Royal MCP Documentation

What is Royal MCP and how does it connect AI to WordPress?

Royal MCP enables AI platforms like Claude, ChatGPT, Cursor, and Google Gemini to securely interact with your WordPress content through the Model Context Protocol (MCP). It ships 205 tools total — a WordPress core surface (posts, pages, media, users, settings) plus per-plugin integrations that auto-register when the underlying plugin is active: Elementor, Divi, WooCommerce, ACF, GuardPress, SiteVault, Royal AI Firewall, Redirection, and more. AI assistants read, create, edit, and manage every layer through natural language.

What is MCP?

Model Context Protocol (MCP) is an open standard developed by Anthropic for connecting AI assistants to external data sources. It provides a secure, standardized way for AI platforms to read and interact with your applications.

Requirements

• WordPress 5.8 or higher
• PHP 7.4 or higher
• HTTPS enabled (required for Claude Desktop integration)

How do I install Royal MCP on my WordPress site?

From WordPress.org (Recommended)

Manual Installation

How do I configure Royal MCP after installing?

Basic Setup

The main Royal MCP settings page showing API key and endpoint configuration

Adding and configuring AI platforms with API keys and model selection

How do I connect Claude Desktop to WordPress?

Royal MCP includes a native OAuth connector for Claude Desktop. When you add your site as a connector, Claude handles the entire authentication flow automatically — no API keys or config files needed.

Setup Steps

1. Enable Royal MCP

In your WordPress admin, go to Royal MCP → Settings and toggle "Enable Royal MCP Integration" on. This activates the MCP endpoint and OAuth server that Claude needs to connect.

2. Copy your Remote MCP Server URL

Scroll down to "Claude Connector Settings" and copy the Remote MCP Server URL. It will look like: https://yoursite.com/wp-json/royal-mcp/v1/mcp

3. Add the connector in Claude Desktop

Open Claude Desktop, go to Settings → Connectors, click "Add custom connector", enter a name (e.g., "My WordPress Site"), paste the URL, and click "Add".

4. Authorize in your browser

Claude Desktop will open your browser to your WordPress site. Log in with your WordPress credentials if prompted, then you'll see an authorization screen asking to allow Claude to connect. Click "Authorize".

The OAuth consent screen — click "Authorize" to grant Claude access to your WordPress site

5. Return to Claude Desktop

After authorizing, your browser will prompt you to open Claude Desktop. Click "Open Claude" (or similar) to return to the app. Claude will complete the connection automatically and your site's 41+ MCP tools will be available immediately.

Claude Desktop showing Royal MCP connector with all 37 WordPress tools and permission controls

Alternative: Connect via Config File

If the Connectors method doesn't work, you can connect Claude Desktop directly using the config file with your API key. This bypasses OAuth entirely and connects immediately.

{
  "mcpServers": {
    "my-wordpress-site": {
      "url": "https://yoursite.com/wp-json/royal-mcp/v1/mcp",
      "headers": {
        "Authorization": "Bearer your-api-key-here"
      }
    }
  }
}

Example Commands

Once connected, try asking Claude:

• "Summarize my last 10 blog posts"
• "List all draft posts on my site"
• "Create a new post about [topic]"
• "What categories do I have?"

Real proof of Royal MCP working with Claude - successful site info retrieval

How do I set up the native Claude Desktop OAuth connector for WordPress?

Royal MCP includes a complete OAuth 2.0 authorization server for Claude Desktop's native “Add Connector” flow. Instead of copy-pasting an API key, you click a button in Claude, log in with your WordPress account, approve the permissions on a consent screen, and you’re connected.

How it Works

When Claude Desktop adds Royal MCP as a connector:

1. Claude calls Royal MCP’s OAuth metadata endpoint at /.well-known/oauth-authorization-server to discover the auth flow.
2. Claude registers itself dynamically (RFC 7591 Dynamic Client Registration). No manual app creation required.
3. Claude redirects you to your WordPress login (PKCE-secured authorization code flow per MCP spec 2025-11-25).
4. You approve a consent screen showing the permissions Claude is requesting.
5. Royal MCP issues an access token (SHA-256 hashed at rest) and a refresh token.
6. Claude uses the access token in the Authorization: Bearer ... header for all subsequent MCP requests.

Setup Steps

The consent screen Claude Desktop shows during OAuth setup

Security Properties

• Access tokens are SHA-256 hashed — the raw token only exists in Claude Desktop, never on disk on your server.
• Authorization codes are single-use with a 10-minute expiry.
• PKCE (S256) is required on every authorization request.
• Redirect URI validation enforces localhost or HTTPS only.
• Daily cleanup of expired OAuth tokens via WordPress scheduled event.

