Open-source coding agent, Native OAuth
Cline WordPress MCP. Remote Servers tab, streamableHttp type.
Cline WordPress MCP setup starts in the MCP Servers panel, where a Remote Servers tab takes a name, the URL and a transport. Behind it, Cline keeps every server in one shared settings file, and a remote entry must say streamableHttp explicitly; leave the type out and Cline assumes the older SSE transport.
Checked against Cline's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6
{
"mcpServers": {
"gobuildwp-your-site-com": {
"type": "streamableHttp",
"url": "https://your-site.com/wp-json/mcp/wppilot-oauth"
}
}
}- Documented extension path
- ~/.cline/data/settings/cline_mcp_settings.json
- Connect-screen CLI path
- ~/.cline/mcp.json; CLI/version compatibility untested
- Remote type
- "streamableHttp"
- Default timeout
- 60 seconds
Setup
Add WordPress to Cline
Distinguish the extension's documented settings path from the CLI path generated by GoBuildWP. Confirm which file the actual installed client loads; these source and documentation paths are not a versioned interoperability test.
Open the MCP Servers panel
Click the MCP Servers icon in the Cline sidebar. Recent releases group MCP under Customize; the docs still show Configure, then Configure MCP Servers, for the raw file.
Add a remote server
On the Remote Servers tab enter the server name, paste the URL, choose Streamable HTTP rather than SSE (Legacy), and press Add Server.
Or paste GoBuildWP's block
Merge it into mcpServers in cline_mcp_settings.json. If you use the token entry, keep its type field; without it Cline tries SSE and fails.
Authenticate
For the OAuth URL, the server row shows an Authenticate button. The callback returns to a loopback address on your machine, and the token is saved with the server's entry.
From the terminal
cline mcp opens a wizard for the same settings, and cline config mcp lists what is configured.
Verify the connection before allowing changes
Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.
Use the gobuildwp-your-site-com MCP server in Cline. Do not change anything.
1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.
Connect screen
The Cline entries GoBuildWP writes
Both of GoBuildWP's remote entries for Cline spell the transport streamableHttp, in camel case, which is Cline's own spelling. The OAuth entry is that type and the OAuth URL, nothing more; Cline runs the sign-in itself, with dynamic client registration by default. The token entry adds an Authorization header. The Connect screen also names ~/.cline/mcp.json for the Cline CLI. Only the Application Password entry, and OAuth on a site the Connect screen sees as local, go through npx.
| OAuth 2.1 | type streamableHttp and the OAuth URL. Press Authenticate on the server's row to sign in. |
|---|---|
| Access token | type streamableHttp, url and an Authorization header. |
| Application Password | The npx bridge with WP_API_URL, WP_API_USERNAME and WP_API_PASSWORD in env. |
Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.
{
"mcpServers": {
"gobuildwp-your-site-com": {
"type": "streamableHttp",
"url": "https://your-site.com/wp-json/mcp/wppilot",
"headers": {
"Authorization": "Bearer wpp_YOUR-ACCESS-TOKEN"
}
}
}
}Troubleshooting
Cline errors and their causes
| Symptom | Cause and fix |
|---|---|
| The server connects to nothing and mentions SSE | type is missing, so Cline used legacy SSE. Set "type": "streamableHttp". |
| Edits to the old globalStorage settings file do nothing | Cline 4 moved MCP settings to ~/.cline/data/settings/cline_mcp_settings.json and migrated the old file. Edit the new one. |
| Remote server times out | Cline gives remote connects about ten seconds. Check the site's response time; the per-server timeout field (seconds, default 60) covers calls, not the first connect. |
| npx not found | The bridge needs Node.js. Use the native streamableHttp entry instead. |
| alwaysAllow is ignored | That field belongs to Roo Code. In Cline, approval is governed by the global MCP switch. |
Inside Cline
What Cline shows when a server is healthy
Each server row in the MCP Servers panel shows its state and, once connected, the tools it offers. A row with a restart control and no tools has failed to connect; the error is shown on the row. Cline gives remote servers roughly ten seconds to connect, so a slow host can fail here while working in a browser.
