Title: HandyMCP: MCP Server for Claude, ChatGPT and AI Agents Author: Sukesh Published: October 18, 2026 Last modified: October 26, 2026 --- Search plugins ![](https://ps.w.org/handymcp/assets/banner-772x250.png?rev=3753203) ![](https://ps.w.org/handymcp/assets/icon-256x256.gif?rev=3766942) # HandyMCP: MCP Server for Claude, ChatGPT and AI Agents By [Sukesh](https://profiles.wordpress.org/sukeshbd24/) [Download](https://downloads.wordpress.org/plugin/handymcp.1.0.5.zip) * [Details](https://wordpress.org/plugins/handymcp/#description) * [Reviews](https://wordpress.org/plugins/handymcp/#reviews) * [Installation](https://wordpress.org/plugins/handymcp/#installation) * [Development](https://wordpress.org/plugins/handymcp/#developers) [Support](https://wordpress.org/support/plugin/handymcp/) ## Description **HandyMCP (Handy MCP) turns your WordPress site into an MCP server**, so AI apps like Claude, ChatGPT, Cursor, GitHub Copilot, Windsurf and Gemini CLI can work on your site for you. Ask in plain words: “write a post about our new service”, “build a landing page in Elementor”, “put the hoodies on sale”. HandyMCP does the clicking, inside the permissions you choose, and site edits can be undone in one click. MCP (Model Context Protocol) is the open standard AI apps use to connect to other software. Your site is the server: there is no HandyMCP account, no relay service and no usage quota. The AI app talks to your site directly and can never do more than your WordPress user is allowed to. #### A free WordPress MCP plugin for Claude, ChatGPT and AI agents HandyMCP is a free WordPress MCP server. Connect Claude (including Claude Code), ChatGPT, Cursor or another AI agent once, then ask it to write and update posts, build Elementor and block editor pages, fix SEO titles, add stock photos with alt text or update WooCommerce products. It also works as a WooCommerce MCP for your store and an Elementor MCP plugin that uses your real Elementor widgets, so you can keep editing the page by hand. No copying and pasting between tabs, and no extra AI subscription. #### Why HandyMCP Most MCP plugins give an AI app a way in. HandyMCP also gives you the controls to trust it on a real site: * **No usage caps.** No daily caps, no credits and no per-call fees. Only per-minute rate limits, which you set. * **No relay, no vendor account.** The MCP server is plain PHP running on your own site. AI apps connect to your site directly, so there is no hosted middleman, no sign-up and no usage fee. Your content never passes through our servers. * **Undo built in.** Before a tool changes a post, page, term, menu item or product, HandyMCP records how it was. Undo it from the dashboard, or ask the AI. * **Permissions you control.** Turn groups of tools off, make them read only, or switch off single tools. Permanent deletes need an explicit confirmation. * **Live pages stay safe.** “Make a new version” creates a draft. A published page is only replaced when you clearly ask. * **Native page builder editing.** Elementor and Gutenberg pages are built with their own widgets and blocks, so you can keep editing them by hand. * **Everything logged.** The Activity screen lists every request, the app that sent it and the page it touched. #### What the AI can do in the free version * **Posts and pages:** list, read, search, create, edit, duplicate, schedule, trash and restore. Small text edits without resending the whole page. * **Block editor (Gutenberg):** read blocks, insert, update and remove blocks, or build a whole page in one step. * **Elementor:** list the widgets on your site (including addon packs such as ElementsKit, Happy Addons and Essential Addons), build and edit pages, change single elements, save templates and update global colors and fonts. * **WooCommerce (basic):** list and read products, change titles, descriptions, prices, sale prices and stock, manage product categories, create and edit coupons, see low stock, and read orders. * **Contact forms:** create and edit forms in Contact Form 7 and WPForms. Read forms and entries from Gravity Forms, Fluent Forms, Forminator, Formidable, Ninja Forms, MetForm and JetFormBuilder. * **Media and stock photos:** upload images from a URL or straight from your ChatGPT chat, resize and convert them to WebP as they upload, crop, rotate and flip images, rebuild thumbnails, replace an image file while keeping its URL (with a backup to restore), write alt text and captions, add SVG icons, and search free photos on Openverse (or Pexels and Unsplash with a free key). * **Clear crash reports:** when another plugin or theme crashes during a change, HandyMCP names it, tells the AI to check the result before trying again, and shows you a notice. * **Menus, categories and tags:** create and edit menus and items, assign