# Browser AI can now use your WordPress site.
> Royal MCP lets browser AI use your WordPress tools via the Cloudflare WebMCP bridge; Cloudflare, Vercel and Lighthouse scanners mark the site agent-ready.
- Canonical:
- Last updated: 2026-10-21
- HTML version:
---
- [Overview](https://royalplugins.com/royal-mcp/)
- [Features](https://royalplugins.com/royal-mcp/features/agent-ready/)
[Ways to connect](https://royalplugins.com/royal-mcp/features/connect/)
[Works with other MCP plugins NEW](https://royalplugins.com/royal-mcp/features/works-with-other-mcp-plugins/)
[Agent Ready NEW](https://royalplugins.com/royal-mcp/features/agent-ready/)
[Safety and Recovery NEW](https://royalplugins.com/support/royal-mcp/safety-and-recovery/)
- [Getting Started](https://royalplugins.com/royal-mcp/connect-claude/)
[How It Works](https://royalplugins.com/royal-mcp/how-it-works/)
[WordPress MCP Guide NEW](https://royalplugins.com/royal-mcp/wordpress-mcp/)
[Connect Claude](https://royalplugins.com/royal-mcp/connect-claude/)
[Connect ChatGPT](https://royalplugins.com/royal-mcp/connect-chatgpt/)
[Editing Elementor with Claude](https://royalplugins.com/blog/editing-elementor-with-claude-four-workflows/)
- [Troubleshooting](https://royalplugins.com/support/royal-mcp/troubleshooting-start-here/)
[Start Here — Quick Checklist](https://royalplugins.com/support/royal-mcp/troubleshooting-start-here/)
[Diagnose with curl](https://royalplugins.com/support/royal-mcp/diagnose-mcp-with-curl/)
[Common Patterns](https://royalplugins.com/support/royal-mcp/#troubleshooting)
- [Developers](https://royalplugins.com/support/royal-mcp/add-your-plugin-tools/)
[Add your plugin’s tools](https://royalplugins.com/support/royal-mcp/add-your-plugin-tools/)
[Shape replies with filters](https://royalplugins.com/support/royal-mcp/exposing-customer-email-via-filter/)
[WP-CLI commands](https://royalplugins.com/support/royal-mcp/wp-cli-commands/)
[GitHub repository](https://github.com/royalplugins/royal-mcp)
- [Support](https://wordpress.org/support/plugin/royal-mcp/)
- [All Docs](https://royalplugins.com/support/royal-mcp/)
Overview
Features — Ways to connect
— Works with other MCP plugins (NEW)
— Agent Ready (NEW)
— Safety and Recovery (NEW)
Getting Started — How It Works
Getting Started — Connect Claude
— WordPress MCP Guide (NEW)
— Connect ChatGPT
— Editing Elementor with Claude
Troubleshooting — Start Here
— Diagnose with curl
— Common Patterns
Developers — Add your plugin’s tools
— Shape replies with filters
— WP-CLI commands
— GitHub repository
Support (wp.org Forum)
All Docs
New in 1.5.1
Royal MCP 1.5.1 supports the WebMCP browser-agent standard on the server side, and publishes MCP Server Card, Skills Index, and OAuth Protected Resource metadata at the standard well-known paths. Cloudflare Agent Readiness scanner, Vercel is-agentic, and Chrome Lighthouse 13.3+ Agentic Browsing audit all recognize your site as agent-ready with no extra setup.
By Jameson · Founder & Lead Developer
[Get Royal MCP](https://wordpress.org/plugins/royal-mcp/)
Two auth paths, one endpoint
External clients
OAuth Bearer
Claude Desktop, ChatGPT, Cursor, mcp-remote
Browser agents
Cookie + nonce
WebMCP bridge rides visitor session
POST /wp-json/royal-mcp/v1/mcp → 200 OK
Overview
## What "agent-ready" means for your site
Two things ship together in Royal MCP 1.5.1: browser AI can now call your MCP tools, and every scanner that grades sites for AI-agent compatibility recognizes yours.
Through Royal MCP 1.5.0, connecting an AI to your WordPress site meant one path: an external MCP client (Claude Desktop, ChatGPT connectors, Cursor, Windsurf, mcp-remote) authenticating with an OAuth Bearer token. That path is still here and unchanged.