For the complete auth model, per-transport boundary rules, threat scenarios, and a production-readiness checklist for security and agency teams, see the Direct-Connect Threat Model.

If OAuth Setup Fails

OAuth depends on Claude reaching three URLs on your site — /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource, and /wp-json/royal-mcp/v1/mcp. On most hosts this just works. On a few managed hosts (notably SiteGround), nginx-level rules and edge caches can short-circuit those URLs before WordPress sees them, and Claude shows a generic “Couldn’t connect” or “Authorization failed” error. We have dedicated troubleshooting articles for each known failure mode:

• OAuth Fails on Managed Hosts (SiteGround, o2switch, LiteSpeed) — edge caches poisoning the OAuth endpoints. Symptom: authorize fails immediately, cache-hit headers appear on /.well-known/* URLs.
• Imunify360 Blocks Royal MCP OAuth Discovery — CloudLinux Imunify360 bot-protection intercepts /wp-json/* and /.well-known/* with HTTP 200 + "Access denied by Imunify360 bot-protection" JSON. Silent connect failure with ofid_… error, empty Activity Log. Fix is host-side (paste-ready allowlist request in the guide). Auto-detected by Royal MCP 1.4.36+.
• Sucuri / CloudProxy Blocks Royal MCP OAuth Discovery — Sucuri firewall returns HTTP 404 for /.well-known/oauth-authorization-server at its edge before your origin sees the request. Signature: Server: Sucuri/Cloudproxy header on the 404 with an unbranded HTML body. Very common on SiteGround. Fix: allow the OAuth paths in the Sucuri dashboard’s Access Control → Allow URL Paths (path-based, not IP). Auto-detected by Royal MCP 1.4.41+.
• Plain Permalinks Break OAuth Discovery — WordPress permalinks set to Plain disables rewrite rules; OAuth endpoints at domain root (/.well-known/*, /authorize, /token, /register) aren’t reachable. Symptom: MCP URL contains ?rest_route=, Claude fails with ofid_…. 30-second fix. Auto-detected by Royal MCP 1.4.36+.
• SiteGround Returns 404 for /.well-known/ — SiteGround’s nginx layer reserves the path prefix and returns 404 before WordPress sees the request. Symptom: tiny nginx 404 with no X-Httpd header on the OAuth metadata URL.
• Fix /.well-known/ Content-Type with a Cloudflare Transform Rule — static files return 200 but with text/plain; strict MCP clients reject the metadata. Free Cloudflare Transform Rule overrides the response Content-Type at the edge in ~2 minutes.
• OAuth Discovery Returns HTML Instead of JSON — a membership plugin (ARMember, MemberPress, Restrict Content Pro) or theme template is intercepting the request and serving its own login or access-denied page. Symptom: /.well-known/oauth-authorization-server returns 200 with an HTML body. Auto-detected by Royal MCP 1.4.22+.
• Stale OAuth Discovery Files in Your Webroot — static files at /.well-known/oauth-* from an earlier version’s workaround advertise old REST-namespace endpoint URLs. Symptom: discovery returns JSON but authorization_endpoint contains /wp-json/royal-mcp/v1/. Auto-detected; includes a mandatory carve-out for SiteGround-style hosts where the static files are load-bearing.
• OAuth Endpoints Overlap with Existing Pages — a membership plugin (MemberPress, Paid Memberships Pro, Ultimate Member, BuddyBoss) has published a /register page at the same slug Royal MCP uses for OAuth registration. Fix relocates the OAuth endpoint via the royal_mcp_oauth_rewrite_paths filter. Auto-detected by Royal MCP 1.4.40+.
• Web Server 301-Redirects /register to /register/ — Nginx mod_dir, Apache mod_dir, or .htaccess canonicalization adds a trailing slash and OAuth clients don’t follow 301 on POST. Symptom: POST to /register returns 301 with Location: /register/. Auto-detected by Royal MCP 1.4.22+.
• ChatGPT’s MCP connector fails at Dynamic Client Registration with HTTP 466 (or any 460–469) — an intermediary WAF layer (managed host, CDN edge, custom ModSecurity rule action) is fingerprinting the ChatGPT-flavored DCR POST specifically. Symptom: Claude Desktop / Claude.ai web connect fine, ChatGPT reports “Dynamic client registration failed: registration endpoint returned 466”. Confirmed case study for Websupport (openresty).
• Connect Claude Desktop via API Key (Skip OAuth) — if you only need Claude Desktop, the mcp-remote bridge with an Authorization: Bearer header sidesteps the entire OAuth flow.

Can I use Royal MCP with Cursor, VS Code, Windsurf, or Claude Code?

Royal MCP works with any MCP-compliant client, not just Claude Desktop. The same API key + URL pattern works in every IDE and CLI that supports MCP servers.