menu locations, create terms. * **SEO:** find pages missing an SEO title or description, then set titles, meta descriptions and focus keywords with Yoast SEO or Rank Math. * **Undo:** the last 20 changes, from the dashboard or by asking the AI. * **Site brief:** write your brand voice, words to use and avoid, call to action and house rules once. Every connected AI app reads them before it writes anything. #### Works with any MCP app Claude (web, desktop, mobile and Claude Code), ChatGPT (developer mode connectors), Cursor, VS Code with GitHub Copilot, Windsurf, Gemini CLI, Zed, Cline and any app that supports remote MCP servers over HTTP. The Connection screen shows step by step setup for more than 20 apps. #### Example prompts * “Build a landing page for my webinar with Elementor as a draft, using my brand colors.” * “Write SEO titles and meta descriptions for every page that is missing one.” * “Find images without alt text and describe them.” * “Which products are low on stock? Raise the price of the blue hoodie to 39.” * “Create a contact form with name, email, budget and message, and add it to the Contact page.” #### Safe by design * Sign in with OAuth 2.1 and a clear approval screen (used by Claude and ChatGPT), personal access tokens, or WordPress Application Passwords. * Only the user roles you allow can connect. Each app only gets the scopes you approve. * Read-only mode lets AI apps look without changing anything. * Destructive actions such as permanent deletes need confirmation. * You decide who gets in. Connecting an AI app means you let that app act on the site as your WordPress user, inside the permissions you approve. The approval screen says so, and you can disconnect any app at any time. * No tool runs arbitrary PHP, SQL or shell commands. * No site administration: AI apps cannot install, activate, update or delete plugins or themes, manage users, change core settings or edit files. During an AI request these capabilities are removed from the connected user, even for administrators. * Passwords and API keys are never logged. Rate limits stop runaway loops. #### HandyMCP Pro [HandyMCP Pro](https://handymcp.com/#pricing) adds full WooCommerce (orders, refunds, coupon rules, variations, reports), WPBakery, Divi, Beaver Builder, Avada and Flatsome( UX Builder, header, footer and theme options), Elementor Pro Theme Builder, Gravity Forms editing, safe plugin and theme updates with automatic rollback, scheduled updates, malware scan and cleanup, file edits with automatic restore, backups, translation and custom field plugins, full undo history and white label. It also adds WP-CLI style commands (no shell needed), a block theme builder with a private preview, safe PHP snippets in WPCode and Code Snippets, and full Wordfence control. The Agency plan adds a client sites hub to update and manage many sites from one place. Moving to Pro keeps your connected apps, settings and history. [Documentation](https://handymcp.com/docs/) | [Prompt library](https://handymcp.com/prompts/) | [Support](https://wordpress.org/support/plugin/handymcp/) ### External services HandyMCP works on your own server. It only contacts outside services in these cases: * **Openverse** (stock photo search). When an AI app uses the images_search tool, the search words, orientation and number of results are sent to the Openverse API (api.openverse.org). No personal data is sent. Openverse is run by WordPress. org. [Terms](https://docs.openverse.org/terms_of_service.html), [Privacy](https://wordpress.org/about/privacy/). * **Pexels** (optional). Only when you add a Pexels API key in Settings > Photos: the search words and your key are sent to the Pexels API (api.pexels.com) during images_search and videos_search, and videos_add downloads the chosen video from Pexels. [Terms](https://www.pexels.com/terms-of-service/), [API terms](https://www.pexels.com/api/documentation/#guidelines), [Privacy](https://www.pexels.com/privacy-policy/). * **Unsplash** (optional). Only when you add an Unsplash access key in Settings > Photos: the search words and your key are sent to the Unsplash API (api.unsplash. com) during images_search. [Terms](https://unsplash.com/terms), [API guidelines](https://help.unsplash.com/en/articles/2511245-unsplash-api-guidelines), [Privacy](https://unsplash.com/privacy). When an Unsplash photo is added to the media library, the site also calls that photo’s Unsplash download link, as the Unsplash API guidelines require. * **Image and file downloads.** When an AI app adds an image or uploads media from a URL (images_add, wp_upload_media), your site downloads that file from the address the AI app gives, usually the image service above. Only the file is requested. * **Anonymous error reports (optional, off by default).