Native editor, Native OAuth
Zed WordPress MCP. A remote context server, no bridge.
Zed WordPress MCP servers are context servers, configured under context_servers in settings.json and managed from Settings, AI, MCP Servers. Current Zed releases connect to a remote URL directly and run OAuth themselves, and GoBuildWP's entries for Zed now use that: a url, with headers only when you bring a token.
Checked against Zed's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6
{
"context_servers": {
"gobuildwp-your-site-com": {
"url": "https://your-site.com/wp-json/mcp/wppilot-oauth"
}
}
}- Settings
- ~/.config/zed/settings.json
- Windows
- %APPDATA%\Zed\settings.json
- Healthy
- Green dot: Server is active
Setup
Add WordPress as a Zed context server
The MCP Servers screen and settings.json edit the same data. Use the screen for adding, the file for reviewing.
Open MCP Servers
Settings, then AI, then MCP Servers, then Add Server and Add Remote Server. The command agent: open settings reaches the same place, and zed: open settings file opens the raw JSON.
Paste the url entry
Merge GoBuildWP's block into context_servers, or give Add Remote Server the same URL. A Zed build that predates remote servers cannot load it; update Zed rather than reaching for a bridge.
Authenticate
A remote server without an Authorization header gets an Authenticate button. Zed identifies itself with its published client metadata, falls back to dynamic registration, and keeps the token in the system keychain.
Confirm the dot is green
Back on MCP Servers, the WordPress row should show a green indicator whose tooltip reads Server is active. Any other state is a connection problem to fix before prompting.
Keep tool permissions on confirm
agent.tool_permissions.default set to confirm makes the agent ask before each call. Per-tool rules use mcp:<server>:<tool> keys when you later want reads to run freely.
Verify the connection before allowing changes
Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.
Use the gobuildwp-your-site-com MCP server in Zed. Do not change anything.
1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.
First task
A first Agent panel prompt
Zed is often used on a theme repository. This prompt checks the site's design tokens against the editor's view and writes nothing.
Use the WordPress context server. Change nothing.
1. wppilot/get-active-design: the active design
system's colours and type.
2. wppilot/check-contrast on that palette.
3. List any pair below WCAG AA, and where in this
repository's CSS each colour is defined.Connect screen
GoBuildWP's Zed entries
On a public site GoBuildWP's OAuth entry for Zed is a context server holding only url, the OAuth endpoint; with no Authorization header Zed runs the sign-in itself. The token entry is the same url shape with a headers object, and Zed then skips its OAuth prompt. Neither carries the retired source field, and neither needs Node.js. Only the Application Password entry, and the OAuth entry on a site the Connect screen sees as local, start a process through npx.
| OAuth 2.1 | url alone under context_servers. Zed shows an Authenticate button and keeps the token in the system keychain. |
|---|---|
| Access token | url plus headers with the Bearer value. No sign-in step. |
| Application Password | The npx @automattic/mcp-wordpress-remote entry with credentials in env, as command, args and env under context_servers. |
Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.
{
"context_servers": {
"gobuildwp-your-site-com": {
"url": "https://your-site.com/wp-json/mcp/wppilot",
"headers": {
"Authorization": "Bearer wpp_YOUR-ACCESS-TOKEN"
}
}
}
}Inside Zed
Reading Zed's indicators and logs
The indicator on MCP Servers is the first check; Server is active means Zed connected and listed tools. For anything else, zed: open log shows the editor log, where a failed OAuth exchange or a 401 from WordPress is recorded. On Windows the file is under AppData\Local\Zed\logs.
Zed separates availability from approval. Agent profiles decide which servers and tools a conversation can use, through context_servers.<name>.tools in the profile, and tool permissions decide whether each call asks. Keep both narrow while validating.
Zed supports MCP tools and prompts. GoBuildWP's abilities are tools, so everything the site exposes is usable; there is simply no resources panel for it to fill.
