Secure MCP Server for Claude, ChatGPT, Gemini and other AI Agents

Description

miniOrange Secure MCP Server is a complete WordPress MCP server plugin that turns your WordPress site into a fully working Model Context Protocol (MCP) server. Once installed, you can connect Claude to WordPress, connect ChatGPT to WordPress, or link any MCP-compatible AI in just 2 minutes.

Ask AI to write blog posts, edit Elementor and Kadence page layouts, manage custom post types and their custom fields, upload media, update WooCommerce products, manage Yoast SEO, moderate comments, handle contact form submissions, and much more, all through simple chat. With Governed REST API Access, AI can even use REST endpoints from your other plugins, under the same permissions.

Unlike other WordPress MCP server plugins that give AI full admin access, we put you in complete control. Role-based AI permissions, Turn each tool on or off, self-hosted OAuth 2.1 login, and full activity logs are all included, with no restrictions.

Quick Links

Official Website | ChatGpt Setup Guide | Claude Setup Guide | Documentation | Book a Demo

Key Features of the Secure WordPress MCP Server

Built security-first, so you can let AI work on a live site with confidence:

• 426 MCP tools in 26 categories – WordPress core, WooCommerce, Yoast SEO, Rank Math, Advanced Custom Fields, Elementor, Kadence, Contact Form 7, WPForms, Gravity Forms, Fluent Forms and more.
• Governed REST API access – AI can use any WordPress REST endpoint, including those from your other plugins, with route-by-route, role-based permissions.
• Agent Registry – decide, per WordPress role, exactly which tools an AI agent can use.
• Self-hosted OAuth 2.1 with PKCE – the AI never sees your WordPress password.
• Every call checked against WordPress capabilities – an AI can never do more than its user can do in wp-admin.
• Full audit log – every call, allowed or refused, is recorded.
• Safe theme and code editing – changes go to a draft, are syntax-checked and previewed, and publish with automatic backup and rollback.
• Built-in troubleshooting – a Troubleshooting page finds out why an AI client can’t connect and tells you what to fix.

Everything runs on your own server. No third-party relay sits between your AI client and your site.

How to Install the WordPress MCP Server (2 Minutes)

1. Log in to your WordPress admin dashboard.
2. Go to Plugins → Add New.
3. Search for Secure MCP Server.
4. Click Install Now, then Activate.

Create Your First AI Agent

1. Open Secure MCP Server from the WordPress admin sidebar.
2. Click Register your first agent.
3. Enter an agent name and click Next.
4. Choose which abilities each user role can use, then click Create & Continue.
5. Click Continue. You’ll see Connect your AI client.

How to Connect ChatGPT to WordPress

1. Under Connect your AI client, select ChatGPT. A setup panel opens.
2. Copy Your Site URL from the panel.
3. Click the MCP Server for WordPress link in the panel. It opens the app in ChatGPT.
4. Click Install Plugin.
5. Enter your WordPress Site URL and click Continue.
6. Click Allow Access. Now start chatting with your site through ChatGPT.

Full guide: Set up ChatGPT with WordPress using MCP

How to Connect Claude to WordPress

1. Under Connect your AI client, select Claude. A setup panel opens.
2. Open the connector page miniOrange MCP for WordPress and click Connect.
3. Enter your site’s address. You’ll land on the sign-in gateway — paste your site’s URL there.
4. Log in with your WordPress account and click Allow access. Your approved tools now appear in Claude – start chatting with your site.

Full guide: Connect WordPress with Claude using MCP

Video: Connect Claude to WordPress Using Secure MCP Server

Connect Gemini, Cursor, Windsurf & Any MCP Client

The plugin follows the open Model Context Protocol standard, so it works with Gemini, Cursor, Windsurf, and any MCP-compatible client. Connect several AI clients at once, each with its own permissions and audit trail.

Your MCP server endpoint:
https://gateway.miniorange.ai/v2/mcp

What Your AI Agent Can Do

426 tools in 26 categories. Integration tools appear only when the related plugin is active.

