GoBuildWP CloudConnect your sites through one workspace.Explore Cloud →
GoBuildWP
Download freeDownload

WordPress Abilities API and MCP Adapter

WordPress MCP Adapter vs GoBuildWP: the bridge, and what sits on top of it.

WordPress MCP Adapter vs GoBuildWP is not a choice between rivals: GoBuildWP bundles the Adapter. The Adapter is the WordPress project's link between the Abilities API and MCP, and it leaves sign-in, human confirmation, a change log and undo to whoever registers abilities. This page shows how to run the Adapter alone, and what GoBuildWP adds when you do not want to build those four pieces.

See the feature table Get GoBuildWP free

Vendor sources checked 2 October 2026, Sources

By GoBuildWPContent updated How we check claims

Distribution checked 2 October 2026. Version 0.7.0 is now in the WordPress.org directory, with direct admin installation. Library bundling is deprecated. It remains infrastructure requiring registered abilities, not a complete operational product or part of WordPress core.

Where MCP Adapter leads

Why the Adapter is the right base layer

From the Adapter's repository, guides and releases, read 29 September 2026.

  1. It is the WordPress project's own standard

    GPL-2.0, maintained in the WordPress GitHub organisation, and available in the WordPress.org directory as version 0.7.0. Anything registered through the Abilities API can reach MCP through it.

  2. Exposure is opt-in

    An ability stays off MCP until its author marks it public, so installing the Adapter exposes nothing by accident.

  3. You decide every rule

    Custom transports and per-server permission callbacks let a developer choose exactly how clients authenticate and what they may call.

  4. Multisite sessions

    Since v0.6.0 each site in a network keeps its own session storage.

Feature by feature

What the bridge provides, and what is left to plugins

The Adapter's cells come from its repository, guides, releases and the 7.2 roadmap. Many say none built in; that is the design, not a shortfall.

  • Yes
  • Partly
  • No
  • Not documented
WordPress MCP Adapter compared with GoBuildWP, feature by feature
FeatureMCP AdapterGoBuildWP
TransportYes: stdio through WP-CLI and Streamable HTTP; MCP 2025-11-25 in the tagged release.85Yes: Streamable HTTP on modern 2026-07-28 and legacy 2025-11-25, 2025-06-18, 2024-11-05. MCP Tasks is available on the modern transport since Free 1.15.0; background execution requires a job-backed ability. Local clients can also use stdio through WP-CLI on the site's machine.
Safety profiles and read-onlyPartly: Abilities stay private until marked public.2Yes: Beyond public or private: three profiles from Read Only up to Developer Full Access, and a switch per ability.
Multisite and many sitesYes: Session storage per site since v0.6.0.5Yes: On a network, an ability can be pointed at another site, which keeps its own profile and ledger.
Skills and memoryPartly: Prompt-type abilities become MCP prompts; no bundled skills.2Yes: Bundled skills, delivered as MCP prompts and as skill:// resources; memory that lasts across sessions is Pro.
Where it runsA separately installed official plugin, version 0.7.0 now in WordPress.org. Not in WordPress core; library bundling is deprecated.19A plugin in your install that includes the Adapter. Clients connect directly, or through the optional GoBuildWP Cloud gateway.
Price and usage capsFree and open source.1Free and open source, no per-call metering charge; per-credential write rate limits still apply; Pro $39–$99.99 a year, or $59.99–$199.99 once.
OAuth 2.1 sign-inNo: No built-in OAuth; WordPress authentication, with OAuth only as custom code.3Yes: Built in, no custom code: OAuth 2.1 and PKCE, clients registered by CIMD or else DCR, each one revocable.
Scoped, expiring credentialsNo: No credential system of its own.3Yes: Its own credentials: tokens with an expiry, a scope and a ceiling set by the safety profile.
Who confirms a destructive callNo: No built-in human confirmation; MRTR on trunk lets an ability ask but does not verify a person.4Yes: Confirmation-gated calls use the model flag by default. In person-approves mode they need a human decision through supported client elicitation or a wp-admin link. Ordinary writes need a per-ability rule or Pro approval policy to wait too.
Change logPartly: Observability hooks, and WordPress 7.1's ability-invoked action; no log screen.10Yes: A ledger screen of every write, redacted, with the agent credential, 90 days and CSV or JSON export.
Writes made through other MCP serversNot documented: Not documented by MCP Adapter.Yes: On WordPress 7.1, GoBuildWP uses core's new pre-execute filter to hold writes that reach abilities through other plugins' MCP servers, such as Elementor's and WooCommerce's, to the safety profile and a person's approval (off by default). Its change log records those writes either way, with undo where a before-image can be restored.
ElementorNo: None built in; it exposes what other plugins register.2Yes: Free: 18 Elementor abilities already written, classic and atomic.
Block editorNo: None built in.2Yes: Core blocks in post content need a browser session to finish a write; block theme Global Styles, templates, patterns and navigation menus are edited directly in Free, with undo. Pro has Spectra and Kadence Blocks abilities as well as GenerateBlocks.
Other page buildersNo: None built in.2Yes: Pro registers builder abilities, from Bricks and Divi 5 to Beaver Builder and WPBakery.
WooCommerceNot documented: None built in; WooCommerce registers its own abilities for the Adapter to expose.Yes: Free registers 13 WooCommerce abilities of its own for reads and single-product edits; Pro adds 52, refunds and reports included.
Builder-to-builder conversionNo: Not in the Adapter's scope.2Yes: Pro converts pages between builders as new drafts, each with a per-element loss report.

