Cascadia Web Services

MountDev AI MCP Connector is a WordPress MCP plugin that lets you connect ChatGPT, Claude, and other MCP-compatible AI clients directly to your WordPress site. Use it to give AI agents secure, controlled access to WordPress posts, pages, media, comments, users, and other site resources through the Model Context Protocol.
If you are searching for a way to connect ChatGPT to WordPress, connect Claude to WordPress, or run AI agents on WordPress with secure authentication and permission controls, this plugin provides a practical WordPress AI connector for content management, publishing workflows, media handling, and site updates.
Built for agencies, developers, publishers, and teams using AI to manage WordPress, MountDev AI MCP Connector supports OAuth 2.0 for ChatGPT, WordPress Application Passwords for Claude Desktop, Cursor, and Windsurf, and profile-based access controls to help keep WordPress automation secure.
WooCommerce Support: Manage your online store with 74 WooCommerce-specific tools for products, orders, coupons, shipping, tax rates, webhooks, payment gateways, and reports. Control inventory, process refunds, manage product variations, and automate store operations through AI agents.
<h4>Features</h4>
<ul>
<li>MCP Server Implementation – Full JSON-RPC 2.0 endpoint for MCP protocol</li>
<li>OAuth 2.0 Support – Native OAuth authentication for ChatGPT with secure credential generation</li>
<li>WordPress Application Passwords – Secure Basic Auth for Claude Desktop, Cursor, Windsurf</li>
<li>Profile-Based Access Control – Predefined profiles for flexible tool management</li>
<li>149 Essential Tools – 75 WordPress core + 74 WooCommerce tools</li>
<li>74 WooCommerce Tools – Products, orders, coupons, shipping, tax, and more (requires WooCommerce plugin)</li>
<li>Zero External Dependencies – Pure WordPress implementation</li>
<li>AES-256-CBC Encryption – Client secrets stored securely</li>
</ul>
<h4>Supported Clients</h4>
<ul>
<li>ChatGPT – OAuth 2.0 authentication with Client ID/Secret</li>
<li>Claude Desktop – Basic Auth with Application Passwords</li>
<li>Cursor – Basic Auth with Application Passwords</li>
<li>Windsurf – Basic Auth with Application Passwords</li>
<li>Any MCP-compatible client supporting OAuth 2.0 or Basic Auth</li>
</ul>
<h4>Supported Plugins</h4>
WordPress Core (75 tools) – Complete WordPress management including posts, pages, media, comments, users, taxonomies, site settings, menus, plugins, and themes.
WooCommerce (74 tools) – Full integration with WooCommerce for managing your online store: 
* Products & Inventory – Create, update, manage variations, stock levels, categories, tags, brands, and attributes 
* Orders & Fulfillment – Process orders, refunds, order notes, and customer management 
* Store Operations – Coupons, shipping zones, tax rates, payment gateways, webhooks, and sales reports
All tools respect WordPress user capabilities and permissions. Visit the plugin’s Profiles tab to see the complete tool list and create custom access profiles.
<h3>External Services</h3>
This plugin includes a Node.js bridge script that connects MCP clients (Claude Desktop, Cursor, Windsurf, etc.) to your WordPress site’s REST API endpoints. The bridge facilitates communication between the MCP client and your WordPress installation.
What the service is and what it is used for: 
The wordpress-mcp-bridge is a Node.js script that acts as a communication bridge between MCP-compatible AI clients and your WordPress site’s REST API. It translates MCP protocol requests into WordPress REST API calls and returns the responses to the AI client.
What data is sent and when: 
When you use an MCP client (like Claude Desktop) with this plugin, the bridge sends the following data to your WordPress site’s REST API endpoints: 
* Your WordPress username and Application Password (for authentication) 
* MCP protocol requests (tool calls, resource requests, prompts) 
* Content data when creating or updating WordPress posts, pages, media, etc. 
* This data is sent every time you interact with WordPress through the MCP client
Where the data is sent: 
All data is sent to YOUR OWN WordPress site’s REST API endpoints at: 
* <code>https://yoursite.com/wp-json/mountdev-ai-mcp-connector/v1/messages</code> (main MCP endpoint) 
* <code>https://yoursite.com/wp-json/mountdev-ai-mcp-connector/v1/oauth/*</code> (OAuth endpoints for ChatGPT)
Important notes: 
* No data is sent to any third-party external services 
* All communication is between the MCP client and your own WordPress installation 
* Your WordPress credentials and data remain on your own server 
* The plugin does not transmit any data to external services operated by the plugin author or any third parties
<h3>Security</h3>
<ul>
<li>OAuth 2.0 with PKCE – Enhanced authorization flow for ChatGPT</li>
<li>AES-256-CBC Encryption – Client secrets encrypted at rest</li>
<li>Token Expiration – Access tokens expire after 1 hour</li>
<li>Refresh Tokens – Valid for 30 days with automatic renewal</li>
<li>Authorization Codes – Expire after 10 minutes</li>
<li>WordPress Application Passwords – Secure Basic Auth for other clients</li>
<li>Admin-Only OAuth – Only administrators can authorize ChatGPT connections</li>
<li>Profile-Based Restrictions – Control which tools are available</li>
<li>Capability Checks – All operations respect WordPress user permissions</li>
<li>No Privilege Escalation – Users cannot perform actions beyond their role</li>
</ul>
<h3>License</h3>
This plugin is licensed under the GPL v3 or later.
See https://www.gnu.org/licenses/gpl-3.0.en.html for details.