WordPress Content

• Posts & Pages (56 tools) – Create, publish, schedule, duplicate, set templates and featured images, trash and restore.
• Categories, Tags & Media (40 tools) – Manage taxonomies, upload media from a URL or file, update alt text and captions.
• Revisions (9 tools) – List, compare and restore revisions and autosaves.
• Comments (21 tools) – Moderate, reply, search, mark spam and view counts.
• Custom Post Types & Fields (19 tools) – Discover any custom post type and edit its items, terms and fields.
• Content Find & Replace (6 tools) – Change part of a post, custom field or setting without rewriting it.

Users & Site Management

• Users & Roles (38 tools) – Create users, assign roles, update profiles, send password reset links.
• Settings, Plugins, Themes & Updates (34 tools) – Site title, tagline, homepage, timezone, plugin activation and updates, auto-updates, site health.
• Maintenance (8 tools) – Clear caches, refresh permalinks, run cron events, read the error log.
• Theme Editing (32 tools) – Block templates, global styles, patterns and theme files, with draft, preview, publish and restore.

Plugin Integrations

• WooCommerce (41 tools) – Products, orders, refunds, customers, coupons and sales reports.
• Advanced Custom Fields (25 tools) – Field groups, repeaters, flexible content, relationships, options pages.
• Yoast SEO & Rank Math (15 tools) – SEO titles, meta descriptions, focus keywords, canonicals, schema, Open Graph.
• Forms & Leads (54 tools) – Contact Form 7 (Flamingo), WPForms, Gravity Forms and Fluent Forms entries, with CSV export.
• Elementor (10 tools) – Read, edit, style, move and duplicate Elementor elements
• Divi 4 & Divi 5 – Read and edit Divi Builder layouts, modules, text, images and styling.
• Kadence Blocks (18 tools) – Build Kadence pages, insert rows, columns, headings, buttons and images.

Governed REST API Access: Go Beyond Built-in Tools

AI can use any WordPress REST API endpoint – core, WooCommerce, Yoast or any other plugin – with no plugin update needed.

• Read-only by default – a new AI agent can read posts, pages and media; any write needs your approval.
• Granular control – allow each route and method (read or write) per user role, all logged.
• Site-wide write switches – turn all create, update or delete REST calls off for the whole site in one click.
• Dangerous routes stay blocked – plugin and theme installs, activations, batch and blueprint-import routes can never be granted.

WooCommerce MCP Server

Run your store through chat. Create and update products, attributes, categories and tags. Look up, create and update orders, change order status, add order notes and issue refunds. Manage customers, view purchase history and customer segments, and create or update coupons. Get sales, orders, products, customers, coupon usage and top-seller reports.

SEO MCP: Yoast SEO & Rank Math

Bulk-update SEO titles and meta descriptions, set focus keywords, mark cornerstone content, and control robots meta, advanced robots directives, canonical URLs, breadcrumb titles and sitemap inclusion. Manage Open Graph, Twitter/X cards and schema types. Rank Math SEO metadata is supported too.

Advanced Custom Fields (ACF) MCP

Read and update any ACF field value, in bulk or one at a time. Work with repeater rows, flexible content layouts, relationship fields and options pages. Create field groups, add fields, update location rules, check conditional logic, and validate a value before it is saved. You can also search posts by ACF field value.

Page Builder MCP: Elementor, Divi & Kadence

Elementor: read a page layout, change element text, images, links and styling without breaking the design, move, duplicate or delete elements, look up widget schemas and preview the rendered result.

Divi 4 & Divi 5: read Divi Builder layouts and update modules, text, images, links and styling through chat, without opening the visual builder.

Kadence Blocks: build new Kadence layout pages, insert rows, columns, headings, buttons, icons and images, update block text and styling, and set page layout options.

