Title: GripMCP – MCP Server for WordPress: Connect Claude & AI Assistants
Author: Akshay T.
Published: November 13, 2026
Last modified: November 13, 2026
---
Search plugins
# GripMCP – MCP Server for WordPress: Connect Claude & AI Assistants
By [Akshay T.](https://profiles.wordpress.org/akshay89/)
[Download](https://downloads.wordpress.org/plugin/gripmcp.1.0.0.zip)
* [Details](https://wordpress.org/plugins/gripmcp/#description)
* [Reviews](https://wordpress.org/plugins/gripmcp/#reviews)
* [Installation](https://wordpress.org/plugins/gripmcp/#installation)
* [Development](https://wordpress.org/plugins/gripmcp/#developers)
[Support](https://wordpress.org/support/plugin/gripmcp/)
## Description
[GripMCP](https://gripmcp.com/) turns your WordPress site into a Model Context Protocol(
MCP) server. Paste one address into your AI assistant, approve the connection, and
you can manage your site’s content with AI in plain language: write and edit posts,
upload images, organise categories and menus, moderate comments, look into errors,
and more. Paid plans add more tools for developers, agencies and stores.
The assistant never gets more power than the person who connected it. Every action
is checked against that WordPress user’s real role and capabilities, deletions wait
for your approval unless you choose otherwise, and the endpoint stays off until
you switch it on.
#### Connect in a minute
* **One address.** Your site answers at its own address followed by `/mcp`.
* **One-click connect.** In Claude, add a custom connector, paste the address,
sign in to WordPress and approve. No tokens or config files. This uses the standard
MCP authorization flow (OAuth 2.1 with PKCE and dynamic client registration),
so other MCP clients that support it connect the same way.
* **Access tokens** for config-file clients such as Claude Desktop or `mcp-remote`.
Make as many as you need: tokens are stored hashed, expire after 90 days unless
you choose otherwise, work only at the GripMCP endpoint, and can be revoked at
any time. WordPress Application Passwords work too.
* **You choose who can connect.** Administrators always can; other roles only when
you allow them.
#### What your assistant can do with the free plugin
* **Content:** list, read, create, update, edit in place and delete posts, pages
and custom post types; categories, tags and custom taxonomies; menus; comments;
custom fields; reading WordPress’s settings (changing them stays with you, in
Settings); revisions and restore.
* **Media:** upload from a link or a file in the chat, place images into a post
or set them as the featured image. On assistants that support in-chat panels,
you can drag images onto an upload panel right in the conversation, or open an
upload page when the chat cannot reach your site.
* **Users:** list users and their roles.
* **Safety:** deletions held for your approval, with a check of what they would
break; revisions to undo an edit.
* **Site health:** site health checks, the PHP error log, a record of recent crashes,
cron events, cache flushing (including Elementor and page-cache plugins such
as LiteSpeed Cache and WP Rocket), and a check of how any page renders.
* **Plugin abilities:** on WordPress 6.9 and later, discover and run the read-only
actions other plugins publish for AI clients through the WordPress Abilities
API, such as looking up orders, products or form entries. Actions that change
something stay on the plugin’s own screens.
* **Progress cards:** for requests that take several steps, one live card in the
chat with each step and the outcome.
#### With a paid plan
GripMCP Creator, Operator and Fleet are a separate plugin with more tools for developers,
agencies and stores, sold at [gripmcp.com](https://gripmcp.com/pricing/) and not
hosted on WordPress.org. Each plan includes the ones before it; the pricing page
compares them.
The Abilities tools appear on WordPress 6.9 and later. If tools are added after
you connect, for example by a WordPress update, reconnect GripMCP in your AI app
to load them; GripMCP tells the assistant.
#### Safe by default
* The endpoint is off until you switch it on, and it requires HTTPS.
* Every tool checks the connected user’s WordPress capabilities. GripMCP never
grants a capability the user does not already have.
* The assistant writes content, not code: a change that would add code such as
a script, an embedded frame, an event handler, a javascript: link or a block’s
custom CSS to a post or custom field is refused with the reason, even for an
administrator. Code already on your pages is kept as it is, and you can add code
yourself in the WordPress editor.
* Access keys work only on the GripMCP endpoint, not on the rest of the WordPress
API.
* Destructive actions (deleting posts, pages, media, comments, categories, tags
and menus, replacing a menu’s items, and removing a page-builder layout) are
set to “Ask me first” on a new install: each one waits for you to approve it
on a page in your own WordPress admin. Requests waiting for you are also listed
on the Approvals tab of the GripMCP screen, with a count on its menu item, so
a lost link never strands one. There is no way for an assistant to approve its
own request. Under Permissions you can switch them off entirely, or allow them
without asking.