MountDev AI MCP Connector

Transform your WordPress site into an AI-powered Model Context Protocol (MCP) server. Exposes WordPress functionality for AI agents.

Royal Plugins

Royal MCP is a security-first Model Context Protocol (MCP) server for WordPress. It gives AI platforms like Claude, ChatGPT, and Google Gemini structured access to your WordPress content — with authentication, rate limiting, and audit logging that most MCP implementations skip entirely.
According to <a href="https://mcpplaygroundonline.com/blog/mcp-server-security-complete-guide-2026" rel="nofollow ugc">recent security research</a>, 41% of public MCP servers have no authentication and respond to tool calls without any credentials. Royal MCP takes the opposite approach: every MCP session requires an API key, every request is rate-limited, and every interaction is logged.
<h4>Why Security Matters for MCP</h4>
MCP gives AI agents the ability to read, create, update, and delete your WordPress content. Without proper authentication, anyone who discovers your MCP endpoint can:
<ul>
<li>Read all your posts, pages, and media</li>
<li>Create or delete content</li>
<li>Access user data and plugin information</li>
<li>Overwhelm your server with rapid-fire requests</li>
</ul>
Royal MCP prevents all of this with API key authentication on session initialization, timing-safe key comparison, per-IP rate limiting (60 requests/minute), and a full activity log of every MCP interaction.
<h4>37+ MCP Tools Built In</h4>
WordPress Core (37 tools):
<ul>
<li>Posts — create, read, update, delete, search, count</li>
<li>Pages — full CRUD with parent page support</li>
<li>Media — library browsing, metadata, deletion</li>
<li>Comments — create (respects moderation settings), read, delete</li>
<li>Users — display names and roles (emails and usernames are not exposed)</li>
<li>Categories & Tags — create, assign, delete, count</li>
<li>Menus — list menus and menu items</li>
<li>Post Meta — read, update, delete custom fields</li>
<li>Site Info — site name, description, WordPress version, timezone</li>
<li>Plugins & Themes — list installed plugins and themes with active status</li>
<li>Search — full-text content search across post types</li>
<li>Options — read allowlisted safe options only</li>
</ul>
<h4>Plugin Integrations (Conditional)</h4>
Royal MCP automatically detects compatible plugins and adds specialized MCP tools. No configuration needed — if the plugin is active, the tools appear.
WooCommerce Integration (9 tools): 
When WooCommerce is active, AI agents can manage your store:
<ul>
<li>Browse and search products by category, status, or type</li>
<li>Create and update products with prices, SKUs, stock levels</li>
<li>View orders, order details, and update order status</li>
<li>List customers with order count and total spent</li>
<li>Get store statistics — revenue, order count, average order value by period</li>
</ul>
GuardPress Integration (7 tools): 
When GuardPress is active, AI agents can monitor your site security:
<ul>
<li>Get current security score and grade with factor breakdown</li>
<li>View security statistics — failed logins, blocked IPs, alerts</li>
<li>Run vulnerability scans and review results</li>
<li>List blocked IP addresses and failed login attempts</li>
<li>Browse the security audit log filtered by severity</li>
</ul>
SiteVault Integration (6 tools): 
When SiteVault is active, AI agents can manage your backups:
<ul>
<li>List available backups filtered by status or type</li>
<li>Trigger new backups (full, database, files, plugins, themes)</li>
<li>Check backup progress in real time</li>
<li>View backup statistics — total size, last backup, counts</li>
<li>List and review backup schedules</li>
</ul>
<h4>Works Alongside WordPress Core MCP</h4>
