Description
Born Creative MCP Server transforms your WordPress site into a fully authenticated remote MCP (Model Context Protocol) endpoint. It allows AI assistants — such as Claude.ai — to securely connect to your site and create, update, schedule, and manage posts, pages, media, and taxonomy, all via a standards-compliant OAuth 2.1 and JSON-RPC 2.0 interface.
Unlike local stdio-based MCP servers, this plugin exposes a remote HTTP transport, meaning your AI tools can connect to your live WordPress site without needing direct server access.
How it works
The plugin registers a set of REST API endpoints that implement the MCP streamable HTTP transport. Clients authenticate using OAuth 2.1 with PKCE (Proof Key for Code Exchange), receive a bearer access token, and then use that token to call any of the 18 built-in MCP tools.
MCP Tools included
- Posts — list, get, create, update, delete, search
- Pages — list, get, create, update, delete
- Media — list, get, upload from URL, upload base64-encoded, delete
- Categories — list, create, update
- Tags — list, create
- Yoast SEO (optional) — get and update Yoast SEO metadata (requires Yoast SEO plugin)
OAuth 2.1 Authentication
- Dynamic client registration (RFC 7591)
- Authorization code flow with PKCE
- Access token and refresh token lifecycle management
- Token rotation and revocation
- Tokens are SHA-256 hashed — plaintext tokens are never stored
Advanced content features
- Schedule posts by setting a future publish date
- Set featured images
- Add custom post meta
- Sideload media from external URLs
- Full category and tag assignment
Yoast SEO integration
If the Yoast SEO plugin is active, two additional MCP tools are automatically registered: yoast_get_seo and yoast_update_seo, allowing AI assistants to read and write SEO titles, descriptions, and focus keywords.
Installation
- Upload the
born-creative-mcp-serverfolder to/wp-content/plugins/. - Activate the plugin through the Plugins menu in WordPress.
- Navigate to Settings > MCP Server to review configuration options.
- Ensure your site uses HTTPS — required for OAuth 2.1 in production.
- If using nginx, ensure your server config permits access to
/.well-known/paths. - Connect your MCP client (e.g. Claude.ai) using the OAuth authorization server URL displayed in the plugin settings.
FAQ
-
What is MCP?
-
Model Context Protocol (MCP) is an open standard that allows AI assistants to interact with external tools and data sources in a structured way. This plugin implements the MCP server side of that protocol over HTTP.
-
Which AI assistants are supported?
-
Any MCP-compatible client that supports the streamable HTTP transport and OAuth 2.1 with PKCE. Claude.ai (claude.ai/settings/integrations) is the primary tested client.
-
Is HTTPS required?
-
Yes, for production use. OAuth 2.1 requires HTTPS to protect bearer tokens and authorization codes in transit. The plugin will function over HTTP for local development only.
-
No. Only authenticated WordPress users can complete the OAuth consent flow. The MCP session inherits that user’s capabilities, so content tools are limited to what that user is permitted to do within WordPress.
-
Does this plugin store access tokens in the database?
-
Tokens are stored as SHA-256 hashes — the plaintext token is only ever visible to the client at the moment it is issued. This means tokens cannot be recovered from the database if compromised.
-
What database tables does the plugin create?
-
Four tables are created on activation (using your configured table prefix):
born_mcp_oauth_clients,born_mcp_oauth_codes,born_mcp_oauth_tokens,born_mcp_sessions.
All tables are removed on uninstall. -
Does the plugin support Yoast SEO?
-
Yes. If Yoast SEO is active, two additional tools —
yoast_get_seoandyoast_update_seo— are automatically registered. No additional configuration is needed.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Born Creative MCP Server” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Born Creative MCP Server” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.0.1
- Initial release.
- OAuth 2.1 with PKCE authorization code flow.
- Dynamic client registration (RFC 7591).
- 18 MCP tools: posts, pages, media, categories, tags, and optional Yoast SEO.
- Streamable HTTP MCP transport (JSON-RPC 2.0).
- SHA-256 token hashing, token rotation, and revocation.
- Admin settings page and active connections view.
- Automatic
.well-known/oauth-authorization-servermetadata endpoint.