Easy MCP AI for WordPress

Easy MCP AI is a free WordPress plugin that exposes your site as a Model Context Protocol (MCP) server, letting AI assistants like Claude, ChatGPT, and Cursor manage content, SEO, media, and analytics through natural conversation. Built by a small team of WordPress and plugin developers, it runs entirely in pure PHP with no Node.js, no external proxy, and no additional infrastructure required. The plugin is available on WordPress.org and the developer reports over 6,000 active website installations.

What It Is

Easy MCP AI bridges WordPress and AI assistants using the open Model Context Protocol standard created by Anthropic. Once installed, it exposes WordPress capabilities as AI-ready tools that any MCP-compatible client can call. The plugin covers the full content lifecycle — from keyword research and content planning through writing, publishing, SEO optimization, and analytics — all accessible through a single conversation without touching the WordPress admin panel.

Tool Coverage and Plugin Integrations

The plugin ships with 240 total MCP tools across three categories:

• 96 core tools covering posts, pages, media, comments, users, categories, tags, menus, plugins, themes, blocks, custom post types, revisions, templates, and global styles
• 92 plugin integration tools for WooCommerce, Advanced Custom Fields, Yoast SEO, Rank Math, SEOPress, Slim SEO, The SEO Framework, BuddyPress, and The Events Calendar
• 54 data integration tools for Google Analytics 4, Google Search Console, DataForSEO, Semrush, SE Ranking, and Ahrefs

The developer also references a broader "Abilities Directory" covering 90+ plugins and 1,800+ tools via the WordPress 6.9 Abilities API, which allows any plugin adopting that standard to become instantly usable by AI.

Security Architecture

Easy MCP AI includes a layered security model designed for production use:

• OAuth 2.1 with PKCE (S256), Dynamic Client Registration (RFC 7591), and Authorization Server Metadata (RFC 8414)
• Bearer token authentication with SHA-256 hashing — raw tokens are shown only once and never stored in plaintext
• Per-token granular tool permissions via a checkbox-based permission tree
• WordPress capability checks (current_user_can) on every tool call
• Configurable rate limiting (default: 60 requests/minute) with atomic object cache support
• IP whitelisting for IPv4 and IPv6 ranges
• Full audit logging with token ID, tool name, arguments (passwords redacted), result status, IP, and timestamp
• Global "Disabled Delete Tools" setting to block destructive operations system-wide

Pure PHP Deployment Model

The plugin runs entirely inside WordPress on any standard shared hosting. There are no long-running processes, no Node.js scripts, and no external proxy services. MCP classes lazy-load only on REST API requests, keeping frontend performance unaffected. Token validation is cached in the object cache for fast request times. The MCP endpoint follows the standard WordPress REST API pattern at /wp-json/easy-mcp-ai/v1/mcp and requires HTTPS.

AI Client Compatibility

Easy MCP AI supports any MCP-compatible AI client, with documented setup guides for Claude Desktop, Cursor, and ChatGPT. The plugin uses Streamable HTTP transport, which is the current MCP transport standard. The admin interface is available in 52 languages, including English, Spanish, French, German, Portuguese, Japanese, Chinese, Indonesian, and Arabic, with per-plugin language customization independent of the global WordPress locale.

Why It Matters for WordPress Operators

The plugin positions itself as an end-to-end workflow tool rather than a single-purpose integration. A single AI conversation can pull keyword data from DataForSEO or Semrush, generate a content plan, draft and publish a post directly to WordPress, push SEO metadata to Yoast or Rank Math, and then retrieve Google Analytics and Search Console performance data — without the user leaving the chat window. The plugin is listed as 100% free with no second subscription required; third-party SEO API costs (DataForSEO, Semrush, etc.) are paid separately to those providers.