Coding agent, Native OAuth

Kilo Code WordPress MCP. A remote entry in kilo.jsonc.

Kilo Code WordPress MCP configuration moved when Kilo changed architecture: servers now live under the mcp key of the main Kilo config file, ~/.config/kilo/kilo.jsonc or a project's kilo.jsonc, as type remote. Kilo tries Streamable HTTP first, falls back to SSE, and starts OAuth on its own when a server asks for it.

Get GoBuildWP free Setup steps

Checked against Kilo Code's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6

By GoBuildWPContent updated 12 October 2026How we check claims

~/.config/kilo/kilo.jsoncOAuth 2.1

{
  "mcp": {
    "gobuildwp-your-site-com": {
      "type": "remote",
      "url": "https://your-site.com/wp-json/mcp/wppilot-oauth"
    }
  }
}

Global config: ~/.config/kilo/kilo.jsonc
Project config: kilo.jsonc or .kilo/kilo.jsonc
Remote type: "remote"

Connect screen

GoBuildWP's Kilo entries, in kilo.jsonc

GoBuildWP writes Kilo entries for kilo.jsonc, globally at ~/.config/kilo/kilo.jsonc or in the project, under the mcp key, the same shape OpenCode uses. The OAuth entry is type remote with the OAuth URL, and Kilo runs the sign-in. The token entry is type remote with enabled, "oauth": false and an Authorization header, so Kilo does not offer a sign-in the header makes unnecessary. The Application Password entry is a local entry that starts the npx bridge.

OAuth 2.1	type remote with the OAuth URL. Kilo shows a needs-auth notification; clicking it starts the WordPress sign-in.
Access token	type remote, url, headers and "oauth": false. Swap the literal token for {env:GOBUILDWP_TOKEN} to keep it out of the file.
Application Password	The npx bridge as a local entry with the credentials in environment. Needs Node.js.

Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.

~/.config/kilo/kilo.jsoncAccess token

{
  "mcp": {
    "gobuildwp-your-site-com": {
      "type": "remote",
      "url": "https://your-site.com/wp-json/mcp/wppilot",
      "enabled": true,
      "oauth": false,
      "headers": {
        "Authorization": "Bearer wpp_YOUR-ACCESS-TOKEN"
      }
    }
  }
}

Setup

Add WordPress in Kilo Code

Project config beats global, so a repository can pin its own WordPress site while your global file holds another.

Open the MCP Servers tab
In Kilo's Settings, go to Agent Behaviour, then MCP Servers, and press Add Server. Choose Remote (HTTP).
Enter the URL
Paste the OAuth URL for a personal setup. Kilo writes a type remote entry to kilo.jsonc.
Sign in when prompted
Kilo shows a needs-auth notification for the server; clicking it starts the WordPress sign-in.
For a token, keep OAuth off on the entry
GoBuildWP's token entry already sets "oauth": false on the canonical URL. Reference the token as {env:GOBUILDWP_TOKEN} so it stays out of the file.
Allow reads in the config
Kilo's permission block accepts patterns keyed as {server}_{tool}. Allow the WordPress reads and leave writes to the Permission Dock.

Verify the connection before allowing changes

Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.

First connection checkRead Only

Use the gobuildwp-your-site-com MCP server in Kilo Code. Do not change anything.

1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
   then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.

These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.

Inside Kilo Code

Confirming the connection in Kilo

The MCP Servers tab lists each server with its state. A needs_auth state raises a notification rather than failing silently. In the CLI, kilo mcp manages servers and /mcps toggles them for the session; /auto-approve changes approval behaviour there.

Tool calls surface in the Permission Dock, where Approve Always writes a rule for that tool. Tool keys are the server name and tool joined by an underscore, so a pattern for the WordPress server's read tools can be written by hand.

timeout on an entry is in milliseconds, 15 seconds by default for remote servers. A slow WordPress host may need more for the first tool list.

Signs it worked

The server shows connected in MCP Servers
No needs-auth notification remains
Approve Always is used for reads only
kilo mcp lists the same server

First task

A first Kilo task: plan a taxonomy cleanup

Ask for a plan, not edits. It checks the site's taxonomy before anyone restructures content.

Kilo Code promptReads only

Plan only. Use the WordPress MCP server, read only.

