Droid CLI, Native OAuth
Factory Droid WordPress MCP setup. Add it with droid mcp add.
Factory Droid WordPress MCP setup comes down to one file and one screen: Droid keeps MCP servers in ~/.factory/mcp.json and manages them from the /mcp screen inside a session. GoBuildWP hands Droid a ready droid mcp add command, either for OAuth, where Droid discovers the authorization server and registers itself, or carrying an access token for runs with no browser.
Checked against Factory Droid's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6
droid mcp add 'gobuildwp-your-site-com' 'https://your-site.com/wp-json/mcp/wppilot-oauth' --type http- Config
- ~/.factory/mcp.json or .factory/mcp.json
- Remote type
- "http" with url and headers
- Manage in session
- /mcp
Setup
Connect Droid to a WordPress site
Decide first whether this server belongs to you or to one repository. Droid reads both files, and a project entry cannot be removed from the /mcp manager.
Pick OAuth or a token on the site
In GoBuildWP, open Connect and choose Factory Droid under OAuth for your own interactive use, or under Access token for an unattended job. A token gets an expiry and only the abilities the job needs, and it is shown once, so copy the whole command while it is on screen.
Run the command in a terminal
Paste the droid mcp add line. It writes the server to your user-level ~/.factory/mcp.json. For a repository-only server, add the same block by hand to .factory/mcp.json in the repo root instead.
Keep the secret out of the file
Droid expands ${NAME} from your environment inside headers, though not inside url. Replace the literal token with ${GOBUILDWP_TOKEN} and export it in your shell if the file is shared or synced.
Open /mcp in a session
Start droid and run /mcp. The manager lists each server with its state and tools. If you chose OAuth instead of the token, this is where you select the server and authenticate.
Set how far Droid may go on its own
MCP tools are rated low, medium or high risk against Droid's autonomy level. Leave autonomy low for the first run so each WordPress call asks before it runs.
Verify the connection before allowing changes
Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.
Use the gobuildwp-your-site-com MCP server in Factory Droid. Do not change anything.
1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.
Connect screen
The Factory Droid entries GoBuildWP writes
Both generated entries are terminal commands. The OAuth one is droid mcp add with the OAuth URL and --type http; you then open /mcp inside Droid and finish the browser sign-in. The token one uses the canonical endpoint with the Bearer header and adds --no-oauth. That flag matters: the site advertises OAuth metadata for its other route, and without it Droid would start a browser sign-in it does not need.
| OAuth 2.1 | droid mcp add with the OAuth URL and --type http, then /mcp. Droid discovers the server, registers through a Client ID Metadata Document or dynamic registration, and stores the token in the system keyring. |
|---|---|
| Access token | The same command against the canonical endpoint, with the header and --no-oauth. Scoped abilities and an optional expiry, and no sign-in step. |
| Application Password | A stdio entry for ~/.factory/mcp.json that launches @automattic/mcp-wordpress-remote through npx, with the WordPress username and password in env. |
Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.
droid mcp add 'gobuildwp-your-site-com' 'https://your-site.com/wp-json/mcp/wppilot' \
--type http \
--header 'Authorization: Bearer wpp_YOUR-ACCESS-TOKEN' \
--no-oauthInside Factory Droid
Reading Droid's view of the connection
droid mcp list prints every configured server and whether it connected, which is quicker than opening a session when you only want to know if the site answered. Inside a session, /mcp shows the same list with the tools each server exposes; WordPress abilities appear there under the server name you chose.
Droid remembers tool approvals against a fingerprint of the transport configuration. Change the URL, for example from the OAuth endpoint to the token endpoint, and earlier approvals no longer apply, so expect to be asked again. That is by design, not a lost setting.
When several definitions share a name, Droid loads one of them, and organization-managed servers and an enterprise mcpPolicy win over anything in your own files. If a server you added never appears, check whether your organization's policy allowlist includes it.
Signs it worked
- droid mcp list shows the GoBuildWP server as connected
- /mcp lists wppilot/ abilities under that server
- No browser window opened on the token route
- The first call asks for approval at low autonomy
First task
A first job that suits an autonomous CLI
Droid tends to be given a whole task and left to it, so prove that it stops where the site says stop. This prompt reads widely and asks for a plan, with no writes.