Supported IDEs and Clients

Common Configuration Pattern

Most clients want the same three values — the server URL, your API key, and a header name. The exact JSON shape varies by client but the values are identical:

{
  "name": "Royal MCP",
  "url": "https://yoursite.com/wp-json/royal-mcp/v1/mcp",
  "headers": {
    "Authorization": "Bearer your-api-key-here"
  }
}

For OAuth-capable clients, drop the headers block and the client will negotiate the access token via the OAuth metadata endpoint instead.

LM Studio Setup

LM Studio added native MCP support in version 0.3.x. It expects a config file called mcp.json in your LM Studio config directory.

Config file location:

• macOS: ~/.lmstudio/mcp.json
• Windows: %USERPROFILE%\.lmstudio\mcp.json
• Linux: ~/.lmstudio/mcp.json

Option 1 — direct HTTP (recommended for LM Studio 0.3.x+):

{
  "mcpServers": {
    "royal-mcp": {
      "url": "https://example.com/wp-json/royal-mcp/v1/mcp",
      "headers": {
        "Authorization": "Bearer your-api-key-here"
      }
    }
  }
}

Option 2 — mcp-remote bridge (works on every LM Studio version, also a fallback for any stdio-only MCP client):

{
  "mcpServers": {
    "royal-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://example.com/wp-json/royal-mcp/v1/mcp",
        "--header",
        "Authorization:Bearer your-api-key-here"
      ]
    }
  }
}

After saving the file, restart LM Studio (or use the “Reload MCP servers” button in newer versions). Royal MCP’s tools should appear in the model’s available-tools list.

Ollama Setup

Recommended frontends that pair Ollama with MCP servers:

If you want the simplest “Ollama + Royal MCP” path: install Continue in VS Code or JetBrains, point it at your local Ollama install for the model, and use the same mcpServers config from the LM Studio section above.

Which AI platforms does Royal MCP work with?

Royal MCP supports multiple AI platforms. Each can be configured independently.

Platform Resources & Documentation

Official documentation and developer resources for each supported AI platform:

MCP Protocol Resources

Learn more about the Model Context Protocol standard:

How do I create and rotate Royal MCP API keys?

WordPress API Key

This key authenticates requests to your WordPress site from AI platforms.

• Auto-generated when plugin is activated
• Click "Regenerate" to create a new key (invalidates the old one)
• Keep this key secure - anyone with it can access your site via API

Platform API Keys

These keys authenticate requests from your site to AI services.

• Obtain from each platform's developer console
• Enter in the corresponding platform card in settings
• Keys are stored securely in your WordPress database

What tools does Royal MCP give my AI assistant?

Royal MCP exposes 205 tools to AI platforms — a WordPress core layer that is always available, plus conditional plugin-integration layers that auto-register when the underlying plugin is active. Grouped by category below.

Posts

Pages

Media

Taxonomies

Site & System

Does Royal MCP work with the WordPress Abilities API and the WordPress MCP Adapter?

Yes. Every Royal MCP tool automatically registers as a WordPress Ability on WordPress 6.9 and above. Same 205 tools, three access paths — use whichever fits your workflow. Added in v1.4.38.

The three access paths

1. Native MCP endpoint (default) — /wp-json/royal-mcp/v1/mcp. Full MCP 2025-11-25 protocol, OAuth 2.0 discovery, session management. Used by Claude Desktop, ChatGPT, Cursor, Windsurf, and every other MCP-compliant client.
2. WP Abilities REST API — standard WordPress core REST endpoints under /wp-json/wp-abilities/v1/*. Any WordPress developer familiar with the REST API can enumerate and invoke tools without knowing MCP. Standard WP authentication (Application Passwords, cookies, or JWT via a plugin).
3. WordPress MCP Adapter — Automattic’s official MCP-adapter plugin bridges the WP Abilities API to the MCP protocol. If you already use the WordPress MCP Adapter for other WP-native tools, Royal MCP’s abilities auto-appear alongside them — no additional configuration.

Why three paths, not just one

Different clients need different transports. The native MCP endpoint is optimized for the OAuth-flavored, session-based flow Claude Desktop and ChatGPT use. The WP Abilities REST API is optimized for programmatic WordPress work — scripts, cron jobs, and third-party plugins that don’t want to speak MCP. The WordPress MCP Adapter path is optimized for teams that have standardized on the Automattic adapter as the single MCP surface for a fleet of WordPress sites. All three paths hit the same tool implementations under the hood — nothing is duplicated or diverged.

