HandyMCP: MCP Server for Claude, ChatGPT and AI Agents

HandyMCP (Handy MCP) turns your WordPress site into an MCP server, so AI apps like Claude, ChatGPT, Cursor, GitHub Copilot, Windsurf and Gemini CLI can work on your site for you. Ask in plain words: “write a post about our new service”, “build a landing page in Elementor”, “put the hoodies on sale”. HandyMCP does the clicking, inside the permissions you choose, and site edits can be undone in one click.

MCP (Model Context Protocol) is the open standard AI apps use to connect to other software. Your site is the server: there is no HandyMCP account, no relay service and no usage quota. The AI app talks to your site directly and can never do more than your WordPress user is allowed to.

A free WordPress MCP plugin for Claude, ChatGPT and AI agents

HandyMCP is a free WordPress MCP server. Connect Claude (including Claude Code), ChatGPT, Cursor or another AI agent once, then ask it to write and update posts, build Elementor and block editor pages, fix SEO titles, add stock photos with alt text or update WooCommerce products. It also works as a WooCommerce MCP for your store and an Elementor MCP plugin that uses your real Elementor widgets, so you can keep editing the page by hand. No copying and pasting between tabs, and no extra AI subscription.

Why HandyMCP

Most MCP plugins give an AI app a way in. HandyMCP also gives you the controls to trust it on a real site:

• No usage caps. No daily caps, no credits and no per-call fees. Only per-minute rate limits, which you set.
• No relay, no vendor account. The MCP server is plain PHP running on your own site. AI apps connect to your site directly, so there is no hosted middleman, no sign-up and no usage fee. Your content never passes through our servers.
• Undo built in. Before a tool changes a post, page, term, menu item or product, HandyMCP records how it was. Undo it from the dashboard, or ask the AI.
• Permissions you control. Turn groups of tools off, make them read only, or switch off single tools. Permanent deletes need an explicit confirmation.
• Live pages stay safe. “Make a new version” creates a draft. A published page is only replaced when you clearly ask.
• Native page builder editing. Elementor and Gutenberg pages are built with their own widgets and blocks, so you can keep editing them by hand.
• Everything logged. The Activity screen lists every request, the app that sent it and the page it touched.

What the AI can do in the free version

• Posts and pages: list, read, search, create, edit, duplicate, schedule, trash and restore. Small text edits without resending the whole page.
• Block editor (Gutenberg): read blocks, insert, update and remove blocks, or build a whole page in one step.
• Elementor: list the widgets on your site (including addon packs such as ElementsKit, Happy Addons and Essential Addons), build and edit pages, change single elements, save templates and update global colors and fonts.
• WooCommerce (basic): list and read products, change titles, descriptions, prices, sale prices and stock, manage product categories, create and edit coupons, see low stock, and read orders.
• Contact forms: create and edit forms in Contact Form 7 and WPForms. Read forms and entries from Gravity Forms, Fluent Forms, Forminator, Formidable, Ninja Forms, MetForm and JetFormBuilder.
• Media and stock photos: upload images from a URL or straight from your ChatGPT chat, resize and convert them to WebP as they upload, crop, rotate and flip images, rebuild thumbnails, replace an image file while keeping its URL (with a backup to restore), write alt text and captions, add SVG icons, and search free photos on Openverse (or Pexels and Unsplash with a free key).
• Clear crash reports: when another plugin or theme crashes during a change, HandyMCP names it, tells the AI to check the result before trying again, and shows you a notice.
• Menus, categories and tags: create and edit menus and items, assign menu locations, create terms.
• SEO: find pages missing an SEO title or description, then set titles, meta descriptions and focus keywords with Yoast SEO or Rank Math.
• Undo: the last 20 changes, from the dashboard or by asking the AI.
• Site brief: write your brand voice, words to use and avoid, call to action and house rules once. Every connected AI app reads them before it writes anything.

Works with any MCP app

Claude (web, desktop, mobile and Claude Code), ChatGPT (developer mode connectors), Cursor, VS Code with GitHub Copilot, Windsurf, Gemini CLI, Zed, Cline and any app that supports remote MCP servers over HTTP. The Connection screen shows step by step setup for more than 20 apps.

