Royal MCP Pro is Live - 300+ MCP tools (and growing), 7-day undo, builder-focused - Founding Members Special (Ending Oct. 31st)
WordPress Plugins
Free Tools
Claude Skills
Resources
Pricing Support My Account Cart
NEW IN 1.5.10 TablePress, Code Snippets and WPCode →

Royal MCP — Connect, manage and edit WordPress from your AI agent

By Jameson · Founder & Lead Developer · Updated October 2026

Royal MCP is a free WordPress plugin that connects AI Agents like Claude, ChatGPT, and Cursor directly to your WordPress site via the Model Context Protocol (MCP), plus the browser-based AI Agents rolling out now through Cloudflare's WebMCP bridge and more to come.

Royal MCP gives AI tools 109 core tools to read, create, edit, and manage your posts, pages, media, users, and settings through natural language, no manual dashboard work required.

Install alongside WooCommerce, Elementor, Divi, ACF, Yoast SEO, UpdraftPlus, WPForms, Solid Security, Wordfence, Contact Form 7, MonsterInsights, W3 Total Cache, LiteSpeed Cache, Duplicator, BuddyPress, Royal AI Firewall, or any of our Royal Plugins and Royal MCP auto-detects them, unlocking 150 additional tools for plugin-specific workflows: 250+ tools in total.

According to Stack Overflow's 2025 Developer Survey, 76% of developers now use AI coding assistants. And according to Anthropic (2025), the Model Context Protocol is supported by over 20 AI applications. Royal MCP bridges the gap between these AI tools and the 43% of the web powered by WordPress.

Royal MCP walkthrough
Royal MCP walkthrough thumbnail
Watch the walkthrough 5:00

“Try it live” launches a real WordPress admin in your browser with Royal MCP pre-configured, with a demo API key, enabled platforms, and sample activity log entries. No signup, closes when you leave the tab.

5.0 on WordPress.org 100,000+ downloads
security security passed passed Code Scanned
WordPress compatibility PHP compatibility Tested by plugintests.com
259 MCP Tools
10+ AI Platforms
25 Plugin Integrations
5 Page Builders

The bridge between WordPress and AI

WordPress
Your site, content & store data
Royal MCP
Translates AI requests into WordPress actions
AI Assistant
Claude, ChatGPT, Cursor & more

Royal MCP is a free WordPress plugin that gives AI Agents like Claude, ChatGPT, and Cursor full stack access to your WordPress site through 109 built-in tools, so you can create posts, manage media, work with custom post types, edit settings, and more via natural language. Works with every MCP-capable AI client out of the box via OAuth or API.

Claude
ChatGPT
Cursor
Gemini
Windsurf
Mistral
Perplexity
Groq
Cohere
Together AI

Royal MCP works with every MCP-capable client out of the box and with any other AI platform via WordPress’s REST API.

Set up Royal MCP in 3 steps

5 minutes or less.

No developer required. Full walkthrough videos on the Connect Claude and Connect ChatGPT pages.

1

Install free from WordPress.org

Search “Royal MCP” in your Plugins → Add New screen, or grab it from wordpress.org/plugins/royal-mcp/. One-click activate like any other WordPress plugin.

2

Grab your MCP URL

Open Royal MCP in the WordPress admin. The Connect screen surfaces your endpoint URL: https://yoursite.com/wp-json/royal-mcp/v1/mcp. Copy it.

3

Add as a connector, authorize, done

In your AI client of choice, name the connector, paste your URL, click Add, authorize the OAuth prompt in your browser. Full step-by-step: Connect Claude · Connect ChatGPT.

Connecting AI is the easy part. Trusting it is the job.

Any MCP plugin can connect an AI client to WordPress. Royal MCP is built for what comes next: changes you can review and reverse, layouts that stay editable, connections that work on the host you already have, and one place to run every site.

01Free

Safe by default

The AI starts with the least it needs. Turn on Drafts only and it can create and edit drafts while publishing, live pages and site settings are refused. Give each connected client Full, Drafts only or Read-only access, preview changes before they go live, and see every AI change from the last 72 hours with the value before and after, ready to undo.