Ability categories

Royal MCP registers a set of ability categories so tools are discoverable by domain: royal-mcp/core (WordPress core operations), royal-mcp/woocommerce, royal-mcp/elementor, royal-mcp/acf, royal-mcp/guardpress, royal-mcp/sitevault, royal-mcp/forgecache, royal-mcp/raif, royal-mcp/redirection, royal-mcp/royal-links, and royal-mcp/royal-ledger. AI agents and standard WordPress consumers can enumerate abilities by category to find just the tools relevant to a task.

Can Claude edit my Elementor pages through Royal MCP?

When Elementor is active on your site, Royal MCP automatically registers 8 additional MCP tools for reading page structures, cloning pages, managing the template library, adding widgets, reading widget settings, and bulk text/image replacements. No configuration is required — the tools appear as soon as Elementor is detected.

Use it for: AI-assisted Elementor page building, cloning existing pages as starting templates, bulk text or image swaps across pages, template library management, and programmatic content updates from any MCP-compatible AI client.

Available Tools

Example Queries

Things you can ask Claude or another MCP-compatible AI agent:

• “What sections and widgets are on the /pricing page?”
• “Clone the homepage as a starting template for a new spring-sale landing page.”
• “Replace every ‘Buy Now’ button label with ‘Get Started’ on the homepage.”
• “Swap the hero image on the /about page with the new team photo I uploaded yesterday.”
• “List all saved Elementor templates so I can see what’s available to reuse.”
• “Import the template I exported from staging and create a new About page from it.”

Can Claude edit my Divi pages through Royal MCP?

When Divi is active on your site — either the Divi Builder plugin or the Divi theme — Royal MCP registers 9 additional tools for AI-driven Divi editing. Ships with support for both Divi 4 (shortcode format) and Divi 5 (block format).

Divi’s data model is different from Elementor’s — Divi 4 stores pages as nested shortcodes, Divi 5 stores them as blocks, and both have quote-parsing quirks that break naive find-and-replace. Royal MCP’s Divi tools handle both formats safely: pre-write layout validation, format-aware find-and-replace, page cloning with fresh clientIds, image URL swaps across every image-bearing element, library-entry application to any target page, and structure introspection. Every destructive write emits a 72-hour undo token.

Available Tools

Example Queries

Things you can ask Claude or another MCP-compatible AI agent:

• “Is my /pricing page built in Divi 4 or Divi 5, and what modules does it use?”
• “Show me the section-and-module outline of the homepage so I can plan a rebuild.”
• “Replace every ‘Buy Now’ label with ‘Get Started’ on the homepage — but preview first.”
• “Clone my New York services page as a Denver services draft.”
• “Swap the hero image on the About page from the old headshot URL to the new one.”
• “Apply my ‘City Services’ Divi Library entry to the Portland page in merge mode.”
• “List every saved layout in the Divi Library so I can pick one to reuse.”
• “Validate the layout string in my clipboard before I paste it into the About page.”

Can Claude create products, orders, and coupons in WooCommerce?

When WooCommerce is active on your site, Royal MCP automatically registers 29 additional MCP tools covering products, variations, attributes, orders, coupons, customers, and store stats. No configuration is required — the tools appear as soon as WooCommerce is detected.

Use it for: AI-assisted product creation, natural-language order status updates, B2B and phone order entry, coupon management, bulk inventory adjustments across variations, product-attribute rework, customer lookup, and store analytics queries.

Products (4 tools)

Product Variations (6 tools)

Product Attributes (4 tools)

Orders (6 tools)

Coupons (7 tools)

Customers & Stats (2 tools)

Example Queries

Things you can ask Claude or another MCP-compatible AI agent:

• “What were my top 5 best-selling products last month?”
• “List all orders that have been processing for more than 7 days.”
• “Create a new simple product called ‘Premium Coffee Beans’ for $24.99 with 100 units in stock.”
• “Update order #1234 to completed status.”
• “What’s my average order value compared to last month?”
• “Find customers who have spent more than $500 lifetime.”

Can Claude run GuardPress security scans and manage the firewall?

When GuardPress (the Royal Plugins WordPress security plugin) is active, Royal MCP registers 7 additional tools for monitoring site security, viewing scan results, and reviewing the audit log from any AI client.

Use it for: daily security check-ins, on-demand vulnerability scans, blocked-IP review, failed-login analysis, and audit-log queries.

Available Tools

Example Queries

• “What’s my current security score?”
• “Run a vulnerability scan and tell me what it finds.”
• “Show me all failed login attempts from the last 24 hours.”
• “List the IPs blocked in the past week and the reason for each block.”
• “Are there any plugins on this site with known CVEs?”
• “Summarize the security audit log for high-severity events this month.”

Can Claude create backups and restore my site with SiteVault?

When SiteVault (the Royal Plugins backup & restore plugin) is active, Royal MCP registers 6 additional tools for triggering backups, listing backup history, and reviewing schedules.

