wordpress-mcp

> **v1.2.2 changelog:** Pinned all plugin installs, added checksum verification support, removed automatic `wp eval` and dynamic PHP file mutation, required explicit approval for `wp-mcp-ultimate`, `sudo`, `wp eval`, user creation, plugin activation, and option updates; added untrusted content handling and audit logging. > > **v1.2.1 changelog:** Hardened install script guidance and called out high-trust risks for Path C (`wp-mcp-ultimate`) and the `@automattic/mcp-wordpress-remote` npm proxy. > > **v1.2.0 changelog:** Added Path C (wp-mcp-ultimate, 58 abilities, OAuth 2.1). Updated Path A: mcp-adapter v0.6.1+ ships pre-built ZIP (no composer needed), STDIO transport via `wp mcp-adapter serve`, HTTP proxy via `@automattic/mcp-wordpress-remote`, Abilities API guide, migration from deprecated Automattic/wordpress-mcp. Added `references/mcp-adapter-guide.md` and `references/wp-mcp-ultimate.md`. > > **v1.1.0 changelog:** Added complete AI Engine tool reference (109+ tools), `wp_write_blocks` block schema, real-world workflows (theme switch, media upload with permission fix, menu creation, Gutenberg rewrite), Cloudflare cache-busting, SVG-to-PNG conversion, WP-CLI menu command corrections. # WordPress MCP — three paths (mcp-adapter + AI Engine + wp-mcp-ultimate) > **Security notice**: This skill configures high-trust WordPress admin integrations. Application Passwords, Bearer Tokens, and OAuth credentials are secrets. Never commit them, print them in logs, or paste them into unt...