Safety and recovery guide →
02Pro

Stays editable in your builder

What the AI builds is real builder content your team keeps editing, not a block of HTML. Royal MCP Pro creates native Elementor widgets and Divi modules and works with Elementor global classes and variables, theme-builder conditions and Divi global presets. Free already keeps pages as native Gutenberg blocks and covers the Elementor and Divi basics: outlines, clones, text and image swaps.

See Royal MCP Pro →
03Free

Works on real hosts

Shared hosting, firewalls, CDNs and security plugins are where most AI connections break. Royal MCP checks the usual blockers in Site Health, signs in with Claude and ChatGPT in the browser, connects with an API key when a host blocks sign-in, and comes with nearly 50 support guides for specific hosts, firewalls and CDNs.

Troubleshooting, start here →
04Royally · for Pro sites

Every site from one place

Running many client sites? Royally connects to sites running Royal MCP Pro and gives you monitoring, previews, approvals, receipts, undo and a kill switch across all of them.

Three layers. One protocol.

WordPress.org runs MCP for the plugin directory. Royal MCP runs it against your live site, with Drafts only, access levels and 72-hour undo built in. Royal MCP Pro adds 7-day undo, a 90-day audit log and endpoint profiles for agencies.

Layer 01 · Distribution
W

WordPress.org MCP

Manages the wp.org plugin directory. Validate readme files, check submission status, and submit plugins for review, all from inside Claude Code, Cursor, or VS Code.

For: Plugin authors submitting to wp.org
Shipped: March 2026
Read the announcement →
You are here
Layer 02 · Runtime
R

Royal MCP

Manages live WordPress sites. Read and create posts, edit pages, manage media, configure settings: 250+ tools across content, taxonomy, users, and store data, with Drafts only, per-client access levels and 72-hour undo.

For: AI tools managing live WordPress sites
Shipped: January 2026
Install Royal MCP →
Layer 03 · Agency runtime
R

Royal MCP Pro

Builds on the free plugin with 7-day undo, a 90-day audit log, endpoint profiles that choose which tools each connection sees, bulk edits with previews, and structural Elementor and Divi editing.

For: Agencies running AI against production
Shipped: August 2026
Explore Royal MCP Pro →

Every tool. Four ways in.

Every other WordPress MCP plugin we’ve reviewed ships one endpoint, one transport, one auth pattern (take it or leave it). Royal MCP registers every one of its 250+ tools through four separate access paths: its own MCP endpoint, the WordPress core Abilities API, the Automattic WordPress MCP Adapter, and now the WebMCP browser-agent standard. Same tools, whichever surface your AI stack already speaks.

1

Native MCP endpoint

Direct JSON-RPC over the /wp-json/royal-mcp/v1/mcp route. Full MCP 2025-11-25 spec, OAuth 2.0 discovery, session management. Claude Desktop, ChatGPT connectors, Cursor, and Windsurf hit this endpoint straight from your WordPress site, the same way any REST client would.

2

Core Abilities REST API

On WP 6.9+, every Royal MCP tool is discoverable at /wp-json/wp-abilities/v1/*. Standard WordPress authentication (Application Passwords, cookies, JWT). Any script, cron job, or third-party plugin that speaks REST invokes every Royal MCP tool without knowing what MCP is.

3

WordPress MCP Adapter

Sites running Automattic’s official WordPress MCP Adapter get Royal MCP’s tools through that adapter’s endpoint automatically. Same 250+ tools, whichever MCP server your fleet standardized on. Zero adapter configuration on the Royal MCP side.

4

WebMCP browser bridge

Browser AI can now use your Royal MCP tools directly. When a visitor is signed into your site, browser-based AI agents from any WebMCP-compatible bridge can call the same tools that Claude Desktop and ChatGPT already use, without any extra login step. Cloudflare’s WebMCP is the first bridge implementation shipping today; more are on the way. Off by default; one toggle in settings turns it on.