Use it for: pre-update backup automation, backup health checks, “is the latest backup complete yet?” status polling, and schedule audits.

Available Tools

Example Queries

• “Trigger a full backup before I install this plugin update.”
• “When was the last successful backup, and how big was it?”
• “Is the backup that’s currently running complete yet?”
• “Run a database-only backup right now.”
• “Show me my backup schedules and when each one runs next.”
• “What’s the total size of all my backups on disk?”

Can Claude read and write ACF fields, repeaters, and flexible content?

When Advanced Custom Fields (free or Pro) is active, Royal MCP registers 4 additional tools for reading and writing ACF fields. Added in v1.4.24.

Why a dedicated integration when wp_get_post_meta already returns custom-field data: WordPress’s meta API returns the raw stored value — serialized arrays for repeaters, raw IDs for relationships, raw attachment IDs for image fields. ACF’s get_field() / update_field() respect each field’s Return Format and hydrate values per field type, the same view a human editor sees in the ACF UI. AI agents interacting with ACF want the formatted view, not the raw serialized one.

Available Tools

Example Queries

• “List the ACF field groups on this site and the fields in each one.”
• “Read all ACF fields for post ID 142 and show me their values.”
• “Get the subtitle field value for the post titled ‘Launch Announcement’.”
• “Update the featured_quote field on post 142 to ‘...’.”
• “Which ACF field groups apply to the Product post type?”

Can Claude create and manage 301 redirects with the Redirection plugin?

When Redirection (John Godley’s plugin, 2M+ active installs) is active on your site, Royal MCP registers 4 additional tools for listing, creating, and updating redirects — and listing redirect groups. Added in v1.4.38.

Use it for: bulk 301 setup during a site migration, cleaning up 404s an AI agent found in your Activity Log, staging redirect changes during a URL structure refactor, or asking Claude to audit redirect groups before an SEO audit.

Available Tools

Example Queries

• “Set up 301 redirects for every old /blog/YYYY/MM/ URL to the new /articles/ structure.”
• “List every redirect in the ‘Modified Posts’ group with a hit count above 100.”
• “The old /pricing-2024/ URL is still getting hits — redirect it to /pricing/ permanently.”
• “Show me all redirects pointing at pages that don’t exist anymore.”
• “Change the target of the /old-about redirect from /company to /about.”

Can Claude manage Royal AI Firewall bot policies and read recent bot hits?

When Royal AI Firewall is active on your site, Royal MCP registers 6 additional tools for reading firewall stats, inspecting recent bot activity, and adjusting per-bot policies through natural language. Added in v1.4.37.

Royal MCP and Royal AI Firewall work as a companion pair: Royal AI Firewall sees HTTP-layer AI bot traffic hitting your site, Royal MCP lets your own AI clients act on your site. Together they give complete visibility over both sides of AI traffic on your WordPress install.

Available Tools

Example Queries

• “How many bot hits did we get in the last 7 days, and which bots were the top 5?”
• “Show me the last 20 bot requests to /wp-json paths.”
• “Block GPTBot and CCBot but allow ClaudeBot through.”
• “Give me yesterday’s bot-hit rollup with per-bot subtotals.”
• “Turn on the master AI-bot block for the next hour while we test the site.”

Can Claude clear the page cache and check cache stats through ForgeCache?

When ForgeCache is active on your site, Royal MCP registers 3 additional tools for page cache management. Useful when an AI agent just published or updated content and needs the cache to reflect it, or when troubleshooting stale-content reports.

Available Tools

Example Queries

• “I just updated the /pricing page — purge its cache so visitors see the new copy.”
• “How much disk is ForgeCache using and how old is the oldest entry?”
• “Clear the entire cache — I just imported 200 posts and want everything fresh.”

Can Claude create short URLs and check click stats through Royal Links?

When Royal Links (affiliate-link / URL-shortener / cloaker plugin) is active on your site, Royal MCP registers 3 additional tools for creating short URLs, listing existing links, and pulling click stats.

Use it for: spinning up a branded short URL on the fly (yoursite.com/deal instead of a long UTM-tagged affiliate URL), asking Claude to pull click stats before a campaign wrap-up, or bulk-creating short URLs from a campaign spreadsheet.

Available Tools

Example Queries

• “Create a short URL /deal that redirects to my affiliate URL for WPForms Pro.”
• “Show me my top 10 short URLs by click count this month.”
• “How many clicks did the /summer-sale link get in the last 30 days?”
• “List every short URL in the ‘affiliate’ category.”

Can Claude track my subscription costs and upcoming renewals through Royal Ledger?