** HandyMCP asks once whether you want to share them, and nothing is sent unless you choose Yes. You can turn it off any time in Settings. Once a day, and soon after the connection check finds a problem, a short report is sent to handymcp.com (handymcp.com/wp-json/ sdl/v1/errors): which tools failed, the error messages with addresses, emails, keys and numbers removed, the type of AI app, connection check results, a one- way hash of your site (not its address), and your WordPress, PHP, theme and active plugin versions. No content, users, customers, IP addresses or keys are sent. Reports are kept for one year. [Terms](https://handymcp.com/terms/), [Privacy](https://handymcp.com/privacy-policy/). * **AI app sign-in.** When an AI app connects with OAuth and identifies itself with a client metadata URL (part of the MCP authorization standard), your site reads that public document from the app’s own website to show its name and check its return address. No site data is sent. The connection check in HandyMCP > Connection only calls your own site. It runs when you open that screen and also once a day in the background (WP-Cron), and it never contacts anyone else. HandyMCP has no license checks, no tracking without your consent and no update server of its own; updates come from WordPress.org. **Privacy and your AI app.** HandyMCP does not send your content anywhere by itself. The AI app you connect (for example Claude or ChatGPT) receives what it reads through its own connection, such as posts, pages, products, orders and form entries, and handles it under that app’s own terms and privacy policy. Contact details in orders and form entries (such as email addresses and phone numbers) are masked by default, and passwords and API keys are never returned. You choose which abilities each app may use in HandyMCP > Abilities. ## Screenshots [⌊Connection: copy the server URL, follow the steps for your AI app, and see connected apps, access tokens and recent sessions.⌉⌊Connection: copy the server URL, follow the steps for your AI app, and see connected apps, access tokens and recent sessions .⌉[ Connection: copy the server URL, follow the steps for your AI app, and see connected apps, access tokens and recent sessions. [⌊Abilities: choose what AI apps may read and change, group by group or one ability at a time, with a How this works link for each group.⌉⌊Abilities: choose what AI apps may read and change, group by group or one ability at a time, with a How this works link for each group.⌉[ Abilities: choose what AI apps may read and change, group by group or one ability at a time, with a How this works link for each group. [⌊Activity: every request from AI apps, newest first, with the page it touched and the app that made it.⌉⌊Activity: every request from AI apps, newest first, with the page it touched and the app that made it.⌉[ Activity: every request from AI apps, newest first, with the page it touched and the app that made it. [⌊Changes: see what each AI change did and undo it, grouped by task, so you can undo a whole task or a single change.⌉⌊Changes: see what each AI change did and undo it, grouped by task, so you can undo a whole task or a single change.⌉[ Changes: see what each AI change did and undo it, grouped by task, so you can undo a whole task or a single change. [⌊Settings: turn the server, OAuth sign-in and read-only mode on or off, write a site brief, add photo keys and set limits.⌉⌊Settings: turn the server, OAuth sign- in and read-only mode on or off, write a site brief, add photo keys and set limits .⌉[ Settings: turn the server, OAuth sign-in and read-only mode on or off, write a site brief, add photo keys and set limits. [⌊Site brief: tell AI apps your brand voice, words to use and avoid, and rules they must follow on every page they create or change.⌉⌊Site brief: tell AI apps your brand voice, words to use and avoid, and rules they must follow on every page they create or change.⌉[ Site brief: tell AI apps your brand voice, words to use and avoid, and rules they must follow on every page they create or change. [⌊Upgrade: what the free plugin includes and what HandyMCP Pro adds.⌉⌊Upgrade: what the free plugin includes and what HandyMCP Pro adds.⌉[ Upgrade: what the free plugin includes and what HandyMCP Pro adds. ## Installation 1. In your dashboard go to Plugins > Add New, search for “HandyMCP”, then install and activate it. Or upload the ZIP under Plugins > Add New > Upload Plugin. 