Nothing else in the WordPress MCP ecosystem ships this. Some competitors require a local Node.js MCP server to bridge, some only work through a browser extension, some ship a single HTTP endpoint with rigid client requirements. Royal MCP works with the WordPress core direction, the two standard access patterns above, and the emerging browser-agent standard, so whichever way your AI stack evolves, the tools stay reachable. Fully backwards compatible: existing OAuth clients keep working exactly as before.

Your MCP server, discoverable by every AI scanner.

Royal MCP now publishes an MCP Server Card, a Skills Index, and OAuth Protected Resource metadata at the standard well-known paths. Cloudflare’s Agent Readiness scanner, Vercel’s is-agentic, and Chrome Lighthouse’s Agentic Browsing audit all recognize your site as agent-ready with no extra setup.

/.well-known/mcp/server-card.json

Server card

A public discovery document at the standard well-known path. Names your MCP endpoint, supported protocol versions, auth methods, and tool categories. Any agent runtime can read it before touching the auth’d endpoint.

/.well-known/agent-skills/index.json

Skills index

Publishes your Royal MCP tool set as agent-callable skills, one entry per installed integration category. Auto-populates from what’s active on the site. Filter hook for customization.

Link: rel="mcp-server-card"

RFC 8288 Link headers

Every /mcp response carries a Link header pointing at the metadata documents, so agent runtimes that hit the endpoint find them without extra probing.

Verified by

Cloudflare Agent Readiness scanner (Level 3: Advanced Integration), Vercel is-agentic, and Chrome Lighthouse 13.3+ Agentic Browsing audit all recognize Royal MCP-installed sites without extra setup on your side. Fully backwards compatible: nothing changes for existing OAuth clients, and the discovery documents work whether or not you enable browser agents.

What Can You Do with Royal MCP?

Built for power users and developers who want seamless AI integration.

🔗

Claude Desktop Integration

Native MCP connector designed for Claude Desktop. Copy your Remote MCP Server URL and start chatting with your WordPress content immediately, or install the one-click .mcpb bundle from the plugin admin for zero-config setup.

🔒

Enterprise-Ready Security

API key authentication, OAuth with an optional Pending Clients approval gate for new connectors, per-request activity logging, and HTTPS enforcement. Every request is tracked, gated, and secured.

🛠

109 WordPress Tools

Full read/write access to posts, pages, custom post types, media, categories, tags, comments, users, menus, plugin settings, and site configuration. Sensitive credentials inside plugin settings are automatically redacted before AI sees them.

📊

Activity Logging

Complete audit trail of every AI interaction, plus a Protocol Insights dashboard that rolls it up weekly: which clients hit your endpoint, which MCP protocol versions they used, which methods they called most.

💻

REST API Endpoints

Standard WordPress REST API integration with JSON-RPC protocol. Supports MCP protocol versions 2024-11-05 through 2026-07-28.

🖼

Images and PDFs from the Chat

Hand ChatGPT or Claude an image or PDF and it goes straight into your media library, converted and compressed on the way in (for example, a JPEG under 400 KB).

🔄

Dry Run and Undo

High-blast writes like site options and permalink structure accept a dry-run flag, so the AI previews the exact change (current value, proposed value, size delta, affected URLs) before you approve the commit. Content, settings, menu, WooCommerce, Elementor and Divi writes also return a 72-hour undo token, and one call reverses the change.

Your site, your rules

Giving an AI client access to a site should never mean losing sight of it. Royal MCP gives you seven ways to limit, review and reverse what connected clients do, from inside wp-admin or from the terminal.

Drafts only

AI clients can create and edit drafts. Publishing, live pages and site settings are refused, so nothing goes live until you review it.

Settings › What AI clients may do

Access levels

Give each connected client Full, Drafts only or Read-only access. The API key and other MCP servers on the site get their own level.

Connected Clients · Settings

Recent Changes

Every AI change from the last 72 hours, with the value before, what the change wrote, and what it is now. The AI client can undo any of them.