When Royal Ledger (cost-tracker and license-vault plugin) is active on your site, Royal MCP registers 4 additional tools for adding tracked costs, listing them, checking upcoming renewals, and listing stored license keys.

Use it for: asking Claude to log a new subscription you just bought, getting a rundown of renewals in the next 30 days, categorizing costs (plugins / themes / hosting / domains / SaaS), or discovering which license keys are stored for a specific product.

Available Tools

Example Queries

• “What subscriptions renew in the next 30 days?”
• “Add WPForms Pro at $199/year renewing on 2026-11-15 to my plugin costs.”
• “How much am I spending per year on hosting across all my tracked items?”
• “List every license key I have stored for ‘Elementor Pro’.”
• “Show me all expired SaaS subscriptions I’m still tracking.”

What is the Royal MCP REST API reference for developers?

Endpoints

Authentication

All API requests require authentication via the WordPress API key:

Can Claude publish a post, set the featured image, add categories, and write SEO meta in one call?

Yes — that’s the composer pattern. Royal MCP ships a small set of cross-plugin composer tools that stitch multiple write operations into one atomic call. Instead of asking the AI to make 5 separate tool calls (upload image → create post → set featured image → assign categories → write SEO meta), the composer does it in one, with each step logged and any failure surfaced as a warning rather than a hard error.

Available Composers

The composition pattern

Composers follow a best-effort shape:

1. One step is the anchor — if it fails, the whole call fails. In wp_publish_and_promote the anchor is post creation.
2. Every other step is best-effort — failures surface as warnings in the response but don’t block the anchor step.
3. Every step’s status is logged in the steps array of the response, so an AI agent can inspect exactly what worked and what didn’t.

Example Queries

• “Draft a blog post titled ‘Winter Sale is Live’ from the outline in my notes, sideload the hero image from this URL, categorize under ‘Announcements’, tag ‘sale’ and ‘winter’, and write SEO meta — publish immediately.”
• “Schedule this launch post to publish next Tuesday at 9am with a featured image from the /media/hero.jpg URL and set the meta description to ‘...’.”
• “Save the following as a draft, categorize under ‘Case Studies’, tag with ‘retail’, and write SEO title and description — I’ll review and publish manually.”

How do I undo something Claude did to my site?

Royal MCP ships an undo-token system for reversible operations. Every destructive tool call that supports it returns a short opaque undo_token in its response. Passing that token to the mcp_undo_last_operation tool reverses the operation. Tokens live for 72 hours by default. Shipped across the Free plugin starting in v1.4.39 and expanded in v1.4.40.

Tools that issue undo tokens (Free)

• wp_delete_post — restores the deleted post (or page, product, or custom post type) including all meta, terms, and revisions
• wp_delete_term — restores the deleted taxonomy term and re-attaches it to every post that had it before deletion
• wp_delete_menu_item — restores the deleted menu item at its original position
• wp_reorder_menu_items — reverts a menu reorder to its prior order

How to use it

The flow is one extra call. When the AI agent runs a destructive tool, the response includes an undo_token field:

{
  "ok": true,
  "deleted_post_id": 142,
  "undo": {
    "token": "opaque-string-here",
    "expires_at": "2026-08-24T14:30:00Z"
  }
}

To reverse it, call mcp_undo_last_operation with that token:

mcp_undo_last_operation({ token: "opaque-string-here" })

Or just tell your AI in natural language: “Undo that”, “wait, restore that post”, “revert the last menu reorder”. Claude and other MCP-capable clients handle the token roundtrip internally when they see an undo block in a prior response.

Token lifetime

Undo tokens live for 72 hours after issuance. After that the reverse-state is garbage-collected on the daily royal_mcp_token_cleanup cron. If the token is used before expiry, the reverse-state is consumed and removed — each token is single-use.

How do I see what my AI assistant did on my site?

Royal MCP logs all API interactions for security and debugging purposes.

Accessing the Log

Navigate to Royal MCP > Activity Log in your WordPress admin.

Log Information

• Timestamp - When the request occurred
• MCP Server - Which AI platform made the request
• Action - The MCP tool that was called
• Status - Success or error
• Request/Response - Detailed data (expandable)

Activity log showing all AI interactions with timestamps, actions, and status

Royal MCP isn't working — what should I check first?

