miniOrange MCP - Secure MCP Server for ChatGPT, Claude, Gemini, any AI Agent

MCP (Model Context Protocol) is an open standard that lets AI assistants use tools. This plugin makes your WordPress site an MCP server, so AI clients like Claude and ChatGPT can safely read and update your site through tools you control.

Yes. Alongside its own MCP server, which Claude, ChatGPT and other assistants reach over OAuth 2.1, this WordPress MCP plugin includes an MCP adapter that offers them the abilities your plugins register, next to its own 483 abilities.

Install and activate Secure MCP Server, create an AI agent, and choose ChatGPT under Connect your AI client. Open the MCP Server for WordPress app in ChatGPT, enter your site's address and click Allow Access. It takes about two minutes, and ChatGPT can then write posts, edit pages, manage WooCommerce products and more, using only the tools you allowed.

Yes. Every WordPress user connects their own AI client with their own login, so each person's AI works as them, is limited to their role, and is recorded under their name in the audit log. Team members find their connection steps under My AI Access in wp-admin.

Yes. In the Agent Registry you choose, for each WordPress role, which tools an AI agent may use: for example, editors' AI can write and edit posts but not install plugins or change settings. Every call is also checked against the person's own WordPress permissions, so an AI can never do more than its user could do in wp-admin.

Claude, ChatGPT, Gemini, Cursor, Grok, Windsurf and any MCP-compatible client.

483 tools in 34 categories, covering WordPress core, the block editor, menus, widgets, WooCommerce, Yoast SEO, Rank Math, Advanced Custom Fields, Elementor, Divi, Kadence, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, theme editing and site maintenance. Integration tools appear only when the related plugin is active.

These are just examples of what you can ask. Your AI can do anything that the abilities allowed for your role can do.

• "Write a blog post about our summer sale, add it to the News category and schedule it for Monday 9 AM."
• "Find all products under ₹500 and put them on a 20% sale until Sunday."
• "Write meta descriptions for every post that doesn't have one."
• "Export this month's Gravity Forms entries as CSV."
• "Change the footer text in my theme, preview it, then publish."
• "Why aren't my scheduled posts publishing? Check cron and the error log."
• "Use the REST API to list this week's bookings from my booking plugin."
• "Change the heading in my homepage hero to 'Spring Collection'."
• "Add our new Pricing page to the main menu, right after About."

Yes. Access uses self-hosted OAuth 2.1 with PKCE, so the AI never sees your password. Every call is limited by role through the agent Registry, checked against WordPress capabilities, rate-limited and logged. You can require human approval for sensitive actions and mask sensitive data. Rate limits are enforced by the miniOrange Gateway; human approval and data masking are part of the Business plan.

No. Every tool runs as the WordPress user who approved the connection, and every call is checked against that user's capabilities exactly as in wp-admin.

Yes. Secure MCP Server becomes your MCP adapter for every REST route you allow, without any coding. AI can discover and call any WordPress REST route, including those from WooCommerce, Yoast and other plugins, with no plugin update needed. A new agent starts with read-only access to core WordPress content. Writes and routes outside it need an explicit, per-role grant, and you can switch off all create, update or delete REST calls for the whole site. Plugin and theme install, activate, batch and blueprint-import routes are always blocked.

Theme changes never touch the live site directly. They go into a draft, PHP is syntax-checked and JSON validated, and you can preview the draft. Publishing takes a backup and rolls back automatically if the site fails to load, and you can restore any earlier publish.

Yes. 41 tools cover products, attributes, orders, order notes, refunds, customers, coupons and sales reports.

Yes. 14 Yoast SEO tools cover titles, meta descriptions, focus keywords, cornerstone content, robots, canonicals, breadcrumbs, Open Graph, Twitter/X cards, schema and sitemaps. Rank Math SEO metadata is also supported.

Yes. The read-only SEO tools need only permission to read a post, so you can give them to a role such as Subscriber and keep the AI strictly read-only. They show each post's SEO title, meta description and focus keywords, both as saved and as search engines see them, and can list posts with SEO issues such as a missing meta description. They work with Rank Math and Yoast SEO, and with All in One SEO and SEOPress on the Pro plan.

Yes. 25 ACF tools cover field values, repeaters, flexible content, relationships, options pages, field groups and location rules.

Yes. Elementor (12 tools), Divi 3 and Divi 4, and Kadence Blocks (18 tools) are supported, so AI can read, edit, style and build layouts. Divi support (Divi 4 and Divi 5 layouts) is part of the Pro plan.

Yes. For pages and posts made in the block editor, the AI can list the blocks on a page and change one heading, paragraph, button, image caption or setting, insert new blocks or patterns exactly where you ask, and move, duplicate or delete a block, while every other block stays exactly as it was. Each change saves a revision you can restore. Pages built with Elementor, Divi or another page builder are edited with that builder's own tools instead.

Yes. The AI can create and rename menus, add pages, posts, categories and custom links, reorder and nest items, assign menus to your theme's locations, and edit the Navigation menus used by block themes. It can also add, update, move and delete sidebar and footer widgets.

Page caches are cleared automatically after each AI change, for the most common cache plugins, managed hosts and CDNs. If a cache the plugin does not recognise still shows the old page, clear it from that cache's settings, or ask the AI to clear the caches. A changed page is cleared straight away; to keep busy sites fast, the whole cache is cleared at most once a minute, so a site-wide change such as a menu edit can take up to a minute to show.

Contact Form 7 (with Flamingo for submissions), WPForms, Gravity Forms and Fluent Forms, including CSV export of entries.

Yes. Every tool has a global on/off toggle, and the agent Registry controls tools per role. Developers can also limit exposed tools with the MOSMCP_EXPOSED_PREFIXES constant. Tools are switched on or off for each agent and WordPress role in the Agent Registry's role/ability matrix; a tool that is off for a user's role is hidden from their AI client, and the AI is told how it can be turned on.

Click Revoke in the agent Registry. Access ends immediately.

Yes. Connect as many as you need, each with separate permissions and its own audit trail.

Page lock blocks edits to content that changed after the AI read it, post revisions can be restored, theme changes publish with automatic backup and rollback, and destructive actions require confirmation.

No. The MCP server and OAuth server run on your own WordPress site. Your AI client connects directly to your site. If you connect through the miniOrange Gateway (gateway.miniorange.ai), your AI client's requests pass through the gateway on their way to your site; the tools still run, and every permission is still checked, on your own site.

AI clients need a public HTTPS URL. Sites on localhost or behind a firewall cannot be reached. Also make sure your CDN or cache is not caching the MCP endpoint. Open the Troubleshooting tab in Secure MCP Server to run a connection test; it lists the likely causes with the fix for each.

No. Install, follow the onboarding checklist, and paste one URL into your AI client.