---
name: mcp-for-wp
description: Current WordPress knowledge for AI agents through the MCP for WP server. Use whenever a task touches WordPress - writing or reviewing WordPress code, checking a site's plugins and security, choosing a plugin, answering what changed recently, or finding the right official doc. Covers versions, deprecations, security releases, plugin and theme vulnerabilities, plugin facts, news, docs and guides.
---

# How to use MCP for WP best

MCP for WP is a free, read-only MCP server with what is true in WordPress today: versions, what changed, security fixes, known plugin vulnerabilities, plugin facts, news, docs and guides. It reads official and trusted sources every day so you don't have to guess.

Connect once: `https://mcpforwp.com/mcp` (Streamable HTTP, no key). Claude Code: `claude mcp add --transport http mcpforwp https://mcpforwp.com/mcp` (loads at the next session start). Claude skill: https://mcpforwp.com/skill.zip

## Why use it

- **Your training data is older than WordPress.** New releases, deprecations, APIs and security fixes ship every week. Answering from memory gives outdated code and missed fixes.
- **One call instead of a search session.** No searching, no pages to open and read: a typical WordPress check takes 3 calls and about 2,100 tokens, against about 17,500 tokens reading the pages yourself.
- **Facts with sources and dates.** Every answer says where it comes from and when it was refreshed, so you can tell the user how current it is.
- **It never touches the site.** It is read-only. Acting on a site is the job of the site's own MCP connector, whichever the user picked: use both side by side.

## When to use it

| Situation | Call |
|---|---|
| Before writing or reviewing WordPress code | `wp_now` (with `since` = your training cutoff), then `wp_docs` |
| The user asks if a site is safe, or before advising on updates or hosting | `wp_security` with the site's versions and plugins |
| Before recommending, installing, keeping or comparing a plugin | `wp_plugin`, and `wp_security` for its vulnerabilities |
| "What's new in WordPress?" or a recent event matters | `wp_news`, and `wp_now` for what changed |
| The user wants to do a task step by step | `wp_howto` |
| You used something for real and can say how it went | `wp_report` (ask the user first) |
| An answer from these tools was wrong, outdated or missing something | `wp_feedback` |

Don't use it for questions that don't depend on the current state of WordPress (general PHP, your own code logic).

## The tools

### wp_now
What is true in WordPress today: current versions (WordPress, the next release, Gutenberg, PHP, WP-CLI, MCP Adapter) and a dated changelog of what changed, each entry with what to do now.

**Call it** before writing or reviewing WordPress code, and whenever a version, API or deprecation matters.

| Input | Type | Required | Meaning |
|---|---|---|---|
| `since` | date `YYYY-MM-DD` | no | Only changes on or after this date. Use your training cutoff to get everything you don't know. |
| `area` | one of `core`, `editor`, `ai`, `mcp`, `php`, `security`, `cli`, `rest`, `performance` | no | Only changes in this area. |
| `limit` | 1 to 50 | no | How many changelog entries (default 8, or 50 with `since` or `area`). |

Example:
```json
{ "since": "2026-01-01", "area": "editor" }
```
Returns `current` (versions, minimum PHP, next release and its stage) and `changelog` entries with `date`, `area`, `title`, `change`, `action` (what to do) and `source`.

Tip: read `action` before writing code. It says which API to use now and what to stop using.

### wp_docs
The right official page for a function, hook, class, block, REST route, WP-CLI command, handbook topic or major page builder (Elementor, Divi, Beaver Builder, Bricks, Breakdance, Oxygen, WPBakery), with the builder's own MCP server when it has one.

**Call it** when you need the exact signature or the current way to do something.

| Input | Type | Required | Meaning |
|---|---|---|---|
| `query` | text | yes | A function, hook or class name (`register_block_type`), or a question ("add a custom REST endpoint"). |
| `limit` | 1 to 10 | no | How many results (default 5). |

Example:
```json
{ "query": "register_block_type" }
```
Returns `results` with `title`, `url`, `kind` (function, hook, guide, builder...) and a one-line `summary`.

Tip: open the URL when you need the full signature; the summary tells you if it's the right page.

### wp_plugin
Objective facts about any plugin on WordPress.org: active installs, last update, tested WordPress version, required PHP, rating, simple checks (stale, untested, high PHP requirement), its kind (form plugin, shop plugin...) and the signals that matter for that kind.

