WordPress MCP: Connect Claude or Codex to Edit Your Site by Chat

If you have wished your AI assistant could just do things in WordPress instead of handing you instructions, that is exactly what a WordPress MCP server unlocks. MCP — the Model Context Protocol — is an open standard from Anthropic that lets AI assistants like Claude and Codex connect to external systems. A WordPress MCP server exposes your site's actions (read pages, create posts, upload images, switch themes) as tools your assistant can call.

This post explains what a WordPress MCP server is, how to connect one, what you can do with it, and how the security model keeps you in control.

What is MCP, in plain terms?

Think of MCP as a USB-C port for AI tools. Without it, your assistant is a brilliant conversationalist with no hands. With an MCP server connected, it gains a specific set of capabilities it can use on your behalf — and WordPress is a perfect fit, because so much of running a site is repetitive, structured work.

WordPress has no native integration with Claude or Codex. A WordPress MCP server is the bridge that fills that gap: your assistant talks to the MCP server, the server talks to WordPress (over a secure REST connection), and changes show up on your site.

Connecting a WordPress MCP server

We will use XeoRank, which runs a managed WordPress MCP server so you do not have to host anything. The server URL is https://mcp.xyle.app/mcp.

Claude (Desktop or web)

1. Open Settings → Connectors → Customize.
2. Click + Add connector, name it XeoRank, and paste https://mcp.xyle.app/mcp.
3. Click Connect and sign in. Claude handles authentication automatically — no API key.

Codex

Codex connects over native HTTP and reads a key from a header:

1. Open Connect to a custom MCP.
2. Name it XYLE, toggle Streamable HTTP, and set the URL to https://mcp.xyle.app/mcp.
3. Under Headers, add Authorization with the value Bearer <your XeoRank API key> (create the key in Settings → Connect → API Keys).

Claude Code (CLI)

claude mcp add xyle --transport http https://mcp.xyle.app/mcp

Then run /mcp and authenticate. Verify any client by asking: "List my XeoRank sites."

A quick tip: if you add the server and your assistant cannot see the tools, reconnect or restart the MCP session — clients fetch the tool list once when they connect.

Connecting your WordPress site

The MCP server still needs permission to touch your specific site. The plugin method works on any host:

1. Install the Xyle Connector plugin (Plugins → Add New → Upload Plugin).
2. Create an Application Password (Users → Profile → Application Passwords).
3. Tell your assistant to connect with your site URL, your wp-admin username (not the app password's name), and the Application Password — then enable writes.

What you can do once connected

A WordPress MCP server turns natural-language requests into real actions. The common ones:

• Read — list pages and posts, and read a page's editable structure.
• Build — create new pages and blog posts from a description.
• Edit precisely — change one heading or swap one image without rebuilding the page.
• Media — upload an image from a URL into the media library and reuse it.
• Custom fields — read and set ACF (Advanced Custom Fields) values.
• Site-level — switch themes, set a homepage, publish or unpublish.
• Design review — screenshot a page so the assistant can critique and fix layout issues.
• SEO — analyze a page for SEO, AEO, and GEO, then fix the top issues.

You never call these tools by name — you describe the outcome ("add a pricing page", "swap the hero image", "publish this") and the assistant maps it to the right tool.

The security model

Letting an AI agent connect to your WordPress site sounds risky until you see how it is gated:

• HTTPS-encrypted connection; your credentials are stored encrypted, and the assistant never sees your raw password.
• Writes are off by default — read access is automatic, but the assistant cannot change anything until you explicitly enable writes per site.
• Draft-first — new content is created as drafts; you publish.
• Revocable — the Application Password and API key can be revoked at any time, instantly cutting off access.
• Approvals — keep destructive actions (deleting a site, theme edits) set to "needs approval" in your AI client.

Because the connector talks to WordPress through its standard REST API with an Application Password, you are never sharing your main login, and you can see and revoke access from your WordPress profile whenever you like.

WordPress MCP vs. AI plugins

AI plugins that live inside wp-admin are useful for generating a snippet of text in a single box. A WordPress MCP server is a different category: it gives your assistant the whole site as a workspace, from the comfort of the chat you already use for everything else. You plan, build, and review in one place — and the same assistant can also research keywords, audit SEO, and check your AI visibility.

Get started

A WordPress MCP server is the missing link between "AI that talks about your site" and "AI that builds it." Connect one in a few minutes:

• Read the MCP setup docs.
• Follow the full WordPress vibe-coding guide.
• Or sign up for XeoRank and connect your first site.

New to the idea of building sites by chat? Start with our guide on building a WordPress site with AI.