
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@cavort-it-systems/wordpress-mcp
Advanced tools
Lightweight WordPress MCP server - token-optimized REST API access
Lightweight WordPress MCP server for site management. 158 tools with token-optimized responses — REST API responses automatically slimmed from kilobytes to essentials.
v3.0 (BREAKING): Multi-site — one server instance manages any number of sites via a single WORDPRESS_SITES env var. Every tool now requires a site argument; use the new list_sites tool to discover configured ids. The old single-site env vars are removed. wp_activate_plugin / wp_deactivate_plugin / wp_delete_plugin now use cvrt-mcp-endpoints mcp/v1 routes and take the plugin file path (e.g. akismet/akismet.php) instead of a slug.
v2.1: Now includes Pro modules for ACF and WooCommerce via wp-pilot-pro.
v2.0: Extended tools for the cvrt-mcp-endpoints plugin — install plugins/themes from WordPress.org, database management, full widget/menu control, and more.
WordPress REST API returns extremely verbose JSON (~5-10KB per post). This server strips it down:
| Response | Before | After | Reduction |
|---|---|---|---|
wp_list_posts (10 posts) | ~50KB | ~2KB | 96% |
wp_get_post | ~5KB | ~200 bytes | 96% |
wp_list_plugins | ~15KB | ~800 bytes | 95% |
Less tokens = faster responses, lower costs, more context for your AI.
npm install -g @cavort-it-systems/wordpress-mcp
Or run directly:
npx @cavort-it-systems/wordpress-mcp
v3.0 is multi-site (BREAKING CHANGE). A single server instance now manages any number of WordPress sites, defined in one WORDPRESS_SITES env var as a JSON array of {id, url, username, password} objects. The old single-site env vars (WORDPRESS_SITE_URL, WORDPRESS_USERNAME, WORDPRESS_PASSWORD) are no longer read — set WORDPRESS_SITES instead.
Every tool (except list_sites) now requires a site argument naming the target site id. Call list_sites first to discover which ids are configured — it returns {id, url} for each site (passwords are never returned or logged).
Add to your MCP config (~/.claude.json or Claude Desktop settings):
{
"mcpServers": {
"wordpress": {
"command": "npx",
"args": ["@cavort-it-systems/wordpress-mcp"],
"env": {
"WORDPRESS_SITES": "[{\"id\":\"boardcouture\",\"url\":\"https://boardcouture.shop\",\"username\":\"cavortkonzepte\",\"password\":\"xxxx xxxx xxxx\"}]"
}
}
}
}
Add more sites by appending objects to the WORDPRESS_SITES array — one server instance handles them all.
claude mcp add wordpress \
-e WORDPRESS_SITES='[{"id":"boardcouture","url":"https://boardcouture.shop","username":"cavortkonzepte","password":"xxxx xxxx xxxx"}]' \
-- npx @cavort-it-systems/wordpress-mcp
git clone https://github.com/cvrt-jh/wordpress-mcp.git
cd wordpress-mcp
npm install && npm run build
Uses Application Passwords (WordPress 5.6+):
All responses are automatically trimmed. Example:
wp_get_post — from ~5KB to ~200 bytes:
// Before (WordPress REST API raw)
{"id":123,"date":"2026-01-15T10:30:00","date_gmt":"2026-01-15T09:30:00",
"guid":{"rendered":"https://example.com/?p=123"},"modified":"2026-01-20T14:00:00",
"modified_gmt":"2026-01-20T13:00:00","slug":"my-post","status":"publish",
"type":"post","link":"https://example.com/my-post/","title":{"rendered":"My Post"},
"content":{"rendered":"<p>Full content...</p>","protected":false},
"excerpt":{"rendered":"<p>Excerpt...</p>","protected":false},
"author":1,"featured_media":456,"comment_status":"open","ping_status":"open",
"sticky":false,"template":"","format":"standard","meta":{"footnotes":""},
"categories":[1,5],"tags":[10,20],"class_list":["post-123","type-post",...],
"_links":{"self":[...],"collection":[...],"about":[...],...}}
// After (slimmed)
{"id":123,"title":"My Post","slug":"my-post","status":"publish",
"date":"2026-01-15T10:30:00","modified":"2026-01-20T14:00:00",
"link":"https://example.com/my-post/","excerpt":"Excerpt...",
"author":1,"categories":[1,5],"tags":[10,20],"featured_media":456}
What gets stripped:
| Field | Where | Why |
|---|---|---|
guid, _links | everywhere | Internal WordPress data |
content.rendered | lists | Only included when explicitly requested |
meta, class_list | posts/pages | Theme/plugin metadata |
ping_status, comment_status | posts | Rarely needed |
template, format, sticky | posts | Theme-specific |
| HTML tags | excerpts | Clean text output |
| Pretty-print JSON | all | Compact single-line output |
Every tool below requires a site argument (the id from your WORDPRESS_SITES config), except list_sites itself.
