Cowboy MCP - Free MCP Server with Undo for Claude & ChatGPT

Cowboy MCP is a free, open-source WordPress MCP server: a Model Context Protocol endpoint that runs inside your own site, so Claude, ChatGPT, Cursor, Claude Code, Codex, Gemini and any other MCP client can manage WordPress in plain English. Every tool is included, every change your agent makes can be undone, and nothing is routed through a third-party relay - the agent talks straight to your site. Stop clicking around wp-admin. Just tell your AI what you want.

• 💬 Do everything by chat - create and edit posts and pages, run your WooCommerce shop, manage users and menus, tidy the media library, change settings, and fix errors when they crop up.
• ↩️ Undo any change - a per-change undo journal and one-click database checkpoints let you roll back a single edit or the entire site.
• 🔄 Updates plugins & themes safely - backup first, health check after, one-command undo if anything breaks.
• 🛡️ Safe by default - safe mode confirms before anything destructive, you can preview any change before it runs, every key can be scoped to read-only, and every action is written to an audit log.
• 🆓 Free and open source - every tool included, with deep WooCommerce, Gutenberg, ACF, Elementor, Wordfence and SEO support. No Pro tier, no credits, no usage meter.
• 🔒 Your data stays yours - self-hosted, no accounts, no relay, no phone-home. Your agent connects to your site; nothing leaves your server.
• 🔌 Works with your AI agent - Claude, ChatGPT, Cursor, Codex, Gemini, Claude Code and any MCP client. Set up in about two minutes, on a live site or a local one.

"More access than any other MCP offers, easy to use, LOVE the change journal and the checkpoints - safe if you break something, without having to run back ups on the host or yet another plugin." - a WordPress.org reviewer

Ask in plain language - "publish these three drafts," "why is the checkout page 500-ing," "bump every Summer Sale price 20%," "clear the cache and re-check site health" - and your agent gets it done. Most WordPress AI plugins let an assistant write blog posts. Cowboy MCP lets your agent actually run the site: content, yes, but also the terminal-level work you would normally stop and do by hand - WP-CLI, files, the database, error logs, and diagnostics. When something breaks, your agent can find it and fix it instead of just apologizing. Try it without installing anything: click Live Preview above to open a throwaway WordPress Playground site with Cowboy MCP already active. What you can do with it

• Manage content by chat - draft, edit, schedule, and publish posts and pages; upload media; sort categories and tags; build navigation menus.
• Edit pages block by block - your agent reads any page as a Gutenberg block tree and makes surgical edits: update a heading, move a section, swap a pattern. On block themes it can edit Site Editor templates and global styles too - all undoable.
• Run the back office - add and edit users, change roles, and tidy the media library: find every image missing alt text and fix it in one go. Deleted media is recoverable, and the site can never be left without an administrator.
• Run your store - update WooCommerce products, prices, orders, refunds, coupons and inventory in bulk; pull sales reports.
• Fix things that break - read error logs, test emails and HTTP requests, inspect hooks and REST routes, check transients and rewrite rules, and repair database tables. No SSH required.
• Do the developer stuff - run WP-CLI commands, edit files in wp-content, and take site snapshots before big changes.
• Vibe code your site - describe the theme tweak or feature you want; your agent writes the code, checks the error log, and fixes what it broke. With per-change undo and database checkpoints, vibe coding a live site stops being reckless.
• Keep SEO tidy - read, write and audit Yoast SEO or Rank Math meta across the site with one vocabulary.
• Plug into the WordPress Abilities API - every tool doubles as a cowboy-mcp/* ability, so WP-CLI (wp ability run), the REST API, the official MCP Adapter and WordPress's own AI tooling can call it - with safe mode, the audit log and undo still in front. Abilities other plugins register (WooCommerce, the AI plugin's core abilities, core) show up as tools for your agent automatically.
• Get more done, faster - the server fronts its tools with a two-tool gateway (cowboy_discover + cowboy_run), so your agent stays sharp and accurate with a big toolset and picks the right action the first time.

Tool coverage Up to 168 tools. The core set is always on; integrations light up automatically when their plugin is active.

• Content - posts, pages and custom post types (5) · taxonomies (4) · comments (4) · media (4) · menus (6) · options (1)
• Gutenberg & Site Editor - block tree read/edit with path addressing, block types, patterns, templates and template parts, global styles, navigations (15; 8 on classic themes)
• Site administration - users and roles (5) · plugins (6) · themes (5) · files in wp-content (4) · database health and repair (5) · WP-CLI, site info and search-replace (3) · site health (1)
• Diagnostics - error log, HTTP and email tests, hooks, transients, REST routes, thumbnails, rewrite rules, snapshot, Connection Doctor (10)
• Safety - list changes, undo a change, create/list/restore/delete database checkpoints (6) · batch execution and audit-log retrieval (2)
• WooCommerce - products and variations, orders and refunds, customers, coupons, tax and shipping settings, reports (40)
• Wordfence - scans, blocks, firewall, live traffic, activity, settings (17)
• ACF - field groups, fields, values, repeaters (9) · Elementor - templates, page content, global styles, widgets (7)
• SEO - Yoast SEO and Rank Math meta read/write/audit (4) · Cache - WP Rocket, LiteSpeed Cache, W3 Total Cache (4) · Forms - WPForms, Gravity Forms, Contact Form 7 (1)