* Before a destructive action is put up for approval, GripMCP checks what it would
break: a page that is your homepage or in a menu, an image used as the logo,
site icon or a featured image, a category that is the default one or still in
use. You see the findings with the request; high-risk ones recommend trying it
on a staging copy first and ask you to confirm before it runs.
* Credentials are protected: secret-looking options are refused, and passwords
and API keys inside other plugins’ settings (a payment gateway’s secret key,
an SMTP password) are shown to the assistant as “[redacted]”.
* A per-user rate limit, an activity log of your assistant’s tool calls, and a
connection diagnostics log for when a connector stops working.
#### In-chat progress cards
For requests that take several steps, assistants that support in-chat panels (the
MCP Apps standard) show one live card with each step and its result, then the outcome.
An assistant that declares the extensions it supports when it connects, and leaves
panels out of them, is not sent the card tools at all. Developers can switch off
the upload panel with the `gripmcp/in_chat_uploads` filter, and the cards with the`
gripmcp/progress_cards` filter.
#### External services
GripMCP contacts other servers only in these cases:
* **Freemius** (freemius.com), which sells and licenses the paid plans and, if
you opt in, collects usage data for GripMCP. After activation GripMCP asks whether
you want to opt in; skipping it sends nothing. If you opt in, Freemius receives
your name and email, your site’s address, title and language, your WordPress,
PHP and GripMCP versions, whether GripMCP is active or uninstalled, and the list
of your plugins and themes (you can untick this one on the opt-in screen), and
GripMCP checks in with Freemius once a day while you stay opted in. Freemius
is also contacted when you open the Upgrade page (it loads prices and the checkout,
with no details about your site), buy a plan or activate a licence, or send the
optional feedback form when you deactivate (anonymous by default). The Upgrade
page also loads Google’s analytics script ([privacy](https://policies.google.com/privacy)),
which records nothing because GripMCP offers no trial. See GripMCP’s [privacy policy](https://gripmcp.com/privacy-policy/)
and [terms](https://gripmcp.com/terms/).
* **WordPress.org** (api.wordpress.org): Site Health’s update check, the same request
WordPress itself sends. [Privacy policy](https://wordpress.org/about/privacy/).
* **A web address you or your assistant give**, to download a file into the Media
Library.
* **Your own site**, to load a page for the page-render check.
## Installation
1. Upload the `gripmcp` folder to `/wp-content/plugins/`, or go to Plugins Add New
Upload Plugin and choose the zip.
2. Activate GripMCP.
3. Open **GripMCP** in the admin menu and switch the endpoint on with the switch at
the top right. It saves as soon as you change it.
4. Copy the endpoint address from the **Setup** tab.
5. Connect your assistant:
6. * **Claude (web, desktop or mobile):** Settings Connectors Add custom connector,
paste the address, then sign in to WordPress and approve.
* **Config-file clients:** create a token under **Access** and use it as `Authorization:
Bearer `.
7. Choose what the assistant may do under **Permissions**.
The short `/mcp` address needs pretty permalinks (Settings Permalinks set to anything
but “Plain”). Without them the Setup tab shows the longer REST address instead,
ending in `?rest_route=/gripmcp/v1/rpc`, which works with any permalink setting.
## FAQ
### Which assistants work with GripMCP?
Any MCP client that supports the Streamable HTTP transport. Claude connects with
one click through a custom connector. Clients that read a config file connect with
an access token.
### Is it safe?
Every tool call runs as a WordPress user and is checked against that user’s capabilities,
exactly as wp-admin would check them. For the tightest control, connect as a dedicated
user with a limited role, and keep “Destructive actions” on “Ask me first” (the
default) or set it to “Off”.
### Does it send my data anywhere?
Only if you choose to. Usage data goes to Freemius only if you opt in after activation,
and Freemius is otherwise contacted only when you open the Upgrade page, buy a plan
or send deactivation feedback. The other services listed under “External services”
are contacted only when your assistant asks for that action.
### What is in the free plugin, and what do the paid plans add?
The free plugin (the Explorer plan) covers everyday site care: content, media, categories,
menus, comments, custom fields, the list of users, reading WordPress’s settings,
revisions, approvals for deletes, the debug log, site health and read-only plugin
abilities. No plan limits access tokens or connected apps. The paid plans are a
separate plugin with more tools for developers, agencies and stores, sold at gripmcp.
com, where the pricing page compares them. Each paid licence covers a set number
of sites.
### How do I move from a paid plan back to the free plugin?
You don’t have to: when a licence ends, the paid version keeps running with the
free plugin’s features. To switch to this free plugin, for its updates from WordPress.
org, install and activate it first (if WordPress offers to replace the copy you
have, accept), and only then delete the paid copy if it is still listed. Your settings,
connected apps and activity log carry over. Deleting GripMCP while no other copy
is installed removes all of them, and your assistant then has to connect again;
your site’s content is never touched.