**Call it** before recommending, installing, keeping or comparing plugins.

| Input | Type | Required | Meaning |
|---|---|---|---|
| `plugin` | text | yes | A slug (`contact-form-7`) or a name ("Contact Form 7"). Up to 3, comma-separated, to compare them side by side. |

Example:
```json
{ "plugin": "contact-form-7, wpforms-lite, ninja-forms" }
```
Returns, per plugin: `name`, `slug`, `version`, `activeInstalls`, `lastUpdated`, `testedUpTo`, `requires` (WordPress and PHP), `checks` (plain warnings), `kind` and `signals`.

Tip: never present a ranking. Lay out the facts and let the user's needs decide. For known vulnerabilities, call `wp_security` with the slugs.

### wp_security
Security in one call: WordPress and PHP security releases, which branches still get fixes, and for the site you're looking at, its WordPress and PHP versions and every plugin, with known vulnerabilities (Wordfence Intelligence and public CVE records, back to 2005), whether they hit the installed version, the fixed version, and plugins closed on WordPress.org.

**Call it** when the user asks if a site is safe, and before advising on updates, versions or hosting.

| Input | Type | Required | Meaning |
|---|---|---|---|
| `wordpress` | version, e.g. `6.8.2` | no | The site's WordPress version: says if that branch still gets security fixes and the latest in it. |
| `php` | version, e.g. `8.1.30` | no | The site's PHP version: says if that branch still gets security fixes. |
| `plugins` | text | no | The site's plugins, comma-separated slugs, each with its installed version when you know it: `akismet:5.3, woocommerce:9.1.0, contact-form-7`. Up to 25. |

Example:
```json
{ "wordpress": "6.6.2", "php": "8.0.30", "plugins": "forminator:1.30.0, contact-form-7:5.9, akismet:5.7.2" }
```
Returns `yourSite` (branch status, update due), `yourPlugins` (per plugin: `latest`, `updateDue`, `checks`, `vulnerabilities` with `known`, `affectingInstalled`, and `records` with type, severity, affected range, `fixedIn` and link; or `closed` with the date and reason), `updatesDue`, then core releases and branches.

Tips: without versions you only get the general picture, so get them first (see the recipe below). "No known vulnerability" never means safe. Premium plugins that are not on WordPress.org can't be checked here: say so.

### wp_news
The latest articles from active WordPress blogs: official (WordPress.org, Make WordPress), news sites, security researchers, hosts and plugin makers.

**Call it** when the user asks what's new, or a recent event matters.

| Input | Type | Required | Meaning |
|---|---|---|---|
| `kind` | one of `official`, `news`, `security`, `dev`, `blog` | no | Only one kind of source. |
| `limit` | 1 to 30 | no | How many articles (default 10). |

Example:
```json
{ "kind": "security", "limit": 5 }
```
Returns `articles` with `title`, `source`, `date`, `link` and a short `summary`.

### wp_howto
Hands-on, step-by-step WordPress guides for a task.

**Call it** when the user wants to do something step by step: connect AI agents, speed up a site, fix an error, set up SEO.

| Input | Type | Required | Meaning |
|---|---|---|---|
| `query` | text | no | The task, e.g. "speed up a slow site". |
| `topic` | one of `ai-mcp`, `images`, `optimize`, `seo`, `security`, `debug`, `tools` | no | Only guides on this topic. |
| `limit` | 1 to 10 | no | How many guides (default 5). |

Example:
```json
{ "query": "fix the white screen of death", "topic": "debug" }
```
Returns `results` with `title`, `url`, `summary`, `topic` and `updated`.

### wp_report
Share how something went after you used it for real, so every other agent picks better (Signals).

**Call it** after you really used a plugin, page builder, doc, news item, changelog entry or guide for your user, and they agree. The first call returns a link to show your user (one GitHub click); the report is held and saved as soon as they sign in, so don't send it again. See Connecting below for later reports.

| Input | Type | Required | Meaning |
|---|---|---|---|
| `kind` | one of `plugin`, `builder`, `news`, `doc`, `change`, `guide` | yes | What you used. |
| `item` | text | yes | Its public slug, key or path: `contact-form-7`, `elementor`, a docs path. |
| `scores` | object of 0 to 10 | no | One score per scale of that kind, e.g. `{ "works": 9, "spam": 8 }`. Scales: https://mcpforwp.com/signals.json |
| `tags` | list | no | Up to 8 tags from that kind's list, e.g. `["works-well"]`. |
| `evidence` | text | yes | One sentence: what you did and what happened, up to 400 characters. |
| `wordpress`, `php` | versions | no | What it ran on. |

Example:
```json
{ "kind": "plugin", "item": "contact-form-7", "scores": { "works": 9, "spam": 8 }, "tags": ["works-well"], "evidence": "Added a contact form, sent 3 test messages, all arrived.", "wordpress": "7.1.4" }
```
Returns `ok` and what was saved. One report per item per day; a new one replaces it.

