y",
"@automattic/mcp-wordpress-remote@latest"
],
"env": {
"WP_API_URL": "https://your-site.com/",
"JWT_TOKEN": "your-jwt-token-here"
}
}
}
}Name gobuildwp-your-site-com
Remote MCP server URL https://your-site.com/wp-json/mcp/wppilot-oauth
OAuth Client ID (leave empty)
OAuth Client Secret (leave empty){
"servers": {
"wordpress-mcp": {
"type": "http",
"url": "https://your-site.com/wp-json/wp/v2/wpmcp/streamable",
"headers": {
"Authorization": "Bearer your-jwt-token-here"
}
}
}
}{
"servers": {
"gobuildwp-your-site-com": {
"type": "http",
"url": "https://your-site.com/wp-json/mcp/wppilot-oauth"
}
}
}The Claude Desktop entry loses its Node.js proxy and its stored token: the sign-in happens in the browser and is revocable from wp-admin. VS Code drops the pasted bearer token for the same reason. Guides for every client are in Claude Desktop, VS Code and the WordPress MCP hub.
Honest trade-offs
What changes for your agents after the move
You give up
- The catch-all REST tools. Any route a plugin exposed was callable; GoBuildWP only offers typed abilities.
- Direct stdio-style access from anywhere. GoBuildWP's stdio route, wp wppilot mcp serve, runs only on the machine that hosts the site, so a remote CI job needs an HTTP client.
- A zero-cost WooCommerce route for store writes: GoBuildWP Free reads the store and edits single products, and the rest is Pro.
You gain
- A maintained plugin, with sign-in you can revoke per app instead of JWTs copied into config files.
- Profiles that stop writes on a live site until you allow them, and a person-confirms mode for destructive calls.
- A record of each change, credited to the agent that made it, with undo for supported changes that reports what it restored.
Sources, checked 29 September 2026
Where the archive facts come from
The old plugin's trunk README is now only a deprecation notice, so its features are taken from the last tagged release.
- 1. Automattic/wordpress-mcp on GitHubArchive banner dated 17 September 2026, and the trunk README: deprecated, "do not use it for new installations". Seen 29 September 2026.
- 2. wordpress-mcp v0.2.5 Readme.mdEndpoints, JWT tokens, the mcp-wordpress-remote proxy, VS Code setup and the experimental REST CRUD tools. Seen 29 September 2026.
- 3. wordpress-mcp releasesLast release v0.2.5, published 24 July 2025. Seen 29 September 2026.
- 4. WordPress/mcp-adapterWhere the archived README sends developers. v0.6.1 (13 August 2026) was the latest release when seen 29 September 2026; v0.7.0 was listed in the WordPress.org plugin directory when rechecked on 2 October 2026.
- 5. WordPress.com developer docs: MCPWhere the archived README sends everyone else: the hosted WordPress.com route. Seen 29 September 2026.
FAQ
Leaving Automattic's wordpress-mcp: questions
Is Automattic's wordpress-mcp plugin still supported?
No. GitHub shows the repository archived by its owner on 17 September 2026, and the README says it is no longer maintained and should not be used for new installations. The last release, v0.2.5, is from 24 July 2025. We read both on 29 September 2026.
What does Automattic recommend instead?
The archived README points to WordPress.com's MCP documentation for setup, and to the WordPress MCP Adapter and the Abilities API for development. GoBuildWP is a third option: a self-hosted server built on the same Abilities API.
Will my old JWT tokens work with GoBuildWP?
No. They were issued by the old plugin for its own endpoint. GoBuildWP signs clients in with OAuth 2.1, its own access tokens or an Application Password, so each client is reconnected once.
Can both plugins run at once?
Their routes differ, /wp/v2/wpmcp for the old plugin and /mcp/wppilot for GoBuildWP, so a side-by-side switchover is possible. We have not tested the pair together; the old plugin gets no fixes, but retire its credentials only after required tasks and bounded write/recovery paths pass on staging. A single read does not establish migration completeness.
Is GoBuildWP built on the MCP Adapter?
Yes. GoBuildWP bundles the Adapter for MCP 2025-11-25 clients, adds its own 2026-07-28 transport, and puts profiles, a change ledger and undo around the abilities it registers.
What do I lose by moving?
The old plugin's generic REST tools could call almost any REST route on the site. GoBuildWP has no catch-all tool like that in Production Safe; each action is a typed ability. That is safer, but a job that relied on an obscure plugin route may need a Pro integration or may not be covered.
Replace the archived plugin on staging first.
Install GoBuildWP Free, connect one client in Read Only, then run every job your agents depend on, including a bounded write and its undo, before you switch wordpress-mcp off.