Desktop app, Native OAuth

Claude Desktop WordPress MCP. Connector, bundle or config file.

Claude Desktop WordPress MCP has two routes, and they run in different places. A custom connector is called from Anthropic's cloud, so the site needs public HTTPS. The .mcpb bundle and claude_desktop_config.json start a local process on your computer, which is how Desktop reaches a staging or localhost site.

Get GoBuildWP free Setup steps

Checked against Claude Desktop's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6

By GoBuildWPContent updated 12 October 2026How we check claims

Add custom connectorOAuth 2.1

Name                   gobuildwp-your-site-com
Remote MCP server URL  https://your-site.com/wp-json/mcp/wppilot-oauth
OAuth Client ID        (leave empty)
OAuth Client Secret    (leave empty)

Connector: Customize, Connectors, Add custom connector
Local config: claude_desktop_config.json (stdio only)
Logs: mcp.log and mcp-server-<name>.log

Connect screen

The Claude Desktop entries GoBuildWP writes

For OAuth the Connect screen gives Desktop a walkthrough, not a file: the server name and URL to type into Add custom connector, with the OAuth client fields left empty. For a local site it offers the .mcpb bundle, which embeds an Application Password, or a config block that runs @automattic/mcp-wordpress-remote through npx. An access token also goes into claude_desktop_config.json, carried by the mcp-remote bridge, because that file only starts local processes.

OAuth 2.1	Custom connector. Works only when the site is reachable from the internet over HTTPS, because Anthropic's servers make the calls.
Desktop extension bundle	A .mcpb file with the password inside. Double-click it or use Settings, Extensions, Advanced settings, Install Extension. Delete the file once installed.
Access token	An npx mcp-remote entry for claude_desktop_config.json that passes the header as Authorization:${AUTH_HEADER}, with the Bearer value in env. Keeping it in env matters on Windows, where Desktop does not escape the space inside an argument. Needs Node.js; reaches a local site too.
Application Password	The npx entry for claude_desktop_config.json. It needs Node.js on the computer; Automattic's bridge documents Node 22 or later.

Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.

claude_desktop_config.jsonApplication Password

{
  "mcpServers": {
    "gobuildwp-your-site-com": {
      "command": "npx",
      "args": [
        "-y",
        "@automattic/mcp-wordpress-remote@latest"
      ],
      "env": {
        "WP_API_URL": "https://your-site.com/wp-json/mcp/wppilot",
        "WP_API_USERNAME": "your-wp-user",
        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Setup

Pick the Desktop route that can reach your site

Ask one question first: can a server on the internet open your site's HTTPS URL? If yes, use the connector. If not, use the bundle.

Public site: add a custom connector
Open Customize, then Connectors, then Add custom connector. Paste the server name and URL from GoBuildWP and leave OAuth Client ID and Secret empty. On Team or Enterprise an Owner adds it under Organization settings first.
Sign in and switch it on per chat
Approve the WordPress login in the browser. Then, in a conversation, use the + button, open Connectors and enable the site. A connector is off in each new chat until you turn it on.
Local site: install the bundle
Create an Application Password in GoBuildWP, download the .mcpb, and open it with Claude Desktop. The file contains the password in plain text, so delete it after installing.
Or edit the config file
Settings, Developer, Edit Config opens claude_desktop_config.json. Merge the generated mcpServers block into what is there, save, and quit Desktop fully before reopening; a closed window is not a restart.
Confirm the tools loaded
In a chat, open the attachment menu, then Connectors, then Manage connectors. The WordPress server should list its tools. If it does not, read the logs below before changing anything.

Verify the connection before allowing changes

Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.

First connection checkRead Only

Use the gobuildwp-your-site-com MCP server in Claude Desktop. Do not change anything.

1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
   then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.

These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.

Troubleshooting

Claude Desktop errors and their causes

Symptom	Cause and fix
The connector says it cannot reach the server	Anthropic's cloud cannot open the URL. Localhost, a private IP, a VPN-only host or a basic-auth staging site all fail here. Use the bundle or config file for those.
The config file entry never appears	Desktop was not fully quit, or the JSON is invalid after merging. Quit from the menu bar or system tray, validate the file, and reopen.
npx fails with ENOENT on Windows	Anthropic's troubleshooting notes a ${APPDATA} lookup failure. Add APPDATA to the server's env block with your real path, and make sure npm is installed globally.
The bundle installs but every call is unauthorized	Check the bundle credential and revocation state, endpoint, header forwarding and returned authentication error. Regenerate a protected per-person bundle when the evidence identifies credential failure.
A hand-written token entry in claude_desktop_config.json does nothing	That file runs local stdio servers, so an http entry with headers is ignored. Use the generated entry, which starts npx mcp-remote with the header, or a custom connector with OAuth on a public site.

