{
  "markdown": "# wpagent-mcp\n\nAn [MCP](https://modelcontextprotocol.io) server that lets Claude — or any MCP-compatible client — actually operate a WordPress site: plugins, content, themes, menus, media, users, WooCommerce, Elementor and WP-CLI.\n\nIt talks to your site through the free [WpAgent](https://wpagent.dev) bridge plugin over a REST API where every request is signed with HMAC-SHA256. No site credentials are involved, and no data passes through a third-party service: the connection is client → your WordPress, directly.\n\n## Install\n\nNothing to install ahead of time — the config below fetches it on demand.\n\n1. Install the **WpAgent** plugin on your WordPress site and activate it.\n2. In the WordPress admin, open **WpAgent** and generate an API key. Choose the permissions you want the assistant to have; a read-only key is a sound way to start.\n3. Add the server to your MCP client. For Claude Desktop, in `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"wpagent\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"wpagent-mcp\"],\n      \"env\": {\n        \"WP_SITE_URL\": \"https://your-site.com\",\n        \"WP_API_KEY_ID\": \"wpaia_xxxxxxxxxxxx\",\n        \"WP_API_SECRET\": \"the secret shown once when you generated the key\"\n      }\n    }\n  }\n}\n```\n\nFor Claude Code:\n\n```bash\nclaude mcp add wpagent \\\n  --env WP_SITE_URL=https://your-site.com \\\n  --env WP_API_KEY_ID=wpaia_xxxxxxxxxxxx \\\n  --env WP_API_SECRET=... \\\n  -- npx -y wpagent-mcp\n```\n\n### Environment variables\n\n| Variable | Required | What it is |\n| --- | --- | --- |\n| `WP_SITE_URL` | yes | Your site's base URL, no trailing slash |\n| `WP_API_KEY_ID` | yes | The key id shown in the plugin |\n| `WP_API_SECRET` | yes | The secret, displayed once at generation |\n| `WP_SITE_LABEL` | no | A friendly name; defaults to the hostname |\n\n## What it can do\n\n| Area | Examples |\n| --- | --- |\n| Plugins | list, search wordpress.org, install, activate, deactivate, update, delete |\n| Content | posts, pages, products, any custom post type, with meta and featured images |\n| Themes | list, search, install, activate, theme mods, custom CSS, logo, colours |\n| WooCommerce | settings, orders, coupons, shipping zones, payment gateways, tax rates, stats |\n| Structure | menus, widgets, sidebars, taxonomies, terms, redirections |\n| Media | browse, upload, delete |\n| Users & comments | list, create, update, moderate |\n| Audit | best-practices check over security, SEO, performance, with auto-fixes |\n| WP-CLI | allowlisted commands, off unless enabled in `wp-config.php` |\n\n## What it will not do\n\nThe API has no path to arbitrary PHP, no path to your database, and no path to `wp-config.php`. WP-CLI execution is disabled unless the site owner adds `define('WPAIA_ENABLE_WPCLI', true);` on the server, and even then only allowlisted commands run — `db`, `eval`, `eval-file`, `shell`, `server`, `config` and `package` are always refused.\n\n## Safety\n\n- Every request is signed with HMAC-SHA256 and carries a timestamp; requests older than five minutes are rejected.\n- Permissions are per key and checked on every route, so a read-only key stays read-only.\n- Every call is written to an audit log you can read in the WordPress admin.\n- Revoking a key in WordPress takes effect immediately.\n\nAsk the assistant to confirm before destructive actions, and keep a current backup — it can delete content when you tell it to.\n\n## Related\n\n- [WpAgent](https://wpagent.dev) — hosted dashboard built on the same bridge, with a free read-only tier\n- The bridge plugin is GPL-2.0-or-later; this server is MIT.\n\n## Licence\n\nMIT © KipDev\n",
  "bytes": 3574,
  "sha": "ce9c7b09644cfbe82ededb3cd071720c02506ee1f2b9ae8700f7c4609bd61308",
  "repo_slug": "the-kipdev/wpagent-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_dev_wpagent_wpagent_mcp_e58bcc72/readme"
}