WordPress MCP

WordPress exposes an MCP server through the MCP Adapter plugin, built on top of WordPress's Abilities API. Installing the plugin alone does not add any MCP tools — you also need to expose Abilities to it. WordPress core ships with only three Abilities, so most setups need custom ones too.

This page walks through all three steps: install MCP Adapter, expose the core Abilities, and add a custom Ability.

Prerequisites

• WordPress 6.9+ (ships the Abilities API)
• Admin access to install plugins and edit mu-plugins
• Ability to create an Application Password for your WordPress user

Step 1: Install MCP Adapter

Via WP-CLI:

wp plugin install https://github.com/WordPress/mcp-adapter/releases/latest/download/mcp-adapter.zip --activate

Manually:

1. Download the latest release from the MCP Adapter GitHub releases page.
2. Extract it into wp-content/plugins/.
3. Activate it from Plugins in the WordPress admin dashboard.

This creates an MCP server at:

https://<your-site>/wp-json/mcp/mcp-adapter-default-server

Step 2: Expose the core Abilities

WordPress core registers three Abilities (core/get-site-info, core/get-user-info, core/get-environment-info), but none are marked public to MCP by default. Expose them with a small mu-plugin.

Create wp-content/mu-plugins/mcp-expose-core-abilities.php:

<?php
add_filter( 'wp_register_ability_args', function ( $args, $ability_id ) {
	$core_abilities = array(
		'core/get-site-info',
		'core/get-user-info',
		'core/get-environment-info',
	);

	if ( in_array( $ability_id, $core_abilities, true ) ) {
		$args['meta']['mcp']['public'] = true;
	}

	return $args;
}, 10, 2 );

mu-plugins (Must-Use Plugins) load automatically and cannot be disabled from the admin UI, which makes them a good fit for this kind of infrastructure-level configuration.

Step 3: Create an Application Password

MCP clients authenticate with HTTP Basic Auth using your WordPress username and an Application Password (not your login password).

1. Go to Users → Profile.
2. Scroll to Application Passwords, enter a name, and click Add New Application Password.
3. Copy the generated password immediately — it is shown only once.

Step 4 (optional): Add a custom Ability

Core Abilities only cover site/user/environment info. To expose anything else — for example, a custom query against another plugin's data — register your own Ability.

Create a mu-plugin (e.g. wp-content/mu-plugins/my-ability.php):

<?php
add_action( 'wp_abilities_api_init', 'myplugin_register_abilities' );

function myplugin_register_abilities() {
	wp_register_ability( 'myplugin/list-things', array(
		'label'               => 'List things',
		'description'         => 'Returns a list of things.',
		'category'            => 'site', // required — omitting it silently fails registration
		'input_schema'        => array(
			'type'       => 'object',
			'properties' => array(
				'limit' => array( 'type' => 'integer', 'default' => 20 ),
			),
		),
		'output_schema'       => array(
			'type'  => 'array',
			'items' => array( 'type' => 'object' ),
		),
		'permission_callback' => function () {
			return current_user_can( 'manage_options' );
		},
		'execute_callback'    => function ( $input ) {
			// Your logic here.
			return array();
		},
		'meta'                => array(
			'mcp' => array( 'public' => true ),
		),
	) );
}

Notes:

• category is required; without it, wp_register_ability() fails silently.
• Set meta.mcp.public to true, or the Ability is registered but not reachable over MCP.
• permission_callback gates who can execute the Ability — enforce this even if you only expect trusted clients.

Verify

Call the MCP server directly to confirm your Abilities are live. Replace <username> and <app-password> with your credentials:

curl -u '<username>:<app-password>' \
  -H 'Content-Type: application/json' \
  -X POST 'https://<your-site>/wp-json/mcp/mcp-adapter-default-server' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": { "name": "mcp-adapter-discover-abilities", "arguments": {} }
  }'

The response should list the core Abilities plus any custom ones you registered with public => true.

Next step

Add the WordPress MCP server to your Hub:

1. In Bloque, add a new server with HTTP transport and the URL from Step 1 (https://<your-site>/wp-json/mcp/mcp-adapter-default-server). See Add an MCP Server.
2. Base64-encode <username>:<app-password> from Step 3.
3. In the server form's custom headers field, add: Authorization: Basic <encoded-value>.

WordPress's MCP server uses HTTP Basic Auth rather than OAuth or a bearer token, so the credentials go in this header instead of the usual Authenticate flow.