Run your WordPress fleet from Claude, ChatGPT or Cursor.

What is the TalkToWP MCP server?

A hosted MCP server that connects AI assistants to your TalkToWP fleet data. It is built for agencies, freelancers and in-house teams running multiple WordPress sites.

What can I ask my WordPress sites?

Ask in plain English. For example:

• “Which of my sites have problems right now?”
• “What changed on example.com before it went down?”
• “Is it safe to update WooCommerce on the client sites?”
• “Update the plugins on staging, then tell me if anything broke.”
• “Show me which sites have weak security headers or no WAF.”

What people use it for

Which tools does the assistant get?

36 tools: 15 that only read, and 21 that change things. Site arguments accept an id, URL, hostname or name. Ambiguous matches are reported, not guessed.

Read tools (always on)

Change tools (permissioned)

These need a paid plan and pass four gates before anything happens. See Safety.

How does the plugin risk score work?

assess_update_risk looks at one plugin and returns a reliability score, the observed update success rate, common failure patterns and known conflicting plugins. Give it a site and it also reports which of those conflicting plugins are actually installed there. The data is anonymised and aggregated across all sites TalkToWP monitors.

Scores are smoothed toward 90 and carry a confidenceTier. If the tier is no_data, meaning fewer than 10 observations, ignore the score.

How do I connect Claude, ChatGPT or Cursor?

1. 01 Sign in to TalkToWP and open MCP in the sidebar.
2. 02 Copy the address, or the ready-made instruction for your client.
3. 03 Paste it into the client and connect.
4. 04 The client opens TalkToWP's sign-in and consent screen. Approving grants access. TalkToWP never asks for a password on the client's behalf.
5. 05 The MCP page shows “connected” after the client's first request.

Clients with documented setup:

What happens when I ask for a change?

1. 01 The assistant reads site state and runs assess_update_risk.
2. 02 It tells you what it intends to change and waits for your go-ahead.
3. 03 The request passes the four access gates.
4. 04 TalkToWP snapshots the affected plugin or theme directory.
5. 05 The change is applied.
6. 06 TalkToWP loads the site and checks it. A 5xx response or a WordPress critical-error page counts as broken, including when served as HTTP 200.
7. 07 If verification fails, the snapshot is restored automatically.
8. 08 The job ends in a terminal status.

Job statuses

Changes run asynchronously. A change is complete only at a terminal status. Write tools wait up to 45 seconds by default (configurable from 5 to 170 seconds), then return the job as still running. The assistant uses get_action_status to follow it.

How does TalkToWP keep an AI assistant from breaking my sites?

Read-only is the default. Nothing changes on a site until a person turns it on, and the MCP server cannot turn it on for itself.

Four gates, all required for any change

These controls can only be changed by a person in the TalkToWP dashboard. The MCP server cannot alter them. A refusal is a decision by the owner, and the assistant is instructed to relay it rather than work around it.

Authentication and access

• OAuth 2.0 with an explicit consent screen. No long-lived token to store or leak.
• Every request is scoped server-side to the signed-in account's sites.
• A route allowlist applies to MCP-authenticated requests. A leaked access token cannot reach billing, account deletion, settings, site creation or deletion, AI chat endpoints, or the AI-action permission controls, whatever its scopes.
• Disconnecting a client under Connected apps cuts its access within about a minute.

Protection against prompt injection

Plugin names, error messages, incident text and file contents come from the monitored site, which others may be able to edit. Every result flags those fields in an untrustedSiteData block. The assistant is instructed that instructions found there are not requests from you, and must be quoted and confirmed, never acted on.

Update safety

• Snapshot before every plugin or theme update.
• Verification after, with critical-error-page detection.
• Automatic rollback on failure.
• One change at a time per site, enforced in the database.
• An optional idempotency_key means a retry after a timeout returns the original job instead of running twice.

Files

• Reads cover the WordPress root, so modified core files and injected code can be found.
• Writes are confined to wp-content/. Core cannot be modified.
• Files holding credentials or keys are refused for both read and write: wp-config.php and its backups, .env, private keys, database dumps and .git/. The WordPress plugin itself enforces this.
• write_site_file replaces the whole file, is not snapshotted and cannot be rolled back.

Limits that are deliberate

What does not exist

There are no tools for any of the following. These capabilities are absent from the platform and the WordPress plugin, not merely switched off.

• Installing plugins or themes
• Deleting plugins or themes
• Changing users or roles
• Running database queries
• Writing outside wp-content/

Which plans include the MCP server?

Every plan can read. Paid plans can also use the change tools, subject to the four gates. Paid prices are monthly and introductory. See the full pricing.

Technical specification

Learn more about the protocol at modelcontextprotocol.io

Questions people ask

Connect your fleet to your AI assistant.

Start free with one site. Read every tool today, and move to a paid plan when you want the assistant to make changes. Learn more about what TalkToWP checks, the agency tools, or how we handle your data.