MCP
One address. Three kinds of secret.
Claude talks to WP Adapter Cloud. The plugin on your WordPress is a signed dock. Nothing public faces the internet from origin.
Endpoint
POST https://wpadapter.com/mcp
JSON-RPC 2.0. Protocol 2025-03-26. Depaza, Claude, Cursor, ChatGPT, and Grok all use this URL.
https://wpadapter.com/mcp
The three secrets
| Looks like | Lives | Job |
|---|---|---|
wpa_live_… |
Claude / Cursor / Code header | MCP key. Shown once when you mint it. Org keys see every paired site. Client keys (Agency) lock to one site. |
wpa_site_… |
WordPress → Connect | HMAC dock. Pairs this origin to your account. Never paste this into Claude. |
| OAuth sign-in | Claude Desktop / Cowork / claude.ai / ChatGPT | No paste key. The browser signs you in on wpadapter.com. ChatGPT chapter. |
Never: WordPress application passwords, Administrator logins, or pointing the AI at /wp-json.
site_id
If the key can see more than one WordPress, every tool except list-sites needs site_id. Call list-sites first. A client key is already locked; you do not pass it.
Error you will see: Multiple sites. Call list-sites and pass site_id.
Which tools you get
- Editor plan (Pro, Pro Max, Agency Lite, Agency X) → post/page/canvas tools, WooCommerce if it is on the origin, plugin/core updates if Policy allows. Editor tools.
- Forms plan → form tools only. Form tools.
- Both on the org → both sets. A Forms-only key still cannot edit posts.
Inactive plan (expired) → Plan inactive. Renew at wpadapter.com/account.
Rate limits
- Origin (editor writes): 60 calls / minute / WordPress user.
- Form submit on the site: 10 / minute / visitor IP.
Usage rows live in Account → Usage. Origin also writes WP Adapter → Activity.
Mint, revoke, reconnect
- MCP keys: Account → Keys and the Connect page.
- Sites: Account → Sites. Test pings the dock.
- Reconnect: in WordPress, Connect this site again. The old HMAC is replaced.