list_sites - List configured site ids and URLs (no site argument; passwords never returned)These work with any WordPress site:
wp_site_info - Get site name, description, URLwp_get_settings - Get site settingswp_update_settings - Update site settingswp_get_namespaces - List REST API namespaceswp_list_posts - List posts with filterswp_get_post - Get single postwp_create_post - Create postwp_update_post - Update postwp_delete_post - Delete postwp_search_posts - Search postswp_list_pages - List pageswp_get_page - Get single pagewp_create_page - Create pagewp_update_page - Update pagewp_delete_page - Delete pagewp_list_users - List userswp_me - Get current userwp_get_user - Get user by IDwp_create_user - Create userwp_update_user - Update userwp_delete_user - Delete userwp_list_plugins - List pluginswp_get_plugin - Get plugin detailswp_activate_plugin - Activate plugin (mcp/v1; plugin is the file path, e.g. akismet/akismet.php)wp_deactivate_plugin - Deactivate plugin (mcp/v1; plugin is the file path)wp_delete_plugin - Delete plugin (mcp/v1; plugin is the file path)wp_list_themes - List themeswp_get_active_theme - Get active themewp_get_theme - Get theme detailswp_activate_theme - Switch themeswp_list_media - List media librarywp_get_media - Get media itemwp_update_media - Update media metadatawp_delete_media - Delete mediawp_list_categories - List categorieswp_create_category - Create categorywp_update_category - Update categorywp_delete_category - Delete categorywp_list_tags - List tagswp_create_tag - Create tagwp_update_tag - Update tagwp_delete_tag - Delete tagwp_list_comments - List commentswp_get_comment - Get commentwp_create_comment - Create commentwp_update_comment - Update/moderate commentwp_delete_comment - Delete commentwp_moderate_comments - Batch moderateThese require the cvrt-mcp-endpoints WordPress plugin to be installed and activated.
mcp_search_plugins - Search WordPress.org pluginsmcp_install_plugin - Install plugin from WordPress.orgmcp_update_plugin - Update single pluginmcp_update_all_plugins - Update all pluginsmcp_search_themes - Search WordPress.org themesmcp_install_theme - Install theme from WordPress.orgmcp_update_theme - Update single thememcp_update_all_themes - Update all themesmcp_delete_theme - Delete inactive thememcp_get_version - Get WordPress version infomcp_get_system_info - Get comprehensive system infomcp_check_updates - Check for all updatesmcp_update_core - Update WordPress coremcp_flush_rewrite - Flush rewrite rulesmcp_flush_cache - Clear all cachesmcp_get_tables - List tables with sizesmcp_search_replace - Search/replace in databasemcp_optimize_tables - Optimize all tablesmcp_clean_revisions - Delete old revisionsmcp_clean_comments - Delete spam/trash commentsmcp_list_options - List options with prefix filtermcp_get_option - Get single optionmcp_set_option - Create/update optionmcp_delete_option - Delete optionmcp_bulk_get_options - Get multiple optionsmcp_list_menus - List navigation menusmcp_get_menu_locations - Get theme locationsmcp_get_menu - Get menu with itemsmcp_create_menu - Create menumcp_delete_menu - Delete menumcp_add_menu_item - Add menu itemmcp_delete_menu_item - Delete menu itemmcp_assign_menu_location - Assign menu to locationmcp_list_sidebars - List all sidebarsmcp_get_sidebar_widgets - Get sidebar widgetsmcp_list_widget_types - List widget typesmcp_get_widget - Get widget detailsmcp_add_widget - Add widget to sidebarmcp_update_widget - Update widget settingsmcp_delete_widget - Remove widgetmcp_move_widget - Move widget to sidebarmcp_get_health - Site health scoremcp_get_debug_info - Debug informationmcp_get_php_info - PHP configurationmcp_get_plugins_health - Plugin health/updatesmcp_get_cron_status - Cron jobs statusmcp_run_cron - Run cron hook manuallyRequires wp-pilot-pro and Advanced Custom Fields.
