miniOrange Secure MCP Server is a complete WordPress MCP server plugin that turns your WordPress site into a fully working Model Context Protocol (MCP) server. Once installed, you can connect Claude to WordPress, connect ChatGPT to WordPress, or link any MCP-compatible AI in just 2 minutes. Ask AI t
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.9 and PHP 7.4.
SourceWordPress plugins · Nov 5, 2026
01 / Source details
Aboutthistool.
miniOrange Secure MCP Server is a complete WordPress MCP server plugin that turns your WordPress site into a fully working Model Context Protocol (MCP) server. Once installed, you can connect Claude to WordPress, connect ChatGPT to WordPress, or link any MCP-compatible AI in just 2 minutes.
Ask AI to write blog posts, edit Elementor and Kadence page layouts, manage custom post types and their custom fields, upload media, update WooCommerce products, manage Yoast SEO, moderate comments, handle contact form submissions, and much more, all through simple chat. With Governed REST API Access, AI can even use REST endpoints from your other plugins, under the same permissions.
Unlike other WordPress MCP server plugins that give AI full admin access, we put you in complete control. Role-based AI permissions, Turn each tool on or off, self-hosted OAuth 2.1 login, and full activity logs are all included, with no restrictions.
Quick Links
Official Website | ChatGpt Setup Guide | Claude Setup Guide | Documentation | Book a Demo
Key Features of the Secure WordPress MCP Server
Built security-first, so you can let AI work on a live site with confidence:
Every user connects their own AI – each person uses their own ChatGPT or Claude, limited to the tools you allow their role.
479 MCP tools in 33 categories – WordPress core, the block editor, menus and widgets, WooCommerce, Yoast SEO, Rank Math, Advanced Custom Fields, Elementor, Kadence, Contact Form 7, WPForms, Gravity Forms, Fluent Forms and more.
Block-by-block page editing – AI changes one heading, paragraph or button and leaves the rest of the page exactly as it was.
Changes show straight away – page caches are cleared automatically after every AI change, and drafts can be shared with an expiring preview link.
Governed REST API access – AI can use any WordPress REST endpoint, including those from your other plugins, with route-by-route, role-based permissions.
Agent Registry – decide, per WordPress role, exactly which tools an AI agent can use.
Self-hosted OAuth 2.1 with PKCE – the AI never sees your WordPress password.
Every call checked against WordPress capabilities – an AI can never do more than its user can do in wp-admin.
Full audit log – every call, allowed or refused, is recorded.
Safe theme and code editing – changes go to a draft, are syntax-checked and previewed, and publish with automatic backup and rollback.
Built-in troubleshooting – a Troubleshooting page finds out why an AI client can’t connect and tells you what to fix.
Everything runs on your own server. No third-party relay sits between your AI client and your site. When you connect through the miniOrange Gateway, your AI client’s requests pass through the gateway on their way to your site; the tools still run, and every permission is still checked, on your own WordPress site.
How to Install the WordPress MCP Server (2 Minutes)
01Log in to your WordPress admin dashboard.
02Go to Plugins → Add New .
03Search for Secure MCP Server .
04Click Install Now , then Activate .
Create Your First AI Agent
05Open Secure MCP Server from the WordPress admin sidebar.
06Click Register your first agent .
07Enter an agent name and click Next .
08Choose which abilities each user role can use, then click Create & Continue .
09Click Continue . You’ll see Connect your AI client .
How to Connect ChatGPT to WordPress
10Under Connect your AI client , select ChatGPT . A setup panel opens.
11Copy Your Site URL from the panel.
12Click the MCP Server for WordPress link in the panel. It opens the app in ChatGPT.
13Click Install Plugin .
14Enter your WordPress Site URL and click Continue .
15Click Allow Access . Now start chatting with your site through ChatGPT.
Full guide: Set up ChatGPT with WordPress using MCP
Each team member can connect their own ChatGPT the same way.
How to Connect Claude to WordPress
16Under Connect your AI client , select Claude . A setup panel opens.
17Open the connector page miniOrange MCP for WordPress and click Connect .
18Enter your site’s address. You’ll land on the sign-in gateway — paste your site’s URL there.