Example prompts

• “Build a landing page for my webinar with Elementor as a draft, using my brand colors.”
• “Write SEO titles and meta descriptions for every page that is missing one.”
• “Find images without alt text and describe them.”
• “Which products are low on stock? Raise the price of the blue hoodie to 39.”
• “Create a contact form with name, email, budget and message, and add it to the Contact page.”

Safe by design

• Sign in with OAuth 2.1 and a clear approval screen (used by Claude and ChatGPT), personal access tokens, or WordPress Application Passwords.
• Only the user roles you allow can connect. Each app only gets the scopes you approve.
• Read-only mode lets AI apps look without changing anything.
• Destructive actions such as permanent deletes need confirmation.
• You decide who gets in. Connecting an AI app means you let that app act on the site as your WordPress user, inside the permissions you approve. The approval screen says so, and you can disconnect any app at any time.
• No tool runs arbitrary PHP, SQL or shell commands.
• No site administration: AI apps cannot install, activate, update or delete plugins or themes, manage users, change core settings or edit files. During an AI request these capabilities are removed from the connected user, even for administrators.
• Passwords and API keys are never logged. Rate limits stop runaway loops.

HandyMCP Pro

HandyMCP Pro adds full WooCommerce (orders, refunds, coupon rules, variations, reports), WPBakery, Divi, Beaver Builder, Avada and Flatsome (UX Builder, header, footer and theme options), Elementor Pro Theme Builder, Gravity Forms editing, safe plugin and theme updates with automatic rollback, scheduled updates, malware scan and cleanup, file edits with automatic restore, backups, translation and custom field plugins, full undo history and white label. It also adds WP-CLI style commands (no shell needed), a block theme builder with a private preview, safe PHP snippets in WPCode and Code Snippets, and full Wordfence control. The Agency plan adds a client sites hub to update and manage many sites from one place. Moving to Pro keeps your connected apps, settings and history.

Documentation | Prompt library | Support

External services

HandyMCP works on your own server. It only contacts outside services in these cases:

• Openverse (stock photo search). When an AI app uses the images_search tool, the search words, orientation and number of results are sent to the Openverse API (api.openverse.org). No personal data is sent. Openverse is run by WordPress.org. Terms, Privacy.
• Pexels (optional). Only when you add a Pexels API key in Settings > Photos: the search words and your key are sent to the Pexels API (api.pexels.com) during images_search and videos_search, and videos_add downloads the chosen video from Pexels. Terms, API terms, Privacy.
• Unsplash (optional). Only when you add an Unsplash access key in Settings > Photos: the search words and your key are sent to the Unsplash API (api.unsplash.com) during images_search. Terms, API guidelines, Privacy. When an Unsplash photo is added to the media library, the site also calls that photo’s Unsplash download link, as the Unsplash API guidelines require.
• Image and file downloads. When an AI app adds an image or uploads media from a URL (images_add, wp_upload_media), your site downloads that file from the address the AI app gives, usually the image service above. Only the file is requested.
• Anonymous error reports (optional, off by default). HandyMCP asks once whether you want to share them, and nothing is sent unless you choose Yes. You can turn it off any time in Settings. Once a day, and soon after the connection check finds a problem, a short report is sent to handymcp.com (handymcp.com/wp-json/sdl/v1/errors): which tools failed, the error messages with addresses, emails, keys and numbers removed, the type of AI app, connection check results, a one-way hash of your site (not its address), and your WordPress, PHP, theme and active plugin versions. No content, users, customers, IP addresses or keys are sent. Reports are kept for one year. Terms, Privacy.
• AI app sign-in. When an AI app connects with OAuth and identifies itself with a client metadata URL (part of the MCP authorization standard), your site reads that public document from the app’s own website to show its name and check its return address. No site data is sent.

The connection check in HandyMCP > Connection only calls your own site. It runs when you open that screen and also once a day in the background (WP-Cron), and it never contacts anyone else. HandyMCP has no license checks, no tracking without your consent and no update server of its own; updates come from WordPress.org.

Privacy and your AI app. HandyMCP does not send your content anywhere by itself. The AI app you connect (for example Claude or ChatGPT) receives what it reads through its own connection, such as posts, pages, products, orders and form entries, and handles it under that app’s own terms and privacy policy. Contact details in orders and form entries (such as email addresses and phone numbers) are masked by default, and passwords and API keys are never returned. You choose which abilities each app may use in HandyMCP > Abilities.