Not every WordPress MCP plugin is built the same. Some run the MCP server on your own site; others route every AI request through a vendor's proxy. Some ship real OAuth 2.1 with PKCE; others reuse WordPress Application Passwords. Some fail cleanly; others fail silently. These five questions separate real MCP servers from lead-gen funnels — ask them before you install anything.
The WordPress MCP Plugin Market Is Splitting
A year ago there were essentially no WordPress MCP plugins. Today there are dozens, and install counts on the largest are growing 50–70% month over month. Google “WordPress MCP” and you'll see landing pages that all look the same: promises about Claude and ChatGPT connecting to your site, screenshots of AI tool calls, a big install button.
Under the surface, these plugins are radically different. Two plugins that both claim to be “WordPress MCP servers” can have different architectures, different authentication models, different failure modes, and different long-term dependencies. Buyers rarely know to ask about any of that.
This guide is the criteria. Five questions. Ask them before you install, and the differences that matter become obvious.
Question 1 — Does It Run on Your Server, or Theirs?
This is the biggest architectural split in the market, and the one buyers usually miss.
Self-hosted MCP: The plugin installs on your WordPress site, spins up an MCP server there, and every AI request goes directly from the AI client to your site. The plugin does the work. No external service. No third-party proxy.
Vendor-relayed MCP: The plugin installs on your WordPress site, but it's mostly a thin client. Every AI request routes through the vendor's hosted proxy service. The vendor's servers see every call, hold your credentials, and are on your critical path.
Why it matters
- Uptime. If the vendor's proxy goes down, your AI stops working. If they get DDoSed, you're offline. If they price-hike, you pay or lose access.
- Privacy. A vendor-relayed setup means every prompt, every response, every tool call transits their infrastructure. They can log it. They can train on it (check the ToS). They can be subpoenaed for it.
- Independence. With a self-hosted MCP, you can uninstall the plugin and everything stops. With a vendor-relayed MCP, the vendor still holds account records, connection metadata, and possibly your data.
How to tell which is which
Look at the setup flow. If installing the plugin requires signing up for an account on the vendor's site, that's a strong signal it's vendor-relayed. If the pricing page has a monthly “SaaS” fee tied to the plugin, that's another signal. If the docs mention “our servers” or “our infrastructure” anywhere in the connection flow, that's the tell.
The self-hosted version just says “install the plugin, generate an API key or approve OAuth, connect your client.” No signup step. No monthly cost. No mention of “our infrastructure.”
Question 2 — How Does It Authenticate AI Clients?
There are three authentication models you'll see in WordPress MCP plugins today. They are not equivalent.
OAuth 2.1 with PKCE and Dynamic Client Registration (best)
OAuth 2.1 (RFC draft) with PKCE (RFC 7636) and Dynamic Client Registration (RFC 7591) is what modern MCP clients like Claude.ai's remote connectors expect. Each client gets its own credentials during a first-run handshake. Access tokens are short-lived and rotate automatically. You can revoke a single client's access without affecting anything else.
Scoped API keys (fine)
Long-lived opaque tokens generated in the plugin's admin UI, transmitted as a header. Works well for Claude Desktop config files, cron scripts, and CI. Weak point: if the key leaks, anyone with it has full access until you rotate. Fine for local/scripted use, not ideal for browser-based AI clients that can't securely store secrets.
WordPress Application Passwords (weak for this use case)
WordPress core's built-in application-password feature was designed for scripts and mobile apps, not for AI agents talking to your site continuously. Application passwords are long-lived shared secrets tied to a WordPress user, not per-client. If you connect three AI clients with the same password, you can't revoke one without breaking all three. Nothing forces rotation. And most damaging: with an application password, the AI client operates as the full WordPress user, not scoped down to MCP calls only.
The tell: if the plugin's docs say “log in with your WordPress username and application password,” that's the weak model. Modern MCP plugins that take security seriously ship OAuth 2.1 as the primary auth path.
Question 3 — Which AI Clients Can Actually Connect?
MCP is an open protocol, but not every WordPress plugin implementing it works with every AI client. The client landscape:
- Claude Desktop — local app, reads a JSON config file, expects an MCP server it can reach via HTTP or subprocess
- Claude.ai custom connectors — web-based, requires a publicly-reachable HTTPS endpoint with OAuth 2.1 support
- ChatGPT — via Actions/GPTs and increasingly native MCP support, requires OAuth or API-key authentication
- Gemini — growing MCP support via extensions
- Custom clients — anything that speaks the MCP HTTP transport spec
Some WordPress MCP plugins only ship a client for their own hosted app. If you're not using their app, you can't use their MCP. That's a walled garden in an ecosystem that specifically exists because MCP is an open standard.
What to look for: the plugin's docs should mention multiple named clients (Claude Desktop, Claude.ai web, ChatGPT, etc.) with setup instructions for each. If the docs only say “connect via [our app],” that's the walled-garden shape.
Question 4 — What Can the AI Actually Do on Your Site?
“WordPress MCP plugin” is a scope claim. The scope varies enormously.