19Log in with your WordPress account and click Allow access . Your approved tools now appear in Claude – start chatting with your site.
Full guide: Connect WordPress with Claude using MCP
Video: Connect Claude to WordPress Using Secure MCP Server
Connect Gemini, Cursor, Windsurf & Any MCP Client
The plugin follows the open Model Context Protocol standard, so it works with Gemini, Cursor, Windsurf, and any MCP-compatible client. Connect several AI clients at once, each with its own permissions and audit trail.
Your MCP server endpoint: https://gateway.miniorange.ai/v2/mcp
What Your AI Agent Can Do
479 tools in 33 categories. Integration tools appear only when the related plugin is active.
WordPress Content
Posts & Pages (56 tools) – Create, publish, schedule, duplicate, set templates and featured images, trash and restore.
Categories, Tags & Media (45 tools) – Manage taxonomies, upload media from a URL or file, update alt text and captions, crop and resize images.
Revisions (9 tools) – List, compare and restore revisions and autosaves.
Comments (21 tools) – Moderate, reply, search, mark spam and view counts.
Custom Post Types & Fields (19 tools) – Discover any custom post type and edit its items, terms and fields.
Content Find & Replace (6 tools) – Change part of a post, custom field or setting without rewriting it.
Block Editor (12 tools) – Edit one block at a time: change its text or settings, insert, move, duplicate and delete blocks and patterns, and detach synced patterns.
Preview Links (2 tools) – Expiring links to share a draft without signing in.
Settings, Plugins, Themes & Updates (34 tools) – Site title, tagline, homepage, timezone, plugin activation and updates, auto-updates, site health.
Maintenance (8 tools) – Clear caches, refresh permalinks, run cron events, read the error log.
Theme Editing (41 tools) – Block templates, global styles, patterns and theme files, logo, site icon, Additional CSS and Customizer settings, with draft, preview, publish and restore.
Menus & Navigation (16 tools) – Build and reorder menus, assign locations, and edit block-theme Navigation menus.
Widgets & Sidebars (8 tools) – Add, update, move and delete widgets, including block widgets.
Site Overview (1 tool) – Tells the AI how your site is built and which tools it may use.
Governed REST API Access: Go Beyond Built-in Tools
AI can use any WordPress REST API endpoint – core, WooCommerce, Yoast or any other plugin – with no plugin update needed.
Read-only by default – a new AI agent can read posts, pages and media; any write needs your approval.
Granular control – allow each route and method (read or write) per user role, all logged.
Site-wide write switches – turn all create, update or delete REST calls off for the whole site in one click.
Dangerous routes stay blocked – plugin and theme installs, activations, batch and blueprint-import routes can never be granted.
WooCommerce MCP Server
Run your store through chat. Create and update products, attributes, categories and tags. Look up, create and update orders, change order status, add order notes and issue refunds. Manage customers, view purchase history and customer segments, and create or update coupons. Get sales, orders, products, customers, coupon usage and top-seller reports.
SEO MCP: Yoast SEO & Rank Math
Bulk-update SEO titles and meta descriptions, set focus keywords, mark cornerstone content, and control robots meta, advanced robots directives, canonical URLs, breadcrumb titles and sitemap inclusion. Manage Open Graph, Twitter/X cards and schema types. Rank Math SEO metadata is supported too.
Advanced Custom Fields (ACF) MCP
Read and update any ACF field value, in bulk or one at a time. Work with repeater rows, flexible content layouts, relationship fields and options pages. Create field groups, add fields, update location rules, check conditional logic, and validate a value before it is saved. You can also search posts by ACF field value.
Page Builder MCP: Elementor, Divi & Kadence
Elementor: read a page layout, change element text, images, links and styling without breaking the design, move, duplicate or delete elements, look up widget schemas and preview the rendered result.
Divi 4 & Divi 5: read Divi Builder layouts and update modules, text, images, links and styling through chat, without opening the visual builder. (Pro plan.)
Kadence Blocks: build new Kadence layout pages, insert rows, columns, headings, buttons, icons and images, update block text and styling, and set page layout options.
