WSP MCP - AI Agents Connector turns your WordPress site into a Model Context Protocol (MCP) server. AI clients can read and edit posts, pages, categories, tags, media, comments, users, and (when installed) Yoast SEO meta and Elementor page content \u2014 all under granular, per-ability admin control.<\/p>\n\n
The plugin ships its own native MCP server<\/strong>. You do not need the WordPress MCP Adapter or any companion plugin: activate, copy your connection details from MCP > Connection<\/strong>, and connect. WooCommerce tools (products, orders, refunds, coupons, customers, reports) are available when WooCommerce is active, and Advanced Custom Fields tools (field groups, fields, values, post types, taxonomies, options pages) when ACF is active.<\/p>\n\n Built and maintained by the WebSensePro<\/a> team. For documentation, setup guides, and connection help, visit the plugin home at freewordpressmcp.com<\/a>.<\/p>\n\n Every tool is individually toggleable in MCP > Settings<\/strong>, and all write tools are off by default.<\/p>\n\n Core WordPress<\/strong><\/p>\n\n Yoast SEO<\/strong> (requires Yoast SEO)<\/p>\n\n Elementor<\/strong> (requires Elementor)<\/p>\n\n WooCommerce<\/strong> (requires WooCommerce \u2014 financial and PII tools require the Advanced Custom Fields<\/strong> (requires ACF \u2014 structural changes require No. This plugin includes its own MCP server and connects directly. As of v2.2 the older MCP Adapter \/ Abilities-API compatibility path has been removed; connect using the native endpoint shown on MCP > Connection<\/strong>.<\/p><\/dd>\n Use a WordPress Application Password (sent via HTTP Basic auth) or the plugin-generated API key shown on the Connection page. Either is validated on every request, and tool actions are limited by the authenticated user's capabilities.<\/p><\/dd>\n Any client that supports the Streamable HTTP MCP transport \u2014 Claude Desktop, MCP Inspector, IDEs, and scripts.<\/p><\/dd>\n\n<\/dl>\n\n\nKey features<\/h4>\n\n
\n
Authorization: Bearer<\/code> or X-WSP-MCP-API-Key<\/code>).<\/li>\nComplete tools list<\/h4>\n\n
\n
\n
\n
manage_woocommerce<\/code> capability)<\/p>\n\n\n
manage_options<\/code>; value tools enforce per-object capabilities)<\/p>\n\n\n
Links<\/h4>\n\n
\n
\n
\/wp-content\/plugins\/<\/code> and activate it.<\/li>\n\n
Do I need the WordPress MCP Adapter plugin?<\/h3><\/dt>\n
How does authentication work?<\/h3><\/dt>\n
Which AI clients are supported?<\/h3><\/dt>\n
2.4.1<\/h4>\n\n
\n
update_field()<\/code> \u2014 for posts, users, terms, and options \u2014 is now recursively sanitized (arrays walked; each string run through wp_kses_post()<\/code>) so <script><\/code>\/<style><\/code> and inline event handlers can no longer be stored through the MCP tools. Legitimate WYSIWYG\/HTML field content still works. Addresses the WordPress.org \"arbitrary code insertion\" review finding.<\/li>\n<\/ul>\n\n2.4.0<\/h4>\n\n
\n
~\/.config\/opencode\/opencode.json<\/code> file with the API key inlined in the header, ready to create and paste.<\/li>\n<\/ul>\n\n2.3.1<\/h4>\n\n
\n
wp_kses_post()<\/code> so scripts cannot be injected via _elementor_data<\/code>.<\/li>\nmanage_options<\/code> (was edit_posts<\/code>), matching the admin-level nature of global options.<\/li>\nwsp_register_acf_abilities()<\/code> dual-mode registration helper (dead code, not hooked).<\/li>\nRequires at least<\/code> now uses the major-only WordPress version format (6.9).<\/li>\n<\/ul>\n\n2.3.0<\/h4>\n\n
\n
manage_options<\/code>; value reads\/writes enforce per-object capabilities (edit_post<\/code>, edit_user<\/code>, list_users<\/code>, manage_categories<\/code>, manage_options<\/code>).<\/li>\nwsp-mcp-ai-agents-connector<\/code> (folder, main file, and text domain) to match the public name ahead of WordPress.org submission.<\/li>\n2.2.0<\/h4>\n\n
\n
2.1.0<\/h4>\n\n
\n
manage_woocommerce<\/code> capability.<\/li>\n2.0.0<\/h4>\n\n
\n
1.3.0<\/h4>\n\n
\n
1.2.1<\/h4>\n\n
\n
1.2.0<\/h4>\n\n
\n