bwt
// mcp server

WordPress.com MCP

ga Hosted SaaS Auth: OAuth Spec: undocumented
Protocol
Spec revision targeted:
Not documented by the project
Transports:
streamable-http
Endpoint:
https://public-api.wordpress.com/wpcom/v2/mcp/v1

The MCP 2026-07-28 revision removes the initialize handshake and protocol-level sessions. What it changes for WordPress · Confirmed 2026-07-24

by Automattic

Automattic's hosted MCP server. Nothing to install, and the only one of these using OAuth 2.1.

Docs
// capabilities
// editorial

The hosted MCP server for WordPress.com sites. Because Automattic runs it, there is no plugin to install and no endpoint to secure yourself — you authorize an AI client against your WordPress.com account and it connects. The current tool surface is twelve tools: five STRAP facade tools covering content authoring, site editor context, account, and site operations, plus seven standalone tools for listing sites, domain availability search, DNS records and restoration, nameservers, mail setup, checkout URLs, and plans. Content coverage spans posts, pages, comments, media, categories, tags, block patterns and synced patterns, alongside site settings, themes, plugins, and activity logs. Write, update, and delete operations all require explicit user confirmation.

Pros

  • OAuth 2.1 with PKCE and token rotation; no client secrets stored locally
  • Zero setup — nothing to install, host, or keep patched
  • Write operations gated behind explicit user confirmation
  • Broadest surface here: content plus domains, DNS, and billing

Cons

  • WordPress.com only — no path for self-hosted installs
  • Proprietary and Automattic-operated; you cannot audit or extend the server
  • Plan requirements for write access are not documented publicly
  • Domain and checkout tools make it a commerce surface as much as a content one
// context
// vendor

Automattic

WordPress.com, WooCommerce, Jetpack, Tumblr. The company behind much of WordPress.
// methodology

Status semantics

GA: published, documented, intended for production use. Beta: feature-complete but rough edges. Alpha: usable for evaluation, expect breaking changes. Experimental: research-only, not safe for production.

Capability tags

Capability tags reflect what an agent can do via the MCP server, not what the underlying WordPress install supports. A "post-management" capability means the MCP server exposes posts as MCP tools; whether the agent has permission to use them depends on the authentication model.