# The WordPress MCP Adapter, explained The WordPress MCP Adapter is the official WordPress plugin that turns abilities registered through the WordPress Abilities API into MCP tools, so AI clients like Claude Desktop, Claude Code, Cursor and VS Code can use them. It's free, needs WordPress 6.9 or newer and PHP 7.4, and the current version is 0.7.1, released October 16, 2026. The adapter adds no AI features of its own. Its readme calls it "the server and transport layer". **What your assistant can do through it depends entirely on which abilities your plugins have registered and marked public.** Install it on a fresh site, connect Claude Desktop, and the assistant sees three tools. Ask it what it can do and the list comes back empty until some plugin on the site marks an ability public. The adapter's own guide calls that expected. - [How the two pieces fit](#how-the-two-pieces-fit) - [Setting it up](#setting-it-up) - [The catch with Claude and ChatGPT on the web](#the-catch-with-claude-and-chatgpt-on-the-web) - [Registering your own ability](#registering-your-own-ability) - [A worked example: a hosted alternative](#a-worked-example-a-hosted-alternative) - [What goes wrong](#what-goes-wrong) - [Finer points](#finer-points) ## How the two pieces fit The Abilities API is in WordPress core. It landed in 6.9 in December 2025, and it gives plugins, themes and core one standard way to say "here's something I can do". Each ability has a name like `my-plugin/get-latest-orders`, a label, a description, a category, input and output schemas, the function that does the work, and a permission check. Abilities are useful on their own. With `show_in_rest` on, they appear under `wp-json/wp-abilities/v1`, where an authenticated user can list them and run them. The MCP Adapter is the bridge to AI clients. It reads the registry and exposes public abilities over MCP. The WordPress AI team kept it out of core on purpose, so it can keep pace with how fast the MCP spec changes. Version 0.7.0 (October 2, 2026) was the first release in the WordPress.org plugin directory and added support for the 2026-07-28 MCP spec. Here's what a client sees when it connects to the default server: - `mcp-adapter/discover-abilities` lists the public abilities on the site. - `mcp-adapter/get-ability-info` reads one ability's details and schema. - `mcp-adapter/execute-ability` runs it. Abilities are private by default. A developer opts one in by setting `meta.public` (or `meta.mcp.public` for MCP only) to `true`. And the permission check still runs against the connected WordPress user before anything happens, so an assistant connected as an Editor can't do what an Editor can't do. ## Setting it up The adapter's own site-owner guide says it takes about ten minutes. 1. In wp-admin, go to Plugins → Add New, search for "MCP Adapter", install and activate it. Or run `wp plugin install mcp-adapter --activate`. 2. Go to Users → Profile (ideally for a separate user with the lowest role that can do the job), scroll to Application Passwords, name one after the client, and click Add New Application Password. Copy it: WordPress shows it once. 3. Add the site to your AI client. For Claude Desktop (Settings → Developer → Edit Config) or Cursor (`~/.cursor/mcp.json`), the guide uses a small helper that runs through `npx`: ```json { "mcpServers": { "my-wordpress-site": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote@latest"], "env": { "WP_API_URL": "https://example.com/wp-json/mcp/mcp-adapter-default-server", "WP_API_USERNAME": "your-username", "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx" } } } } ``` That helper needs Node.js on your computer. Clients that take a URL and a header, like Claude Code, can skip it and send `Authorization: Basic` with your username and application password encoded in base64. On a local site with WP-CLI, you can skip the password too. The client runs `wp mcp-adapter serve --user=admin` directly over stdio. To test it, ask your assistant to list the WordPress abilities it can use. An answer (even "there aren't any") means the connection works. ## The catch with Claude and ChatGPT on the web This one's in the adapter's own docs, and it's the biggest limit for most site owners. The web versions of Claude and ChatGPT add servers through an OAuth sign-in. They don't have a field for an Application Password. WordPress doesn't ship an OAuth server, and the adapter doesn't add one. So, in the guide's words, these apps can't connect to the MCP Adapter on their own today. Your options are a desktop client (Claude Desktop, Claude Code, Cursor, VS Code), or a plugin that adds an OAuth sign-in to your site. If your clients or your team live in claude.ai or ChatGPT in a browser, that decides it. The ChatGPT desktop app can run local STDIO servers, but neither OpenAI's docs nor the adapter's mention running `wp mcp-adapter serve` through it, so treat that pairing as untested. ## Registering your own ability If you write plugins, here's the minimum. Every ability needs a category that already exists when you register it. Core gives you `site` and `user`. ```php add_action( 'wp_abilities_api_init', function () { wp_register_ability( 'my-plugin/count-drafts', [ 'label' => 'Count drafts', 