GoBuildWP CloudConnect your sites through one workspace.Explore Cloud →
GoBuildWP
Download freeDownload

AI pair programmer, Native OAuth

GitHub Copilot WordPress MCP. Four surfaces, four config homes.

GitHub Copilot WordPress MCP setup depends on where you use Copilot. In VS Code it reads .vscode/mcp.json, Visual Studio has its own list of files, the Copilot CLI keeps ~/.copilot/mcp-config.json, and the cloud agent takes JSON in the repository settings. On Business and Enterprise plans an administrator must first allow MCP servers at all.

Get GoBuildWP free Setup steps

Checked against GitHub Copilot's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6

By GoBuildWPContent updated How we check claims

~/.copilot/mcp-config.jsonOAuth 2.1
{
  "mcpServers": {
    "gobuildwp-your-site-com": {
      "type": "http",
      "url": "https://your-site.com/wp-json/mcp/wppilot-oauth",
      "tools": [
        "*"
      ]
    }
  }
}
VS Code
.vscode/mcp.json (servers)
Copilot CLI
~/.copilot/mcp-config.json (mcpServers)
Org policy
MCP servers in Copilot, off by default

Inside GitHub Copilot

One server, four ways to see whether it loaded

In VS Code, MCP: List Servers and the server's output channel answer the question. In Visual Studio, the tools picker shows whether the WordPress tools are enabled, and the CodeLens in the JSON file shows whether authentication is still needed.

In the Copilot CLI, /mcp show lists servers and their state; a server marked needs-auth is fixed with /mcp auth and its name. copilot mcp list and copilot mcp get work outside a session, and --allow-tool pre-approves specific tools for scripted runs.

The cloud agent logs a Start MCP Servers step in each session. If the WordPress server is missing there, inspect the startup error, JSON, required fields such as tools, and the COPILOT_MCP_ secret reference. The agent does not ask before using tools, but WordPress capabilities, token scope and ceiling, safety profile, per-ability switches, confirmation requirements and any Pro approval policy still apply on the site.

Loaded when

  • The organization policy allows MCP servers
  • Your surface lists the WordPress tools
  • Sign-in, or the token, is accepted without a 401
  • The cloud agent's token can only read

Setup

Connect WordPress to the Copilot you use

Pick the surface first. The server object is similar everywhere; the file, the top-level key and the required fields are not.

  1. Business or Enterprise: enable the policy

    An organization or enterprise owner turns on MCP servers in Copilot. It is disabled by default, and while it is off no Copilot surface will load your WordPress server.

  2. Copilot in VS Code

    Put GoBuildWP's servers block in .vscode/mcp.json, trust the server, and sign in. Everything in the VS Code guide applies.

  3. Copilot in Visual Studio

    Visual Studio reads %USERPROFILE%\.mcp.json, a solution's .vs\mcp.json or .mcp.json, and also .vscode\mcp.json. Tools start disabled; enable them in the tools picker, and use the Authentication Required CodeLens in the file to sign in.

  4. Copilot CLI

    Run copilot mcp add --transport http with the name and URL, adding --header for a token. The CLI stores mcpServers in ~/.copilot/mcp-config.json and requires a tools list on each server; it rejects VS Code's servers key.

  5. Cloud agent

    In the repository's Settings, Copilot, MCP servers, add JSON with mcpServers, type, url, headers and tools. Put the token in a secret named with the COPILOT_MCP_ prefix. The agent runs these tools without asking, so give it a token with read abilities only.

Verify the connection before allowing changes

Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.

First connection checkRead Only
Use the gobuildwp-your-site-com MCP server in GitHub Copilot. Do not change anything.

1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
   then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.

These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.

Connect screen

GoBuildWP's Copilot entries are for Copilot CLI

GoBuildWP's Copilot tab writes for the Copilot CLI: mcpServers with type http, the URL and a tools list of "*", in ~/.copilot/mcp-config.json, a committed .github/mcp.json or a local .mcp.json. The CLI rejects the servers key VS Code uses. Copilot Chat in VS Code reads the VS Code configuration, so use the VS Code tab for it, and the cloud agent cannot use OAuth servers at all; give it an access token.

OAuth 2.1Works in VS Code, Visual Studio (a CodeLens offers Authentication Required) and the Copilot CLI (/mcp auth). The cloud agent does not support OAuth servers.
Access tokenThe only route for the cloud agent: a header whose secret is stored with the COPILOT_MCP_ prefix. Also fine in the CLI with copilot mcp add --header.
Application PasswordThe npx bridge entry, for editors on a machine with Node.js. Not usable by the cloud agent.

Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.