Plus 17 read-only MCP resources (site info, recent posts, plugin list, the full tools catalog, and more), 4 resource templates, and 8 guided workflow prompts (site audit, troubleshooting, SEO optimization, security hardening, performance, content migration, bulk updates, WooCommerce setup). Connect Claude Code to WordPress Generate an API key under Settings > Cowboy MCP, then run one command in your terminal: claude mcp add --transport http your-site https://yoursite.com/wp-json/cowboy-mcp/v1/endpoint --header "Authorization: Bearer YOUR_API_KEY" The Connection tab shows this command pre-filled with your site's endpoint. Ask Claude Code to "list my draft posts" and it will call the matching tool. Connect Claude (desktop and web) with one click No terminal and no key to paste: turn on the Desktop Connector under Settings > Cowboy MCP > Settings, add your site's endpoint as a custom connector in the Claude desktop or web app, and approve the sign-in on your own site as an administrator. The consent screen lets you choose full access, read-only, or a hand-picked list of tools. This is a standard OAuth 2.1 flow and requires a public HTTPS site; on a local site, Claude Desktop connects through the small mcp-remote bridge shown on the Connection tab instead. Connect ChatGPT to WordPress ChatGPT connects to your site as a custom connector (Developer Mode) using the same one-click sign-in. It needs a public HTTPS site because ChatGPT connects from OpenAI's servers. The Connection tab walks through the steps. Connect Cursor, Windsurf, Cline, Zed and VS Code Add one block to your editor's MCP config (for Cursor, ~/.cursor/mcp.json): { "mcpServers": { "your-site": { "url": "https://yoursite.com/wp-json/cowboy-mcp/v1/endpoint", "headers": { "Authorization": "Bearer YOUR_API_KEY" } } } } Any client that speaks Streamable HTTP with a Bearer header works the same way. Connect Codex CLI export COWBOY_MCP_API_KEY="YOUR_API_KEY" codex mcp add your-site --url https://yoursite.com/wp-json/cowboy-mcp/v1/endpoint --bearer-token-env-var COWBOY_MCP_API_KEY Connect Gemini CLI gemini mcp add --transport http your-site https://yoursite.com/wp-json/cowboy-mcp/v1/endpoint --header "Authorization: Bearer YOUR_API_KEY" n8n, Opencode and other MCP clients Cowboy MCP is a standard Streamable HTTP MCP server (JSON-RPC 2.0). Point any MCP client - n8n, Opencode, LibreChat, your own agent - at /wp-json/cowboy-mcp/v1/endpoint with an Authorization: Bearer header. Local development sites Local, Studio, MAMP, DevKinsta, wp-env, Docker - it works the same. Terminal tools (Claude Code, Cursor, Codex, Gemini CLI) run on the same computer as your local site and connect with an API key exactly like on a live site, no public URL or tunnel needed. Claude Desktop connects through the mcp-remote bridge; the Connection tab detects local sites and shows the ready-to-copy config. Only the cloud apps - claude.ai and ChatGPT - need a public HTTPS address. Built for live sites You are handing an AI real control, so Cowboy MCP is built to keep you in charge:

• Safe mode (on by default) - destructive tools refuse to run until the agent resends the call with explicit confirmation, and the refusal includes a preview of what would have happened.
• Dry run - every non-read-only tool accepts a dry-run flag that reports exactly what would change without touching anything.
• Per-change undo journal - before-state snapshots for every journaled change; roll back a single edit from the Activity tab or by asking your agent; seven-day retention by default; conflicts are detected if something else changed the same row since.
• Database checkpoints - one-click snapshots of your site's database tables, restorable in one click; taken automatically before plugin and theme updates and before mutating WP-CLI commands. Checkpoints restore tables, not uploaded files or code.
• Safe plugin and theme updates - file backup first, database checkpoint, then a health check that automatically restores the previous version if the site breaks.
• Audit log - every tool call, error and authentication event, with key, tool, arguments and result, on the Logs tab; pruned after 30 days.
• Scoped credentials - each API key and each OAuth connection can be full access, read-only, or a custom list of tools; a read-only key cannot write even if the agent tries.
• Hashed keys, rate limits, origin checks - keys are shown once and stored as one-way hashes, requests are rate-limited per key (120/minute by default), and requests from unknown browser origins are rejected.
• Guardrails you cannot talk your way past - a denylist of sensitive options, dangerous SQL and WP-CLI commands, SSRF protection on outbound requests, path confinement to wp-content with a syntax check on every PHP write and no writes to mu-plugins, self-delete and last-administrator protection, and a Power mode for the rare job that needs the gloves off - which only a human can switch on in wp-admin. The agent can never grant itself more power through Cowboy's own tools, and abilities from other plugins cannot touch Cowboy's credentials or settings either.
• Connection Doctor - a one-click self-test that checks HTTPS, reachability, REST, OAuth discovery and common host blockers (Cloudflare challenges and bot rules, ModSecurity-style firewalls, LiteSpeed caching), names the exact thing in the way, and hands you a report you can paste into a support topic.

