Hosted agent, Hosted, public HTTPS
Manus WordPress MCP. A custom server, reached from Manus's cloud.
A Manus WordPress MCP connection is opened from Manus's own infrastructure, not from your computer. That makes it good at long, unattended WordPress jobs, and it means the site has to answer over public HTTPS. When you save the server, Manus checks it can connect and lists the tools it found.
Checked against Manus's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6
Name gobuildwp-your-site-com
Transport HTTP
Server URL https://your-site.com/wp-json/mcp/wppilot-oauth
Client credentials (leave empty)- Add in
- Settings, custom MCP servers
- Transport
- HTTP
- Reaches your site from
- Manus's servers
Setup
Add WordPress to Manus
Manus has moved this screen between releases. Its documentation names it Custom MCP Servers under Integrations, while GoBuildWP's steps and Manus's help center use Connectors wording. Look for the option to add a custom MCP server by URL.
Check the site from outside
Check unauthenticated discovery or status for the exact generated endpoint and canonical host, then perform one authorized read. A protocol endpoint need not render a web page. Diagnose DNS, TLS and WAF failures from the actual response.
Open custom MCP servers
In Manus, open Settings, then the integrations or connectors area, and choose to add a custom MCP server. GoBuildWP's walkthrough calls the form Direct configuration.
Name it and paste the URL
Use the server name GoBuildWP suggests, keep the transport on HTTP, and paste the OAuth URL. Leave client credentials empty.
Sign in to WordPress
After Manus verifies the server it asks you to authorize. Sign in on your own site as a dedicated administrator account created for Manus; GoBuildWP only accepts connections from users with manage_options. Keep the job narrow with the site's safety profile and the abilities you leave enabled, or use an access token limited to chosen abilities.
Read the tool list before the first task
Manus shows the tools it retrieved. If the list is shorter than you expect, the safety profile or the user's role is hiding abilities, which is the site working as intended.
Verify the connection before allowing changes
Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.
Use the gobuildwp-your-site-com MCP server in Manus. Do not change anything.
1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.
Inside Manus
Knowing what a hosted agent did on your site
Manus verifies the connection when you save and lists the retrieved tools on the server's entry, so a failure shows up immediately rather than mid-task. A server that saves but lists no tools usually signed in as a user whose role or GoBuildWP profile exposes nothing.
Because Manus works unattended, the record that matters is on the WordPress side. GoBuildWP's change ledger lists every write with the ability, the WordPress user and the connected app, and supported changes can be rolled back from it. Read it after the first real job; wppilot/list-changes returns the same list to any connected client.
Manus's documentation lists API keys and Bearer tokens among the authentication options for custom servers, and GoBuildWP's Connect screen now writes token steps for it. A token suits one service account shared by a team; give it an expiry and only the abilities the jobs need. For a single person, OAuth keeps the grant revocable from Connected Apps without touching other connections.
Signs it worked
- Manus verified the server and listed its tools
- The authorization screen was on your own domain
- Dedicated identity meets GoBuildWP connection authority; scope and profile permit only intended reads
- No new writes in the ledger are attributable to this read-only test session
First task
A first job that shows how Manus plans
Manus breaks work into steps and runs them without waiting for you. Give it a read-only research task, then compare its report with what you see in wp-admin.
Using my WordPress MCP server, do not create, edit
or delete anything.
Audit the site's published content: run
wppilot/audit-content, then wppilot/audit-media-alt.
Group the findings into broken links, missing alt
text and thin pages. For each group, list the five
most important items with their WordPress IDs.Troubleshooting
Manus errors and their causes
| Symptom | Cause and fix |
|---|---|
| Manus reports that it could not connect | The URL is not reachable from the internet over HTTPS. Localhost, private IPs, VPN-only staging and sites behind HTTP basic auth all fail. |
| Sign-in never starts | One possible cause is client credentials typed into the form; clear them so Manus registers itself against the site, then save again. If the fields were already empty, check the error Manus shows and whether the site's /.well-known OAuth paths answer from outside. |
| The tool list is empty after sign-in | The connected WordPress user can see nothing under the current profile. Check the profile and the enabled abilities before raising the role. |
| A long task stops halfway with an authorization error | The access token expired and the refresh was refused, often because the grant was revoked in Connected Apps or the site's clock drifted. Re-authorize and check server time. |
| Your security plugin blocked Manus | Requests come from Manus's cloud, not your IP. Allow the MCP route and the /.well-known OAuth paths rather than whitelisting a single address. |
Connect screen
The Manus entries GoBuildWP writes
GoBuildWP generates two sets of steps for Manus. The OAuth steps give a server name, the OAuth URL, HTTP as the transport, and the instruction to leave any OAuth client id and secret empty so the site's own registration is used. The access-token steps give the canonical URL and the Bearer token, or an Authorization header with the same value if the form asks for a header instead. On a local or private site, the Connect screen replaces the OAuth steps with a notice, because Manus cannot reach it.
| OAuth 2.1 | The recommended route. Manus runs the sign-in against your site after it verifies the URL. |
|---|---|
| Access token | Manus's custom-server documentation lists Bearer tokens, so GoBuildWP offers one: choose the Bearer option and paste the token. Manus's page does not name the dialog's fields, so the steps stay general about them. |
Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.
Server URL https://your-site.com/wp-json/mcp/wppilot
Authentication Bearer token
Token wpp_YOUR-ACCESS-TOKENRelated
Other agents that run in the cloud
- Perplexity: research-first, with a custom remote connector
- OpenClaw: a self-hosted alternative that can reach private sites
- Undo and rollback: what the ledger can reverse after an unattended job
Manus documentation read on 29 September 2026
FAQ
Manus questions
Can Manus connect to a WordPress site on localhost?
No. Manus calls the site from its own servers, so the endpoint has to be public and served over HTTPS. GoBuildWP's Connect screen shows a notice instead of steps when it detects a local site.
Can I give Manus an Application Password instead?
GoBuildWP does not generate one for Manus. Use OAuth, or a GoBuildWP access token with the Bearer option, which can be limited to chosen abilities and given an expiry.
What stops Manus from doing more than I asked?
The WordPress user's capabilities, the GoBuildWP safety profile, the per-ability switches and, for an access token, its ability list and ceiling. Destructive and critical calls need confirmation, but by default the agent supplies that flag itself; for a person to approve them, turn on A person approves in GoBuildWP's settings, or Pro's approval queue. Manus's plan decides what it tries; the site decides what succeeds.
How do I see what Manus changed?
Open GoBuildWP's change ledger in wp-admin, or ask any connected client to call wppilot/list-changes. Each entry names the ability and the connection, and supported changes can be rolled back.
Let Manus work unattended, inside limits you set.
A public HTTPS site, a dedicated account for Manus, and the change ledger open after its first job.