Securely Connect your WordPress site to AI Agents using MCP

Overview

MCP Server for WordPress connects a WordPress site to AI Agents such as ChatGPT, Claude, and other MCP-compatible clients, so users can read information about their site and perform actions on it using natural language, for example, checking site and environment details, viewing their account, and creating or updating posts and much more.

The connector exposes whatever abilities the site registers through the Abilities API as tools that the AI Agent can call. Each ability is a discrete, permission-checked action defined on the site, so any ability available on the WordPress site can be executed through the connector, always within the limits of the signed-in user's permissions.

Download Plugin Pricing Plans Request a Demo

Prerequisites

Before connecting, you need:

• A self-hosted WordPress site running WordPress 6.9 or later. This is the version that introduced the WordPress Abilities API, which the connector relies on.
• The site must be publicly reachable over HTTPS, since the connection is made from the internet. Local or private URLs will not work.
• The free miniOrange Secure MCP Server plugin is installed and active on the site. It is available from the WordPress plugin directory.

Configuration Steps

Step 1: WordPress Side Setup

• In your WordPress admin dashboard, go to Plugins, then the Add New button.
• Search for miniOrange Secure MCP Server, click Install Now, then Activate.

• After activation, open the Secure MCP Server menu in the admin sidebar.

• Go to the NHI Registry tab of the plugin, click on the Register your first NHI button.

• Provide a desired Name to your NHI and on Next.

• Enable the abilities of your choice.
• Click on the Register NHI button.

• Open the Connect to AI tab and copy the site URL.

• Keep the site URL handy, you'll need it while configuring the connector in the AI Agent.

Step 2: AI Agent Side Setup

• ChatGPT
• Claude AI
• Any AI Agent

• In your ChatGPT, go to Apps and click on the Settings icon.

• Click on the Advanced Settings.

• Enable the Developer Mode toggle and navigate back to the previous UI.

• Click on Create App.

• Enter the desired App Name and Connection field value as https://gateway.miniorange.ai/mcp

• Click on the Sign in button.
• Enter your site URL and click on Continue button.

• Click on the Allow Access button.

• In Claude, navigate to Settings >> Connectors.
• Click on the Add Connector icon and then select the Add custom connector option.

• Add the connector name and the MCP URL, and click on the Add button.

• Click on the Connect button.

• Now, add the URL of your WordPress site and click on Continue.

The Connect to AI tab provides two ways to connect any MCP-compatible client. Any AI client that supports OAuth 2.1 with PKCE and Dynamic Client Registration (RFC 7591) will work directly with the endpoint. The server exposes an OAuth Authorization Server Metadata document at /.well-known/oauth-authorization-server for auto-discovery.

Gateway Method (recommended, no server configuration required)

Connect through the miniOrange MCP Gateway.

• In your AI client, add a custom connector or remote MCP server and enter the Gateway connector URL shown on the tab.
• When the gateway asks which site to connect, enter your WordPress site URL.
• Sign in to WordPress and click Approve on the authorization screen.
• Tools enabled in your NHI Registry become available in your AI client.

Direct Method (advanced)

Connect AI clients directly to your site's MCP endpoint.

• In your AI client, add a custom connector or remote MCP server and enter the site's MCP endpoint shown on the tab.
• Sign in to WordPress and click Approve on the authorization screen.
• Tools enabled in your NHI Registry become available in your AI client.

What You Can Do Once Connected

Once connected, the AI Agent can read and manage your site through natural-language prompts, checking site and environment details, viewing your account, and creating or updating posts and pages. The exact set of actions depends on which abilities your site registers through the Abilities API. Because each ability is permission-checked, the AI Agent can only perform actions the signed-in user is allowed to perform.