How to Give Claude Full Control of Your WordPress Site Using MCP

WordPress powers 43% of all websites on the internet. As of March 20, 2026, every one of those sites on a paid WordPress.com plan has a new kind of collaborator available: an AI agent that can draft and publish posts, approve and reply to comments, restructure categories, and bulk-fix missing SEO metadata — all through natural language, all via the Model Context Protocol.

This isn't a chatbot bolted onto a CMS. It's a full read-write integration. Your AI agent connects via OAuth 2.1, respects WordPress user role permissions, defaults every new post to draft, and logs every action to your Activity Log. What shipped yesterday is 19 new write operations across six content types — posts, pages, comments, categories, tags, and media — layered on top of the read-only MCP access Automattic introduced last October.

This guide walks you through what shipped, how it works technically, how to connect Claude Desktop (or any MCP client) in under five minutes, and how to automate WordPress content pipelines with Python.

Why This Matters

The scale alone makes this significant. WordPress.com sees 20 billion page views and 409 million unique visitors every month. Giving AI agents write access to that platform isn't a side feature — it's a fundamental shift in how web content gets produced and managed.

But the more interesting story is architectural. WordPress.com is now the largest production deployment of MCP write capabilities in the wild. The Model Context Protocol — Anthropic's open standard for connecting AI applications to external systems — has been rapidly adopted across developer tooling (Claude Desktop, Cursor, VS Code Copilot, ChatGPT), but most integrations have been read-only: "tell me about my data."

WordPress.com's write integration proves the pattern works at production scale, with real safety constraints. If you're building agentic systems and wondering how to design AI write access that doesn't terrify your users, the WordPress.com MCP implementation is worth studying closely.

The timing also matters. WordPress.com added an official Claude Connector in February 2026, making WordPress.com the first WordPress host to appear in Claude's connectors directory. The March 20 update expands that from read-only analytics to full content management. As TechCrunch reported, this "lowers the barrier to setting up and maintaining websites" — and also raises real questions about content quality that we'll address in the Limitations section.

What Just Shipped: The 19 New Write Operations

Before March 20, the WordPress.com MCP integration was read-only. Your AI agent could tell you which posts were trending, summarize comments, and run site health checks. Powerful for analysis — useless for execution.

The new write capabilities add a unified tool — wpcom-mcp-content-authoring — that exposes 19 operations across six resource types:

Posts (posts.create, posts.update, posts.delete)
Create drafts, update published posts (with an immediate-publish warning), move to trash. Supports full metadata: categories, tags, author, featured image, SEO fields, and scheduled publish dates.

Pages (pages.create, pages.update, pages.delete)
Same as posts, with additional support for page hierarchy (parent ID), template selection, and menu_order. The agent reads your theme's design tokens before creating content, so it uses your actual colors, fonts, and block patterns.

Comments (comments.create, comments.update, comments.delete)
Approve pending comments, reply to specific threads, mark spam, bulk-clean. Every status change is immediate if the comment is already approved.

Media (media.update, media.delete)
Update alt text, captions, titles, and descriptions. The file itself doesn't change — only metadata. This is the operation with the highest ROI: one prompt like "find all images missing alt text and fix them based on their filenames" can clean up years of accessibility debt in seconds.

Categories (categories.create, categories.update, categories.delete)
Build hierarchical taxonomies, rename slugs (with a warning that this breaks archive URLs), restructure parent-child relationships. Unlike posts, categories don't go to trash — deletion is permanent and requires explicit confirmation.

Tags (tags.create, tags.update, tags.delete)
Same pattern as categories. Useful for a prompt like: "Find all posts about machine learning that aren't tagged 'AI' and add the tag."

All operations go through the unified wpcom-mcp-content-authoring tool using an action-based interface: list to discover available operations, describe to get the schema for a specific operation, and execute to run it with user_confirmed: true.

How MCP Works Under the Hood

For most users, MCP is invisible — they connect Claude, type a prompt, things happen. For developers building on top of this, understanding the protocol layer matters.

MCP operates on a client-server model:

1. MCP Client (Claude Desktop, Cursor, your Python script) initiates a session
2. MCP Server (WordPress.com's hosted server at public-api.wordpress.com) exposes a list of tools with schemas
3. The AI model decides which tool(s) to call based on the user's natural language input
4. The server executes the operation against the WordPress.com REST API (authenticated via OAuth 2.1)
5. Results are returned to the client

The key insight: the AI model never touches WordPress.com directly. It calls the MCP server, which enforces permissions, validates inputs, and applies WordPress's own role-based access control. An editor role can't change site settings. A contributor can draft but not publish. The same rules you set in WordPress apply to AI agents.

Authentication uses OAuth 2.1, which means:

• No passwords stored in config files
• Revocable access (disconnect the agent anytime from your WordPress.com dashboard)
• Scoped permissions — you control which operations are enabled per site

The Automattic MCP ecosystem extends beyond WordPress.com. The same protocol connects to WooCommerce (store orders, products, customers), Beeper (cross-platform chat history), and Clay (contact network). A single AI agent can query your WordPress analytics, check your WooCommerce inventory, and draft a product announcement post in one conversation.