Royal MCP › Recent Changes

Read-only mode

One switch refuses every tool that changes the site. All reads keep working, and clients can see which tools are marked.

Settings › What AI clients may do

Connected Clients

One row per AI client and user signed in through OAuth. Revoke access on any row, or revoke all at once.

Royal MCP › Connected Clients

Site Health tests

Four checks that catch the usual blockers before a client does: permalinks, discovery document, Authorization header reaching WordPress, sign-in addresses reachable.

Tools › Site Health

WP-CLI commands

Check connection health, list connected clients, rotate the API key, switch Drafts only on or off and set each client's access level from the terminal, on one site or in a loop over every site you manage.

WP-CLI command reference

What Does Royal MCP Look Like?

From inside WordPress, from inside Claude, from inside ChatGPT. See the full picture.

Inside WordPress

Connecting Claude

Two paths to connect: paste the Remote MCP Server URL manually, or download the .mcpb bundle from Royal MCP settings for one-click Claude Desktop install. No config, no copy-paste.

Connecting ChatGPT

See Royal MCP in Action

Setup walkthroughs, feature deep-dives, and real-world use cases, one video at a time.

How Does the Model Context Protocol Work?

Royal MCP exposes 109 core tools via MCP's JSON-RPC protocol. Complete WordPress access for AI platforms, following WordPress security best practices.

wp_get_posts
wp_get_post
wp_create_post
wp_update_post
wp_delete_post
wp_count_posts
wp_get_post_types
wp_get_pages
wp_get_page
wp_create_page
wp_update_page
wp_delete_page
wp_publish_and_promote
wp_create_preview_link
wp_get_media
wp_get_media_item
wp_upload_media
wp_upload_media_from_url
wp_update_media
wp_set_featured_image
wp_delete_media
wp_count_media
wp_get_taxonomies
wp_get_categories
wp_get_tags
wp_create_term
wp_update_term
wp_delete_term
wp_add_post_terms
wp_count_terms
wp_get_comments
wp_create_comment
wp_delete_comment
wp_get_pending_comments
wp_approve_comment
wp_spam_comment
wp_trash_comment
wp_get_users
wp_get_user
wp_get_site_info
wp_search
wp_get_menus
wp_get_menu_items
wp_create_menu
wp_create_menu_item
wp_update_menu_item
wp_delete_menu_item
wp_reorder_menu_items
wp_get_themes
wp_get_active_theme
wp_get_theme_mods
wp_update_theme_mod
wp_get_custom_css
wp_update_custom_css
wp_get_post_meta
wp_update_post_meta
wp_delete_post_meta
wp_get_term_meta
wp_update_term_meta
wp_delete_term_meta
wp_get_option
wp_update_option
wp_get_plugin_settings
wp_get_plugins
wp_get_seo_meta
wp_update_seo_meta
wp_get_permalink_structure
wp_update_permalink_structure
wp_get_post_revisions
wp_restore_revision
wp_get_site_status
wp_get_error_log_tail
wp_get_cron_schedule
royal_mcp_connection_health

Royal Plugin Tools

When other Royal Plugins or supported third-party plugins are active, Royal MCP automatically exposes 150 additional tools. Install any of these alongside Royal MCP and your AI gets dedicated commands for that plugin's functionality, no extra configuration required.

Integration tools auto-load only when the host plugin is active, so there's no overhead if you don't use them.*

*If you don’t see your favorite plugin on the list, it doesn’t mean it’s not supported, it just means we haven’t added dedicated MCP tools for it yet. Suggest coverage here →

Why we didn’t build another one-plugin MCP.

The MCP wave is coming to WordPress. WooCommerce is exploring one. Page builders are experimenting. Every major plugin author is asking the same question (“should we ship our own MCP server?”), and for most of them the honest answer is yes.

Which puts the burden on you. Every plugin that ships its own MCP is another endpoint to configure in Claude Desktop, another OAuth flow to walk through, another token to rotate, another health surface to babysit. Multiply that across the plugins on a typical WordPress site, times the AI clients your team uses, and you’re managing a fleet of connectors instead of your actual site.