Use the GoBuildWP MCP server only. Change nothing.
1. Call wppilot/agent-context and report the safety
profile and the WordPress role you are acting as.
2. Call wppilot/audit-content and summarize the
findings by type.
3. For the three worst pages, call wppilot/get-content
and propose a fix for each, as a plan only.
4. List every ability you called.Troubleshooting
Factory Droid errors and their causes
| Symptom | Cause and fix |
|---|---|
| A browser opens even though you used a token | The server was added without --no-oauth. Remove it with droid mcp remove and add it again with the flag, or set "oauth": false on the entry in mcp.json. |
| droid mcp remove refuses to delete the server | It lives in the project's .factory/mcp.json. Project servers cannot be removed from the CLI or the /mcp manager; edit the file in the repository. |
| ${GOBUILDWP_TOKEN} is sent literally and every call is 401 | The variable is not set in the environment Droid started from. Expansion works in headers, env and OAuth client fields, not in url, so keep the endpoint literal. |
| Remote calls time out on a slow host | Droid waits 10 seconds to connect to an http server by default. Raise connectTimeout (milliseconds) on the entry, then check why the site is slow with GoBuildWP's system status. |
| The server connects but a tool you expect is missing | Check disabledTools on the entry first, then the token's ability list on the site. A token limited to chosen abilities hides everything else. |
Letting Droid act on its plan
From the audit plan to one applied fix at a time
Droid's first task ends with a plan for the three worst pages. The content audit already tells it how each finding could be fixed: wppilot/audit-content-status lists every finding with the abilities that would fix it and whether those abilities are available on this site, so a missing meta description points at your SEO plugin's edit ability and a thin page points at wppilot/update-post. On staging, set to Production Safe, raise Droid's autonomy only far enough for it to apply one fix, then stop and report.
Asking for one fix per turn sounds slow, but it is what keeps the ledger useful. Each write lands as its own entry with Droid's credential named, and if the second fix turns out wrong you can roll back that one change with wppilot/rollback-change, where the entry shows a supported restore, rather than undoing the whole session.
- "Apply only the fix for the first page in your plan. Then re-read it with wppilot/get-content and show me the difference."
- "Call wppilot/list-changes and give me the change ID for that edit."
Droid and GoBuildWP Cloud
Factory Droid is not on the GoBuildWP Cloud list of tested OAuth apps. Droid's own OAuth discovery makes a sign-in to the Cloud link plausible; for droid exec on a server, a Cloud personal access token added with --header and --no-oauth is the route that needs no browser. A direct droid mcp add per site stays the documented setup and keeps nothing between Droid and WordPress.
FAQ
Factory Droid questions
Does Factory Droid support OAuth for WordPress?
Yes. Droid discovers the authorization server, registers itself with dynamic client registration or Factory's published client metadata, and keeps tokens in the system keyring. GoBuildWP's OAuth tab gives the droid mcp add command for the /wp-json/mcp/wppilot-oauth URL; authenticate from /mcp afterwards.
Why does GoBuildWP add --no-oauth to the Droid command?
Because the site publishes OAuth discovery metadata. Droid would find it and try a browser sign-in even though the Bearer header already authenticates every request. The flag switches that off for this one server.
Are Droid's OAuth tokens per project?
No. Factory documents them as global: one sign-in serves every project that uses a server of the same name. Name the server after the site so two WordPress installs never share a slot.
Can droid exec use the WordPress server unattended?
It can, at the autonomy level you pass with --auto. Pair that with a GoBuildWP token limited to the abilities the job needs and a short expiry, so an unattended run cannot reach further than the task.
Related
Other terminal agents
- Claude Code: the same one-command setup, with a --scope flag instead of two files
- Codex CLI: TOML configuration and a separate login command for OAuth
- OpenCode: another open agent, configured in opencode.json
- OpenClaw: an agent gateway reached from chat apps rather than a terminal
- Application Passwords: when the site cannot issue GoBuildWP tokens
Factory Droid documentation read on 29 September 2026
Give Droid a token that ends with the job.
Scope the abilities, set an expiry, and keep autonomy low until the site has shown what it refuses.