MountDev AI MCP Connector for WordPress
Connect ChatGPT, Claude or another AI assistant to your WordPress site, then ask it to do the work you would otherwise do by hand.
Connecting takes one address and a sign-in. There are no API keys to create, no client IDs to copy and nothing to paste into a configuration file. Claude and ChatGPT identify themselves automatically, using the published client metadata the Model Context Protocol defines for exactly this, and you approve the connection on your own site.
Ask it to draft and publish a post, update product prices in WooCommerce, rewrite the SEO titles on a slow page, tidy your menus, or clear out spam comments. It works on your site directly, so there is no copying and pasting between a chat window and your admin screens.
You decide what it may touch. Access is granted with a profile, which is a named set of tools: read only, content editing, SEO, store management, or one you build yourself. Everything the assistant does still runs through WordPress’s own permissions, so it can never do more than the account it signed in as.
What you can ask for
- Precise edits – change one sentence, or one word across the whole site, with every change previewed, checked and reversible
- Content – draft, edit, publish and schedule posts and pages, manage categories, tags and menus
- Media – upload images, set alt text, tidy the library
- Shop – update products, stock, prices, variations, coupons, orders and refunds in WooCommerce
- Search – edit titles, descriptions and schema in Rank Math or Yoast, manage redirects, check what is ranking
- Pages – build and change Elementor layouts, global colors and typography
- Forms – manage Contact Form 7 forms, templates and messages
- Housekeeping – comments, users, plugins, themes and site settings
Works with the assistants people actually use
- ChatGPT – paste the address, sign in, done
- Claude – paste the address, sign in, done (Claude.ai, Claude Desktop and Claude Code)
- Cursor, Windsurf and other editors – connect with a WordPress Application Password
- Any client that speaks the Model Context Protocol
389 tools, across the plugins you already run
82 WordPress core, 78 Rank Math SEO, 74 WooCommerce, 71 Elementor (36 free and 35 Pro), 35 Jetpack, 29 Yoast SEO and 20 Contact Form 7. Tools for a plugin appear only when that plugin is active, so the list stays as short as your site is.
Written for the specific plugin, not guessed at. Rank Math’s focus keywords, Elementor’s page structure and WooCommerce’s variations each store data their own way, and each tool is built for how that plugin actually works.
Built for people who are responsible for a site
- Nothing is sent to us or to any third party. The assistant talks to your site and nowhere else.
- Client secrets are encrypted before they are stored.
- Access tokens expire after an hour; authorization codes after ten minutes.
- Only administrators can issue credentials.
- Every action respects the signed-in user’s WordPress capabilities, checked against the specific post, product or comment being touched.
Security
- OAuth 2.0 with PKCE – authorization requires a logged-in WordPress user and an explicit approval step
- AES-256-CBC encryption – client secrets encrypted at rest
- Token expiry – access tokens last an hour, refresh tokens 30 days, authorization codes ten minutes
- Per-object capability checks – a tool checks rights over the specific object, not just a broad capability
- Administrator-only credentials – only administrators can issue or view OAuth credentials
- No privilege escalation – the assistant can never exceed the permissions of the account it signed in as
External Services
This plugin talks to your site and nothing else. No data is sent to Cascadia Web Services or to any third party.
For editors that cannot connect to a remote MCP server themselves, the plugin includes an optional Node.js bridge script that runs on your own computer. It passes requests between the editor and your site’s REST API at:
https://yoursite.com/wp-json/mountdev-ai-mcp-connector/v1/messageshttps://yoursite.com/wp-json/mountdev-ai-mcp-connector/v1/oauth/*
It sends your WordPress username and Application Password to authenticate, along with whatever the assistant is asking for. Everything stays between your computer and your own server.
License
This plugin is licensed under the GPL v3 or later.
See https://www.gnu.org/licenses/gpl-3.0.en.html for details.