InstaMCP: The WordPress MCP Server Built Into InstaWP

InstaMCP is InstaWP’s built-in WordPress MCP server. It turns any site hosted on InstaWP into something an AI assistant can read and change directly, through 43 typed, permission-scoped tools, and it switches on from a single toggle in Site Details. You do not install a plugin, generate an application password or run a bridge process.

In practice that means a prompt like “Publish the draft called July Sale and put it in the Offers category” becomes a real WordPress action, carried out by a scoped tool rather than by an assistant guessing its way around wp-admin. InstaMCP ships switched off on every InstaWP site from the Sandbox plan upward, and version 1.11 ships with 15 skills already installed.

Which of the three options you want is decided by where the site lives, not by a feature list. InstaMCP only covers sites hosted on InstaWP, which is what buys you the single toggle and leaves the runtime, the tokens and the updates with InstaWP. InstaWP’s open-source WordPress MCP Server is a Node.js process you run yourself against any WordPress site, so it reaches sites hosted elsewhere at the cost of owning the credentials and the uptime. The official WordPress MCP Adapter is a plugin built on the Abilities API, aimed at developers who want to expose their own abilities rather than switch a server on. All three speak the same protocol, and WordPress MCP explains that protocol from first principles.

What Is InstaMCP, the WordPress MCP Server Built Into InstaWP?

InstaMCP is the MCP server that comes with InstaWP hosting. It is not a separate product you buy, a plugin you go and find, or a generic WordPress MCP implementation you configure yourself. Every InstaWP site on a Sandbox plan or above already has it, switched off, waiting in the MCP tab of Site Details.

That matters more than it sounds. On a typical WordPress site, connecting an AI client means installing a plugin, generating an application password, storing that password somewhere, standing up a bridge process, and keeping all of it patched. InstaMCP removes that work because the platform already owns the site. Enabling it installs the integration and issues a 64-character token in one step.

Step four is the one worth remembering. The assistant does not hold your admin credentials. It holds a token whose permissions you chose.

See it in action here:

What InstaMCP Can Do: All 43 Tools by Category

Most comparisons of WordPress MCP servers describe capabilities in the abstract. Here is the actual inventory, counted off a live InstaMCP 1.11 endpoint. The rows add up to 43, gated tools included, so nothing is hidden from the total.

The discovery tools folded into those first two rows are easy to skip past and worth understanding. Before doing anything, the assistant can ask the site what exists on it. That is why InstaMCP works on a site with custom post types it has never seen: it discovers them rather than assuming a standard blog schema.

How Do You Enable InstaMCP on a WordPress Site?

Getting started with the InstaWP WordPress MCP Server is fast and developer-friendly. Whether you want to test it locally, extend it with custom tools, or connect it to Claude Desktop for real-time AI interaction, you’ll be up and running in minutes.

Follow this simple setup guide to launch your own MCP-powered WordPress assistant. Make sure you have:

• An active InstaWP account
• ChatGPT Plus or any other LLM tools’s subscription with Developer Mode, OR Claude Desktop app
• 5 minutes

Step 1: Create a site, or open an existing one

Go to instawp.com and log in. To start fresh, click Create New Site and pick your WordPress version, PHP version and site name. Provisioning takes roughly 30 seconds. InstaMCP works equally well on a site you created months ago or migrated in, so if you already have one, just open it.

Select your preferred configuration:

• WordPress version (latest recommended)
• PHP version (8.1+ recommended)
• Site name (e.g., my-ai-site)

Click Create and wait ~30 seconds for provisioning. Your WordPress site is now live with a temporary URL like my-ai-site.instawp.site.

Must Read: Create Site | InstaWP Docs

Step 2: Enable the MCP Server

In your InstaWP dashboard, click on your site to open the Site Detail page. In the left sidebar, locate and click “MCP”.

Click the “Enable MCP” button.

As you do so, InstaWP installs the WordPress MCP plugin automatically and a secure authentication token is generated.

Step 3: Copy Your MCP Connection URL

After enabling, you’ll see your MCP URL displayed in the dashboard. It looks something like:

https://my-ai-site.instawp.site/insta-mcp?t=abc123xyz...

https://my-ai-site.instawp.site/insta-mcp?t=abc123xyz...

Click the copy icon to copy this URL to your clipboard.

Step 4: Add the connection to your AI client

In Claude Desktop, open Connectors in the sidebar, click Add Custom Connector, paste the URL, and give it a name you will recognise later, for example the client’s name rather than My Site. Once added, click Configure to review the available tools and pre-approve the actions you are comfortable with.

For ChatGPT, the connection is added through Developer Mode. We walk through that flow in detail in How to Connect ChatGPT to WordPress. Cursor, Windsurf, Zed and the CLI clients each take the same URL in their own MCP configuration.

