royalplugins/royal-mcp

---

Royal MCP is an open-source WordPress plugin that turns your site into a Model Context Protocol server. Connect it once, and your AI app can read and change your site the way you would from wp-admin: posts, pages, media, menus, your WooCommerce store, Elementor and Divi pages, SEO, backups and security. Every call runs as a WordPress user, is checked against that user’s capabilities, and lands in an activity log, and every destructive change can be undone.

Nothing is relayed through a third-party service. Your API keys, sign-in tokens and logs stay in your own WordPress database.

What you can do with it

Ask in plain language. These all work on the free plugin:

Built to work alongside other MCP tools

Royal MCP is designed to run next to the MCP tools other plugins ship, so your AI can reach for the best tool for each part of a job.

• Elementor. When Elementor’s own MCP is switched on, Royal MCP detects it and tells your AI that Elementor’s builder is there for designing new layouts. Royal MCP’s Elementor tools keep handling edits to the pages you already have: text and image swaps, widgets, cloning and templates.
• WooCommerce. WooCommerce’s own MCP abilities keep working. Royal MCP adds the rest of the store: coupons, variations, attributes, customers and store stats.
• WordPress Abilities API. Royal MCP’s tools also register as WordPress abilities. With the MCP Adapter installed they are served on Royal MCP’s own adapter server, royal-mcp-server, with the same permission checks, switches and logging as the native endpoint.

Royal MCP answers on its own endpoint and never switches off another plugin’s tools, so together they cover more of your site than any one of them alone.

Safety

• Your AI app asks first. Claude, ChatGPT and other clients ask you to approve each destructive tool call by default.
• Drafts first. New posts and pages start as drafts.
• Read-only and drafts-only modes. One switch refuses every tool that changes the site, or every tool that would publish.
• An access level per connection. Give each connected AI app Full, Read-only or Drafts-only access from the Connected Clients screen, and revoke any of them.
• Recent Changes with undo. Every destructive write stores a snapshot first. The Recent Changes screen shows the before, after and current values, and one mcp_undo_last_operation call reverses a change within 72 hours.
• Activity log. Every tool call is logged with the tool name, argument keys, IP and user agent. Argument values are never stored.
• Dry runs. High-impact writes such as site options and permalink structure can be previewed before they are applied.

Capabilities

270 tools: 113 core tools that are always available, plus 157 integration tools that load only when the matching plugin is active.

WordPress core (113 tools)

• Content - Posts, pages and custom post types (create, read, update, delete, clone as a draft, revisions, featured images)
• Taxonomies - Categories, tags, custom taxonomies, term meta, post-term linking
• Media - Browse; upload images, PDFs and other allowed files (by URL, base64 or a file handed over by ChatGPT); convert, resize and compress images on upload; find a file already in the library by address or content and reuse it instead of uploading a copy; update metadata; delete
• Blocks - Read a post’s block tree; insert, replace, move or delete single blocks; replace text across blocks; read and edit synced patterns; read global styles and Site Editor templates
• Comments - Create and moderate (approve, spam, trash)
• Users - Display names, roles, registration dates and any capabilities granted beyond a user’s roles. Emails and usernames are not exposed unless a site owner opts in with the royal_mcp_user_fields filter
• Menus - Read, create items, reorder, update
• Theme - Custom CSS, theme mods, active theme
• Site - Permalink structure, allowlisted options, site info
• Search - Search across content
• SEO - Meta read and write for Yoast, Rank Math, AIOSEO, SEOPress and SEObolt
• Safety - Read-only mode, drafts-only mode, per-connection access levels, Recent Changes and 72-hour undo
• Plugins and themes - Every installed plugin, including must-use plugins and drop-ins, with versions, active status and last-modified dates; installed themes
• Diagnostics - Site status (WordPress, PHP, MySQL, plugins, themes and cron in one call), PHP error-log tail, cron schedule, and royal_mcp_connection_health

Plugin integrations (157 tools)

Not seeing your plugin? The core tools still cover posts on any custom post type, any plugin’s custom fields through post meta, and any plugin’s comments. Request an integration on the WordPress.org support forum. If you build that plugin, you can add its tools to Royal MCP yourself or partner with us.