acf_list_field_groups - List all field groupsacf_get_field_group - Get field group with schemaacf_export_field_groups - Export as JSONacf_import_field_groups - Import from JSONacf_get_post_fields - Get all fields for postacf_update_post_fields - Update multiple fieldsacf_get_post_field - Get single field valueacf_update_post_field - Update single fieldacf_get_term_fields - Get term ACF fieldsacf_update_term_fields - Update term fieldsacf_get_user_fields - Get user ACF fieldsacf_update_user_fields - Update user fieldsacf_list_options_pages - List options pagesacf_get_options_fields - Get options page fieldsacf_update_options_fields - Update options fieldsacf_get_repeater - Get repeater rowsacf_add_repeater_row - Add rowacf_update_repeater_row - Update rowacf_delete_repeater_row - Delete rowacf_reorder_repeater - Reorder rowsacf_get_flexible - Get layoutsacf_add_flexible_layout - Add layoutacf_update_flexible_layout - Update layoutacf_delete_flexible_layout - Delete layoutacf_reorder_flexible - Reorder layoutsacf_get_relationship - Get related postsacf_set_relationship - Set related postsacf_add_to_relationship - Add postsacf_remove_from_relationship - Remove postsacf_get_clone_references - Get clone field refsacf_get_field_object - Get field schemaRequires wp-pilot-pro and WooCommerce.
woo_list_products - List products with filterswoo_get_product - Get product detailswoo_create_product - Create productwoo_update_product - Update productwoo_delete_product - Delete productwoo_list_variations - List product variationswoo_create_variation - Create variationwoo_update_variation - Update variationwoo_delete_variation - Delete variationwoo_list_attributes - List attributeswoo_list_attribute_terms - List attribute termswoo_create_attribute - Create attributewoo_create_attribute_term - Create termwoo_list_categories - List product categorieswoo_create_category - Create categorywoo_update_category - Update categorywoo_delete_category - Delete categorywoo_list_tags - List product tagswoo_list_orders - List orderswoo_get_order - Get order detailswoo_update_order_status - Update statuswoo_add_order_note - Add notewoo_get_order_notes - Get noteswoo_list_customers - List customerswoo_get_customer - Get customerwoo_create_customer - Create customerwoo_update_customer - Update customerwoo_get_customer_orders - Get order historywoo_list_coupons - List couponswoo_get_coupon - Get couponwoo_create_coupon - Create couponwoo_update_coupon - Update couponwoo_delete_coupon - Delete couponwoo_sales_report - Sales reportwoo_top_sellers - Top selling productswoo_stock_report - Stock status reportwoo_get_product_meta - Get product metawoo_update_product_meta - Update product metawoo_bulk_update_stock - Bulk stock updatesrc/
index.ts # Entry: McpServer + StdioServerTransport
client.ts # WordPress REST API client (Basic Auth)
types.ts # Shared Zod schemas + jsonResult helper
slim.ts # Response slimming transformers
tools/
# Standard WP REST API (wp/v2)
site.ts # 4 tools
posts.ts # 6 tools
pages.ts # 5 tools
users.ts # 6 tools
plugins.ts # 5 tools
themes.ts # 4 tools
media.ts # 4 tools
taxonomies.ts # 8 tools (categories + tags)
comments.ts # 6 tools
# Extended (mcp/v1) - requires cvrt-mcp-endpoints plugin
mcp-plugins.ts # 4 tools - install from WordPress.org
mcp-themes.ts # 5 tools - install from WordPress.org
mcp-core.ts # 6 tools - updates, cache flush
mcp-database.ts # 5 tools - search-replace, optimize
mcp-options.ts # 5 tools - full options CRUD
mcp-menus.ts # 8 tools - navigation menus
mcp-widgets.ts # 8 tools - sidebar widgets
mcp-health.ts # 6 tools - diagnostics, cron
# Pro modules (mcp/v1) - requires wp-pilot-pro
mcp-acf.ts # 31 tools - ACF integration
mcp-woo.ts # 42 tools - WooCommerce
One server instance manages all your sites via the WORDPRESS_SITES env var (see Configuration). Call list_sites to see configured ids, then pass site: "<id>" to any other tool:
{
"mcpServers": {
"wordpress": {
"command": "npx",
"args": ["@cavort-it-systems/wordpress-mcp"],
"env": {
"WORDPRESS_SITES": "[{\"id\":\"site1\",\"url\":\"https://site1.com\",\"username\":\"admin\",\"password\":\"xxxx xxxx xxxx xxxx\"},{\"id\":\"site2\",\"url\":\"https://site2.com\",\"username\":\"admin\",\"password\":\"yyyy yyyy yyyy yyyy\"}]"
}
}
}
}
MIT
FAQs
Lightweight WordPress MCP server - token-optimized REST API access
We found that @cavort-it-systems/wordpress-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.