Step 5: Verify the connection

Open a new conversation in ChatGPT or Claude and test the connection:

Test prompt:

List all posts on my WordPress site

List all posts on my WordPress site

The AI will call the MCP server, retrieve your posts via the REST API, and display them in a formatted list with titles, IDs, and status.

More test commands:

Show me the 5 most recent draft posts
What plugins are currently active on my site?
List all categories and their post counts

Show me the 5 most recent draft posts
What plugins are currently active on my site?
List all categories and their post counts

If the client reports no tools available, the usual cause is a truncated URL. The token is long and easy to clip when copying by hand.

There is a second cause, fixed in InstaMCP 1.11.1, and it does not look like a URL problem at all. Any plugin that gates logged-out traffic could intercept the MCP endpoint before InstaMCP ever saw the request: a password-protection plugin, a membership plugin, a coming-soon or maintenance page.

The tell is that it failed in exactly the same way with a valid token as with a nonsense one, so it reads as an authentication failure when nothing is wrong with your token. InstaMCP now claims the endpoint earlier than any of them can. If you are on an older version and seeing this, update the plugin.

Prefer to watch it done? See Enable MCP Server on InstaWP.

How InstaMCP Keeps an AI Agent Inside Its Lane

Agencies ask this before connecting anything to a client site, so here is the mechanism rather than a reassurance. Three things constrain what a connected agent can do: the tools it is given, the scopes on its token, and a second gate in front of the powerful tools.

Everything goes through a typed tool

There is no general-purpose escape hatch in the default tool set. An agent asked to update a page calls the tool that updates a page. It cannot decide to reach into the filesystem on the way, because no tool in its list does that.

Scopes ride on the token

InstaMCP uses four scopes: mcp:read, mcp:write, mcp:delete and mcp:admin. They sit on top of the WordPress role behind the connection, so a token cannot grant more than the underlying user has. Safe Mode narrows things further when you want a connection that can look but not touch.

The powerful tools are behind a second gate

Three tools are genuinely powerful: execute_php, db_query and site_files. All three are off by default, and enabling MCP does not enable them. That is the part people miss. Turning MCP on and turning the power tools on are two separate decisions, and the first never implies the second.

If you call execute_php on a freshly enabled site and get back Forbidden: execute_php is disabled, that is the design working, not a bug. An administrator turns it on deliberately at WP Admin, under Settings, InstaMCP, Capabilities.

execute_php in particular sits behind three conditions at once: an administrator has to opt in, the token needs the mcp:admin scope, and the user needs the manage_options capability. Our own recommendation is to enable it on staging first and use it in production only when you trust the connecting client and have a recent backup.

The fourth thing to know is the time limit. execute_php asks the host for 30 seconds, but in PHP that is a request rather than a guarantee: a host that pins max_execution_time at the server level refuses it, and the original limit stands. So the tool tells you which limit actually applied. Every result carries time_limit_seconds, the limit in force for that call, plus a time_limit_note when the request was turned down.

Two fixes that stop it breaking the rest of the site

In 1.11.0 the whole bundled dependency tree was namespace-prefixed. A shared PHP library loaded by two plugins at different versions is a classic way to white-screen a WordPress site, and InstaMCP can no longer be one half of that collision.

In 1.10.5 tool results carrying binary data stopped disappearing. An archive, an image or a compressed stream used to come back as an empty HTTP 202 with nothing written to any log, which reads as a hang or a timeout. The agent now gets a clear marker telling it to base64-encode or summarise the payload instead.

Skills and Memory: Teaching InstaMCP Your House Style

Eight of the 43 tools cover Skills and Memory. They get the least attention and they change the most about how the site works with you.

Skills are reusable playbooks stored on the site. You write down how a task should be done once, and any assistant that connects afterwards follows it. If your landing pages always use a particular section order and a particular set of blocks, that becomes a skill, and the next agent builds pages your way instead of inventing its own layout.

Memory stores durable facts about the site. Which page builder it uses, which client hates carousels, which plugin broke the last time someone ran updates. These survive between sessions, so you are not re-explaining the site every morning.

You do not start with an empty skill library

InstaMCP 1.11 ships 15 skills already installed. A connected assistant finds them with skill_list and reads one with skill_get, so the first useful build happens before you have written anything of your own.

The one that surprises people is page builders. The page-builder-pages skill builds and edits Elementor and Bricks pages by writing the builder’s own data and regenerating its CSS, so the page renders correctly and still opens in the builder afterwards for a designer to finish. That matters because a page written as Gutenberg blocks will not open in Elementor at all. We validated it end to end on live sandboxes running Elementor 4.1.5 and Bricks 2.3.7, creating and editing on both.

For native block work, gutenberg-pages covers full-canvas page layouts with valid block markup from the first save, and instastudio handles HTML-first sites where pages are source files rather than blocks.