Step-by-Step: Connect Claude to Your WordPress.com Site

This takes under five minutes.

Step 1: Enable MCP on your account
Go to wordpress.com/me/mcp. Toggle MCP on. Select which sites you want to expose.

Step 2: Choose your write capabilities
Toggle on only what you need. If you only want content creation, enable posts and pages. If you're doing a media audit, enable media.update but leave posts.delete off.

Step 3: Connect Claude
Two options depending on which Claude product you're using:

• Claude.ai (web/desktop): Go to Settings → Connectors → Browse connectors. Search "WordPress.com," click +, and authenticate via OAuth. You're done. This is the official Claude Connector launched in February.

• Other MCP clients (Cursor, VS Code, any MCP-compatible tool): Follow the wordpress.com/me/mcp-setup guide for your specific client. Each client has a JSON or YAML config file where you add the WordPress.com MCP server endpoint and OAuth credentials.

Step 4: Test with a simple prompt

List my last 5 published posts and show me which ones are missing meta descriptions.

You'll get back actual data from your site, not a hallucinated guess. That's the MCP difference.

Step 5: Try your first write operation

Draft a short post announcing that my site now supports AI agent-managed content. 
Save it as a draft, categorize it under "News," and write a 150-character meta description.

The agent will describe exactly what it plans to do, ask for confirmation, then execute. The post appears in your WordPress drafts — review before publishing.

Automate at Scale: Python + WordPress.com REST API

For teams and developers who want to automate content pipelines — batch post creation, scheduled audits, programmatic SEO fixes — connecting through Claude Desktop is too manual. Here's how to build the same workflow in Python.

The WordPress.com MCP server maps directly to the WordPress.com REST API v2. You can call that API directly with your OAuth token.

Snippet 1: Generate a post with Claude, push it to WordPress as a draft

import anthropic
import requests
import json
import re
 
def generate_post(topic: str, style_guide: str = "") -> dict:
    """Use Claude to write a structured blog post."""
    client = anthropic.Anthropic()
 
    prompt = f"""Write a blog post about: {topic}
 
{f'Style guide: {style_guide}' if style_guide else ''}
 
Return ONLY valid JSON with these keys:
- title (string)
- content (string, HTML with WordPress block comments)
- excerpt (string, under 160 chars)
- suggested_tags (list of strings)
 
Keep the post under 800 words. Use clear H2 headings."""
 
    response = client.messages.create(
        model="claude-opus-4-5",
        max_tokens=2000,
        messages=[{"role": "user", "content": prompt}]
    )
 
    text = response.content[0].text
    json_match = re.search(r'\{.*\}', text, re.DOTALL)
    if not json_match:
        raise ValueError("Claude did not return valid JSON")
    return json.loads(json_match.group())
 
 
def push_draft(site: str, oauth_token: str, post: dict) -> dict:
    """Push a post to WordPress.com as a draft via REST API."""
    headers = {
        "Authorization": f"Bearer {oauth_token}",
        "Content-Type": "application/json",
    }
    payload = {
        "title": {"raw": post["title"]},
        "content": {"raw": post["content"]},
        "excerpt": {"raw": post.get("excerpt", "")},
        "status": "draft",  # Never autopublish — always review first
    }
    url = f"https://public-api.wordpress.com/wp/v2/sites/{site}/posts"
    resp = requests.post(url, json=payload, headers=headers)
    resp.raise_for_status()
    return resp.json()
 
 
if __name__ == "__main__":
    SITE = "yourblog.wordpress.com"
    TOKEN = "your-wpcom-oauth-token"  # From wordpress.com/me/mcp
 
    post = generate_post(
        topic="5 ways MCP is changing how developers build AI agents",
        style_guide="Technical but accessible. Concrete examples only. No buzzwords."
    )
    result = push_draft(SITE, TOKEN, post)
    print(f"Draft created: {result['link']}")
    print(f"Post ID: {result['id']} | Status: {result['status']}")

Snippet 2: Batch-fix missing alt text using Claude for generation

import anthropic
import requests
 
def fix_missing_alt_text(site: str, oauth_token: str, dry_run: bool = True):
    """
    Find all media items missing alt text and generate it with Claude.
    Set dry_run=False to actually apply the updates.
    """
    headers = {"Authorization": f"Bearer {oauth_token}"}
    client = anthropic.Anthropic()
 
    # Fetch media items (paginate for large libraries)
    url = f"https://public-api.wordpress.com/wp/v2/sites/{site}/media"
    params = {"per_page": 100, "media_type": "image"}
    resp = requests.get(url, headers=headers, params=params)
    resp.raise_for_status()
    all_media = resp.json()
 
    missing = [m for m in all_media if not m.get("alt_text", "").strip()]
    print(f"Found {len(missing)} images missing alt text (of {len(all_media)} total)")
 
    for item in missing:
        filename = item["source_url"].split("/")[-1].split("?")[0]
        title = item.get("title", {}).get("rendered", filename)
 
