WordPress MCP

Manage WordPress sites via MCP (Model Context Protocol) through AI Engine. Use for creating/editing posts, SEO analysis, analytics, media management, taxonomy operations, social media scheduling, multilingual content (Polylang), and any WordPress admin task. Requires AI Engine plugin (free) with MCP Server enabled. Also use when asked about WordPress site management, content workflows, or WP-related tasks.

Security Scan

The skill appears to implement a legitimate WordPress admin interface (via AI Engine MCP) but has important inconsistencies and high‑privilege operations that you should understand before use — notably it requires a Bearer token in practice but does not declare any credentials in its metadata and exposes tools that can modify code and run SQL.

Purpose & Capability

The name/description (manage WP via AI Engine MCP) aligns with the documented tools: posts, media, SEO, Polylang, WooCommerce, plugin/theme management and database queries. Those capabilities are appropriate for an administrative WP management skill. However the skill metadata declares no required credential or primary credential while the SKILL.md clearly requires a site URL and a Bearer Token — this mismatch is important (the skill will not function without that secret).

Instruction Scope

SKILL.md explicitly instructs the agent how to call the MCP endpoint and to store URL+Bearer Token in a TOOLS.md file. The documented tools permit extremely powerful actions (write plugin/theme files, install/activate plugins/themes, execute arbitrary SQL via wp_db_query, dynamic REST access). Those actions are coherent for a full admin toolset, but they are high privilege and can alter site code or data. The instructions do not attempt to restrict use of these dangerous operations (beyond a note of caution for SQL), so the agent could perform destructive or invasive actions if invoked with an admin token.

Install Mechanism

Instruction-only skill, no install spec and no code files to run on the agent host — this minimizes local install risk. Nothing is downloaded or written by the skill package itself.

Credentials

Metadata lists no required environment variables or primary credential, but SKILL.md requires a Bearer Token and MCP URL stored in TOOLS.md. The skill therefore implicitly needs a secret (site administrator token) but does not declare it in the registry. This lack of declared credential handling is an incoherence that could cause accidental token exposure (e.g., if stored in a shared doc or memory). The operations the token enables (file writes, SQL, plugin activation) justify needing a high‑privilege secret, but the skill should explicitly declare that requirement and guide secure handling.

Persistence & Privilege

always:false and no install steps that persist on the agent host. The skill can be invoked autonomously by models (default platform behavior), which increases blast radius if combined with other issues, but autonomy alone is not a new red flag here.

What to consider before installing

This skill appears to be a coherent controller for WordPress sites via AI Engine's MCP, but take these precautions before installing or using it: 1) Treat the Bearer Token as a high‑privilege secret — only use tokens for sites you administrate and avoid storing them in publicly accessible files; prefer short‑lived or scoped tokens if possible and revoke them after use. 2) Limit enabled MCP features on the target site — do not enable Database, Plugins, Themes, or Dynamic REST unless you explicitly need them, because those tools allow writing code and running SQL. 3) Because the package metadata does not declare the needed credential, assume the agent will require you to provide the token in conversation or a local TOOLS.md; avoid pasting tokens into shared chats or documents. 4) Verify the AI Engine plugin installation and inspect which MCP tools are exposed (run tools/list) before asking the agent to make destructive changes. 5) If you need to run sensitive operations (installing plugins, modifying theme files, direct SQL), perform them manually or under strict supervision rather than granting an automated agent broad autonomous privileges. If you want a higher assurance rating, ask the skill author/source for an explicit credential declaration, changelog, and a homepage or repo to verify origin.

Manage WordPress sites through AI Engine's MCP Server. AI Engine is a free WordPress plugin that exposes a comprehensive MCP interface.

Setup

The user needs:

1. AI Engine plugin installed (free: https://wordpress.org/plugins/ai-engine/)
2. MCP Server enabled in AI Engine → Settings → MCP
3. A Bearer Token set in MCP settings

Connection details should be stored in the user's TOOLS.md:

## WordPress MCP
- **URL:** https://example.com/wp-json/mcp/v1/http
- **Bearer Token:** <token from AI Engine MCP settings>

How to Call MCP Tools

All calls use JSON-RPC 2.0 over HTTP POST:

curl -s -X POST <MCP_URL> \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"<tool_name>","arguments":{...}}}'

Discovery

List available tools (varies by enabled features):

{"jsonrpc":"2.0","id":1,"method":"tools/list"}

Always start with tools/list to discover what's enabled on this site.

Connectivity Check

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"mcp_ping","arguments":{}}}

MCP Features (Modular)

Tools are grouped into features that the site admin enables in AI Engine → Settings → MCP Features. Only WordPress core is enabled by default. Always use tools/list to discover what's available.

Feature	Default	Description
WordPress	✅ On	Posts, pages, comments, users, media, taxonomies, settings
Plugins	Off	Install, activate, update, and modify plugins
Themes	Off	Install, activate, switch, and customize themes
Database	Off	Execute SQL queries on the WordPress database
Polylang	Off	Multilingual content (requires Polylang plugin)
WooCommerce	Off	Products, orders, customers (requires WooCommerce)
SEO Engine	Off	SEO analysis, analytics (requires SEO Engine plugin)
Social Engine	Off	Social media scheduling (requires Social Engine plugin)
Dynamic REST	Off	Raw access to WordPress REST API

See references/features.md for tool details per feature.

Common Workflows

Content Audit (WordPress + SEO Engine)

1. mwseo_get_seo_statistics — Overall site health
2. mwseo_get_posts_needing_seo — Posts with SEO problems
3. Loop: mwseo_do_seo_scan per post → fix with mwseo_set_seo_title, mwseo_set_seo_excerpt

Publish a Post (WordPress core)

1. wp_create_post with post_title, post_content, post_status: "draft"
2. Optionally set SEO metadata if SEO Engine is enabled
3. wp_update_post with post_status: "publish" when ready

Translation Workflow (Polylang)

1. pll_translation_status — See coverage gaps
2. pll_get_posts_missing_translation with target language
3. pll_create_translation — Create translated post linked to original

Multi-Site Management

Store multiple sites in TOOLS.md and select by name:

### My Blog
- **URL:** https://blog.example.com/wp-json/mcp/v1/http
- **Token:** abc123

### My Shop
- **URL:** https://shop.example.com/wp-json/mcp/v1/http
- **Token:** xyz789

Tips

• Use wp_get_post_snapshot instead of multiple calls — gets post + meta + terms in one request
• Use wp_alter_post for search-replace edits instead of re-uploading entire content
• wp_get_posts returns no full content by default — use wp_get_post for content
• Analytics date params use start_date / end_date (not camelCase)
• Always run tools/list first — available tools depend on which features the admin enabled