For developers
WordPress MCP for developers: your site as a properly described API.
Every operation is a registered ability with a JSON schema, a permission callback and a risk class: 232 in Free, 1,148 more across 89 Pro integrations. 27 clients are documented, and the policy that decides what runs lives on the site, not in the prompt.
GPL v2 or later, OAuth 2.1 with PKCE, Every tool
Illustrative risk-classification sequence, not a template repair or executed staging test. Ability names and classifications follow GoBuildWP 1.18.6 and Pro; the site and results are examples.
The contract
Discovery is runtime, not prompt-time
The agent asks the site what it may call. A prompt that says “you may now delete plugins” changes nothing, because the ability list came from the site and the deletion ability was never registered. Instruction text found in a page, an issue, a product description or a comment gets the same treatment.
That is the difference between a permission model and a persuasion model. Profiles, confirmations, the approval queue and change ledger are server controls. The available surface can change with policy, profile, dependencies and registration; rediscover after those changes and verify authority on every call.
Six properties worth checking in the source
- Profile filtering limits discovery; dispatch and permission callbacks also enforce authority. Allowed operations can still be misused, so prompt injection, credential revocation and denied-call tests remain part of the threat model.
- Risk is derived from category and name, with per-ability policy able to raise the minimum profile or require confirmation. Review installed policy rather than relying on the tool list alone.
- Destructive and critical calls need a confirm flag inside the ability parameters, enforced at MCP dispatch and at REST entry. The model sets that flag itself unless the site's Confirmation mode is switched to "A person approves" or Pro's approval queue is on.
- Writes are rate limited by default to 120 per minute per credential (filterable). Reads are exempt, so inspection stays cheap and mutation stays paced.
- Content abilities refuse wp_template, wp_template_part, wp_global_styles, wp_navigation and wp_block through the generic wrapper.
- First activation switches abilities on and locks them to the host the site has at that moment. A cloned staging database on another hostname stays inert until someone re-enables it for that domain.
Working sessions
What this looks like in Claude Code, Cursor or Codex
The same shape as any agentic session: read, plan, act, verify. The site happens to be one of the tools.
- Inspect before you touch
- Select Read Only explicitly; Production Safe is the default. Inspect one permitted element tree, post type or store setup first. Content-management reads still require their permission callback's authority, and responses may be sent to your AI provider.
- Compose from real schemas
- Widget schemas, field-type schemas, template-condition schemas. The agent reads the target plugin's vocabulary, which is why its output opens in that plugin's editor.
- Plan bounded batches
- Use each ability's actual input limit, retain target IDs and before-state, and inspect partial failures. Rate limiting does not make a multi-call workflow transactional or automatically resumable; verify recovery before retrying.
- Escalate deliberately
- Switch to Developer Full Access when a task genuinely needs WP-CLI or a PHP snippet, on staging, then switch back.
Worked examples: translate a site in Claude Code, bulk alt text in Codex, a read-only audit in Cursor.
Extending it
Skills are Markdown. Abilities are the Abilities API.
If you maintain a plugin, both extension points are already the shape you would have designed.
Register your own abilities
Use the WordPress Abilities API. What you register passes through the same profile, risk classification, confirmation and rate limiting.
Ship a skill with your plugin
A skill is a Markdown file with front matter. The agent sees a summary in discovery and loads the full text only when it is relevant.
Expose prompts as slash commands
Prompt-mode skills register as MCP prompts, which appear as slash commands in clients that support prompts/list.
Developer workflows in depth
Dry runs the server enforces, not the prompt
Asking a model to "show me first" is a convention it can forget. GoBuildWP has two dry-run paths that are enforced on the site. wppilot/preview-ability computes what another ability would change and returns a structured diff plus a wp-admin URL where a person can apply or discard it; apply-preview then commits that diff, and refuses if the target changed after the preview, so what was reviewed is what runs. It only previews abilities that have a projector: in Free that is update-post, update-media, update-site-settings and the post, media, term, comment, menu and menu-item deletes, plus anything a plugin adds through the wppilot_preview_projectors filter. Any other ability is refused by name with a reason, so builder and WooCommerce writes need a working copy or staging instead.
For migrations and rebrands, search-replace-preview finds a string or a PCRE pattern across titles, content, excerpts and chosen post meta and returns a plan id with per-post diffs. search-replace-apply writes only posts in the plan, skips any edited since the preview, writes at most 100 posts per call, and can run as a background job you poll with search-replace-status or stop with search-replace-cancel. Each post it writes gets its own change row, so a partial run is still undoable post by post. All of these are in Free.