Forms & Leads MCP
Work with Contact Form 7 (via Flamingo), WPForms , Gravity Forms and Fluent Forms . List forms and fields, read and count entries, mark them read or unread, trash, restore or delete them, and export entries as CSV . Inspect form settings and notifications, and for Fluent Forms you can create, update and test notifications and confirmations.
Safe Theme & Code Editing
AI can now edit your theme safely:
Edit block templates, template parts, global styles, style variations and patterns.
Read, search and edit theme files – PHP, CSS, JavaScript and theme.json.
No
See it in action
Screenshots & previews.
Onboarding quick-start guide for registering your first AI agent.AI Agents list with role-based policies and ability packs.Agent overview showing configuration and recent activity.Activity log filterable by agent, status, ability, user and date.Connect to AI – setup for ChatGPT, Claude, Cursor and other MCP clients.MCP Server dashboard with active agents, executions, success rate and latency."Your AI Access" view showing a member's allowed tools and how to connect.
02 / Source details
Gettingstarted.
Requirements
01WordPress 6.9 or newer (Abilities API required)
02PHP 7.4 or higher (PHP 8.0+ recommended)
03HTTPS enabled (for OAuth login)
From your WordPress dashboard
04Go to Plugins → Add New Plugin .
05Search for miniOrange Secure MCP Server .
06Click Install Now , then Activate .
07Open Secure MCP Server from the admin sidebar and click Register your first agent .
08Name the agent, set ability access by user role, and click Create & Continue .
09Under Connect your AI client , choose Claude, ChatGPT or another client and follow the setup panel.
10Sign in to WordPress and click Allow Access . Done!
Manual installation
11Download the plugin zip.
12Go to Plugins → Add New → Upload Plugin and upload the zip.
13Activate the plugin and continue from step 4 above.
03 / Source details
Frequently asked questions.
What is an MCP server for WordPress?
MCP (Model Context Protocol) is an open standard that lets AI assistants use tools. This plugin makes your WordPress site an MCP server, so AI clients like Claude and ChatGPT can safely read and update your site through tools you control.
How do I connect ChatGPT to my WordPress site?
Install and activate Secure MCP Server, create an AI agent, and choose ChatGPT under Connect your AI client . Open the MCP Server for WordPress app in ChatGPT, enter your site’s address and click Allow Access . It takes about two minutes, and ChatGPT can then write posts, edit pages, manage WooCommerce products and more, using only the tools you allowed.
Can each person on my team connect their own ChatGPT or Claude?
Yes. Every WordPress user connects their own AI client with their own login, so each person’s AI works as them, is limited to their role, and is recorded under their name in the audit log. Team members find their connection steps under My AI Access in wp-admin.
Can I limit what an editor’s AI can do?
Yes. In the Agent Registry you choose, for each WordPress role, which tools an AI agent may use: for example, editors’ AI can write and edit posts but not install plugins or change settings. Every call is also checked against the person’s own WordPress permissions, so an AI can never do more than its user could do in wp-admin.
Which AI clients are supported?
Claude, ChatGPT, Gemini, Cursor, Grok, Windsurf and any MCP-compatible client.
How many tools are included?
479 tools in 33 categories, covering WordPress core, the block editor, menus, widgets, WooCommerce, Yoast SEO, Rank Math, Advanced Custom Fields, Elementor, Divi, Kadence, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, theme editing and site maintenance. Integration tools appear only when the related plugin is active.
Is it safe to give AI access to my WordPress site?
Yes. Access uses self-hosted OAuth 2.1 with PKCE, so the AI never sees your password. Every call is limited by role through the agent Registry, checked against WordPress capabilities, rate-limited and logged. You can require human approval for sensitive actions and mask sensitive data. Rate limits are enforced by the miniOrange Gateway; human approval and data masking are part of the Business plan.
Can the AI do more than my WordPress user can?
No. Every tool runs as the WordPress user who approved the connection, and every call is checked against that user’s capabilities exactly as in wp-admin.
Can AI use the REST API of my other plugins?
