How to use MCP for WP best

wp_now

What is true in WordPress today: current versions (WordPress, the next release, Gutenberg, PHP, WP-CLI, MCP Adapter) and a dated changelog of what changed, each entry with what to do now.

Call it before writing or reviewing WordPress code, and whenever a version, API or deprecation matters.

Example:

{ "since": "2026-01-01", "area": "editor" }

Returns current (versions, minimum PHP, next release and its stage) and changelog entries with date, area, title, change, action (what to do) and source.

Tip: read action before writing code. It says which API to use now and what to stop using.

wp_docs

The right official page for a function, hook, class, block, REST route, WP-CLI command, handbook topic or major page builder (Elementor, Divi, Beaver Builder, Bricks, Breakdance, Oxygen, WPBakery), with the builder's own MCP server when it has one.

Call it when you need the exact signature or the current way to do something.

Example:

{ "query": "register_block_type" }

Returns results with title, url, kind (function, hook, guide, builder...) and a one-line summary.

Tip: open the URL when you need the full signature; the summary tells you if it's the right page.

wp_plugin

Objective facts about any plugin on WordPress.org: active installs, last update, tested WordPress version, required PHP, rating, simple checks (stale, untested, high PHP requirement), its kind (form plugin, shop plugin...) and the signals that matter for that kind.

Call it before recommending, installing, keeping or comparing plugins.

Example:

{ "plugin": "contact-form-7, wpforms-lite, ninja-forms" }

Returns, per plugin: name, slug, version, activeInstalls, lastUpdated, testedUpTo, requires (WordPress and PHP), checks (plain warnings), kind and signals.

Tip: never present a ranking. Lay out the facts and let the user's needs decide. For known vulnerabilities, call wp_security with the slugs.

wp_security

Security in one call: WordPress and PHP security releases, which branches still get fixes, and for the site you're looking at, its WordPress and PHP versions and every plugin, with known vulnerabilities (Wordfence Intelligence and public CVE records, back to 2005), whether they hit the installed version, the fixed version, and plugins closed on WordPress.org.

Call it when the user asks if a site is safe, and before advising on updates, versions or hosting.

Example:

{ "wordpress": "6.6.2", "php": "8.0.30", "plugins": "forminator:1.30.0, contact-form-7:5.9, akismet:5.7.2" }

Returns yourSite (branch status, update due), yourPlugins (per plugin: latest, updateDue, checks, vulnerabilities with known, affectingInstalled, and records with type, severity, affected range, fixedIn and link; or closed with the date and reason), updatesDue, then core releases and branches.

Tips: without versions you only get the general picture, so get them first (see the recipe below). "No known vulnerability" never means safe. Premium plugins that are not on WordPress.org can't be checked here: say so.

wp_news

The latest articles from active WordPress blogs: official (WordPress.org, Make WordPress), news sites, security researchers, hosts and plugin makers.

Call it when the user asks what's new, or a recent event matters.

Example:

{ "kind": "security", "limit": 5 }

Returns articles with title, source, date, link and a short summary.

wp_howto

Hands-on, step-by-step WordPress guides for a task.

Call it when the user wants to do something step by step: connect AI agents, speed up a site, fix an error, set up SEO.

Example:

{ "query": "fix the white screen of death", "topic": "debug" }

Returns results with title, url, summary, topic and updated.

wp_report

Share how something went after you used it for real, so every other agent picks better (Signals).

Call it after you really used a plugin, page builder, doc, news item, changelog entry or guide for your user, and they agree. The first call opens a one-time sign-in in your user's browser (GitHub or Google); after that it just works.

Example:

{ "kind": "plugin", "item": "contact-form-7", "scores": { "works": 9, "spam": 8 }, "tags": ["works-well"], "evidence": "Added a contact form, sent 3 test messages, all arrived.", "wordpress": "7.1.4" }

Returns ok and what was saved. One report per item per day; a new one replaces it.

Never include the site address, prompts, code or personal data.

wp_feedback

Flag anything wrong or imperfect in MCP for WP's answers, or an idea.

Call it when an answer here was wrong, outdated, missing something you needed, confusing or broken.

Example:

{ "about": "A tool answer", "category": "outdated", "item": "wp_plugin", "note": "Tested up to says 7.0.8, the plugin page now says 7.1.4." }

Check a site (the most useful thing you can do)

1. Get the real versions. With WP-CLI: wp core version, wp eval 'echo PHP_VERSION;', wp plugin list --fields=name,version,status,update_id --format=csv (update_id tells where each plugin updates from, so a premium build sharing a WordPress.org folder name is not mistaken for it). Without it, ask the user, or read the Plugins screen.
2. One call: wp_security with wordpress, php and plugins. Paste that CSV output as is: plugins outside WordPress.org (premium, commercial) are checked under their own slug, must-use plugins are skipped and listed in notChecked.
3. Start from urgent: it is already sorted (no fix yet, replace, update). Then tell the user, most urgent first: plugins whose latest version is still affected (no fix yet: disable or replace), plugins closed on WordPress.org, known vulnerabilities that hit the installed version (update), WordPress or PHP branches without security fixes, then plain updates due.
4. Quote the refresh date, and say that premium plugins were not checked.

Before writing WordPress code

wp_now with since = your training cutoff, read each action, then wp_docs for the exact function or hook. Write against the current API, not the one you remember.

Choosing a plugin

wp_plugin with up to 3 candidates, then wp_security with their slugs. Compare last update, tested version, required PHP and known vulnerabilities against what the user needs. No ranking.

curl -s https://mcpforwp.com/mcp -A "my-agent/1.0" \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"wp_security","arguments":{"wordpress":"7.1.4"}}}'