Approval in recent Cline releases is global: the per-tool auto-approve checkboxes were hidden, and MCP auto-approval follows the single Use MCP servers switch. Leave it asking while you learn which WordPress abilities Cline reaches for, and let GoBuildWP's safety profile block what should never happen.
Inspect the actual tool trace: it should name the connected GoBuildWP server and the authorized ability, with a returned result or error. An answer mentioning WordPress data is not proof that a tool ran. Ask for discovery and one read before any write task.
Signs it worked
- The row shows connected with a tool list
- Authenticate has cleared for the OAuth entry
- Auto-approval is still off
- A discovery prompt names wppilot/ abilities
First task
A first Cline task in Plan mode
Run this in Plan mode so Cline proposes steps and waits. It reads the site's navigation and content; nothing is saved.
Plan only. Use the WordPress MCP server and change
nothing.
1. wppilot/list-menus and wppilot/list-menu-items for
the primary menu.
2. wppilot/get-content for each page the menu links to.
3. Flag menu items pointing at drafts or missing
pages, and propose the menu you would build.From Plan mode to Act mode
Building the menu Cline planned, on a staging site
The Plan-mode task ends with a proposed menu. Acting on it is a good first write for Cline because every step is small and the dangerous one can be avoided entirely. On a staging copy set to Production Safe, switch Cline to Act mode and have it build the new menu alongside the old one rather than editing the live menu in place: wppilot/create-menu makes an empty menu, wppilot/upsert-menu-item adds each entry, and wppilot/reorder-menu-items sets the order and nesting in one call.
Only once you have looked at the new menu in wp-admin should Cline call wppilot/assign-menu-location to put it in the theme's location. That call captures the previous assignment first, so it can be reversed from the change ledger. Leave the old menu in place for a while; wppilot/delete-menu has no trash and cannot be undone, which is exactly the kind of call to keep for a person.
- "Act. Create a new menu called Primary (proposed) and add the items from your plan. Do not assign it to a location."
- "Now assign Primary (proposed) to the primary location and tell me the change ID."
- "Show me the ledger entry for that assignment and whether it can be rolled back."
A global approval switch means the site holds the brake
With Cline's per-tool auto-approve checkboxes gone, auto-approval for MCP is all or nothing. Many people turn it on to stop the prompts during a long task, and from that moment every WordPress ability Cline can see runs without a pause. Decide what Cline can see before that happens. A GoBuildWP access token limited to the menu and content abilities a task needs, with an expiry, hides everything else from Cline; capping it at Read Only turns a whole session into inspection however the switch is set.
Cline through GoBuildWP Cloud uses a personal token
Directly, Cline can sign in to your site with OAuth. Through the optional GoBuildWP Cloud it is listed among the callers that use a personal access token instead: you create one in your Cloud account, limited to the sites it needs and given an expiry, and put it in cline_mcp_settings.json as an Authorization header on a streamableHttp entry pointing at the Cloud link. Choose Cloud when one Cline install should reach several sites; stay direct for a single site, where nothing sits between Cline and WordPress. Either way, the same streamableHttp spelling applies, and a missing type sends Cline down the old SSE path.
FAQ
Cline questions
Does Cline support OAuth for remote MCP servers?
Yes. Cline's changelog and source show OAuth for remote servers with dynamic client registration, plus pre-registered clients where registration is not available. Its docs pages do not describe it yet.
Where does Cline store MCP servers now?
Cline's documentation gives ~/.cline/data/settings/cline_mcp_settings.json for the extension, and CLINE_DATA_DIR moves the data directory. GoBuildWP's Connect screen names ~/.cline/mcp.json for the Cline CLI instead. Which file a particular CLI or desktop build reads has not been tested here, so check the path the client's own MCP settings screen opens.
Is Cline the replacement for Roo Code?
Roo Code's own repository names Cline and the community fork ZooCode as places to go after its shutdown. The Roo Code guide covers moving a WordPress server across.
Does Cline need Node.js for WordPress?
Only for the npx bridge entries. The streamableHttp entry, with a token or OAuth, needs nothing beyond Cline.
Related
Cline's relatives
Cline documentation read on 29 September 2026
Give Cline the site as a Streamable HTTP server.
Set the type explicitly, authenticate once, and keep MCP auto-approval off while you watch the first plan.