How Cowboy MCP is different

• Nothing in the middle. Some WordPress MCP products route every request through their own cloud relay and meter your agent's actions in credits. Cowboy MCP's endpoint runs on your server; there is no account, no relay, no quota. Your content never passes through us.
• Every tool is free. Some plugins gate the useful tools - plugins, themes, the database, WooCommerce - behind a Pro licence. Cowboy MCP ships all of them, GPL-licensed, with no paid tier.
• Typed tools with undo, not a PHP shell. Power tools that let an agent execute arbitrary PHP are built for development and staging copies, with backups. Cowboy MCP gives the agent typed, annotated tools wrapped in safe mode, dry run, undo and checkpoints, so it can be trusted on the site that pays the bills. (Want the comparison? See Cowboy MCP vs Novamira.)
• Undo, checkpoints and an audit trail together. Several MCP plugins now offer approval gates or a time-boxed undo. Cowboy MCP pairs per-change undo with whole-database checkpoints and an always-on audit log, plus dry run and safe mode in front of them - so you can see what happened, preview what will happen, and reverse either one change or all of them.
• A complete server today, wired into the official pieces. WordPress core is growing an Abilities API and an official MCP adapter; they are a framework for exposing capabilities, not a turnkey server. Cowboy MCP is the turnkey server - install, generate a key, connect - and on WordPress 6.9+ it bridges both ways: its tools are registered as abilities (so the adapter, WP-CLI and REST get them with undo), and abilities from other plugins become tools for your agent. Works on WordPress 6.2 or later with no Composer, Node.js or build step.

Setup guides for every client, the full capability list, the security model and head-to-head comparisons with Novamira, AI Engine, WPVibe, InstaWP, the WordPress MCP Adapter and StifLi Flex MCP live at cowboymcp.com. Works with Claude Code, Claude desktop and web apps (one-click sign-in), ChatGPT (Developer Mode connector), Cursor, Windsurf, Cline, Zed, VS Code, Codex CLI, Gemini CLI, Opencode, n8n and anything else that speaks MCP over Streamable HTTP. Integrations that light up automatically: WooCommerce, Gutenberg and the Site Editor, Yoast SEO, Rank Math, Advanced Custom Fields (ACF), Elementor, Wordfence, WP Rocket, LiteSpeed Cache, W3 Total Cache, WPForms, Gravity Forms and Contact Form 7. External services Cowboy MCP sends no telemetry and makes no calls home. The only outbound connections are to WordPress.org, when your agent installs or updates plugins or themes, and any HTTP requests you explicitly ask your agent to make with the HTTP-request tool. Your AI client connects directly to your site; no third-party server sits in between. Support and reviews Questions and connection problems: post in the support forum and paste the Connection Doctor report - topics are usually answered within a day. Bugs and feature requests: GitHub issues. If Cowboy MCP saves you time, a review helps other site owners find it.

1. Install and activate Cowboy MCP from the Plugins screen.
2. Go to Settings > Cowboy MCP and click Generate API Key (it is shown once - copy it).
3. Connect your agent and start giving it instructions.

Claude Code: claude mcp add --transport http your-site https://yoursite.com/wp-json/cowboy-mcp/v1/endpoint --header "Authorization: Bearer YOUR_API_KEY" Claude desktop / web (no terminal): enable the OAuth connector under Settings > Cowboy MCP > Settings > Desktop Connector, add your site as a custom connector in Claude, and approve with one click. (Requires a public HTTPS site; on a local site use the mcp-remote bridge shown on the Connection tab.) Cursor, Codex, Gemini CLI, ChatGPT and other clients: the Connection tab shows a ready-to-copy setup for each, and the connection guides at cowboymcp.com walk through every client step by step.

1.6.6

• Fix: connecting over OAuth while logged out of wp-admin works again. The login round-trip was stripping the percent-encoding from the authorization request, which corrupted redirect_uri and resource so the connection could not resume after signing in. Thanks to @lukaszliniewicz for the report and the fix.
• Fix: the per-IP request limit that guards the endpoint against credential stuffing now counts only failed authentication attempts. Busy sessions behind one IP (cloud connectors, parallel tool calls) were being refused with 429 before their own per-key limit applied.
• Fix: scheduled publishing works. wp_create_post and wp_update_post accept a date ("YYYY-MM-DD HH:MM:SS" in the site timezone, or ISO 8601 with an offset), and wp_update_post accepts status "future".
• Fix: wp_db_health_report counted autoloaded options using only the pre-6.6 "yes" value and undercounted on current WordPress.
• Fix: the Activity tab and audit log now record whether each tool call succeeded, failed, or threw.
• Change: the cache tools are always available. Without WP Rocket, LiteSpeed Cache, or W3 Total Cache, wp_cache_flush clears the WordPress object cache and expired transients instead of the tool being absent.

Earlier versions For the changelog of earlier releases, see changelog.txt.