### What does it store on my site?
Its settings, hashed access tokens, OAuth clients and tokens, an activity log of
tool calls (time, tool, user, result, duration and IP address: kept 3 days on the
free plan, 7 on Creator and 90 on Operator and Fleet, and up to 30 days longer after
a licence lapses), a connection log, page-builder restore points, approval requests
while they wait, the progress cards’ steps (kept 7 days), images uploaded through
the chat until they are added (2 hours at most), and a short list of recent PHP
fatal errors. Deleting the plugin from the Plugins screen removes all of it.
### Does it require HTTPS?
Yes, by default. On a site that is not served over HTTPS, the Setup tab shows a “
Require HTTPS” switch you can turn off for testing, but tokens sent over plain HTTP
can be intercepted.
### One-click connect does not work. What should I check?
Open **GripMCP Activity Connection diagnostics**. It lists every token issued
and every refused request with the reason. One-click connect needs HTTPS and a site
at the root of its domain, because the discovery documents must sit at `/.well-known/`.
If a security plugin blocks `.well-known` paths, allow them. Sites in a subdirectory
can connect with an access token instead.
### My host strips the Authorization header.
Some Apache and LiteSpeed setups drop it before PHP sees it, and then every app
is refused. When you open the GripMCP screen, your browser sends the site a test
request with the header, the way WordPress’s own Site Health checks it, and the
Setup tab warns you if it does not get through. To fix it, add this to the very
top of `.htaccess`:
```
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
```
### My site already uses the /mcp address.
Change GripMCP’s short address by adding `define( 'GRIPMCP_SHORT_PATH', 'ai' );`
to `wp-config.php` (any single word works), or set it to an empty string to turn
the short address off and use the longer REST address. Then copy the new address
from the Setup tab into your assistant.
### How do I report a problem?
Open **GripMCP Activity Report a problem** and describe what you were trying to
do and what happened. GripMCP writes a post around your description and adds what
is needed to look into it: your WordPress, PHP and plugin versions, your GripMCP
settings, what it noticed in its own logs, and the error lines from your site’s
PHP error logs.
With the free plugin, support is on the [GripMCP forum](https://wordpress.org/support/plugin/gripmcp/)
here on WordPress.org: click **Copy post**, then **Open the forum**, and paste it
into a new topic with the title shown above it. Forum posts are public, so read
it first and remove anything you would rather keep private; GripMCP leaves your
site address out of it. On a paid plan, GripMCP writes an email instead: click **
Copy email**, paste it into a new email to support@gripmcp.com with the subject
shown above it, and send it, or download it as a file and attach it.
Settings that stop every app from connecting, such as a switched-off endpoint, are
shown on the GripMCP screen next to their fix, so you may not need to write in at
all. The report is written to leave out passwords, tokens, email and IP addresses,
phone numbers, server folder names and your content, but read it before you send
it. The plugin never sends it: only you do.
### Which versions of WordPress and PHP does it support?
WordPress 6.2 or later, tested up to 7.1. PHP 7.4 or later, tested up to 8.5.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“GripMCP – MCP Server for WordPress: Connect Claude & AI Assistants” is open source
software. The following people have contributed to this plugin.
Contributors
* [ Akshay T. ](https://profiles.wordpress.org/akshay89/)
[Translate “GripMCP – MCP Server for WordPress: Connect Claude & AI Assistants” into your language.](https://translate.wordpress.org/projects/wp-plugins/gripmcp)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/gripmcp/), check out
the [SVN repository](https://plugins.svn.wordpress.org/gripmcp/), or subscribe to
the [development log](https://plugins.trac.wordpress.org/log/gripmcp/) by [RSS](https://plugins.trac.wordpress.org/log/gripmcp/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* Initial release.
## Meta
* Version **1.0.0**
* Last updated **3 days ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.2 or higher **
* Tested up to **7.1.4**
* PHP version ** 7.4 or higher **
* Tags
* [AI](https://wordpress.org/plugins/tags/ai/)[assistant](https://wordpress.org/plugins/tags/assistant/)
[Claude](https://wordpress.org/plugins/tags/claude/)[mcp](https://wordpress.org/plugins/tags/mcp/)
[model context protocol](https://wordpress.org/plugins/tags/model-context-protocol/)
* [Advanced View](https://wordpress.org/plugins/gripmcp/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/gripmcp/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/gripmcp/reviews/)
## Contributors
* [ Akshay T. ](https://profiles.wordpress.org/akshay89/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/gripmcp/)