● Open Source v1.0.0 | Native Streamable HTTP MCP Server

Connect WordPress Directly to Claude, Cursor, Grok & Codex

The tools run on your WordPress site. Clients call wp-json/onemcp/v1/mcp with an application password. The free plugin manages posts, pages, media, comments, terms, menus, plugins, themes, and users. OneMCP Pro adds page builders, SEO, SMTP, cache, WooCommerce, Easy Digital Downloads, and backups.

Download Free Version view plans

Pro Integrations

Core Abilities

Cloud Relays (100% Private)

AI Client Setups

onemcp terminal session • wp-json/onemcp/v1/mcp

Active Session

Click an interaction to simulate:

MCP JSON-RPC Response 200 OK

Logged to wp_onemcp_log. WordPress core tools start on. Other write tools stay off until an administrator enables them.

Universal AI Compatibility

Connect Any AI Client in 60 Seconds

Open OneMCP, then Connection. Generate an application password and copy the snippet for your client. Every client talks to this site over streamable HTTP.

Terminal Command

OneMCP Pro

WordPress, plus 30 plugins

The free plugin includes WordPress. OneMCP Pro adds a plugin only when that plugin is active. Every ability is written in plain words on the integrations page. Passwords, API keys, and CDN tokens are left out of every response.

Divi

Yoast SEO $Rank Math logo$ Rank Math

Easy Digital Downloads

Backuply

Duplicator

See what each plugin can do

How It Works

WordPress runs the tools

The AI client calls your site directly. There is no hosted relay. OneMCP checks the WordPress user, runs the ability, and writes a row to the activity log.

AI Assistant

You prompt Claude, Cursor, Grok, or Codex in natural language, for example "Update the home page headline".

Streamable HTTP

Standard JSON-RPC call is dispatched directly to wp-json/onemcp/v1/mcp using Basic Auth.

Abilities & Safe Mode

WordPress verifies user capabilities, enforces read/write permissions, and records the action in Audit Log.

Live Site Update

WordPress, or a Pro integration such as a page builder or WooCommerce, runs the change and returns JSON.

Free plugin

WordPress abilities

These 26 abilities ship with the free plugin. They start on, and you can turn any of them off. The full list for every plugin is in the documentation.

Get site info. Site name, address, WordPress version, theme, active integrations, and the MCP endpoint.
List content. Posts, pages, and other public content, filtered by status or search.
Get content. One post or page, including the body when you ask for it.
Create content. A new post or page. It stays a draft unless a status is set. A visual layout uses the page builder.
Update content. Title, body, excerpt, or status of one post or page.
Trash content. Moves one post or page to the trash.
List media. Files in the media library.
Get media. One file, with its URL and alt text.
Update media. Title, caption, or alt text of one file.
Add media from a URL. Downloads a public file into the media library.
List terms. Categories, tags, or terms from another taxonomy.
List comments. Comments on the site, or on one post.
Moderate a comment. Approves, holds, marks as spam, or trashes one comment.
List plugins. Installed plugins and which ones are active.
List themes. Installed themes and the active theme.
List users. Accounts on the site. Passwords and sessions are left out.
List taxonomies. Public taxonomies such as categories and tags.
Create a term. A category, tag, or other term.
Update a term. Name, slug, or description of one term.
Set content terms. Replaces the categories or tags on one post.
Get content meta. Custom fields on one post. Passwords, tokens, and API keys are left out.
Update content meta. Sets or clears one custom field. Secret keys are refused.
List menus. Navigation menus.
List menu items. The links in one menu.
Create a menu. An empty navigation menu.
Add a menu item. A custom link on a menu.

Transparent Pricing

Choose Your Plan

Start with the free MCP server and WordPress core tools, or add OneMCP Pro for builders, SEO, mail, cache, stores, and backups.

Free Version

The open-source MCP server and 26 WordPress core tools for individual websites.

$ 0 / forever

For 1 Site (Open Source)
Streamable HTTP endpoint at onemcp/v1/mcp
26 WordPress tools for content, media, comments, menus, and the site
WordPress Application Password authentication
Safe Mode defaults with per-ability switches

Download Free

Personal

Unlock all 30 Pro integrations for a single personal or business WordPress site.

$ 39 / year

For 1 Sites
All Free Features Included
All 30+ Pro Plugin Integrations
Page Builders, SEO, SMTP, Caching, Stores
Backuply & Duplicator Automation
2,000 log entries + CSV export
Priority Email Support

Get Personal

Frequently Asked Questions

How OneMCP connects, what stays on by default, and which tools need Pro.

Does OneMCP send site data through a hosted service?

No. The client calls wp-json/onemcp/v1/mcp on your WordPress site over HTTPS. WordPress runs the tool. OneMCP does not forward those calls through a hosted relay.

Can an AI model accidentally break or delete my site?

WordPress core tools, including content writes, start enabled. You can turn any of them off. Page builder, SEO, SMTP, cache, store, and backup writes stay off until an administrator enables them on the Abilities screen. Every call still checks the WordPress user's capability, and the activity log records it.

How does authentication work?

The plugin integrates seamlessly with native WordPress Application Passwords. You can generate a dedicated application password with 1 click in the plugin admin. All requests authenticate over standard HTTP Basic Auth, enforcing native WordPress capability checks (e.g. manage_options, edit_posts, manage_woocommerce).

Which AI clients and IDEs are supported?

The connection screen writes a snippet for Claude Desktop, Grok, Codex, Cursor, VS Code, Windsurf, OpenCode, Antigravity, and Gemini CLI. Any other client that accepts an HTTP MCP server and an Authorization header can use the same endpoint.

What happens if my site runs on plain HTTP (local staging)?

WordPress core typically disables Application Passwords on non-SSL environments. OneMCP includes a built-in safety filter (wp_is_application_passwords_available) to enable Application Passwords in local development environments (like LocalWP, Docker, or dev servers) while warning you when deploying to production without HTTPS.