Royal MCP 1.5.1 adds a second path: **browser-based AI agents**. When a visitor is signed into your site, browser-based AI from any [WebMCP-compatible bridge](https://www.w3.org/community/webmcp/) can call the same Royal MCP tools that Claude Desktop and ChatGPT already use, without any extra login step. Cloudflare's WebMCP bridge (developer preview shipped 2026-08-06 in [Agent Readiness Labs](https://blog.cloudflare.com/webmcp/)) is the first bridge implementation shipping today. More are on the way.
The second piece: Royal MCP now publishes an **MCP Server Card**, a **Skills Index**, **OAuth Protected Resource metadata**, and **RFC 8288 Link headers** at the standard well-known paths that Cloudflare Agent Readiness scanner, Vercel is-agentic, and Chrome Lighthouse 13.3+ Agentic Browsing all check for. Sites running Royal MCP 1.5.1 pass those checks automatically. Fully backwards compatible — every existing OAuth client keeps working exactly as it did in 1.4.x.
Third-party validators
## Recognized by every AI-readiness scanner
Independent scanners from Cloudflare, Vercel, and Google Chrome all check for the same standard discovery signals. Royal MCP 1.5.1 emits them out of the box.
### Cloudflare Agent Readiness
Cloudflare's public scanner grades sites Level 1 through Level 4 on AI-agent compatibility. Royal MCP sites clear Level 3 (Advanced Integration) automatically once the plugin is active. The [Cloudflare WebMCP bridge](https://blog.cloudflare.com/webmcp/) shipped in Agent Readiness Labs on 2026-08-06.
### Vercel is-agentic
Vercel's open-source scanner ([github.com/vercel-labs/is-agentic](https://github.com/vercel-labs/is-agentic)) checks for the standard well-known discovery documents and OAuth Protected Resource metadata. Royal MCP publishes all of them at the RFC-standard paths.
### Chrome Lighthouse 13.3+
Google's built-in Lighthouse audit shipped Agentic Browsing checks in version 13.3. Same discovery signals, integrated into every Chrome DevTools install. Royal MCP-installed sites score the Agentic Browsing category with no manual work.
**Why "recognized" is the right word.** Royal MCP does not partner with any of these scanners. It emits the standard discovery documents that every scanner in this category reads. When new scanners launch (and they will — the browser-agent category is where the entire industry is heading), Royal MCP sites already speak the shape those scanners look for.
Discovery documents
## Three well-known paths, auto-published
Royal MCP writes and refreshes three JSON discovery documents at the standard well-known paths, plus emits RFC 8288 Link headers on every /mcp response.
### `/.well-known/mcp/server-card.json`
The MCP Server Card. Names the server, lists the protocol revisions it speaks (2024-11-05, 2025-06-18, 2025-11-25, 2026-07-28), advertises supported capabilities, and links to the OAuth authorization server metadata. Scanners read this first.
### `/.well-known/agent-skills/index.json`
The Skills Index. Enumerates the capability categories the server exposes (WordPress content, WooCommerce, GuardPress security, ForgeCache, Elementor discovery, etc.) so an agent can plan a task without loading every tool schema up front.
### `Link headers (RFC 8288)`
Every response from `/wp-json/royal-mcp/v1/mcp` and `/mcp` carries Link headers pointing scanners at the server card and skills index. Plus `/.well-known/oauth-protected-resource` per RFC 9728 for OAuth discovery.
Under the hood
## Two auth paths, one endpoint
External clients keep using OAuth Bearer tokens. Browser agents ride the visitor's own WordPress session with cookie authentication and a nonce check.