'description' => 'Returns how many posts are saved as drafts.', 'category' => 'site', 'output_schema' => [ 'type' => 'integer' ], 'execute_callback' => function () { return (int) wp_count_posts( 'post' )->draft; }, 'permission_callback' => function () { return current_user_can( 'edit_posts' ); }, 'meta' => [ 'mcp' => [ 'public' => true ] ], ] ); } ); ``` Through the default server, the assistant finds it with `discover-abilities` and runs it with `execute-ability`. If you add it to a custom server as a direct tool instead, clients see it as `my-plugin-count-drafts`, because MCP tool names can't contain slashes. Write the description for a model, not a person. It's the only thing the assistant reads when deciding whether to call your ability. There's more on that in [how to build an MCP server](/learn/build-mcp-server). ## A worked example: a hosted alternative Kitepod (we make it) takes a different route to the same goal, and it's worth seeing next to the adapter. It's a free remote MCP server plus a WordPress plugin. You add `https://kitepod.com/mcp` to Claude, ChatGPT or any MCP client and sign in with OAuth, so it works in claude.ai and ChatGPT on the web, and nobody pastes an application password. It needs WordPress 6.4+ and PHP 7.4+. It also reads the same registry. Among its 51 tools, Kitepod can discover the abilities your plugins register and run them as the WordPress user you picked when connecting, next to built-in tools for content, page builders, WooCommerce, SEO and theme code. So with an ability-aware plugin installed, you could ask: ```prompt Check which abilities the plugins on my site have registered, then run the one that counts my draft posts. ``` The adapter's guide tells you to try new abilities on a staging copy first and keep backups. That advice holds with Kitepod too, which isn't a backup service. What it adds is a gate on the live site: under its default approval policy, an ability Kitepod hasn't mapped waits for a person to approve it before it runs, and anything it changes is snapshotted first so it can be reversed. So who should pick which? Take the adapter if you want the official, open-source piece with no service in the middle, you use desktop clients, and the abilities on your site cover what you need. Look at a hosted option if you or your clients work in a browser, or you want the assistant to do more than your plugins have registered. The [WordPress MCP](/wordpress-mcp) hub compares the wider set of options, including WPVibe and Novamira. ## What goes wrong **Connected, but the list is empty.** No plugin on the site has marked an ability public. Install one that registers abilities, or ask the developer of a plugin you use whether it supports the Abilities API. **Your ability never shows up, and there's no error.** You used a category that isn't registered yet. `wp_register_ability()` returns `null` and only logs a notice when `WP_DEBUG` is on, so on production it fails silently. Register custom categories on `wp_abilities_api_categories_init`, which runs before `wp_abilities_api_init`. **401 Unauthorized.** Check you used the login name or email, not the display name, and that the password wasn't revoked. If both are right, some Apache setups strip the `Authorization` header before WordPress sees it. Your host can pass it through. **No Application Passwords section.** The site isn't on HTTPS, or a security plugin or host has turned Application Passwords off. **404 or `rest_no_route`.** With plain permalinks, `/wp-json/` URLs don't work. Use `https://example.com/?rest_route=/mcp/mcp-adapter-default-server`, or save your permalinks again under Settings → Permalinks. ## Finer points ### Is the MCP Adapter part of WordPress core? No. The Abilities API is in core (since 6.9), but the adapter ships as a plugin so it can move as fast as the MCP spec. Install it from WordPress.org. Bundling it as a Composer library inside your own plugin was deprecated in 0.7.0. ### What is the WordPress Abilities API? A core registry where plugins, themes and WordPress itself describe what they can do, with schemas and permission checks. You register with `wp_register_ability()` on the `wp_abilities_api_init` hook. AI clients are one consumer; the REST API under `wp-abilities/v1` is another. ### Does the WordPress MCP Adapter work with ChatGPT? Not on its own in ChatGPT on the web, because ChatGPT signs in to servers with OAuth and the adapter uses Application Passwords. You'd need a plugin that adds OAuth to your site, or a hosted server that handles sign-in. ### Is it safe to connect an AI to my site through the adapter? It runs with the permissions of the user you connect, so use a dedicated user with the lowest role that does the job. Make one application password per client so you can revoke one without touching the others. The adapter's guide also says to try new abilities on staging first and keep backups. ### Which plugins register abilities? It's growing, and there's no single list. Check each plugin's changelog or docs for "Abilities API", or connect and run the discover tool to see what your own site exposes. Install it on a staging copy, connect one desktop client, and ask what it can do. The answer tells you how far your plugins have come.