MountDev AI MCP Connector for WordPress

Connect ChatGPT, Claude or another AI assistant to your WordPress site, then ask it to do the work you would otherwise do by hand.

Connecting takes one address and a sign-in. There are no API keys to create, no client IDs to copy and nothing to paste into a configuration file. Claude and ChatGPT identify themselves automatically, using the published client metadata the Model Context Protocol defines for exactly this, and you approve the connection on your own site.

Ask it to draft and publish a post, tidy your menus, fix a typo on every page, or clear out spam comments. It works on your site directly, so there is no copying and pasting between a chat window and your admin screens.

You decide what it may touch. Access is granted with a profile, which is a named set of tools: read only, content editing, site administration, or one you build yourself. Everything the assistant does still runs through WordPress’s own permissions, so it can never do more than the account it signed in as.

What you can ask for

• Precise edits – change one sentence, or one word across the whole site, with every change previewed, checked and reversible
• Content – draft, edit, publish and schedule posts and pages, manage categories, tags and menus
• Media – upload images, set alt text, tidy the library
• Housekeeping – comments, users, plugins, themes and site settings
• Your other plugins – anything they offer as WordPress Abilities

Works with any plugin that registers WordPress Abilities

WordPress 6.9 added Abilities: a standard way for a plugin to describe what it can do, what it needs and who may use it. Any plugin that registers abilities gets tools in this connector, with nothing extra to install or configure. When the plugin updates its abilities, your assistant sees the change.

Every ability starts switched off, in every profile. You turn on the ones you want, profile by profile, and each is clearly labeled when it can change or delete things. The ability itself checks who may use it before anything runs.

Abilities need WordPress 6.9 or later. On older versions the connector’s own tools work as before.

Works with the assistants people actually use

• ChatGPT – paste the address, sign in, done
• Claude – paste the address, sign in, done (Claude.ai, Claude Desktop and Claude Code)
• Cursor, Windsurf and other editors – connect with a WordPress Application Password
• Any client that speaks the Model Context Protocol

Built for people who are responsible for a site

• Nothing is sent to us or to any third party. The assistant talks to your site and nowhere else.
• Client secrets are encrypted before they are stored.
• Access tokens expire after an hour; authorization codes after ten minutes.
• Only administrators can issue credentials.
• Every action respects the signed-in user’s WordPress capabilities, checked against the specific post, product or comment being touched.

Security

• OAuth 2.0 with PKCE – authorization requires a logged-in WordPress user and an explicit approval step
• AES-256-CBC encryption – client secrets encrypted at rest
• Token expiry – access tokens last an hour, refresh tokens 30 days, authorization codes ten minutes
• Per-object capability checks – a tool checks rights over the specific object, not just a broad capability
• Administrator-only credentials – only administrators can issue or view OAuth credentials
• No privilege escalation – the assistant can never exceed the permissions of the account it signed in as

External Services

This plugin talks to your site and nothing else. No data is sent to Cascadia Web Services or to any third party.

For editors that cannot connect to a remote MCP server themselves, the plugin includes an optional Node.js bridge script that runs on your own computer. It passes requests between the editor and your site’s REST API at:

• https://yoursite.com/wp-json/mountdev-ai-mcp-connector/v1/messages
• https://yoursite.com/wp-json/mountdev-ai-mcp-connector/v1/oauth/*

It sends your WordPress username and Application Password to authenticate, along with whatever the assistant is asking for. Everything stays between your computer and your own server.

The settings page has links to cascadiawebservices.com. Nothing is loaded from that site, and nothing is sent to it unless you click a link.

License

This plugin is licensed under the GPL v3 or later.

See https://www.gnu.org/licenses/gpl-3.0.en.html for details.

Icons on the settings page are from Lucide (https://lucide.dev), licensed under the ISC license. See licenses/lucide.txt.