Llamly MCP - AI Agent with ChatGPT & Claude

A plugin that lets AI apps act on your site through the Model Context Protocol (MCP), the open standard that ChatGPT, Claude, Cursor and other agents use to call external tools. Llamly MCP turns your WordPress site into one of those tools, so your agent can publish, edit and organize things directly instead of telling you what to click.

Install Llamly MCP, open Llamly > Connections and pick ChatGPT. On chatgpt.com, turn on Developer mode in Settings > Security and login, add a custom MCP server with your Llamly endpoint and OAuth authentication, and approve access on your site. It needs a Plus, Pro, Business, Enterprise or Edu plan and a public HTTPS site.

For claude.ai and Claude Desktop, click "Add to Claude" in the Llamly recipe and approve the sign-in on your site, with no terminal and no key. For Claude Code, create a key in the recipe and run the one-line command shown there.

No. Llamly does not call any AI model. You use the AI app you already have, on its own plan, and that app connects to your site. Llamly only needs its own access key or an OAuth approval, both created inside your site.

Yes. This plugin is free and licensed GPLv2 or later. Llamly does not meter requests; the only limit is the rate limit per connection you set in Settings.

No. There is no account and no sign-up. Everything runs inside your WordPress site.

No. Apps like ChatGPT and claude.ai connect with a click and an approval on your site, and from then on you just ask in plain language. Terminal apps such as Claude Code and Codex get a ready-to-paste command.

Any MCP client over Streamable HTTP. Recipes are included for ChatGPT, claude.ai, Claude Desktop, Claude Code, Codex, Cursor, OpenCode and Antigravity CLI.

Almost every change is journaled and can be undone, safe mode makes the agent confirm before deleting or undoing, and the optional approval queue holds publishing for you. The agent works with content permissions only, never administrator ones. Keys can be read only, and every request is logged. See "Safe by design" above.

Yes, read only: the agent can read Elementor pages, templates, widgets and global styles, but Llamly never writes Elementor data.

No. There is no Llamly server or relay. The AI app you connect (ChatGPT, Claude, Codex, Cursor and others) sends requests straight to your site with an access key or an OAuth grant that a user of your site created, and you can revoke it at any time in Connections. Each request runs as that user with content permissions only: an administrator's key cannot change site settings, users, plugins, themes or code, and cannot write unfiltered HTML.

No. Your posts, pages, media, connections, keys, logs and change journal are never sent anywhere. Llamly makes no outbound calls at runtime, except the optional usage statistics described in External services, which send nothing unless an administrator opts in. The AI app you connect sends requests to your site and receives the answers; what that app does with them is governed by its own terms. The connection diagnostics in Connections (Run checks) only call your own site (loopback) to check that the REST API, the MCP endpoint and the OAuth discovery URLs answer.

By default the agent can create, edit and publish without waiting for you, and every change is journaled, so almost everything can be undone in Activity. With safe mode on (the default) the agent must first show you what it will do and send confirm: true before it deletes or trashes something, before it undoes a change, before a redo that is destructive or irreversible, and before changes that cannot be undone. Llamly cannot create, change or delete users. Llamly cannot change site settings either. If you want to approve things yourself, turn on "Require my approval to publish" in Settings: those requests then wait for you in wp-admin.

The Activity tab does not read the current state of every item, so it stays fast with a large history. If you edited an item in WordPress after the agent changed it, Llamly checks the real state when you click Undo and, if the item changed, warns you instead of overwriting your edit.

Approval requests expire after 7 days. The agent must send a new request after that.

In Connections, open the app's menu under Connected apps and click Revoke access. The next request with that token or key is rejected. Deactivating the plugin also stops every connection: the endpoint no longer exists while Llamly is inactive.

If the browser checks pass, this is shown as a warning, not a failure: AI apps connect from outside. Security and cache plugins (Wordfence, Solid Security, All In One WP Security, Sucuri, WP Rocket, W3 Total Cache, LiteSpeed Cache and others) are listed as a heads-up, since they sometimes restrict or cache REST requests.

Media uploads go through MCP as base64 in a single request that is limited to 1 MiB, so one wp_upload_media call carries a file of up to about 693 KB (or less if your PHP upload limit is lower). Text fields such as the caption travel in the same request; for long texts upload the file first and then call wp_update_media. Larger files are refused with a clear message.

Yes for apps that run on your computer and use a key (Claude Code, Codex, Cursor, Antigravity CLI, OpenCode) and for Claude Desktop through the local bridge. claude.ai, ChatGPT and the Claude cloud connector need a public HTTPS address.

Connections, history and settings are kept per site.

By default nothing is removed, so you can reinstall without losing connections, history and settings. If you turn on "Delete data when deleting the plugin" in Settings (it asks for confirmation), deleting the plugin removes Llamly's own tables, options, transients, user meta and the uploads/llamly-mcp folder. Posts, pages, media, users and any other WordPress content are never removed by uninstall. Before an update that rewrites or removes existing data or columns in Llamly's tables, the previous tables are first copied to backup tables named <table>_bak_v<N>. Purely additive updates (new columns or tables) make no copy. The latest backups stay in the database as a safety net, and older ones are removed after a later verified update; deleting the plugin with "Delete data when deleting the plugin" turned on also removes them.