### What the cookie path adds
The WebMCP bridge in the visitor's browser sends requests with `credentials: 'same-origin'`. The bridge acts as the visitor would. Every safeguard the WordPress admin already relies on carries over:
- Only fires when the visitor is signed into your site (session cookie required)
- `X-WP-Nonce` header enforced on every cookie-authenticated request
- Tool-level capability checks (visitor can only invoke what their role allows)
- Per-tool rate limiting with Retry-After compliance
- Off by default — one toggle in Royal MCP settings turns it on
- Zero change to the OAuth Bearer path — every existing client keeps working
#### Request routing
POST /wp-json/royal-mcp/v1/mcp
Authorization: Bearer …
→ **OAuth path** (Claude Desktop, ChatGPT, Cursor)
Cookie + X-WP-Nonce
→ **WebMCP path** (visitor's browser agent)
Same endpoint, two auth paths. Route selected per-request based on which credentials are present.
Setup
## How to enable browser agents
Four steps. Discovery documents already emit as soon as Royal MCP 1.5.1 is active — the toggle just opens the browser-agent auth path.
### Update to 1.5.1+
Install or update Royal MCP from **WP Admin → Plugins → Add New**. It is free from wp.org.
### Open Royal MCP Settings
Navigate to **Royal MCP → Settings** and scroll to the "Browser agents (WebMCP)" section.
### Turn on WebMCP
Flip the master toggle. The status pill shows whether a WebMCP bridge is detected on your domain.
### Verify discovery
Visit `yoursite.com/.well-known/mcp/server-card.json`. JSON → you are done.
FAQ
## Common questions
WebMCP is a [W3C browser-agent standard](https://www.w3.org/community/webmcp/) co-authored by Google and Microsoft, letting browser-based AI agents call tools registered by the current page. Royal MCP 1.5.1 supports WebMCP on the server side, so any WebMCP-compatible bridge in the browser can call your Royal MCP tools directly. [Cloudflare's WebMCP bridge](https://blog.cloudflare.com/webmcp/) (developer preview shipped 2026-08-06 in Cloudflare Agent Readiness Labs) is the first bridge implementation shipping today; more are on the way.
Agent Readiness is a set of standard signals that tell AI agents and crawlers what your site can do. Royal MCP 1.5.1 publishes an MCP Server Card at `/.well-known/mcp/server-card.json`, a Skills Index at `/.well-known/agent-skills/index.json`, OAuth Protected Resource metadata at the RFC 9728 path, and emits RFC 8288 Link headers on every `/mcp` response. Cloudflare Agent Readiness scanner, Vercel is-agentic, and Chrome Lighthouse 13.3+ Agentic Browsing audit all recognize these signals with no extra setup.
The Cloudflare WebMCP bridge uses `credentials: 'same-origin'` — it rides the visitor's WordPress login-session cookies. The bridge acts as the visitor would. Royal MCP enforces a WordPress nonce (`X-WP-Nonce` header) on every cookie-authenticated request, so a bridge can only call tools when the visitor is signed into your site AND holds a valid nonce. External OAuth clients like Claude Desktop, ChatGPT, and Cursor keep using Bearer tokens on the same endpoint. Nothing about the OAuth path changes.
Yes. The "Browser agents (WebMCP)" section on the Royal MCP settings page has a master toggle that is OFF by default. Existing installs get zero behavior change until you flip it on. Discovery documents (Server Card, Skills Index, Link headers) are public and always emit, since they're already discoverable via `/wp-json/royal-mcp/v1/mcp` to any authenticated caller.
No. WebMCP cookie-auth is a second auth path alongside the existing OAuth Bearer path, not a replacement. Every existing OAuth client (Claude Desktop, ChatGPT connectors, Cursor, Windsurf, Claude Code CLI, mcp-remote, Anthropic SDK) continues working exactly as it did in Royal MCP 1.4.x. Fully backwards compatible.
Native WebMCP registration via `navigator.modelContext` in Chrome 149+ (currently behind an experimental flag; stable rollout later this year). This lets browsers with a built-in agent call Royal MCP tools directly, without needing Cloudflare in the middle. Also on the roadmap: deeper OAuth spec coverage including Client Identifier Metadata Documents (CIMD) so external MCP clients discover client registrations without a database round trip.
## Make your WordPress site agent-ready today
Royal MCP is free from the WordPress.org plugin directory. Install, activate, and your site starts publishing the standard discovery documents that every AI-readiness scanner checks for. Flip one toggle when you want browser AI to use your tools too.
[Get Royal MCP](https://wordpress.org/plugins/royal-mcp/)