Connect

Install

1. Install from WordPress.org (recommended, updates through wp-admin) or upload the zip from the latest GitHub release.
2. Go to Royal MCP → Settings, switch Royal MCP on and copy the MCP Server URL. For clients that use an API key, generate one on the same screen.
3. Pick a client below.

Your MCP Server URL is https://yoursite.com/wp-json/royal-mcp/v1/mcp.

Claude (claude.ai, Claude Desktop) - sign in with OAuth

1. Settings → Connectors → Add custom connector.
2. Paste your MCP Server URL.
3. Approve the sign-in screen on your site. No API key needed.

ChatGPT

Add a custom connector with your MCP Server URL and follow the sign-in flow.

Claude Desktop with an API key

{
  "mcpServers": {
    "my-wordpress": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://yoursite.com/wp-json/royal-mcp/v1/mcp",
        "--header", "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Config file: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows).

Cursor, VS Code, Claude Code and other MCP clients

Add an HTTP MCP server with your MCP Server URL and an Authorization header set to Bearer YOUR_API_KEY, or use OAuth where the client supports it.

Raw HTTP

# 1. Start a session. -i prints the headers so you can copy Mcp-Session-Id.
curl -i -X POST https://yoursite.com/wp-json/royal-mcp/v1/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "method": "initialize",
    "id": 1,
    "params": {
      "protocolVersion": "2025-11-25",
      "capabilities": {},
      "clientInfo": {"name": "my-app", "version": "1.0"}
    }
  }'

# 2. List the tools, using the session id from the response headers.
curl -X POST https://yoursite.com/wp-json/royal-mcp/v1/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Mcp-Session-Id: " \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc": "2.0", "method": "tools/list", "id": 2}'

The older X-Royal-MCP-API-Key header still works in this release but is deprecated. Send the key as Authorization: Bearer instead.

Security model

Found a security issue? Report it privately through royalplugins.com/contact, not in a public issue.

Royal MCP Pro

Royal MCP gives one site owner a safe AI connection. Royal MCP Pro is for running AI across real client work: 350+ tools, bulk operations across many pages and products, deeper Elementor, Divi, WooCommerce and ACF authoring, cross-plugin workflows that run a whole job in one call, and a full audit trail.

Pro is one plugin that includes everything in Royal MCP. When Pro is active, you run Pro on its own.

See Royal MCP Pro → · Pricing · Full Free vs Pro comparison

Scope

What Royal MCP deliberately does not do:

• No core file changes. It never writes to wp-content/themes, wp-includes or wp-admin.
• No plugin installs or upgrades. It can list plugins, not install, activate or update them.
• No raw SQL. Every query goes through WordPress APIs and prepared statements.
• No Elementor Theme Builder templates in the free plugin. Theme Builder work is in Royal MCP Pro.
• No Beaver Builder or Bricks layout JSON writes. Their standard post content is readable and writable; builder-specific layout data is left alone unless a dedicated tool covers it.

More from Royal Plugins

Royal MCP works with the rest of the Royal Plugins family. Each one adds its own tools to Royal MCP when it’s active.

Earn with Royal Plugins

Recommend Royal MCP Pro and the rest of the family to your audience and earn 30% on every first-year sale and 15% on every renewal, with a 60-day cookie and monthly payouts.

Join the Royal Plugins affiliate program →

Further reading

• Connect Claude to WordPress in 5 Minutes - the quickest way to get connected, with a video and step-by-step setup.
• Editing Elementor with Claude: 4 Workflows That Work - the four ways to edit Elementor pages with AI and when to use each, with prompts, examples and a video demo.
• Translate WordPress with Claude + DeepL MCP - Royal MCP and another MCP server working together on a real job.
• WordPress’s MCP Era: Distribution and Runtime Servers Now Coexist - why several MCP tools on one site work better together.
• Claude Skills for WordPress - turn the prompts you repeat into reusable workflows.

License

GPLv2 or later. See LICENSE or the GNU site.

Royal MCP is provided as-is. API keys protect your endpoint; guard them like any other credential. You are responsible for the content, commands and actions any AI platform is allowed to perform on your WordPress site.

---

Built by Royal Plugins Lightweight, security-first WordPress plugins. © 2026 Royal Plugins.