WordPress Ops

A small, confirmation-gated MCP server for the standard WordPress REST API. It is configured entirely through environment variables and stores no credentials, sites, or personal data.

Features

• Read configured sites and inspect, search, or list posts.
• Create posts as drafts only.
• Update only approved post fields, with explicit write confirmation. Publishing additionally requires confirm_publish=true.
• Optionally use a post's modified value as an optimistic-concurrency check before updating it.
• Upload media only after explicit confirmation.

Install

python -m venv .venv
.venv/bin/pip install -e .

On Windows, use .venv\\Scripts\\pip install -e ..

Configuration

Use a single site:

WORDPRESS_BASE_URL=https://example.com
WORDPRESS_USERNAME=api-user
WORDPRESS_APP_PASSWORD=xxxx xxxx xxxx xxxx

Or configure named sites:

WORDPRESS_SITES_JSON={"site-a":{"base_url":"https://example.com","username":"api-user","app_password":"xxxx"}}

Run with python server.py. Do not commit .env files or application passwords.

Safety model

Writes are never performed unless confirm_write=true is passed. New posts are drafts, and publishing an existing post requires a separate confirm_publish=true. The server has no delete endpoint.

Development

python -m unittest -v

License

MIT. See LICENSE.