~/.copilot/mcp-config.jsonAccess token
{
  "mcpServers": {
    "gobuildwp-your-site-com": {
      "type": "http",
      "url": "https://your-site.com/wp-json/mcp/wppilot",
      "headers": {
        "Authorization": "Bearer wpp_YOUR-ACCESS-TOKEN"
      },
      "tools": [
        "*"
      ]
    }
  }
}

Troubleshooting

GitHub Copilot errors and their causes

SymptomCause and fix
No surface loads the serverThe MCP servers in Copilot policy is off for your organization. An owner has to enable it.
An entry in .github/copilot/mcp.json is ignoredThat is not a documented Copilot location; older GoBuildWP releases named it. Use ~/.copilot/mcp-config.json or .github/mcp.json for the CLI, and .vscode/mcp.json for Copilot in VS Code.
The CLI rejects the configurationIt expects mcpServers and a tools list on each server. VS Code's servers key does not work there.
The cloud agent cannot sign inIt does not support OAuth servers. Use a GoBuildWP access token in a COPILOT_MCP_ secret.
Visual Studio shows the server but no tools runVisual Studio disables MCP tools by default. Enable them in the tools picker.

Running Copilot against a real site

A read-only token built for the Copilot cloud agent

The cloud agent is the Copilot surface that needs the most care, because it calls tools without asking and cannot sign in with OAuth. Create a GoBuildWP access token on the site's Connect screen specifically for it. Cap the token at Read Only, so the site refuses writes even if the profile is later raised to Production Safe for people, limit it to the abilities the agent's tasks read, and give it an expiry. Store it as a COPILOT_MCP_ secret and reference only that secret in the repository's MCP JSON.

The agent runs on GitHub's infrastructure, so the site must answer over public HTTPS, and anything a security plugin or firewall does to unfamiliar traffic applies to it. If its Start MCP Servers step succeeds but every call fails, ask a working client to run wppilot/connection-doctor, which tests the site's own endpoints for a stripped Authorization header or a firewall answering instead of WordPress.

What Copilot should do on staging before production

Interactive Copilot surfaces ask before they call a tool, which makes them the right place to try a first write. On a staging site set to Production Safe, ask Copilot Chat or the CLI to moderate one pending comment with wppilot/moderate-comment, then read it back with wppilot/get-comment and find the entry in wppilot/list-changes. That exercises approval in the client, permission on the site and the ledger in one small step. Keep the cloud agent read-only on every site.

  • Copilot CLI: approve the single call when prompted rather than pre-approving with --allow-tool on the first run.
  • VS Code and Visual Studio: enable only the comment abilities in the tools picker for this test.
  • Afterwards: confirm in wp-admin which WordPress user the ledger names as the actor.

Copilot and GoBuildWP Cloud

Copilot in VS Code can use the optional GoBuildWP Cloud link with an OAuth sign-in, which helps when one developer works across several sites. For the cloud agent, which cannot sign in, Cloud offers personal access tokens limited to chosen sites and given an expiry. A direct site token is still the narrower choice when only one site is involved, because it can carry its own Read Only ceiling on that site.

FAQ

GitHub Copilot questions

Does GitHub Copilot support a WordPress MCP server?

Yes, in VS Code, Visual Studio, JetBrains IDEs, Xcode, Eclipse, the Copilot CLI and the cloud agent, subject to your organization's MCP policy. The file and format differ per surface.

Can the Copilot cloud agent publish to WordPress on its own?

It uses configured tools without asking in Copilot. A write still needs the WordPress capability, token scope and ceiling, site profile, enabled ability, required confirmation and any Pro approval policy to permit it. Give the cloud agent an expiring token capped at Read Only and limited to the read abilities it needs.

Where does Copilot in JetBrains keep MCP servers?

GitHub documents adding them through the IDE's MCP settings screen, with remote servers taking url and requestInit.headers. The on-disk file path is not documented.

Is the VS Code guide enough for Copilot in VS Code?

Yes. Copilot in VS Code uses VS Code's MCP support, so the VS Code steps, commands and limits are the ones that apply.

First task

A first task that works on every Copilot surface

Keep it identical across surfaces so you can compare results. It reads comments and content and writes nothing.

GitHub Copilot promptReads only
Use the WordPress MCP server. Do not change anything.

1. wppilot/agent-context: which safety profile?
2. wppilot/list-comments: how many are pending?
3. wppilot/list-content: the five newest posts.
4. For the newest post, wppilot/get-content and a
   two-sentence summary.

Related

Related guides

  • VS Code: the editor-side details: trust, output channels, the tool cap
  • Codex CLI: another CLI agent with a user-level config file
  • Application Passwords: for editors where OAuth is not available
Every client guide (26)

GitHub Copilot documentation read on 29 September 2026

Put WordPress behind every Copilot surface you use.

Enable the policy, use the right file for each surface, and give the cloud agent a read-only token.

Get GoBuildWP free See Pro pricing