Inside Claude Desktop

Where Desktop records what went wrong

Local servers write to log files: ~/Library/Logs/Claude on macOS and %APPDATA%\Claude\logs on Windows. mcp.log covers connection attempts for every server, and mcp-server-<name>.log holds the standard error of one server, which is where the npx bridge prints a wrong password or an unreachable URL.

Connectors do not produce those files, because the connection is made in Anthropic's cloud. Their failures surface in the app as a sign-in that never completes or a tool call error. The usual cause is the site itself: behind a firewall, on a private address, or redirecting to a different host, which strips the Authorization header.

Tool results are capped by the connector platform at roughly 150,000 characters, and a single tool call can run for up to four minutes. A request for every post on a large site is better split into pages.

Signs it worked

The connector or extension appears under Manage connectors
The WordPress sign-in happened on your own domain
mcp.log shows no errors for a bundle install
Only the chats you enabled can call the site

First task

A first conversation for a desktop assistant

Desktop is where people draft and review content, so the first task reads a real page and critiques it. Nothing is written back.

Claude Desktop promptReads only

With the WordPress connector, and without changing
anything:

1. Call wppilot/search-content for the word "pricing"
   and pick the most relevant page.
2. Read it with wppilot/get-content.
3. Run wppilot/audit-accessibility on that page.
4. Give me three edits you would make, and the
   abilities you would need to make them.

Living with the Desktop setup

Bundle, password entry or token entry for a local site

All three local routes start a process on your computer, so all three reach a staging copy that Anthropic's cloud cannot. They differ in what happens when you forget about them. The .mcpb bundle and the Application Password entry both carry a WordPress Application Password, which never expires and holds every capability of its user until someone revokes it under Users, then Profile. The access-token entry runs the mcp-remote bridge with a GoBuildWP token instead, and that token can be given an expiry, limited to the abilities the work needs, and capped below the site's safety profile.

For a laptop that only ever talks to a local or staging site, the token entry is the one to keep: when a contractor's machine is wiped or a project ends, an expired token has already stopped working. Use the bundle when you want the fewest steps for a one-off session, and delete both the file and the Application Password afterwards.

Promoting from a local bundle to the live connector

When the same work moves from staging to the public site, do not point the local bundle at production. Remove the extension in Desktop, revoke its Application Password on the staging site, and add a custom connector for the live domain with OAuth. The connector syncs to your Claude account, so it appears on the web as well, and its sign-in can be revoked per client from Connected Apps on the live site.

If you run several public sites, GoBuildWP Cloud can stand in for one connector per site: Claude is on its list of OAuth apps, the Cloud link is added once as a connector, and you choose which connected sites Claude may reach. Cloud also calls sites over the internet, so it does not replace the bundle for a localhost copy.

FAQ

Claude Desktop questions

Does Claude Desktop connect to WordPress from my computer?

Only for the bundle and the config file, which start a local process. Custom connectors are called from Anthropic's cloud, even when you use them in the desktop app.

Can Claude Desktop reach a localhost WordPress site?

Yes, through the .mcpb bundle or a claude_desktop_config.json entry, both of which run the npx bridge on your machine. A custom connector cannot reach localhost.

Is the .mcpb bundle safe to share with a colleague?

No. It contains the Application Password in plain text; anyone with the file can act as that WordPress user. Each person should generate their own, and delete the file after installing.

Can I paste a GoBuildWP access token into a Desktop connector?

Only if your organization has the request-headers beta, which an Owner configures. Without it, put the token in claude_desktop_config.json through the mcp-remote entry GoBuildWP generates, or use OAuth, which is the better route on a public site anyway.

Claude on the web: connectors you add in the browser sync to Desktop
Claude Code: direct HTTP from the terminal, no Node needed
Application Passwords: what the bundle stores and how to revoke it
Edit Elementor pages with Claude: worked example
Moderate WordPress comments with AI: worked example
Fix broken links with AI: worked example

Every client guide (26)

Claude Desktop documentation read on 29 September 2026

Choose the Desktop route by where the site lives.

Connector for a public site, bundle for everything else, and a dedicated WordPress user either way.

Get GoBuildWP free See Pro pricing

Claude Desktop WordPress MCP. Connector, bundle or config file.

The Claude Desktop entries GoBuildWP writes

Pick the Desktop route that can reach your site

Public site: add a custom connector

Sign in and switch it on per chat

Local site: install the bundle

Or edit the config file

Confirm the tools loaded