Without Royal MCP
15+
Connectors to configure, per AI client
  • × OAuth flow per plugin
  • × Tokens per plugin to rotate
  • × Health surfaces to monitor
  • × Version compatibility to track
With Royal MCP
1
Connector for every plugin you install
  • ✓ One OAuth flow
  • ✓ One token to rotate
  • ✓ One health surface
  • ✓ Auto-adapts as plugins ship native MCPs

One connector, one OAuth, one health surface, running your whole plugin fleet. That’s Royal MCP.

Third-party research

91.5% of MCP servers ship without OAuth.

Royal MCP is in the other 8.5%. The four numbers on the right come from published third-party research, not our marketing.

We built Royal MCP with OAuth 2.1 by default, per-tool permission gates mapped to WordPress capabilities, a Pending Clients approval gate for new connectors, and a full activity log plus weekly Protocol Insights rollups for every read and write. No static API keys in .env files. No unauthenticated endpoints. The discipline that should have been standard from day one.

8.5%

of MCP servers use OAuth.

Astrix Security audit, 5,200+ servers, October 2025.

21,000+

publicly accessible MCP servers. Roughly half have no authentication in place.

Censys internet scan, May 2026.

106

zero-day vulnerabilities in an academic scan of 39,884 MCP repositories.

arXiv research, May 2026.

CVSS 9.6

critical vulnerability in a popular MCP proxy shipped across 437,000+ environments.

CVE-2025-6514, NIST database.

Who Is Royal MCP For?

Real examples of AI-powered WordPress workflows.

Content Creators

  • Claude, summarize my last 10 blog posts
  • Write a social media thread based on my latest article
  • Find all posts about marketing and create an outline
  • Draft a new post about our product launch

Site Administrators

  • List all posts not updated in 6 months
  • Show me comment statistics across my site
  • What plugins are currently active?
  • Find all draft posts and summarize them

Developers

  • Build AI-powered content workflows
  • Create custom integrations using MCP
  • Automate content management with AI
  • Generate documentation from site data
Now Available

Royal MCP Pro is live

Royal MCP Pro adds an agency-scale layer on top of the free plugin you already use: 7-day undo, a 90-day audit log, endpoint profiles that choose which tools each connection sees, bulk edits with previews, and structural Elementor and Divi editing.