        # Ask Claude for concise, meaningful alt text
        response = client.messages.create(
            model="claude-haiku-4-5",  # Fast + cheap for batch work
            max_tokens=80,
            messages=[{
                "role": "user",
                "content": (
                    f"Write alt text for an image. Max 125 characters. "
                    f"Be descriptive and specific. Filename: '{filename}'. "
                    f"Title: '{title}'. Return ONLY the alt text."
                )
            }]
        )
        alt_text = response.content[0].text.strip()
 
        if dry_run:
            print(f"[DRY RUN] Would set alt text for '{title}': {alt_text}")
        else:
            patch_url = f"https://public-api.wordpress.com/wp/v2/sites/{site}/media/{item['id']}"
            patch_resp = requests.post(
                patch_url,
                json={"alt_text": alt_text},
                headers={**headers, "Content-Type": "application/json"}
            )
            patch_resp.raise_for_status()
            print(f"Updated '{title}': {alt_text}")
 
 
if __name__ == "__main__":
    fix_missing_alt_text(
        site="yourblog.wordpress.com",
        oauth_token="your-wpcom-oauth-token",
        dry_run=True  # Switch to False when ready to apply
    )

Get your OAuth token from wordpress.com/me/mcp — same token your MCP clients use. The dry_run=True default means you can run the script safely to preview changes before committing.

Benchmarks and What's Actually Fast

Automattic hasn't published formal latency numbers for the MCP write operations, but based on the WordPress.com REST API (which MCP wraps), here's what to expect in practice:

• Post creation (draft): ~200–500ms round-trip. Effectively instantaneous.
• Media metadata updates: ~150–300ms per item. A 100-image alt-text audit completes in under a minute.
• Category restructuring: Near-instant for creation; slug changes propagate immediately and affect all archive URLs.
• Comment moderation (batch approve): The agent operates sequentially per item; 50 pending comments takes ~15–20 seconds total.

The real performance win isn't raw API speed — it's the elimination of the human loop. A task like "restructure my 8 blog categories into a two-level hierarchy, migrate all 140 posts accordingly, and update the nav menu" would take a skilled WordPress admin 2–3 hours. With an AI agent and MCP, it's a single conversation that runs in under 10 minutes.

Limitations and What to Watch

This is WordPress.com only, not self-hosted WordPress.
The MCP integration is specific to sites hosted at WordPress.com on paid plans. If you're running self-hosted WordPress.org, you're out of luck for now. Automattic hasn't announced a self-hosted MCP server, though the WooCommerce MCP integration suggests it's on their roadmap.

Category and tag deletion is permanent.
Unlike posts and pages (which go to trash for 30 days), deleted categories and tags are gone immediately. The agent warns you and requires additional confirmation, but if you're running automation scripts, add explicit safeguards. The dry_run pattern in Snippet 2 above is your friend.

AI-generated content quality is your responsibility.
The Verge put it bluntly: "Watch out for sloppy writing." All new posts default to draft, which is the right call — but the temptation to fully automate publishing is real. WordPress.com sees 409 million monthly visitors. The signal-to-noise ratio of the web degrades when every site can push AI content without review. Use this to accelerate your workflow, not replace editorial judgment.

Slug changes break URLs immediately.
If you ask the agent to rename a category or update a post's slug, archive URLs change instantly on published content. The agent warns you, but there's no undo. Set up redirects before restructuring live taxonomy.

OAuth tokens are long-lived — treat them like passwords.
Your WPCOM_OAUTH_TOKEN in the Python scripts above grants write access to your sites. Store it in an environment variable or secrets manager, not in source code. Rotate it if it's ever exposed.

Final Thoughts

The WordPress.com MCP write integration is one of the more thoughtful AI feature launches of 2026. The safety design is solid: OAuth 2.1 auth, role enforcement, draft defaults, trash-based deletion, per-operation toggles, and a full Activity Log. It's the kind of careful implementation that usually only comes after a few public mistakes — Automattic seems to have learned from watching others.

More interesting than the WordPress.com integration itself is what it signals about MCP's trajectory. When 43% of the web's CMS infrastructure has agentic write access via an open protocol, the question stops being "should we add MCP support?" and starts being "what do we lose by not having it?"

For developers: connect Claude to your WordPress.com site today, run a media audit, restructure your categories, and see how much time you reclaim. For teams building agentic products: study how WordPress.com designed the permission model. For everyone: keep human review in the loop. The drafts folder exists for a reason.

Sources:

1. WordPress.com MCP Write Capabilities Announcement — Automattic, March 20, 2026
2. WordPress.com MCP Original Launch — Automattic, October 2025
3. WordPress.com MCP Tools Reference — Developer Documentation
4. WordPress.com MCP Prompt Examples — Developer Documentation
5. Automattic MCP Ecosystem Overview — automattic.ai
6. Model Context Protocol Introduction — modelcontextprotocol.io
7. TechCrunch: WordPress.com now lets AI agents write and publish posts — TechCrunch, March 20, 2026
8. The Verge: AI Artificial Intelligence — The Verge
9. WordPress.com Claude Connector Launch — Automattic, February 2026
10. WordPress.com OAuth 2.1 Support — Automattic, January 2026
11. WordPress.com About Page — Automattic
12. WordPress.org About Page (43% stat) — WordPress.org