WordPress MCP Server: Let AI Agents Work on Your Boards

A WordPress MCP server lets an AI agent, such as Claude, Cursor or Codex, call tools on your WordPress site instead of only answering questions about it. WordPress now has an official way to do this, built from the Abilities API and the MCP Adapter plugin. KanbanWP also ships its own MCP server, so an agent can read your boards, add tasks, move cards and leave comments.

This guide explains both, shows how to connect an agent to KanbanWP, and covers the limits and risks to plan for.

What MCP is

The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external systems. An MCP server publishes a list of tools, each with a name, a description and an input schema. An MCP client, such as Claude, ChatGPT, Visual Studio Code or Cursor, reads that list and calls the tools when a task needs them. Requests and responses use JSON-RPC 2.0.

For a WordPress site, this means an agent can do real work in the admin, such as creating a post or a task, with no custom integration for each AI product.

The official WordPress MCP server: Abilities API and MCP Adapter

WordPress approaches MCP in two layers. Core keeps a list of what a site can do, and a plugin makes that list available over MCP.

The Abilities API

The Abilities API arrived in WordPress 6.9 in December 2025. The API is a registry where plugins and themes describe units of functionality. Each ability has:

• a name in the form namespace/ability-name
• a label and a description
• JSON Schema definitions for its input and output
• an execute callback that does the work
• an optional permission callback, for example one that checks manage_options

You register an ability with wp_register_ability() on the wp_abilities_api_init hook. WordPress 7.0, released in May 2026, added a JavaScript counterpart to the Abilities API and an AI Client in core that lets WordPress talk to generative AI models.

The WordPress MCP Adapter

The MCP Adapter is the official bridge between abilities and MCP. It became a plugin on WordPress.org in October 2026. The plugin page lists version 0.7.1, which needs WordPress 6.9 and PHP 7.4. The 0.7 release added support for the 2026-07-28 MCP specification.

The Adapter’s default server lives at /wp-json/mcp/mcp-adapter-default-server. It gives the client three tools: one lists the public abilities, one reads an ability’s details, and one runs an ability. According to the site owner guide, it works like this:

• The Adapter adds no abilities of its own. Your plugins decide what is available, and an ability is reachable only if it is marked public.
• The AI client signs in as a WordPress user, usually with an Application Password, and every action runs with that user’s role and permissions.
• Desktop clients connect through the @automattic/mcp-wordpress-remote helper, and clients that accept a URL and a custom header can connect over HTTP directly.
• Web apps such as claude.ai and ChatGPT cannot connect to the Adapter on their own today, because WordPress has no OAuth server for them to use.

The KanbanWP MCP server

KanbanWP version 1.0.1 does not register abilities, so its board tools do not appear through the MCP Adapter. Instead, it runs its own MCP server at:

POST https://your-site.example/wp-json/kanbanwp/v1/mcp

The server answers MCP’s initialize, tools/list and tools/call methods. A GET request returns “405 Method Not Allowed”. The plugin supports WordPress 5.8 and later, so you do not need 6.9 to use it.

The server offers seven tools:

If create_task has no stage, the task goes into the board’s first stage. Priorities are low, normal, high or urgent, and due dates use the YYYY-MM-DD format. There is no delete tool, so an agent cannot remove tasks or boards. Deleting stays in wp-admin or WP-CLI.

How the two approaches differ

Connect an agent to KanbanWP

The full steps are in connecting an agent. In short:

1. Go to KanbanWP > Settings > MCP.
2. Tick Enable MCP server and save. Until you do, the endpoint refuses every request.
3. Copy the MCP token on the same tab. The plugin creates one when you activate it, and Regenerate token replaces it.
4. Add the server to your MCP client with the endpoint URL and an Authorization: Bearer header.

For a client that accepts a URL and headers, such as Cursor, the entry looks like this. Field names vary between clients, so check your client’s MCP documentation for the exact format.

{
  "mcpServers": {
    "kanbanwp": {
      "url": "https://your-site.example/wp-json/kanbanwp/v1/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_MCP_TOKEN",
        "X-KanbanWP-Agent": "Claude"
      }
    }
  }
}

Some clients cannot set HTTP headers. For them, the server also accepts the token as params.auth inside the JSON-RPC request.

Treat the token like an admin key

The MCP token grants read and write access to every board on the site. Anyone who has it can create, edit and move tasks, and the server does not check a WordPress role. Handle it with care:

• Keep it in your agent’s secret storage, never in a shared document or a public repository.
• Use the site over HTTPS only.
• Click Regenerate token if the token leaks or if someone who knew it leaves. The old token stops working at once.
• Do not connect an agent you do not control if a board holds sensitive client material.
• Untick Enable MCP server to block all agent access at once.

An agent that reads your boards also sends their contents to the AI service it runs on. Check that service’s data terms before you connect it to client work.

What the activity log records

Each tool call that touches a board or a task adds an entry to that board’s activity log with the tool’s name. Calls to list_boards are not logged, because they do not target one board. The entry is not tied to a WordPress user. From version 1.0.1 it records the agent as mcp: followed by the name sent in the X-KanbanWP-Agent header, so you can tell several agents apart. Version 1.0.0 logged every agent as plain mcp.

From version 1.0.1, changes made through MCP trigger the same notifications and webhooks as a change made on the board. In version 1.0.0 they triggered neither.

AI agents for project management: a worked example

AI agents for project management are most useful for routine reading and writing that a person would otherwise do by hand. Here is a typical session on a content board with the stages Ideas, Writing, Review and Published:

1. You paste meeting notes into Claude and ask it to add the action items to the “Content” board.
2. The agent calls list_boards to find the board’s ID, then get_board to read its stages.
3. It calls create_task five times. Each task lands in Ideas with a priority and a due date taken from the notes.
4. You ask which items in Review are past their due date. The agent reads the board with list_tasks and lists two tasks.
5. You ask it to comment on both. It calls add_comment on each task, asking the assignee for an update.

Other jobs that suit an agent:

• Standup digest: read a board and report what is blocked, overdue or unassigned.
• Bug intake: let a coding agent open a task for each bug it finds and comment when it has a fix.
• Housekeeping: move tasks to Done once their linked work is finished.

Agentic AI for project management: where to set limits

Agentic AI for project management means an agent plans and carries out several steps on its own. In June 2025, Gartner predicted that over 40% of agentic AI projects will be canceled by the end of 2027, citing rising costs, unclear business value and weak risk controls. A few rules keep a board agent useful and safe:

1. Start on a test board, not a live client board.
2. Ask the agent to create and comment before you let it move or edit tasks.
3. Read the board’s activity log after the first few sessions.
4. Keep a person responsible for priorities. An agent can sort tasks, but it does not know which client matters most this week.

MCP or the built-in AI features?

The two features work in opposite directions. With MCP, an outside agent calls KanbanWP and brings its own model and billing. With the built-in AI features, KanbanWP calls a model with your own API key, inside role limits and monthly token caps. Bring your own AI key explains that setup. You can use either one, or both.

Developers who prefer scripts can use the REST API instead. For the wider picture, read AI for project management, and see how other products handle agents in the best AI project management tools for 2027.