Model Context Protocol
Run your WordPress hosting by asking for it
The Wordify MCP server connects Claude, ChatGPT, and other AI assistants directly to your hosting account. Ask a question in plain language, and your assistant calls the real Wordify API — listing sites, clearing caches, provisioning servers, reading debug logs — and reports back. No API keys. No dashboards to click through.
Your MCP server URL
https://console.wordify.com/mcpThat single URL is the entire configuration. 48 tools, one OAuth sign-in, about a minute to set up.
What is MCP, and why should you care?
The Model Context Protocol is an open standard for giving AI assistants structured access to real systems. Instead of an assistant guessing at HTTP endpoints or asking you to paste screenshots, it gets a typed catalogue of actions it can take — each with documented parameters, validation, and error handling.
Wordify’s MCP server exposes the same /api/v1/* surface the console itself uses. That matters more than it sounds: your assistant isn’t working against a simplified or second-class API. It sees the same sites, the same config sections, the same task queue, and the same permission model you do.
Without MCP
Open the console. Find the site. Click into settings. Repeat for the other eleven sites. Realise you forgot which ones you already did.
With MCP
“Which of my sites are on an end-of-life PHP version, and what would upgrading them break?” — one question, one answer, every site covered.
Connect in about a minute
Connecting is a one-click OAuth flow: paste the server URL into your assistant, sign in to Wordify to authorise, done. There are no API keys to mint, no tokens to paste, and no config files to edit.
In the console, everything below is built into Integrations → AI Connectors — your server URL with a copy button, per-client instructions, and a live list of authorised assistants.
Claude
- Open Settings → Connectors and choose Add custom connector.
- Paste
https://console.wordify.com/mcpinto Remote MCP server URL, then click Add. - Click Connect and sign in to Wordify to authorise. Claude registers itself and obtains its own OAuth token behind the scenes.
Custom connectors require Claude Pro or Max. On Team or Enterprise plans, an organisation owner adds the connector before members can use it.
ChatGPT
- Open Settings → Connectors → Advanced and turn on Developer mode.
- Go to Settings → Connectors → Create.
- Paste the server URL into Connector URL, save, and authorise by signing in to Wordify.
Your first five minutes
Start a new conversation and just ask. You don’t need to name tools or learn a syntax — the tool descriptions tell your assistant how each one is used.
| Ask this | Tools it will reach for |
|---|---|
| “List my Wordify sites and tell me which are on an older WP version.” | list_sites |
| “Clear the cache on all my sites.” | dispatch_task → get_task |
| “Is anything wrong across my fleet right now?” | audit_sites |
| “Preview what upgrading every site to the latest WordPress would do.” | dispatch_task with dry_run=true |
| “My site is throwing a 500 — what’s in the error log?” | update_site_config → get_debug_log |
| “Spin up a staging copy of example.com so I can test the plugin update.” | create_staging → get_task |
| “What did my team spend last month?” | get_usage / list_invoices |
MCP sessions automatically get a 5× rate-limit bucket — 300 requests/min versus the public API’s 60/min — to accommodate the chattier call pattern of an assistant working through a conversation. No opt-in needed.
What’s in the box: 48 tools
The surface covers the full lifecycle of a WordPress site — from provisioning one to billing for it. You never call these by name; they’re what your assistant picks from.
| Group | Tools |
|---|---|
| Orientation | get_me, list_teams, select_team |
| Sites | list_sites, get_site, list_plans, provision_site, audit_sites, clear_site_cache, enable_site_cdn, disable_site_cdn |
| Configuration | update_site_config — one tool, a section discriminator for PHP, cache, CDN, Redis, WordPress settings, basic auth, and debug flags |
| Cron | get_site_cron, update_site_cron |
| Debugging | get_debug_log |
| Admin access | get_admin_login_link, list_wp_users |
| WP-CLI | run_wp_cli |
| Plugins & themes | list_plugins, install_plugin, toggle_plugin, list_themes |
| Content | list_posts, get_post, create_post, update_post |
| Backups | list_backups, create_backup, restore_backup |
| Staging | create_staging, push_staging, pull_staging |
| Cloning | clone_site |
| Domains | list_domains, add_domain, recheck_domain_dns |
| Bulk tasks | dispatch_task, get_task, list_tasks |
| Billing (read-only) | list_invoices, get_usage |
Seven older per-section tools (update_php, update_cache, update_cdn, update_redis, update_wordpress_settings, update_basic_auth, update_debug_mode) remain registered as deprecated aliases of update_site_config so existing agents keep working. Some tools — the content and WP-CLI ones — are feature-gated and only appear for teams entitled to them.
Five concepts that make it click
1. Your team decides what you can do
OAuth proves who you are. What you’re allowed to do is decided by your team role — the same check the web console applies. So if a management action fails, it means your role lacks that capability, not that a token is missing a scope. If you belong to several teams, your assistant calls select_team once to set the active one; single-team users skip it entirely.
2. Slow things return a receipt, not a result
Provisioning a site, creating a backup, enabling a CDN — these take minutes, so they return a task handle immediately rather than blocking. Your assistant polls it with get_task and reports progress as it goes. A brand-new site moves through six steps: DNS record, server account, WordPress install, plugins, configuration, SSL certificate.
3. Ask once, apply everywhere
dispatch_task fans a single action across up to 100 sites in one call. “Clear the cache on all my sites” should produce one call, not one per site. For anything destructive or wide-blast, dry_run=true shows you what would happen first. And audit_sites answers “what’s wrong across my fleet?” in a single request rather than a per-site loop.
4. Destructive actions are fenced off by default
The run_wp_cli escape hatch runs raw WP-CLI for the long tail no purpose-built tool covers. It ships two guardrails. Some commands are blocked outright and cannot be run at all — db, config (it would expose database passwords and secret keys), eval, shell, server, package, and cli. Others — deletes, non-dry-run search-replace, cache flushes — are refused while safe mode is on, which is the default. Turning safe mode off is a deliberate act, and every run is recorded in the site’s activity log either way.
5. Nothing gets published behind your back
The content tools are draft-first by design: create_post saves a draft unless you explicitly ask for status="publish". Publishing is never implicit. Edits create a WordPress revision, so they’re always reversible, and update_post‘s trash action moves content to the trash rather than permanently deleting it.
When something goes wrong
Failures come back as a structured error with a stable code, a human-readable message, and a request ID you can quote to support.
| Code | What it means | What to do |
|---|---|---|
unauthenticated | The connector isn’t authorised — token expired or disconnected | Re-authorise from your assistant |
insufficient_ability | Your team role can’t manage sites | Ask a team owner to upgrade your role |
insufficient_capability | Your role lacks permission for this specific action | Ask a team owner to escalate your role |
team_not_accessible | No team could be resolved | Select a team first, or contact support |
validation_failed | Bad input | The error names the offending field |
not_found | It doesn’t exist — or it isn’t in your current team | Check the ID and which team is active |
One genuinely useful debugging habit: an empty debug log is ambiguous unless you know whether logging was on. get_debug_log returns the WP_DEBUG flag state alongside the log tail, so “nothing here” and “logging was off” are never confused.
You stay in control
Every assistant you authorise appears under Connected AI clients in Integrations → AI Connectors, showing when it connected and when its access expires. Click Disconnect on anything you no longer use — or don’t recognise — and it loses access immediately. You can reconnect any time by authorising again.
A few things deliberately stay in the web console rather than the MCP surface: payment changes, invoice PDF downloads, deleting a domain, changing a site’s primary domain, suspending a site, and deleting a site. Those are one-way doors, and they should be clicked on purpose.