Wpagent Mcp

dev.wpagent由 wpagent.dev 发布v1.1.4更新于 Oct 26, 2026

Manage WordPress & WooCommerce from any MCP client — 58 tools over a signed REST API.

已验证STDIO仅桌面开发者工具商业与电商

概览

AI 生成的概览

让 MCP 客户端通过签名 REST 桥接操作 WordPress 与 WooCommerce 站点：插件、内容、主题、媒体、用户和订单。

可以做什么
  • 管理插件与主题：列出、在 wordpress.org 搜索、安装、启用、停用、更新、删除，以及主题设置与自定义 CSS
  • 创建和编辑内容：文章、页面、产品、任意自定义文章类型，含自定义字段与特色图片
  • 处理 WooCommerce：设置、订单、优惠券、配送区域、支付网关、税率与统计
  • 整理站点结构：菜单、小工具、侧边栏、分类法、术语与重定向
  • 浏览、上传和删除媒体；列出、创建、更新与审核用户和评论
  • 执行安全、SEO 与性能方面的最佳实践检查并自动修复，在启用后运行白名单内的 WP-CLI 命令
适用场景
适合希望助手在自建 WordPress 或 WooCommerce 站点上真正执行操作（发布内容、安装插件、调整商店设置）而不只是代写文本的场景。
运行要求
通过 npx（Node.js）以 stdio 在本地运行。需要在 WordPress 站点安装并启用免费的 WpAgent 插件，并在其中生成 API 密钥。必需环境变量：WP_SITE_URL、WP_API_KEY_ID、WP_API_SECRET；WP_SITE_LABEL 可选。客户端需能直接通过网络访问该站点。
安装前请注意
密钥的权限决定助手能做什么，且它可以删除内容、插件、媒体和用户，建议先用只读密钥并保持最新备份。WP_API_SECRET 仅在生成时显示一次，需妥善保管。除非站点所有者在 wp-config.php 中启用，否则 WP-CLI 保持关闭。每次调用都会记录在 WordPress 后台，密钥可随时吊销。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Wpagent Mcp，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

wpagent-mcp

An MCP server that lets Claude — or any MCP-compatible client — actually operate a WordPress site: plugins, content, themes, menus, media, users, WooCommerce, Elementor and WP-CLI.

It talks to your site through the free WpAgent bridge plugin over a REST API where every request is signed with HMAC-SHA256. No site credentials are involved, and no data passes through a third-party service: the connection is client → your WordPress, directly.

Install

Nothing to install ahead of time — the config below fetches it on demand.

  1. Install the WpAgent plugin on your WordPress site and activate it.
  2. In the WordPress admin, open WpAgent and generate an API key. Choose the permissions you want the assistant to have; a read-only key is a sound way to start.
  3. Add the server to your MCP client. For Claude Desktop, in claude_desktop_config.json:
json
{  "mcpServers": {    "wpagent": {      "command": "npx",      "args": ["-y", "wpagent-mcp"],      "env": {        "WP_SITE_URL": "https://your-site.com",        "WP_API_KEY_ID": "wpaia_xxxxxxxxxxxx",        "WP_API_SECRET": "the secret shown once when you generated the key"      }    }  }}

For Claude Code:

bash
claude mcp add wpagent \  --env WP_SITE_URL=https://your-site.com \  --env WP_API_KEY_ID=wpaia_xxxxxxxxxxxx \  --env WP_API_SECRET=... \  -- npx -y wpagent-mcp

Environment variables

VariableRequiredWhat it is
WP_SITE_URLyesYour site's base URL, no trailing slash
WP_API_KEY_IDyesThe key id shown in the plugin
WP_API_SECRETyesThe secret, displayed once at generation
WP_SITE_LABELnoA friendly name; defaults to the hostname

What it can do

AreaExamples
Pluginslist, search wordpress.org, install, activate, deactivate, update, delete
Contentposts, pages, products, any custom post type, with meta and featured images
Themeslist, search, install, activate, theme mods, custom CSS, logo, colours
WooCommercesettings, orders, coupons, shipping zones, payment gateways, tax rates, stats
Structuremenus, widgets, sidebars, taxonomies, terms, redirections
Mediabrowse, upload, delete
Users & commentslist, create, update, moderate
Auditbest-practices check over security, SEO, performance, with auto-fixes
WP-CLIallowlisted commands, off unless enabled in wp-config.php

What it will not do

The API has no path to arbitrary PHP, no path to your database, and no path to wp-config.php. WP-CLI execution is disabled unless the site owner adds define('WPAIA_ENABLE_WPCLI', true); on the server, and even then only allowlisted commands run — db, eval, eval-file, shell, server, config and package are always refused.

Safety

  • Every request is signed with HMAC-SHA256 and carries a timestamp; requests older than five minutes are rejected.
  • Permissions are per key and checked on every route, so a read-only key stays read-only.
  • Every call is written to an audit log you can read in the WordPress admin.
  • Revoking a key in WordPress takes effect immediately.

Ask the assistant to confirm before destructive actions, and keep a current backup — it can delete content when you tell it to.

Related

  • WpAgent — hosted dashboard built on the same bridge, with a free read-only tier
  • The bridge plugin is GPL-2.0-or-later; this server is MIT.

Licence

MIT © KipDev

来源：README.md，提交 9e7ef03

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v1.1.4最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分