2. Open HandyMCP > Connection and copy the server URL. 3. Pick your AI app in the list on that screen and follow the steps. For Claude: Settings > Connectors > Add custom connector, paste the URL, then approve the connection on your site. Your site must be reachable over HTTPS for Claude and ChatGPT to connect. ## FAQ ### Which AI apps work with HandyMCP? Any app that supports remote MCP servers over HTTP, including Claude (web, desktop and Claude Code), ChatGPT connectors, Cursor, VS Code, Windsurf and others. The Connection screen shows the steps for each app. There is no list of approved apps: any MCP client can connect with OAuth (with automatic app registration), a personal access token or a WordPress Application Password, and you approve each one. ### Do I need an account or API key? No. You only need your own subscription to the AI app you want to use. The optional Pexels and Unsplash keys only improve stock photo search. ### Is there a usage limit? No. There are only per-minute rate limits, which you can change in Settings. ### Can the AI run PHP code or SQL? No. There is no tool for arbitrary code, shell commands or database queries. ### Can the AI manage plugins, themes or users? No. HandyMCP only works with content: posts, pages, media, menus, categories and tags, products, forms and SEO fields. While an AI request runs, the connected user has no plugin, theme, user, core update, file editing, import/export or unfiltered HTML capabilities, whatever their role. All requests go straight from the AI app to your own site; there is no HandyMCP server in between. ### Does it work with WooCommerce? Is it a WooCommerce MCP server? Yes. The free version can read and edit products, prices, stock, categories and coupons, and read orders. HandyMCP Pro adds order updates, refunds, coupon product rules, variations, customers and reports. ### Why does my AI app ask for permission before every action? That prompt comes from the AI app, not from HandyMCP. In Claude open Settings > Connectors, choose your site and set its tools to Always allow. In Cursor turn on Auto-run; in VS Code choose Always allow. HandyMCP still applies your permissions on the site. ### What if the AI makes a mistake? Open HandyMCP > Changes, see exactly what changed and undo it, or ask the AI to undo it. The free plugin keeps the last 20 changes. ### Does HandyMCP work on SiteGround? Yes. HandyMCP works on SiteGround, including its security and caching. SiteGround’s bot protection used to block the AI app sign-in page, and since version 1.0.3 HandyMCP handles this for you. If an app still cannot sign in, the connection check under HandyMCP > Connection shows what to change, or you can connect with an access token instead. See the [SiteGround setup guide](https://handymcp.com/siteground-mcp-wordpress/). ### My AI app cannot connect. What now? Open HandyMCP > Connection and run the connection check. It finds the usual problems( security plugins blocking the REST API, hosts that drop the Authorization header, caching of the endpoint) and tells you how to fix each one. ### Does HandyMCP Pro replace this plugin? Yes. Pro includes everything in HandyMCP. When you activate Pro, it turns this plugin off and keeps all your data. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “HandyMCP: MCP Server for Claude, ChatGPT and AI Agents” is open source software. The following people have contributed to this plugin. Contributors * [ Sukesh ](https://profiles.wordpress.org/sukeshbd24/) [Translate “HandyMCP: MCP Server for Claude, ChatGPT and AI Agents” into your language.](https://translate.wordpress.org/projects/wp-plugins/handymcp) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/handymcp/), check out the [SVN repository](https://plugins.svn.wordpress.org/handymcp/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/handymcp/) by [RSS](https://plugins.trac.wordpress.org/log/handymcp/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.5 * New: Setup checklist on the Connection screen that guides new users to a working connection. * New: Create and edit WooCommerce coupons, with undo. * New: Find pages missing an SEO title or description (Yoast SEO, Rank Math). * New: A notice when a newly installed plugin becomes available to AI apps, with no need to reconnect. * New: The Connection screen shows when an AI app can no longer sign in and needs to reconnect. * Improved: The approval screen only lists permissions for plugins that are installed. * Improved: “How this works” links on each Abilities group. * Improved: Blocked requests show as Refused in Activity, not as errors. * Improved: Ready for PHP 8.4 and 8.5. * Fixed: Tools that failed when an AI app sent a list as text. * Fixed: PHP warnings in the forms list when no forms existed. * Fixed: Listing WooCommerce categories was blocked in read-only mode. * Fixed: A replaced image now shows right away on every page, instead of the old one or a broken image. #### 1.0.4 * New: Changes (was Undo history). Open any AI change to see each field before and now, with a side by side text comparison, then undo it if you want. AI apps can show you the