Weighing more than MCP Adapter and GoBuildWP? The best WordPress MCP server comparison puts every option on one table. Running several sites, GoBuildWP Cloud adds reviewed bulk plugin updates with backup options, backup status for every site and one safety policy across sites.

Using the Adapter on its own

Install the Adapter, mark an ability public, pick stdio or HTTP

Distribution rechecked 2 October 2026 for 0.7.0. The ability-exposure and transport snippets are source guidance, not executed transcripts for that release; verify the exact registered abilities and authentication on staging.

1. Install it

You need WordPress 6.9 or newer and PHP 7.4 or newer. Install the official MCP Adapter from Plugins > Add New, or pin 0.7.0 with WP-CLI as shown. The new distribution deprecates library bundling. GoBuildWP Free 1.18.6 still bundles its own copy of the Adapter, and if the standalone Adapter plugin is also active it shows an admin notice saying the standalone copy can be deactivated.

2. Make an ability public

Abilities registered with wp_register_ability() stay private. The default server shows only those with meta.public or meta.mcp.public set to true; meta.mcp.public false keeps an otherwise public ability out of MCP. Abilities whose mcp.type is prompt or resource appear as MCP prompts and resources. The WordPress Abilities API walkthrough registers one ability end to end and lists the registration mistakes that fail without an error.

3. Choose a transport

stdio runs through WP-CLI on the machine that hosts WordPress, as the user you name. HTTP is the REST route /wp-json/mcp/mcp-adapter-default-server, authenticated as a logged-in WordPress user, usually with an Application Password; OAuth needs custom code. Either way the client sees three meta-tools: discover abilities, get ability info and execute an ability.

Install with WP-CLI0.7.0 · unexecuted example
wp plugin install mcp-adapter --version=0.7.0 --activate
Expose one abilityPHP
// Inside a wp_abilities_api_init callback; at file scope it registers nothing.
wp_register_ability( 'my-plugin/list-drafts', array(
  // label, description, input and output schema,
  // execute_callback and permission_callback as usual
  'meta' => array(
    'public' => true,          // visible on the default MCP server
    // 'mcp' => array( 'public' => false ), // hide it from MCP only
  ),
) );
List tools over stdioWP-CLI
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{} }' \
  | wp mcp-adapter serve --user=admin --server=mcp-adapter-default-server

Coming from Automattic's older wordpress-mcp plugin? That repository has been read-only since its archiving on 17 September 2026. The wordpress-mcp migration page covers the move, whether you land on the Adapter or on GoBuildWP.

A test you can repeat on staging

Call one ability both ways

  1. Expose it and trace the call

    Register a small ability, mark it public and call it through the Adapter over stdio, then over HTTP with an Application Password. Call a GoBuildWP ability from the same client. Afterwards, look for a record of each call without writing any logging code.

  2. Ask for a delete

    Have the agent delete a draft through a public Adapter ability and through GoBuildWP with "A person approves" on. Note whether a human actually saw the request before it ran, or whether the model answered its own question.

  3. Revoke one client

    Remove the Application Password used for the Adapter and revoke the GoBuildWP OAuth app. Check that each client is refused, and that no other client lost access.

Where GoBuildWP leads MCP Adapter

The four pieces the Adapter leaves open

GoBuildWP fills each of them without custom code.

  1. Sign-in

    With the Adapter alone, clients log in as a WordPress user, usually through an Application Password. GoBuildWP ships OAuth 2.1 and access tokens that expire and carry a profile ceiling.

  2. A human in the loop

    The Adapter's MRTR support on trunk lets an ability ask a question, but its guide says it does not verify that a person answered. GoBuildWP's person-approves mode does put the call in front of someone.