Debugging a site without a shell
When there is no SSH, the platform abilities cover most first-look diagnosis. database-query runs one SELECT inside a read-only transaction that is rolled back, returns at most 200 rows and refuses anything else, including WITH, comments and SLEEP. It also refuses the users, usermeta and options tables and payment-token tables, and it needs Developer Full Access. database-tables lists the prefixed tables with sizes, columns and whether the query ability may read each one.
options-explore lists option rows by name or wildcard with autoload state and stored size, and withholds values whose names look secret, which makes it the quick way to find an autoloaded option bloating every request. cron-list shows WP-Cron events with overdue times and flags events with no callbacks, usually left by a removed plugin; cron-run fires one due event the way wp-cron.php would. site-health-tests and connection-doctor round out the set.
Staging clones, local stacks and the domain lock
The plugin is domain-locked to the site address set on its settings screen. That is what stops a production database restored onto staging from answering agents as production, and it has a side effect developers meet early: after you change a local or staging hostname, abilities are refused until the domain is set again for the new address. If an agent that worked yesterday suddenly has nothing it is allowed to call, check the domain before anything else.
On your own machine, a client can launch the server over stdio through WP-CLI rather than HTTP, which suits Claude Code or Codex next to a local WordPress install. Multisite networks are covered too: network-list-sites lists the sites, and network-run-ability runs one ability on one site under that site's own safety profile, permission checks and confirmation rules, then switches back.
Working copies for edits to live pages
On GoBuildWP Pro, working-copy-create clones a published page into a draft, builder and field meta included, for Elementor, Bricks, Divi, Beaver Builder, Oxygen, Breakdance, Etch, WPBakery, Flatsome and block builders. The agent edits the copy; shared classes, templates and other global settings remain separate live targets. working-copy-preview reports what publishing would change and whether the live page was edited in the meantime; working-copy-publish writes the copy back onto the original post so its ID, URL, comments and SEO history survive, with a before-image in the ledger. Turn on draft-first with working-copy-settings and builder writes refuse to touch a published page directly.
Questions
The technical ones
How is this different from hitting the REST API myself?
The REST API describes resources; abilities describe operations with input schemas, permission callbacks, risk classification and confirmation rules. The agent discovers what it may call at runtime rather than being told by your prompt, and server-side permission checks still apply if a client asks for a hidden operation.
Does it work with the official WordPress MCP Adapter?
It builds on the same foundation, the Abilities API, and registers abilities the adapter exposes over MCP. What sits on top is the difference: safety profiles, per-ability policy, confirmation on destructive calls, rate limiting and the plugin-aware modules.
Can I run WP-CLI or PHP through it?
Under Developer Full Access, yes: run-wp-cli, execute-php, write-file and edit-file exist. They are classified critical, which means they are absent under the default Production Safe profile and require an explicit confirm flag when they are available.
How does authentication work?
OAuth 2.1 with PKCE and dynamic client registration for clients that support it, WordPress Application Passwords over HTTPS for those that do not, or an access token for callers with no browser. A token can carry an expiry, a list of the abilities or categories it may use, and a safety-profile ceiling. The agent acts as a real WordPress user, so capabilities apply exactly as they would in wp-admin.
Can I add my own abilities?
Yes. Register them through the WordPress Abilities API with a schema, a permission callback and exposure metadata, then check how GoBuildWP classifies them and test both an allowed and a denied call. Skills are Markdown with front matter, so a workflow can ship with your own plugin. Any plugin's ability can be set on the Abilities screen to always need confirmation or a minimum safety profile.
Which MCP extensions does GoBuildWP serve?
From Free 1.15.0: a public server card at /.well-known/mcp/server-card.json; authenticated skill:// resources; and MCP Apps write-preview cards in supporting hosts. MCP Tasks shipped in Free 1.15.0 on the modern transport. When enabled and tools are served, discovery advertises Tasks. Task-capable, job-backed abilities can run in the background; other abilities return an already completed or failed task. Authenticated clients can poll, retrieve results, list their tasks and request cancellation. Cancellation does not undo completed writes. The connected user's permissions, safety profile and confirmation checks still apply. Tasks can be disabled through the wppilot_mcp_tasks_enabled filter. Extension support depends on the client; ordinary tool results remain available.
Read the source, then point it at staging.
GoBuildWP Free is GPL v2 on GitHub. Read the safety classification and decide for yourself what your agent should be allowed to do.