How to Connect Other MCP Clients to WordPress

Easy MCP AI works with any MCP-compatible client. This page collects the connection settings for clients that don't have a dedicated guide: Windsurf, Cline, Roo Code, Zed, LibreChat, Pydantic AI, and generic stdio-based clients.

For the most popular clients, see the dedicated guides: ChatGPT, OpenAI Codex CLI, Claude.ai, Claude Code, Claude Desktop, GitHub Copilot, Google Antigravity, Cursor, OpenCode, Manus, and LM Studio.

In this article

• Prerequisites
• Generic Settings for Any MCP Client
  • Long-running WordPress Abilities with MCP Tasks
  • OAuth 2.1 (Recommended Where Supported)
  • Bearer Token (Authorization Header)
  • API Key with HTTP Basic
  • Confidential OAuth Clients
  • Token in URL (Last Resort)
• Windsurf
• Cline (VS Code)
• Roo Code (VS Code)
• Zed Editor
• LibreChat
• Pydantic AI (Python)
• Any stdio-Based Client
• Control What Connected Clients Can Access
• Security

Prerequisites

• A WordPress site served over HTTPS with Easy MCP AI installed and activated (see the installation guide).
• Pretty permalinks enabled (Settings > Permalinks set to anything other than "Plain").
• For token-based clients, an API token from Easy MCP AI > Connections (API tokens tab).

Your site's MCP endpoint URL is always your domain followed by /wp-json/easy-mcp-ai/v1/mcp:

https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp

In every snippet below, replace the URL with your own endpoint and YOUR_API_TOKEN with your token.

Generic Settings for Any MCP Client

The MCP endpoint negotiates these protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, and 2025-03-26.

Long-running WordPress Abilities with MCP Tasks

Clients using protocol version 2026-07-28 can use the io.modelcontextprotocol/tasks extension for WordPress Abilities that declare a long-running task contract. The client must declare the extension on the individual tools/call request. Easy MCP AI can then return a task instead of holding the request open until the work finishes.

Poll the task with tasks/get to check its status and collect the result, use tasks/update to provide supported task input, or stop it with tasks/cancel. Easy MCP AI does not push task notifications, so clients should poll for completion. Clients that do not declare the extension continue through the normal synchronous tool-call path.

OAuth 2.1 (Recommended Where Supported)

For clients that support OAuth 2.1, point the client at the MCP endpoint URL. The client auto-discovers OAuth, prompts you to log in to WordPress, and manages tokens automatically. No manual token is needed. If your client cannot open a browser window (for example, terminal, SSH, or CI flows), use Device Login for Browserless MCP Clients.

Setting	Value
Transport	Streamable HTTP
MCP Endpoint URL	https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp
Auth method	OAuth 2.1 (auto-discovered)

For access levels, grant management, and what to do after changing your site address, see Managing OAuth Access in Easy MCP AI.

Bearer Token (Authorization Header)

For clients without OAuth support, generate a token and pass it as a header.

Setting	Value
Transport	Streamable HTTP
Endpoint URL	https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp
Authentication	Authorization: Bearer YOUR_API_TOKEN
Content-Type	application/json

API Key with HTTP Basic

Clients that only expose username and password fields can send an Easy MCP AI API key through HTTP Basic on the MCP endpoint (https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp).

• Put the API key in the password field and use a placeholder username, for example: Authorization: Basic base64(easy-mcp:YOUR_API_TOKEN)
• Or put the API key in the username field and leave the password empty: Authorization: Basic base64(YOUR_API_TOKEN:)

Use this only with wpmcp_ API keys on the MCP endpoint. OAuth access tokens must still be sent with ****** authentication.

Confidential OAuth Clients

Confidential OAuth clients can authenticate with a secret on the OAuth token, device authorization, and revocation endpoints.

• Send client_secret in the request body
• Or send Authorization: Basic base64(client_id:client_secret)

Use exactly one method per request (not both). Public clients configured with token_endpoint_auth_method=none must not send a secret.

Token in URL (Last Resort)

For clients that cannot set headers, append the token to the endpoint:

https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp/YOUR_API_TOKEN

URL-based tokens appear in server access logs, WordPress debug logs, and browser history. Use the Authorization header method whenever possible. A site can also be set to refuse tokens in URLs; see Keep API Keys Out of URLs.

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "wordpress": {
      "serverUrl": "https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_TOKEN"
      }
    }
  }
}

Windsurf also supports OAuth 2.1, so you can omit the headers and complete the login flow instead.

Cline (VS Code)

Add to cline_mcp_settings.json:

{
  "mcpServers": {
    "wordpress": {
      "autoApprove": [],
      "disabled": false,
      "transportType": "streamableHttp",
      "url": "https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_TOKEN"
      }
    }
  }
}

Roo Code (VS Code)

Roo Code uses the same format as Cline. Add the snippet above to the Roo Code MCP settings file (roo_cline_mcp_settings.json).

Zed Editor

Add to ~/.config/zed/settings.json:

{
  "context_servers": {
    "wordpress": {
      "settings": {},
      "url": "https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_TOKEN"
      }
    }
  }
}

LibreChat

Add to librechat.yaml:

mcpServers:
  wordpress:
    type: http
    url: https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp
    headers:
      Authorization: "Bearer YOUR_API_TOKEN"

Pydantic AI (Python)

Use the streamable HTTP server class in your Python application:

from pydantic_ai import Agent
from pydantic_ai.mcp import MCPServerStreamableHTTP

wordpress_mcp = MCPServerStreamableHTTP(
    url="https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp",
    headers={"Authorization": "Bearer YOUR_API_TOKEN"},
)

agent = Agent("openai:gpt-4o", toolsets=[wordpress_mcp])

Any stdio-Based Client

For MCP clients that only speak stdio, use the mcp-remote bridge:

{
  "command": "npx",
  "args": [
    "-y",
    "mcp-remote",
    "https://yoursite.com/wp-json/easy-mcp-ai/v1/mcp",
    "--header",
    "Authorization:Bearer YOUR_API_TOKEN",
    "--transport",
    "http-only"
  ]
}

Replace the outer object key with the server name your client expects. The mcp-remote bridge requires Node.js on your computer; your WordPress server needs nothing extra.

Control What Connected Clients Can Access

Every connection acts as a WordPress user, so roles apply as usual. Tokens can be limited to specific tools, and site-wide guardrails let you disable sensitive tools globally, set rate limits, force AI-created posts to stay drafts, and audit every call. See Creating and Managing API Tokens for details.

Security

If you identify a potential security vulnerability in this plugin, please disclose it responsibly. Follow the protocols on the Themeisle Security Page.