  3. A log you can read

    The Adapter offers observability hooks, and WordPress 7.1 adds an ability-invoked action. GoBuildWP turns that into a ledger screen with the agent named on every row.

  4. Undo

    The Adapter has no undo, by design. GoBuildWP reverses supported recorded writes and checks each restore; permanent deletions and other irreversible writes are listed, not undone.

  5. Abilities to call

    Out of the box the Adapter exposes only what is registered and public. GoBuildWP Free registers 232 abilities, and Pro adds 89 plugin integrations. It can also require confirmation or a minimum profile for abilities other plugins register.

Who should pick which

Building on the standard, or running a site on it?

Choose GoBuildWP when

  • You manage sites and want a governed connection today, not a framework.
  • Sign-in, confirmation, a ledger and undo should work without writing code.
  • Agents need builder, store or SEO abilities that someone has already written.

MCP Adapter is a good fit when

  • You develop a plugin and want its abilities on MCP.
  • You are building your own MCP product on the WordPress standard.

Pricing and hosting model

Both open source; one adds a paid tier

MCP Adapter

Free under GPL-2.0, now distributed through WordPress.org. Requires WordPress 6.9+ and PHP 7.4+, and ships no abilities of its own beyond its three meta-tools.

GoBuildWP

GoBuildWP Free is open source too and includes the Adapter. Pro, $39–$99.99 a year, or $59.99–$199.99 once, adds 89 plugin integrations.

FAQ

Adapter versions, core status and the old plugin

Is the MCP Adapter in WordPress core?

No. As of 2 October 2026 version 0.7.0 is a separately installed plugin in the WordPress.org directory. Install it through Plugins > Add New or the documented WP-CLI route. Library bundling is now deprecated; the Abilities API in core and the Adapter plugin are different layers.

Which version should I install?

The current official listing documents 0.7.0, released 2 October 2026. Pin and test the selected version rather than using an unbounded latest ZIP. Existing guides below retain historical source dates where stated; custom transports and integrations need their own compatibility test.

Do I need WordPress 7 for the Adapter?

No. Its getting-started guide asks for WordPress 6.9 or newer, where the Abilities API is in core, and PHP 7.4 or newer.

Does GoBuildWP replace the Adapter?

No, it uses it: the Adapter handles GoBuildWP's 2025-11-25 clients, GoBuildWP adds a 2026-07-28 transport, and its abilities, profiles, ledger and undo sit above both.

What happened to Automattic's wordpress-mcp plugin?

Automattic archived the GitHub repository on 17 September 2026; the README now sends new installs to the Adapter and WordPress.com's MCP. The migration is covered on a separate page.

Sources, checked 2 October 2026

WordPress MCP Adapter vs GoBuildWP: the sources behind each row

Distribution and 0.7.0 were checked on 2 October 2026 against the official directory. Older ability/transport guide sources retain their 29 September dates. No 0.7.0 installation or interoperability run is recorded here. The official-stack route can use ready-made plugin abilities, including Enable Abilities for MCP; custom coding is not required for every operation.

Best WordPress MCP server, all options compared

  1. 1. WordPress/mcp-adapter repositoryRole, licence and status. Checked 29 September 2026.
  2. 2. Adapter default server guideThree meta-tools, private-by-default abilities, prompts. Checked 29 September 2026.
  3. 3. Adapter transport permissionsWordPress authentication; OAuth only as custom code. Checked 29 September 2026.
  4. 4. Adapter MRTR guideinput_required does not verify a human. Checked 29 September 2026.
  5. 5. Adapter releasesv0.6.1 on 13 August 2026; per-site sessions since v0.6.0. Checked 29 September 2026.
  6. 6. Prepare the 0.7.0 release (PR 342)Merged 23 September 2026; no 0.7.0 tag yet. Checked 29 September 2026.
  7. 7. Roadmap to WordPress 7.2Plans a WordPress.org directory listing; MCP is not in core. Checked 29 September 2026.
  8. 8. Adapter getting startedstdio through WP-CLI and HTTP. Checked 29 September 2026.
  9. 9. Official Adapter on WordPress.org0.7.0 release and direct admin installation, checked 2 October 2026. Bundling as a library now deprecated; installed GoBuildWP releases are assessed separately.
  10. 10. Abilities API in WordPress 7.1The wp_ability_invoked action. Checked 29 September 2026.
  11. GoBuildWP changelog
  12. GoBuildWP capability directory
  13. GoBuildWP pricing

Keep the standard, add the controls.

Install GoBuildWP Free on staging: it brings the Adapter with it, plus sign-in, confirmation, a ledger and undo.

Get GoBuildWP free See Pro pricing