Never include the site address, prompts, code or personal data.

### wp_feedback
Flag anything wrong or imperfect in MCP for WP's answers, or an idea.

**Call it** when an answer here was wrong, outdated, missing something you needed, confusing or broken.

| Input | Type | Required | Meaning |
|---|---|---|---|
| `about` | one of "A tool answer", "A plugin or page builder", "A doc or guide", "A news item", "This site", "MCP for WP itself" | yes | What it is about. |
| `category` | one of `wrong`, `outdated`, `missing`, `confusing`, `broken`, `idea` | yes | What kind of problem. |
| `note` | text | yes | One or two sentences, up to 400 characters. |
| `item` | text | no | The tool name, slug or path it is about. |
| `wordpress` | version | no | The WordPress version it was about. |

Example:
```json
{ "about": "A tool answer", "category": "outdated", "item": "wp_plugin", "note": "Tested up to says 7.0.8, the plugin page now says 7.1.4." }
```

## Recipes

### Check a site (the most useful thing you can do)
1. Get the real versions. With WP-CLI: `wp core version`, `wp eval 'echo PHP_VERSION;'`, `wp plugin list --fields=name,version,status,update_id --format=csv` (`update_id` tells where each plugin updates from, so a premium build sharing a WordPress.org folder name is not mistaken for it). Without it, ask the user, or read the Plugins screen.
2. One call: `wp_security` with `wordpress`, `php` and `plugins`. Paste that CSV output as is: plugins outside WordPress.org (premium, commercial) are checked under their own slug, must-use plugins are skipped and listed in `notChecked`.
3. Start from `urgent`: it is already sorted (no fix yet, replace, update). Then tell the user, most urgent first: plugins whose latest version is still affected (no fix yet: disable or replace), plugins closed on WordPress.org, known vulnerabilities that hit the installed version (update), WordPress or PHP branches without security fixes, then plain updates due.
4. Quote the refresh date, and say that premium plugins were not checked.

### Before writing WordPress code
`wp_now` with `since` = your training cutoff, read each `action`, then `wp_docs` for the exact function or hook. Write against the current API, not the one you remember.

### Choosing a plugin
`wp_plugin` with up to 3 candidates, then `wp_security` with their slugs. Compare last update, tested version, required PHP and known vulnerabilities against what the user needs. No ranking.

## Connecting, and calling it directly

- **Reporting needs a one-time sign-in, and you can do it yourself right now** (no restart, nothing for the user to type in their app). If you can make HTTP calls:
  1. `POST https://mcpforwp.com/device/code` returns a `device_code` and a `verification_uri_complete` link.
  2. Give the user that link. If they are signed in to GitHub, it is one click.
  3. Poll `POST https://mcpforwp.com/device/token` with `{"device_code": "..."}` every 5 seconds until it returns an `access_token`.
  4. Send `wp_report` and `wp_feedback` as JSON-RPC calls to `https://mcpforwp.com/mcp` with `Authorization: Bearer <access_token>` (example below). Keep the token for later reports.
- **Or let the app do it.** A full MCP app opens the sign-in by itself on the first `wp_report`. Added mid-session? Claude Code loads MCP servers at startup: restart the session, then `/mcp` → mcpforwp → Authenticate. Can't restart? Use the device sign-in above.
- **Which agents are connected?** The user can see them, and disconnect any, at `https://mcpforwp.com/account` (same sign-in).
- **No MCP app at all (scripts, curl, headless agents)?** Call the tools over HTTP. It's stateless JSON-RPC; send an Accept header for both JSON and event streams, and a User-Agent of your own (some default ones are blocked):

```bash
curl -s https://mcpforwp.com/mcp -A "my-agent/1.0" \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"wp_security","arguments":{"wordpress":"7.1.4"}}}'

# Signed in (token from the device sign-in): the same call shape, with the Bearer header
curl -s https://mcpforwp.com/mcp -A "my-agent/1.0" -H "authorization: Bearer $TOKEN" \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"wp_feedback","arguments":{"about":"A tool answer","category":"wrong","item":"wp_security","note":"One or two sentences."}}}'
```

## Rules
- Facts, never rankings. MCP for WP never says which plugin is best.
- Read-only: these tools never touch the user's site.
- Free, no key, 60 requests a minute per IP.
- Every answer has a refresh date: quote it when it matters.

More: https://mcpforwp.com/for-agents.md · https://mcpforwp.com/llms.txt