Webmastery Site Toolkit for MCP adds 70+ permission-aware abilities across 16 areas that AI agents and MCP clients can call through the official MCP Adapter plugin. It works with popular MCP clients including Claude, ChatGPT, GitHub Copilot, and Gemini.

The MCP Adapter provides the transport layer. This plugin provides the site-management vocabulary: posts, pages, media, comments, taxonomy, custom post types, post meta, content hygiene, SEO checks, public webmaster verification, Google Site Kit diagnostics, site info, health, security, users, plugins, database, performance, and backup status.

Core editorial workflows work well with a dedicated Editor service account. Sensitive workflows such as plugin management, user auditing, site health, database health, backup status, performance status, and security audits require a separate Administrator service account.

Highlights:

Create, update, list, restore, trash, bulk publish, and bulk trash posts and pages.
Inspect Gutenberg blocks and patch one targeted block or content section in posts, pages, and eligible custom post types instead of rewriting the full content.
Manage categories, tags, comments, media metadata, featured images, and public image URL uploads.
Discover eligible public custom post types and use generated CRUD abilities for each one.
Read, update, and delete safe post meta, including supported Yoast SEO and SEOPress metadata fields.
Run content hygiene checks for orphaned media, missing featured images, and stuck scheduled posts.
Inspect safe site and current-user context, with runtime environment details reserved for Administrator accounts.
Audit plugins, administrator accounts, backups, performance settings, database bloat, site health, and security posture.
Analyze SEO metadata and public Google/Bing webmaster verification proof.
Inspect Google Site Kit setup, modules, current-user permissions, and same-site PageSpeed summaries without exposing OAuth credentials or changing Site Kit settings.

All abilities enforce WordPress capability checks. If the connected account cannot perform the equivalent WordPress action, the ability fails instead of bypassing WordPress permissions. List abilities for posts, pages, custom post types, media, and SEO scores also filter each returned object before exposing full details, so private, trashed, draft, pending, and scheduled content follows WordPress object/status permissions.

3.0.0 is a breaking upgrade from 2.6.0. Update clients for bounded pagination, summary defaults, strict inputs, separate metadata writes, destructive confirmation/previews, canonical errors and database identifier privacy before upgrading. Affected successful records add untrusted_fields markers without rewriting stored values, HTML or block markup. These hints are not prompt-injection prevention; see the migration and agent-safety FAQ below.

For full setup instructions, ability tables, and the deeper security model, visit:
https://www.virtuallyboring.com/webmastery-site-toolkit-for-mcp/