WordPress is building MCP support into core via the Abilities API. Royal MCP complements this by providing security controls that the core implementation does not include — API key authentication, rate limiting, activity logging, and sensitive data filtering. When the Abilities API ships, Royal MCP will continue to provide the security layer, plugin integrations, and WooCommerce tools that core does not cover.
<h4>Supported AI Platforms</h4>
<ul>
<li>Claude (Anthropic) — Full MCP support via Claude Desktop, Claude Code, and VS Code</li>
<li>OpenAI / ChatGPT — GPT-4o, GPT-4 Turbo, GPT-3.5 Turbo</li>
<li>Google Gemini — Gemini 1.5 Pro, 1.5 Flash</li>
<li>Groq — Llama 3.3, Mixtral, Gemma 2</li>
<li>Azure OpenAI — Azure-hosted OpenAI deployments</li>
<li>AWS Bedrock — Claude, Llama, Titan models</li>
<li>Ollama / LM Studio — Local self-hosted models (no external data transmission)</li>
<li>Custom MCP Servers — Connect to any MCP-compatible endpoint</li>
</ul>
<h4>MCP Spec Compliance</h4>
Royal MCP implements the <a href="https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http" rel="nofollow ugc">MCP 2025-03-26 Streamable HTTP transport specification</a>:
<ul>
<li>Single <code>/mcp</code> endpoint for all JSON-RPC communication</li>
<li>POST for client messages, GET for server-sent events, DELETE for session termination</li>
<li>Cryptographically secure session IDs with transient-based storage</li>
<li>Origin header validation to prevent DNS rebinding attacks</li>
<li>Proper CORS handling for browser-based MCP clients</li>
</ul>
<h3>External Services</h3>
This plugin connects to third-party AI services to enable AI platforms to interact with your WordPress content. No data is transmitted until you explicitly configure and enable a platform connection.
What data is sent: Your WordPress content (posts, pages, media metadata) as requested by the connected AI platform through authenticated MCP tool calls.
When data is sent: Only when you have configured a platform with API credentials AND enabled that platform connection AND the AI platform makes an authenticated request.
Supported services and their policies:
<ul>
<li>
Anthropic Claude — Used for Claude AI integration 
<a href="https://www.anthropic.com/legal/consumer-terms" rel="nofollow ugc">Terms of Service</a> | <a href="https://www.anthropic.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
OpenAI — Used for ChatGPT/GPT-4 integration 
<a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms of Use</a> | <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
Google Gemini — Used for Gemini AI integration 
<a href="https://ai.google.dev/terms" rel="nofollow ugc">Terms of Service</a> | <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
Groq — Used for Groq LPU inference 
<a href="https://groq.com/terms-of-use/" rel="nofollow ugc">Terms of Service</a> | <a href="https://groq.com/privacy-policy/" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
Microsoft Azure OpenAI — Used for Azure-hosted OpenAI models 
<a href="https://azure.microsoft.com/en-us/support/legal/" rel="nofollow ugc">Terms of Service</a> | <a href="https://privacy.microsoft.com/en-us/privacystatement" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
AWS Bedrock — Used for AWS-hosted AI models 
<a href="https://aws.amazon.com/service-terms/" rel="nofollow ugc">Terms of Service</a> | <a href="https://aws.amazon.com/privacy/" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
Ollama / LM Studio — Local self-hosted models (no external data transmission)
</li>
<li>
Custom MCP Servers — User-configured servers (data sent to user-specified endpoints only)
</li>
</ul>

Royal MCP

The security-first MCP server for WordPress. Connect Claude, ChatGPT, and Gemini with API key auth, rate limiting, and activity logging.

MountDev AI MCP Connector vs Royal MCP