Open-source terminal agent, Native OAuth

OpenCode WordPress MCP. A remote entry, and opencode mcp auth.

OpenCode WordPress MCP servers go under the mcp key in opencode.json, in the project root or ~/.config/opencode/opencode.json. A remote server is type remote with a url; when WordPress answers 401, OpenCode starts OAuth itself, and opencode mcp auth does it on demand.

Get GoBuildWP free Setup steps

Checked against OpenCode's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6

By GoBuildWPContent updated 12 October 2026How we check claims

opencode.jsonOAuth 2.1

{
  "mcp": {
    "gobuildwp-your-site-com": {
      "type": "remote",
      "url": "https://your-site.com/wp-json/mcp/wppilot-oauth"
    }
  }
}

Project config: opencode.json (highest precedence)
Global config: ~/.config/opencode/opencode.json
Sign in: opencode mcp auth <name>

Setup

Configure OpenCode for WordPress

OpenCode merges configuration with the project file on top, so a repository can bring its own site.

Add a remote entry
Under mcp, add the server as type remote with the OAuth URL, or use the token form shown here.
Sign in
Start OpenCode; the first 401 from WordPress triggers the OAuth flow. Or run opencode mcp auth with the server name. Credentials are stored in ~/.local/share/opencode/mcp-auth.json.
Check it
opencode mcp list shows servers and their auth state; opencode mcp debug with the name prints what went wrong.
Limit the tools
OpenCode warns that MCP servers add to context. A tools block with glob patterns, such as the server name followed by _* set to false, turns tools off globally, and agents can turn them back on individually.
Log out when done
opencode mcp logout removes the stored grant; revoke it in GoBuildWP's Connected Apps too.

Verify the connection before allowing changes

Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.

First connection checkRead Only

Use the gobuildwp-your-site-com MCP server in OpenCode. Do not change anything.

1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
   then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.

These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.

Troubleshooting

OpenCode errors and their causes

Symptom	Cause and fix
Tool list times out	The default is 5,000 ms. Raise timeout on the entry.
A browser opens for the token entry	Add "oauth": false so OpenCode does not start a flow the header does not need.
{env:GOBUILDWP_TOKEN} is empty	Export the variable before starting OpenCode.
Config in ~/.opencode is ignored	The global file is ~/.config/opencode/opencode.json.
The context fills up quickly	Disable the WordPress tools you do not need with a tools glob, or narrow abilities in GoBuildWP.

Connect screen

The OpenCode entries GoBuildWP writes

GoBuildWP's OAuth entry for OpenCode is a type remote server with the OAuth URL, so OpenCode runs the flow itself with dynamic registration. The token entry is type remote with url, enabled, headers and "oauth": false, which OpenCode's docs recommend for a server authenticated by a header. On a site the Connect screen sees as local, the OAuth entry is instead a local server that runs npx mcp-remote.

OAuth 2.1	type remote with the OAuth URL. The first 401 starts the sign-in; opencode mcp auth starts it by hand.
Access token	type remote with headers and "oauth": false. Use {env:GOBUILDWP_TOKEN} for the value, as shown beside it.
Application Password	A local entry running @automattic/mcp-wordpress-remote with the credentials in environment.

Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.

opencode.json, token without a sign-inToken from the environment

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "gobuildwp-your-site-com": {
      "type": "remote",
      "url": "https://your-site.com/wp-json/mcp/wppilot",
      "enabled": true,
      "oauth": false,
      "headers": {
        "Authorization": "Bearer {env:GOBUILDWP_TOKEN}"
      }
    }
  }
}

opencode.jsonAccess token

{
  "mcp": {
    "gobuildwp-your-site-com": {
      "type": "remote",
      "url": "https://your-site.com/wp-json/mcp/wppilot",
      "enabled": true,
      "oauth": false,
      "headers": {
        "Authorization": "Bearer wpp_YOUR-ACCESS-TOKEN"
      }
    }
  }
}

Inside OpenCode

OpenCode's commands and logs

opencode mcp auth list shows which servers hold credentials. Tool names are prefixed with the server name, which is how you target them in tools globs and per-agent settings.

Logs live in ~/.local/share/opencode/log (under %USERPROFILE% on Windows). Starting with --print-logs and --log-level DEBUG shows the MCP exchange live, including the HTTP status WordPress returned.

timeout on an entry is the time OpenCode waits for the tool list, in milliseconds, five seconds by default. That is short for a cold shared host; raise it before blaming the credential.

Signs it worked

opencode mcp list shows the server authenticated
Tools appear prefixed with the server name
The log shows no 401
Only the tools you enabled reach the agent

First task

A first OpenCode session

OpenCode sessions are terminal-first; keep the first one short and read-only.

