Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
-
No community reviews yet
Ran this server? Tell others if you would trust it in production. Reviews are separate from our grade.
Write a reviewWhy it got an A
The official MCP Adapter plugin from the WordPress project (GPL-2.0 or later, v0.7.1 on 2026-10-16, 70,000+ active installs on WordPress.org). It reads the Abilities API, which is in WordPress core since 6.9, and shows the abilities that plugins mark as public to AI clients as MCP tools, resources or prompts. A default server at /wp-json/mcp/mcp-adapter-default-server offers three meta-tools to find and run them, and plugins can add their own servers with a fixed tool list. Local sites can connect over stdio with wp mcp-adapter serve. Remote clients sign in with a WordPress Application Password, which WordPress only offers over HTTPS outside local sites. Each call passes a server-wide login gate and the ability's own permission check. Active: last commit 2026-11-11 and 12 human authors in the last 90 days. One high advisory on record, GHSA-7x77-5r4r-q4rf (CVSS 8.1, published 2026-10-23): before 0.5.0, a custom transport check that denied access by returning WP_Error was ignored, so any logged-in user, even a Subscriber, could use an admin-only server. The fix shipped in 0.5.0 in April 2026, months before the advisory went public. It replaces Automattic's archived wordpress-mcp plugin. The grade covers the adapter, not the abilities other plugins register through it. Biggest deduction: authentication, because an Application Password has no scopes and no OAuth and can do everything its WordPress user can, so connect as a dedicated user with the lowest role that does the job and create one password per client.
How to connect
// ~/.cursor/mcp.json (docs/getting-started/site-owners.md)
{
"mcpServers": {
"my-wordpress-site": {
"command": "npx",
"args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
"env": {
"WP_API_URL": "https://example.com/wp-json/mcp/mcp-adapter-default-server",
"WP_API_USERNAME": "your-username",
"WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
}
}
}
}# docs/getting-started/site-owners.md. Base64 of "username:application-password", one line
claude mcp add --transport http my-wordpress-site \
https://example.com/wp-json/mcp/mcp-adapter-default-server \
--header "Authorization: Basic PASTE_THE_BASE64_HERE"// Settings > Developer > Edit Config (docs/getting-started/site-owners.md)
{
"mcpServers": {
"my-wordpress-site": {
"command": "npx",
"args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
"env": {
"WP_API_URL": "https://example.com/wp-json/mcp/mcp-adapter-default-server",
"WP_API_USERNAME": "your-username",
"WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
}
}
}
}Is WordPress MCP Adapter safe?
Is WordPress MCP Adapter safe to use?
WordPress MCP Adapter grades A (strong public trust signals). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can.
Does WordPress MCP Adapter have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does WordPress MCP Adapter support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Developer Tools
- A Appwrite MCP ServerOfficial Appwrite server that exposes databases, users, functions, teams and storage as tools, hosted with OAuth or run locally with a project API key.
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
Embed this badge
[](https://trustedmcp.io/servers/wordpress-mcp-adapter)<a href="https://trustedmcp.io/servers/wordpress-mcp-adapter"><img src="https://trustedmcp.io/badge/wordpress-mcp-adapter.svg" alt="TrustedMCP grade A" height="80"></a>Community reviews
No published community reviews yet.
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.