Signs it worked
- The WordPress row shows Server is active
- The Agent profile includes the server's tools
- Calls ask for confirmation
- zed: open log shows no auth errors
Troubleshooting
Zed errors and their causes
| Symptom | Cause and fix |
|---|---|
| The row never turns green with the Application Password entry | That entry runs npx, so Node.js has to be on Zed's PATH. Install it, or switch to the OAuth or token url entry, which needs nothing else. |
| No Authenticate button appears | The entry already has an Authorization header, which tells Zed a token handles authentication. Remove the header to let Zed run OAuth. |
| An older entry is rewritten when Zed starts | Zed's settings migration removes the retired source field that older guides, and older GoBuildWP releases, added. The entry keeps working without it. |
| Tools are listed but the agent never uses them | The active Agent profile excludes the server. Add its tools to the profile. |
| Timeout on a slow host | context_server_timeout defaults to 60 seconds. Raise it, or a per-server timeout, then check the site's response time. |
Related
Related guides
- Cursor: a JSON config with a one-click install
- OpenCode: another client that moved from the bridge to native OAuth
- OAuth setup: what GoBuildWP advertises to clients like Zed
Zed documentation read on 29 September 2026
Beyond the green dot
Fixing a contrast failure Zed found
The first Agent panel prompt ends with a list of colour pairs that fail and where each colour is defined in the repository. Where the colour lives in the theme's CSS, the fix belongs in the code Zed already has open: edit it, deploy to staging, and ask the agent to confirm with wppilot/verify-rendered-page, which reports the colours and fonts the served HTML actually carries once the theme, plugins and cache have had their say. Run wppilot/check-contrast again on the new values to close the loop.
Where the colour comes from the site's active design system rather than the theme files, stop and decide by hand. Saving or activating a design changes the design contract GoBuildWP gives agents for later pages, not the pages already rendered; the colours visitors see change only when a theme, builder kit or page is written with the new values. Try that write on staging with the site set to Production Safe, and read the result in a browser before repeating anything on production.
A WordPress-only Agent profile
Zed lets a profile choose which servers and tools a conversation may use. A profile that includes only the WordPress context server's read abilities, and leaves file editing in the repository to a separate profile, makes it obvious in each thread which side the agent can touch. Combined with tool permissions left on confirm, a slip in one conversation cannot quietly reach the other.
If you later allow some calls to run freely with mcp:<server>:<tool> rules, allow reads only. Writes to WordPress should keep asking even when the site's profile would let them through, because Zed's confirmation is the moment you see the arguments before the site does.
Local sites, Cloud, and which entry to keep
For a site on your own machine, GoBuildWP gives Zed the npx bridge, which runs the sign-in locally and needs Node.js on Zed's PATH. Zed also accepts command-based context servers, so GoBuildWP's WP-CLI route, wp wppilot mcp serve with --path and --user, should fit as well when WordPress runs where Zed does; that combination has not been tested here, so confirm one read before relying on it.
For public sites, Zed is among the apps that can sign in to the optional GoBuildWP Cloud: one context server with the Cloud link as its url, one Authenticate click, and the sites you allow. A direct url entry per site is the choice when you want nothing between Zed and WordPress, and it is also the entry to keep for a site you are the only person working on, since there is no account to maintain.
FAQ
Zed questions
Does Zed support remote MCP servers without mcp-remote?
Yes. Zed added remote context servers in late 2025 and native MCP OAuth in 2026. A url entry connects directly and prompts to authenticate when no Authorization header is set.
Does GoBuildWP still generate an npx entry for Zed?
Only for the Application Password route, and for OAuth on a site the Connect screen sees as local, where the bridge runs the sign-in from your machine. On a public site the OAuth and token entries are native url entries.
Where is Zed's settings file on Windows?
%APPDATA%\Zed\settings.json. On macOS and Linux it is ~/.config/zed/settings.json.
Can Zed auto-approve WordPress reads?
Yes, with per-tool rules in agent.tool_permissions using mcp:<server>:<tool> keys. Keep writes on confirm.
Connect Zed to WordPress without the bridge.
A url entry, one Authenticate click, a green dot, and permissions left on confirm.