1. wppilot/list-taxonomies.
2. wppilot/list-terms for categories and tags.
3. Find tags used once and categories with no posts.
4. Propose a cleaner taxonomy as a plan.

Troubleshooting

Kilo Code errors and their causes

Symptom	Cause and fix
.kilocode/mcp.json changes do nothing	Current Kilo reads kilo.jsonc. Run the migration, or move the entry under mcp as type remote.
A sign-in starts for a token entry	Set "oauth": false on the entry; the header already authenticates.
{env:GOBUILDWP_TOKEN} arrives literally	The variable is not set in the environment Kilo started from.
Timeout while listing tools	Remote timeout defaults to 15,000 ms. Raise timeout on the entry.
A project server overrides the one you edited	Project kilo.jsonc wins over the global file. Check both.

Kilo Code past the plan

Carrying out a Kilo taxonomy plan on staging

The planning task produces a list of single-use tags and empty categories. Applying it is mostly reversible work with one irreversible step at the end, so the order matters. On a staging site set to Production Safe, have Kilo first rename or re-parent the terms that stay with wppilot/update-term, then move posts off the tags being merged with wppilot/assign-terms in add mode, and only then consider removing the leftovers.

That last step is the one to slow down. wppilot/delete-term permanently deletes a term, WordPress has no trash for terms, and the ability requires explicit confirmation for that reason. Posts assigned to a deleted term are not deleted with it, but the term itself cannot be brought back from the ledger. Ask Kilo to list exactly which term IDs it would delete and approve them in the Permission Dock one at a time instead of choosing Approve Always.

"Rename the categories from your plan with wppilot/update-term. Report each term ID and the old and new names."
"For each tag being merged, add the target tag to its posts with wppilot/assign-terms in add mode. Do not delete anything."
"List the tags that now have no posts. Stop there."

One kilo.jsonc per client project

Because a project's kilo.jsonc wins over the global file, an agency can keep each client's WordPress staging site pinned to that client's repository, with the server named after the site. The OAuth entry holds no secret, so it is safe to commit, and each developer signs in as their own WordPress user. For a token entry, keep {env:GOBUILDWP_TOKEN} in the committed file and the value in each person's environment, so rotating a token never means a commit.

Switch the site on only for the sessions that need it

A WordPress server that is always enabled puts its tools in front of the model in every Kilo session, including ones about unrelated code, and a model that sees a tool may reach for it. In the CLI, /mcps toggles servers for the current session, and the MCP Servers tab does the same in the extension. Leaving the WordPress entry off by default and enabling it when the task is about the site keeps both the context and the risk smaller.

Expect one re-authentication if Kilo goes unused for a while. GoBuildWP's OAuth access tokens last an hour and are renewed with a refresh token that lasts fourteen days, so after a longer gap Kilo shows the needs-auth notification again. That is the grant expiring as designed, not a broken server; sign in again from the notification.

Kilo Code and GoBuildWP Cloud

Kilo Code is not on the GoBuildWP Cloud list of tested OAuth apps. Cloud's general guidance is that any client with remote Streamable HTTP servers can use the Cloud link, signing in where the client supports OAuth and otherwise sending a personal access token as an Authorization header. Kilo's own OAuth handling should make the first route work, but that has not been checked here; the token route, with oauth set to false on the entry, is the predictable one if the sign-in does not start.

FAQ

Kilo Code questions

Does Kilo Code still read .kilocode/mcp.json?

Kilo's migration merges it into kilo.jsonc. The current MCP docs describe only kilo.jsonc, so treat the old file as legacy.

Does Kilo Code need mcp-remote for OAuth?

No. Kilo starts the OAuth flow itself when a remote server supports it, which GoBuildWP's OAuth endpoint does.

Can I move my Roo Code WordPress server to Kilo?

Yes. Kilo's Roo migration merges Roo's MCP settings into kilo.jsonc. Check the result is type remote and sign in again.

Does Kilo read opencode.json?

Kilo deep-merges legacy opencode.json files in its config locations, a sign of its shared lineage with OpenCode.

Roo Code: the archived extension Kilo migrates from
OpenCode: the same mcp key and type remote
Cline: the other Roo migration target

Every client guide (26)

Kilo Code documentation read on 29 September 2026

Write the WordPress server into kilo.jsonc.

A remote entry, a sign-in from the notification, and reads allowed by pattern.

Get GoBuildWP free See Pro pricing