The rest read like an agency’s own checklist:

• build-site-from-brief: fill a new or staging site’s pages, posts, terms and media from a brief, drafts first.
• pre-launch-content-qa: the go-live sweep for drafts left behind, broken internal links, missing alt text and empty SEO fields.
• safe-plugin-update and safe-theme-switch: update or switch, confirm the site still renders, roll back in one step if it does not.
• diagnose-slow-or-broken-site: read the logs, map the active plugins and theme, name the cause of the 500.
• seo-meta-and-schema: audit titles, meta descriptions and slugs, then add basic schema.
• structured-meta-writer: set WooCommerce prices and sale prices, ACF fields and SEO meta through typed set_meta, dry run first.
• bulk-content-ops: one change across many posts, applied once instead of two hundred times.
• taxonomy-cleanup: merge duplicate terms, rename, reassign content, drop the orphans.
• manage-redirects: keep old URLs alive after a slug change or a migration.
• media-and-featured-images: upload, set alt text, attach and feature correctly.
• skill-creator: how to write your own with skill_save.

Skills arrived in InstaMCP 1.10 and grew through 1.11, so a site provisioned a while back may be running an older build. If skill_list comes back short, check the plugin version and update it.

For an agency running similar builds across many sites, this is where the time goes. The first build teaches the site how you work. The tenth build is faster because that knowledge is still there.

What Can You Actually Do With InstaMCP?

The WordPress MCP Server isn’t just a tech demo; it’s a practical, AI-powered assistant that can replace dozens of repetitive dashboard clicks with a single natural-language command. Here’s how developers, agencies, and content teams are already putting it to work:

Managing Many Sites: When to Use the Account MCP Instead

InstaMCP is scoped to exactly one site. One connection controls one site, which is the right shape when you are working inside a build.

It stops being the right shape at volume. Five sites is fine. Forty client sites means forty MCP connections in Claude or Cursor, which nobody wants to maintain. That is what the account-level MCP is for. It sits outside your sites and manages the hosting itself: creating sites, snapshots, backups, PHP and WordPress versions, plans and billing. It can also arm a site’s MCP for you.

The short version: the account MCP manages your hosting, InstaMCP manages what is inside a site. Neither does the other’s job. If you run client sites at scale, start with the account-level MCP on InstaWP.

Running MCP on a Site That Is Not Hosted on InstaWP

InstaMCP only covers sites hosted with us, because it depends on the platform underneath. For everything else, we maintain an open-source option.

The WordPress MCP Server is a Node.js server you run yourself. It connects to any WordPress site over the REST API using application passwords, is configured through a .env file, and can be started with npx or run in Docker. Tool handlers live in their own files, so adding support for WooCommerce or a custom plugin means writing one new handler rather than modifying the core.

The trade is ownership. You run the process, store the credentials, rotate the application passwords and apply the updates. On InstaWP, that work is ours. If your site lives elsewhere and you are comfortable running a small service, the MCP Server repository has the setup instructions.

InstaMCP vs the Official WordPress MCP Adapter

The short answer: InstaMCP is a managed server InstaWP runs for you on sites it already hosts, while the official WordPress MCP Adapter is a plugin you install and extend yourself on any site. Because InstaWP already runs the site, InstaMCP can install the integration and issue the token without you touching a server, and you give up control of the runtime in return. The adapter costs you that setup work but runs anywhere and is built on the WordPress Abilities API, which is where WordPress core is going. InstaWP tested the adapter hands on in the WordPress MCP Adapter review, so this page does not repeat that argument; if you are still choosing between servers rather than between these two, start from the best WordPress MCP servers comparison.

One piece of housekeeping, because plenty of guides still get it wrong. The Automattic/wordpress-mcp repository has been archived and now points people to WordPress/mcp-adapter for ongoing development and support. If a tutorial sends you to the old repository, it has not been updated. We reviewed the official adapter in detail in our WordPress MCP Adapter review, and compared the wider field in 10 best WordPress MCP servers compared.

Should You Use InstaMCP?

If your sites are on InstaWP, there is little reason not to try it. It is already there, it costs one click, and a read-only connection is close to risk free. Start on a sandbox, keep the power tools off, and see whether the workflows above save you real time before you connect anything client facing.

If your sites are elsewhere, InstaWP’s open-source server does the same job with more setup and more ongoing responsibility, and the official MCP Adapter is worth watching as it matures. InstaMCP removes the infrastructure work because InstaWP already runs the site. The alternatives hand you that work back and give you the runtime in exchange.

Plugin-based WordPress MCP servers are the other route off InstaWP. Our Novamira review covers the most capable of them: free, open source and installable on any host, with raw PHP and file access. In its own documentation, every ability requires an administrator, there is no read-only mode and nothing rolls back automatically, which is the gap InstaMCP’s role-based token scopes and off-by-default PHP tools are built to close.

The baseline has shifted. Connecting AI to WordPress used to be a small infrastructure project, and on a managed platform it is now a setting you turn on. If you want the wider picture of preparing a site for agents, see how to make your WordPress site AI-agent ready.

FAQs