OpenCode promptReads only

Use the WordPress MCP server and change nothing.

1. wppilot/connection-doctor: any warnings?
2. wppilot/security-audit: summarize the findings.
3. wppilot/list-extensions: plugins with updates.
Reply as a checklist.

OpenCode after the first checklist

Updating a plugin the audit flagged, staging first

The first OpenCode session ends with a checklist that usually includes plugins with pending updates. wppilot/security-audit reports hardening signals and outstanding updates; it is not a malware scan, so treat its list as a maintenance queue rather than a verdict. Updating is where an agent can do real damage, so it is worth seeing exactly how GoBuildWP treats it.

wppilot/update-plugin is available on Production Safe but always requires explicit confirmation, and it is not reversible through the change ledger because the previous version is not kept. The safe pattern in OpenCode is: on a staging copy, ask for wppilot/capture-page of the pages the plugin affects, run the update for one plugin and approve the confirmation yourself (with A person approves switched on in GoBuildWP's settings, the site waits for that approval instead of accepting the agent's own confirm flag), then ask for wppilot/verify-rendered-page and wppilot/site-health-tests. Only when those come back clean does the same update go to production, by whatever route your host uses for rollbacks.

"Which plugins does wppilot/list-extensions show with an update available? One line each with the installed and new version."
"Update only plugin X with wppilot/update-plugin. Stop and show me the confirmation request before running it."
"Now run wppilot/verify-rendered-page on the shop page and list any PHP errors that reach the visitor."

A dedicated OpenCode agent for site work

OpenCode prefixes every MCP tool with its server name, which makes it practical to hide the WordPress tools from the agents that write code and expose them to one agent kept for site work. Disable the server's tools with a glob in the main tools setting, then enable them for that agent only. Each conversation then has a clear scope: code agents cannot touch WordPress by accident, and the site agent's prompts can assume the tools are there.

The same split suits the access you give the site. Point the site agent at a token capped at Read Only for audit sessions, and keep the OAuth entry, signed in as a separate administrator account created for OpenCode, for the sessions where you intend to change something.

GoBuildWP confirmations and OpenCode permissions are different gates

When an ability needs explicit confirmation, GoBuildWP refuses the first call and expects the agent to come back with a confirmation flag set. That is a rule for the agent, not a dialog on your screen, so a model told to work without interruption could set the flag itself and carry on. OpenCode's permissions page, checked on 3 October 2026, lists permissions for its built-in tools such as edit and bash but does not describe ask rules for MCP tools, so do not count on OpenCode to stop that second call.

The dependable brakes are on the WordPress side and in what the agent can see. For sessions that should only inspect, use a token capped at Read Only, where the write never runs at all. For sessions that change the site, switch GoBuildWP's confirmation setting to A person approves, so a destructive or critical call waits for you to approve that exact call in wp-admin (or in the client, where it supports MCP elicitation) instead of passing on the agent's own flag. Enable only the write tools the task needs for the site agent, and check wppilot/list-changes afterwards for anything you did not expect. A prompt telling the agent to stop is a request, not a control.

OpenCode with GoBuildWP Cloud

OpenCode is not among the clients GoBuildWP Cloud has tested by name. Because OpenCode starts OAuth when a remote server answers 401, a type remote entry with the Cloud link should prompt a Cloud sign-in, after which you pick the sites it may reach; confirm that on your own setup before relying on it. A Cloud personal access token in the headers, with oauth set to false, is the fallback.

FAQ

OpenCode questions

Does OpenCode support OAuth for remote MCP servers?

Yes. It detects a 401, runs OAuth with dynamic client registration, and stores the credential. opencode mcp auth starts it manually.

When does GoBuildWP give OpenCode an npx entry?

For OAuth only on a site the Connect screen sees as local, where the mcp-remote bridge runs the sign-in from your machine, and for the Application Password route. On a public site the OAuth entry is type remote and needs nothing extra.

Where is OpenCode's config on Windows?

%USERPROFILE%\.config\opencode\opencode.jsonc, alongside the project-level opencode.json.

Can different OpenCode agents see different WordPress tools?

Yes. Disable the tools globally with a glob, then enable them per agent.

Kilo Code: reads opencode.json-style configuration
Factory Droid: another terminal agent with OAuth discovery
Zed: moved from the bridge to native OAuth too
ZCode (GLM): can import an OpenCode server from its MCP screen

Every client guide (26)

OpenCode documentation read on 29 September 2026

Run OpenCode against WordPress, remote and signed in.

A type remote entry, opencode mcp auth, and a tools glob that keeps context small.

Get GoBuildWP free See Pro pricing