Automatic host and WAF detection (check the admin notice first)

Before running any curl probe, look at your Royal MCP admin screen (/wp-admin/admin.php?page=royal-mcp) for an orange notice at the top of the page. Royal MCP self-checks the /.well-known/oauth-authorization-server discovery endpoint every 12 hours and classifies the response against known host and WAF signatures. When it detects an interception pattern, the notice names the specific product and links to the exact fix. Detectors currently ship for:

• Imunify360 (CloudLinux shared hosts) — intercepts /wp-json/* and /.well-known/* with a JSON denial body
• BitNinja WebShield — serves a JavaScript CAPTCHA challenge that MCP clients cannot execute
• Sucuri / CloudProxy — edge-CDN 404 identifiable by the Server header
• SiteGround / other nginx path reservation — 404 pre-PHP without an accompanying PHP fingerprint
• Membership plugin or theme HTML template — discovery returns HTML instead of JSON
• Stale static discovery files from earlier host-support workarounds — JSON is valid but advertises old /wp-json/royal-mcp/v1/* endpoint URLs
• OAuth page shadow — a published WordPress page at /register or /token collides with the OAuth rewrite rules
• Trailing-slash 301 on POST to /register — web-server canonicalization breaking OAuth POST
• Plain permalinks — rewrite rules never generate so OAuth endpoints don’t exist

Each notice includes a “Re-check now” button that skips the 12-hour cache and re-probes immediately — useful when you’ve just made a host or WAF configuration change and want to see the result. If the admin notice classifies a state that’s already been fixed, click Re-check to refresh.

Common failure patterns & where to fix them

Match your symptom to the right doc:

• OAuth consent completes, then Claude says “Couldn’t reach the MCP server” with an ofid_* code — Cloudflare blocking Anthropic’s backend at the edge. See How Cloudflare’s “Block AI Bots” Breaks MCP Connections.
• Token exchange fails with mcp_token_exchange_failed on an Apache shared host — managed security (Imunify360, mod_security with UA rules) blocking python-httpx. See Apache python-httpx 429 fix.
• Silent connection failure, empty Activity Log, curl returns HTTP 200 + "Access denied by Imunify360 bot-protection" JSON — different from the 429 case above; Imunify360 intercepting /wp-json/* and /.well-known/* at the host layer. See Imunify360 blocks Royal MCP fix.
• MCP endpoint URL contains ?rest_route= and Claude can’t discover the OAuth server — WordPress permalinks are set to Plain; rewrite rules aren’t generating so /.well-known/oauth-authorization-server and other OAuth endpoints aren’t reachable. 30-second fix. See Plain permalinks break OAuth discovery.
• Activity Log empty + curl returns 406 with “Mod Security” in the body — cPanel ModSecurity bot-fingerprinting. See ModSecurity 406 fix.
• Discovery returns JSON but issuer points to auth.<subdomain> — Cloudflare Zero Trust hijacking /.well-known/ discovery. See Cloudflare Zero Trust hijack fix.
• Discovery returns HTML instead of JSON — a membership plugin or theme template is intercepting the request. See OAuth discovery HTML fix.
• /.well-known/ returns 404 — nginx (commonly SiteGround) blocking the path prefix. See SiteGround /.well-known/ 404 fix.
• POST to /register gets redirected with a trailing slash — web-server canonicalization breaking OAuth POSTs. See Trailing-slash 301 fix.
• ChatGPT reports “Dynamic client registration failed: registration endpoint returned 466” (or any 460–469) while Claude connects fine — intermediary WAF fingerprinting the ChatGPT-flavored DCR POST. See Non-standard 4xx on /register fix.
• Managed host edge cache serving stale OAuth responses (SiteGround Dynamic Cache, o2switch PowerBoost, LiteSpeed) — see OAuth Fails on Managed Hosts.
• Just want to connect Claude Desktop without debugging OAuth — the API key bypass skips OAuth entirely. Two-line config change, no /.well-known/ discovery required.

For a deeper protocol-level walkthrough of the diagnostic curl probes (4-probe sequence, dual-UA testing, response header reading, paste-ready bash + PowerShell script), see Diagnose Royal MCP Connection Failures with curl.

Claude Desktop requires HTTPS

Claude Desktop will not connect to sites on plain HTTP or localhost. For local development, use ngrok or a similar tunnel that provides an HTTPS endpoint.

API key not working

• Ensure you’re using the WordPress API key, not a platform API key
• Check that the key hasn’t been regenerated since you configured it
• Verify the plugin is activated and integration is enabled in Royal MCP → Settings

Connection test fails on the Royal MCP settings page

• Verify the platform API key is correct
• Check that your server can make outbound HTTPS requests
• Some hosts block external API calls — contact your host if needed
• If the test returns 404, the model dropdown may be set to a model Anthropic has retired. Switch to Claude Sonnet 4.6 (Latest, Recommended) and re-test — this affects only the Test Connection button, not actual Claude usage.