$149/yr $79 /yr Founding Members, rate locked at renewal
Get Royal MCP Pro →

Common Questions

Setup takes about five minutes. Install Royal MCP from WordPress.org (same one-click flow as any other WordPress plugin), open the Connect screen in the plugin admin, copy your MCP URL, then paste it into Claude Desktop, ChatGPT, or Cursor as a custom connector. Authorize the OAuth prompt in your browser and you're done. No API key generation, no server configuration, no terminal commands. Full step-by-step walkthroughs with videos live at Connect Claude and Connect ChatGPT.
No. Royal MCP works for anyone with a WordPress site. Installation matches any other WordPress plugin. OAuth authorization runs in the browser. There's no wp-config.php to edit, no cloudflared tunnel to install, no configuration files to touch. If you've installed and activated a WordPress plugin before, you already have every skill needed to set up Royal MCP.
Royal MCP ships two per-IP rate-limit tiers as standard security defaults to protect your site from runaway or hostile traffic: 60 requests per minute for unauthenticated traffic and 300 requests per minute for OAuth-authenticated clients. Real AI clients (Claude Desktop, ChatGPT, Cursor) all connect via OAuth, so they run on the 300-per-minute tier. Both thresholds are yours to tune via the royal_mcp_rate_limit_max and royal_mcp_rate_limit_window WordPress hooks if a specific workload needs headroom. No daily allowance, no monthly quota, no metered tool call ceiling.
Yes. Royal MCP includes an optional Require approval before new AI clients can connect setting. When enabled, every dynamically-registered OAuth client (Claude Desktop, ChatGPT, Cursor, any MCP-capable tool) queues on the Pending Clients admin page for manual review. Inspect the redirect URI, source IP, and user agent, then Approve or Reject per row. The WordPress admin bar carries a live count badge so pending requests never sit unnoticed. Off by default so first-time setup stays one-click. Flip it on when you want gate-keeping.
No. Elementor 4.3 added its own MCP server (off by default) with element-level operations for Elementor V4 pages. Royal MCP takes a different angle: focused, composable tools built for repeated real-world tasks like clone a page, replace text across every module in one call, swap images, get an outline of a page's structure, on the classic (V3) Elementor pages most sites run. Both work side by side, and Royal MCP only notes Elementor's server when you have switched it on. Different layers of the same stack. See the Royal MCP Elementor Tools reference for the full per-tool guide.
Royal MCP offers 250+ MCP tools in a single plugin: WordPress core operations (posts, pages, media, users, settings) plus per-plugin integrations that auto-register when the underlying plugin is active: WooCommerce, Elementor, Divi, ACF, Yoast SEO, UpdraftPlus, WPForms, Solid Security, Wordfence, Contact Form 7, MonsterInsights, W3 Total Cache, LiteSpeed Cache, Duplicator, BuddyPress, GuardPress, SiteVault, Royal AI Firewall, ForgeCache, Redirection, Royal Links, Royal Ledger, and cross-plugin composers. One MCP endpoint, one OAuth setup, one WAF allowlist, instead of installing separate GitHub-distributed MCP plugins per integration, each with its own endpoint, tokens, and CDN bypass. Distributed through WordPress.org with auto-updates and security review on every release, free with no upsell.
Yes. Nine Divi tools cover both Divi 4 (shortcode format) and Divi 5 (block format), including safety-first reads (page format detection, page outline extraction, layout validation, saved layout listing, single library layout read) and builder-format-aware writes (find-and-replace with dry-run preview, page clone with fresh clientIds, image URL swap across every image-bearing element, and library-entry apply in merge or replace mode). Image swaps, page clones and library imports return a 72-hour undo token. Divi Builder plugin and Divi theme both supported.
No. Royal MCP's Elementor tools work with the free Elementor plugin. Its Divi tools work with both the free Divi Builder plugin and the paid Divi theme. Its WooCommerce tools work with free WooCommerce. Tools only appear when the underlying plugin is active, with no premium tier of any host plugin required to use any Royal MCP integration.
No. Royal MCP is a server that runs inside your WordPress site, so it doesn't call any external AI service. You connect your own AI client (Claude, ChatGPT, Cursor, or any other MCP-capable tool) to your site, and that client reads and writes through Royal MCP. All requests flow client → your WordPress → your database. We don't know whether the LLM you're using stores your context or trains on it, because that's beyond our layer and depends on the AI provider's terms. What we can promise: at Royal MCP's layer, we store nothing.
You can, and for a single-plugin site that might be the simplest path, but it stops being simple around the third or fourth connector. Each plugin's MCP lives at its own endpoint, which means each is a separate setup: separate OAuth flow, separate tokens, separate CDN cache-bypass rule, separate security-plugin allowlist. Wordfence, Sucuri, Cloudflare's WAF and APO all need to know about every new MCP endpoint or the OAuth callbacks silently 403 at the edge before your plugin ever sees them.

Royal MCP is one endpoint. Get /wp-json/royal-mcp/v1/mcp past your cache and security plugin once, and it keeps working as we add more integrations. Your AI still sees “your WordPress site,” not a growing list of URLs to babysit. And if a plugin ships its own MCP and you'd rather use their tools directly, Royal MCP doesn't interfere. You can run both side by side.

Ready to connect AI to WordPress?

Download Royal MCP for free from the WordPress Plugin Directory. No account required, no premium upsells.

Royal MCP

Version 1.5.10
✓ PASSED
Scan Date October 19, 2026
Files Scanned 112
Lines of Code 49,752
Scan Engines Regex, PHPCS