Yes. AI can discover and call any WordPress REST route, including those from WooCommerce, Yoast and other plugins, with no plugin update needed. A new agent starts with read-only access to core WordPress content. Writes and routes outside it need an explicit, per-role grant, and you can switch off all create, update or delete REST calls for the whole site. Plugin and theme install, activate, batch and blueprint-import routes are always blocked.
Can AI break my theme or site?
Theme changes never touch the live site directly. They go into a draft, PHP is syntax-checked and JSON validated, and you can preview the draft. Publishing takes a backup and rolls back automatically if the site fails to load, and you can restore any earlier publish.
Does it work with WooCommerce?
Yes. 41 tools cover products, attributes, orders, order notes, refunds, customers, coupons and sales reports.
Does it work with Yoast SEO and Rank Math?
Yes. 14 Yoast SEO tools cover titles, meta descriptions, focus keywords, cornerstone content, robots, canonicals, breadcrumbs, Open Graph, Twitter/X cards, schema and sitemaps. Rank Math SEO metadata is also supported.
Does it support Advanced Custom Fields (ACF)?
Yes. 25 ACF tools cover field values, repeaters, flexible content, relationships, options pages, field groups and location rules.
Does it support Elementor, Divi and Kadence?
Yes. Elementor (10 tools), Divi 3 and Divi 4, and Kadence Blocks (18 tools) are supported, so AI can read, edit, style and build layouts. Divi support (Divi 4 and Divi 5 layouts) is part of the Pro plan.
Can AI edit just one part of a page?
Yes. For pages and posts made in the block editor, the AI can list the blocks on a page and change one heading, paragraph, button, image caption or setting, insert new blocks or patterns exactly where you ask, and move, duplicate or delete a block, while every other block stays exactly as it was. Each change saves a revision you can restore. Pages built with Elementor, Divi or another page builder are edited with that builder’s own tools instead.
Can AI manage my menus and widgets?
Yes. The AI can create and rename menus, add pages, posts, categories and custom links, reorder and nest items, assign menus to your theme’s locations, and edit the Navigation menus used by block themes. It can also add, update, move and delete sidebar and footer widgets.
Why don’t I see the AI’s change on my site?
Page caches are cleared automatically after each AI change, for the most common cache plugins, managed hosts and CDNs. If a cache the plugin does not recognise still shows the old page, clear it from that cache’s settings, or ask the AI to clear the caches. A changed page is cleared straight away; to keep busy sites fast, the whole cache is cleared at most once a minute, so a site-wide change such as a menu edit can take up to a minute to show.
Which form plugins are supported?
Contact Form 7 (with Flamingo for submissions), WPForms, Gravity Forms and Fluent Forms, including CSV export of entries.
Can I disable specific tools?
Yes. Every tool has a global on/off toggle, and the agent Registry controls tools per role. Developers can also limit exposed tools with the MOSMCP_EXPOSED_PREFIXES constant. Tools are switched on or off for each agent and WordPress role in the Agent Registry’s role/ability matrix; a tool that is off for a user’s role is hidden from their AI client, and the AI is told how it can be turned on.
How do I revoke an AI client’s access?
Click Revoke in the agent Registry. Access ends immediately.
Can I connect multiple AI clients at the same time?
Yes. Connect as many as you need, each with separate permissions and its own audit trail.
What happens if an AI edit goes wrong?
Page lock blocks edits to content that changed after the AI read it, post revisions can be restored, theme changes publish with automatic backup and rollback, and destructive actions require confirmation.
Does my data go through a third-party server?
No. The MCP server and OAuth server run on your own WordPress site. Your AI client connects directly to your site. If you connect through the miniOrange Gateway (gateway.miniorange.ai), your AI client’s requests pass through the gateway on their way to your site; the tools still run, and every permission is still checked, on your own site.
Why does my AI client say it cannot reach my site?
AI clients need a public HTTPS URL. Sites on localhost or behind a firewall cannot be reached. Also make sure your CDN or cache is not caching the MCP endpoint. Open the Troubleshooting tab in Secure MCP Server to run a connection test; it lists the likely causes with the fix for each.
Do I need to know how to code?
No. Install, follow the onboarding checklist, and paste one URL into your AI client.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