Tools not appearing in Claude

1. Run the troubleshooting start-here checklist first — most “tools missing” reports resolve there. The conflict test in particular often surfaces a security or caching plugin filtering MCP responses before they reach Claude.
2. Disconnect and reconnect the MCP connector in Claude (delete the existing one, wait 30 seconds, re-add it fresh).
3. Check Royal MCP → Activity Logs for errors around the time of the failed connection.
4. Ensure your site’s SSL certificate is valid — expired or self-signed certs fail silently in some MCP clients.

Frequently Asked Questions

I installed Royal MCP but Claude keeps saying “couldn’t reach the MCP server” — what’s wrong?

In most cases the plugin is fine and your host or CDN is intercepting the OAuth discovery URL before WordPress sees it. First check: visit /wp-admin/admin.php?page=royal-mcp and look for an orange admin notice. Royal MCP self-checks the /.well-known/oauth-authorization-server discovery endpoint and will name the specific host or WAF product (SiteGround, Cloudflare Zero Trust, Sucuri, Imunify360, BitNinja, LiteSpeed) blocking it, with a copy-paste fix for that product. If the notice is clear but Claude still fails, run curl -i https://YOURSITE.com/.well-known/oauth-authorization-server — a healthy response is JSON with issuer, authorization_endpoint, token_endpoint, and registration_endpoint fields. See Troubleshooting — Start Here and Diagnose with curl for the full flow.

Do I need Elementor Pro, WooCommerce Pro, or Divi Pro for the AI tools to work?

No. Royal MCP’s Elementor tools work with the free Elementor plugin. Its WooCommerce tools work with free WooCommerce. Its Divi tools work with the free Divi Builder plugin or the paid Divi theme. Tools only appear when the underlying plugin is active — install WooCommerce and its wc_* tools auto-register, install Elementor and its elementor_* tools auto-register. No premium tier of any host plugin is required.

Can I use ChatGPT with WordPress through Royal MCP, or is it Claude-only?

Royal MCP works with any MCP-compliant client. Claude Desktop uses the native “Add Connector” OAuth flow. ChatGPT connects via Custom GPTs pointed at your /wp-json/royal-mcp/v1/messages endpoint. Cursor, Windsurf, Claude Code, and VS Code with GitHub Copilot’s MCP support all work. See the AI Platforms section for the full compatibility list and per-client setup patterns.

What happens if I let Claude modify my WordPress site and something breaks?

Every Royal MCP tool call is written to the Activity Log with timestamp, tool name, parameters (sensitive values redacted), and response status. WordPress’s own revision system captures every post and page edit, so post-level rollback is one click in the editor. Destructive operations move items to Trash first, so restoration is one click from the Trash view. Royal MCP Pro adds a dedicated undo layer on top: one-click undo tokens on destructive tools valid for 72 to 168 hours depending on the operation, plus a Recent Operations dashboard widget that surfaces every pending undo in one place with batch rollback support.

I’m on shared hosting — is Royal MCP going to slow down my site?

No. Royal MCP only runs when an AI client makes a request to /wp-json/royal-mcp/v1/*. It does not add any frontend code, does not hook into page rendering, and does not run on non-AI page loads. Regular visitors and Core Web Vitals scores are completely unaffected — the plugin only executes when an authenticated tool call arrives.

What’s the difference between Royal MCP (free) and Royal MCP Pro?

Free ships all 205 tools with unlimited use, OAuth for one AI client at a time, WordPress native revisions plus Trash-based recovery, and Activity Logs that persist until you clear them. Pro adds an agency-scale governance layer on top: one-click undo tokens on destructive tools valid for 72 to 168 hours, a Recent Operations dashboard widget with batch undo, extended audit retention (90 days by default, filterable), per-tool endpoint profiles that scope which tools any client can see, unlimited concurrent AI client connections, and priority email support. Pro is $79/site/year at founding-member pricing (regular $149/year) with the founder rate locked at renewal.

Does Royal MCP work on WordPress multisite networks?

Yes, on a per-site basis. Each site in a multisite network has its own API key, its own Activity Log, and its own settings. AI clients connect to a specific site’s MCP endpoint — Royal MCP does not bridge requests between sites in the network.

Does Royal MCP work with WPML, Polylang, or TranslatePress for multilingual content?

Yes. Translated posts appear as separate WordPress posts (each with its own ID and language meta) and are readable or writable via the standard wp_get_posts, wp_create_post, and wp_update_post tools. AI agents can list posts in a specific language by filtering on the language meta key, or translate a post and write the corresponding translation by ID.

Can I limit which posts, pages, or post types AI can access?

Yes. The wp_get_posts and wp_create_post tools accept a post_type parameter and validate it against registered public post types, so private or internal post types are not exposed. Plugin authors can disable specific tools entirely with the royal_mcp_disabled_tools filter, or scope the option-write allowlist with royal_mcp_writable_options. WordPress’s standard capability checks also apply to every tool call.