same with the new history_changes tool. * New: AI apps can read the Activity log (administrators only), so they can see why a change failed. * New: Crop, resize, rotate, flip and convert images to WebP. The edited image is saved as a new copy, so the original stays safe. * New: Rebuild image thumbnails, for example after a theme change. * New: Replace an image file and keep its URL, with a backup you can restore. * New: Upload images straight from your ChatGPT chat, and resize or convert them as they upload. * New: Clear crash reports. When another plugin or theme breaks during a change, HandyMCP names it and the AI checks the result before trying again. * New: Optional anonymous error reports, off by default. Nothing is sent unless you choose to share. * Improved: Common argument mix-ups from AI apps (categories and tags, option names, op ids, batch steps, JSON text for objects) are understood instead of failing. Local and test sites no longer send error reports. * Improved: AI apps can open a page by its address, and batch accepts calls written the way most AI apps send them. * Improved: The connection check now spots Cloudflare Zero Trust (Access) and shows how to let AI apps through. * Fixed: Pexels and Unsplash keys are no longer written into the settings page; the field shows the last 4 characters and keeps the key unless you paste a new one. * Fixed: Undoing every change to a page now ignores changes that were already undone one by one, so the page really goes back to how it started. * Fixed: AI apps get a clear reason when a tool is off limits (missing permission or connection access) instead of “unknown tool”. * Fixed: Scheduled posts now publish at the right time when the AI sets a date. * Fixed: Category and tag IDs are no longer created as new terms named after the number. #### 1.0.3 * New: Site brief (Settings > Site brief). Tell every connected AI app about your site, voice, words to avoid and rules to follow, in one place. * New: Works with ChatGPT and other apps that use the newest MCP version. * New: Connect with an access token when sign-in is blocked by your host. * Improved: Sign-in now works on SiteGround and other hosts that block it. * Improved: The Connection check explains what blocks AI apps (firewalls, caches, security plugins) and how to fix it. * Improved: Reset sign-in button clears old app connections in one click. * Improved: Settings open on the sub tab you saved, without jumping. * Fixed: Smaller fixes to several tools. #### 1.0.2 * Security: existing connections keep exactly the permissions they were granted; updates never add scopes. * Security: stricter OAuth checks (redirect addresses, resource, refresh token rotation and revocation) and safer handling of proxy headers and rate limits. * Unsplash photos added to the media library are reported to Unsplash as downloads, as its API guidelines require. * The approval screen states clearly that the app will act on the site as you. * Security: stricter checks on post meta, post types, menus, terms, media downloads( including IPv6 address forms), SVG uploads and the undo history. * Security: AI requests can no longer change critical site options (site address, admin email, registration, default role, permalinks). * Undo now refuses to overwrite a page that was edited again afterwards, and restores content exactly as it was. * Contact details in WooCommerce orders and form entries are masked by default. * Changing where form emails are sent now needs an explicit confirmation. * Admin screens no longer hide notices from WordPress or other plugins, and upgrade cards can be dismissed. * Security: AI requests never get administrative capabilities (plugins, themes, users, core updates, files, import/export, unfiltered HTML), whatever the connected user’s role. * Security: all admin screen markup is escaped on output. * Updated the Unsplash link in External services. #### 1.0.0 * First release of HandyMCP on WordPress.org. * Basic WooCommerce tools: products, prices, stock, categories, low stock and orders( read). * Create and edit Contact Form 7 and WPForms forms. ## Meta * Version **1.0.5** * Last updated **1 week ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [AI](https://wordpress.org/plugins/tags/ai/)[AI agent](https://wordpress.org/plugins/tags/ai-agent/) [ChatGPT](https://wordpress.org/plugins/tags/chatgpt/)[Claude](https://wordpress.org/plugins/tags/claude/) [mcp](https://wordpress.org/plugins/tags/mcp/) * [Advanced View](https://wordpress.org/plugins/handymcp/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/handymcp/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/handymcp/reviews/) ## Contributors * [ Sukesh ](https://profiles.wordpress.org/sukeshbd24/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/handymcp/)