- Single-plugin scope. Some MCPs cover only their own plugin's surface: an Elementor-only MCP does Elementor operations; a WooCommerce-only MCP does WC operations; nothing else. Fine if that's all you need. Frustrating when your workflow crosses plugins.
- WordPress core only. Others cover WordPress core (posts, pages, media, users, taxonomies) but nothing plugin-side. Useful for content ops. Useless for “update this product AND invalidate cache AND write SEO meta.”
- Cross-plugin scope. The most powerful shape: MCP covers WordPress core PLUS integrations for the plugins you actually use — WooCommerce, Elementor, ACF, Yoast/Rank Math, backup plugins, cache plugins, security plugins. This is where AI workflows compose across your stack.
Ask about the tool inventory
How many tools does the plugin expose? Which plugins are integrated? Can it publish a post + set featured image + write SEO meta + update a WooCommerce product + purge cache in one turn? That's the difference between a demo and a production tool.
A modern WordPress MCP plugin should have somewhere north of 100 tools if it's serious about cross-plugin coverage. Under 30 tools usually means single-plugin or core-only scope.
Question 5 — What Happens When the AI Makes a Mistake?
AI agents make mistakes. Every production MCP plugin needs three safety layers.
Layer 1: Permission gates on every tool
Every tool call must check WordPress user capabilities. Can a subscriber-role user trigger admin actions? Can a shop-manager user delete other users? A well-built MCP plugin runs current_user_can() checks on every tool call, gates writes behind capability requirements, and refuses anything the connected user isn't authorized for.
Layer 2: Activity logging
Every tool call the AI makes should be logged with timestamp, user, tool name, and arguments. Without this, you have no audit trail. If the AI does something surprising, you need to know what it did and when. Skim the plugin's admin UI for an “Activity” or “Audit” screen. If there isn't one, the plugin is not production-safe.
Layer 3: Reversibility
Three practical mechanisms:
- Post revisions. WordPress core keeps revisions of any post the AI edits. You can roll back from the post edit screen. Good MCP plugins use WordPress's native update APIs so this Just Works.
- Drafts by default. Destructive-by-nature operations (page clones, template imports, bulk changes) should save as drafts unless the caller explicitly asks for publish. Prevents surprise-live changes.
- Explicit undo or rollback. The best MCPs are starting to ship undo tokens or rollback APIs. Not universal yet; a signal of maturity when present.
The composite test: ask the plugin author (or read the docs) — “If the AI accidentally updates 50 products with wrong prices, what's my recovery path?” A good answer names the audit log, the WordPress revision system, or an explicit rollback path. A bad answer says “you'd have to fix them manually.”
How Royal MCP Handles These Five Questions
The transparent disclosure: Royal MCP is our plugin. We built it against these exact criteria. Here's how it scores on its own rubric:
- Q1 (Runs on your server?) Yes. Royal MCP spins up the MCP server on your WordPress install. No hosted proxy, no vendor relay, no external service in the data path. Uninstall the plugin, everything stops. No account records held anywhere else.
- Q2 (Auth model?) OAuth 2.1 with Dynamic Client Registration (RFC 7591), PKCE-S256 (RFC 7636), and metadata discovery (RFC 8414). Scoped API keys also supported for scripted/Desktop use. WordPress Application Passwords are not the primary auth model.
- Q3 (Which clients?) Claude Desktop, Claude.ai custom connectors, ChatGPT (via OAuth), Gemini extensions, and any raw HTTP client that speaks the MCP transport spec. No proprietary client requirement.
- Q4 (Scope?) 100+ tools spanning WordPress core plus integrations for WooCommerce, Elementor, ACF, and other popular plugins. Cross-plugin workflows in one turn.
- Q5 (Safety?)
current_user_can()checks enforced on every tool call across the codebase. Activity log with timestamp + user + tool + args for every call. Clone operations default to drafts. Post edits use WordPress's native revision system for one-click rollback. Full changelog and source publicly reviewable on GitHub.
None of this makes Royal MCP the only good answer. It makes the criteria checkable. Use them to evaluate any WordPress MCP plugin you're considering — ours included.
Try Royal MCP
- Install Royal MCP from the WordPress plugin directory.
- Royal MCP → Settings → generate an API key OR complete the OAuth setup for browser-based clients.
- In Claude.ai web: Settings → Connectors → Add Custom Connector, use URL
https://yoursite.com/wp-json/royal-mcp/v1/mcp, approve the OAuth consent screen. - In Claude Desktop: add Royal MCP to your MCP config JSON with the plugin URL and your API key.
- Ask Claude: “What can you do with my WordPress site?” and watch it enumerate the tools.
For full setup guides across all supported clients, see the Royal MCP setup documentation.
Disclaimer: Royal MCP is developed by Royal Plugins. This guide is written to help WordPress site owners and agencies evaluate any MCP plugin, ours included. The five criteria above are checkable questions — ask them of every plugin you're considering, read the docs, verify claims independently. WordPress plugin landscape changes fast; always confirm current features on the plugin's official listing.