Forms & Leads MCP

Work with Contact Form 7 (via Flamingo), WPForms, Gravity Forms and Fluent Forms. List forms and fields, read and count entries, mark them read or unread, trash, restore or delete them, and export entries as CSV. Inspect form settings and notifications, and for Fluent Forms you can create, update and test notifications and confirmations.

Safe Theme & Code Editing

AI can now edit your theme safely:

• Edit block templates, template parts, global styles, style variations and patterns.
• Read, search and edit theme files – PHP, CSS, JavaScript and theme.json.
• Nothing touches the live site directly. Every change goes into one private draft.
• PHP is checked for syntax errors, JSON for validity, and templates for broken blocks before a change is accepted.
• Preview the draft, and test that the site still loads before it goes live.
• Publishing takes an automatic backup. If the site fails, everything rolls back automatically.
• Undo any publish later with one restore.

Site Management & Maintenance

Update site title, tagline, homepage, posts page, timezone and privacy page. List, activate, deactivate and update plugins and set auto-updates. Check WordPress core, plugin and theme updates, site health and server information. Clear caches, refresh permalinks, inspect and run scheduled (cron) events, and read the site error log to troubleshoot problems.

Smart Content Editing

• Find & replace inside posts, custom fields and settings – change one sentence without rewriting the whole page.
• Page lock – edits are refused if the page changed after the AI read it.
• Revision restore – roll back any post to an earlier version.

Agent Registry: Role-Based Access for Every AI Agent

The Agent Registry controls what each AI agent may do.

• Create named agent policies that map WordPress roles to allowed tools.
• Tools outside a role’s grant are hidden from the AI client and cannot be called.
• Turn an agent on or off without losing its configuration.
• Revoke an AI client’s access instantly.
• Use the role/ability matrix editor to manage everything in one place.

So an editor’s AI can write content but cannot install plugins, and a shop manager’s AI can update orders but cannot touch site settings.

Troubleshooting: Find Out Why an AI Client Can’t Connect

If an AI client can’t reach your site or sees no tools, open the Troubleshooting tab. The plugin checks your site and the connection from outside, and shows only the problems that are likely to be real.

• Each problem is explained in plain language, with who can fix it and the exact change to make.
• Detects firewall, CDN, caching and reverse-proxy issues, and servers that strip the Authorization header.
• Copy-paste Apache and Nginx fixes for the most common causes.
• Copy for support gives you a redacted report to send to our team.

Three Layers of Security on Every Call

1. The connection is a real WordPress user. OAuth 2.1 (PKCE) tokens are bound to the user who approved the connection and to your site. Expired, revoked or wrong-site tokens are refused.
2. Role-scoped AI grants. Only the tools allowed for that role through the agent Registry are visible and callable.
3. WordPress capability checks. Each call is checked exactly like wp-admin, down to the individual post, page, comment

Plus:

• Per-tool on/off toggles for every tool.
• Prompt-injection detection and behavioral anomaly detection.
• Rate limits and quotas per AI client.
• Data rules & DLP that mask emails, phone numbers and secrets.
• Human-in-the-loop approval for sensitive actions.
• Destructive actions need confirmation, and every tool tells the AI client whether it is read-only or destructive.
• Activity audit log that records the user, AI identity, client, tool, outcome and time, filterable by agent, status, tool, user and date.

Dashboard & Monitoring

See active agents, executions, success rate and latency at a glance. Members can open “Your AI Access” to see which tools their role allows and how to connect.

Example Prompts

• “Write a blog post about our summer sale, add it to the News category and schedule it for Monday 9 AM.”
• “Find all products under ₹500 and put them on a 20% sale until Sunday.”
• “Write meta descriptions for every post that doesn’t have one.”
• “Export this month’s Gravity Forms entries as CSV.”
• “Change the footer text in my theme, preview it, then publish.”
• “Why aren’t my scheduled posts publishing? Check cron and the error log.”
• “Use the REST API to list this week’s bookings from my booking plugin.”

Need Help?

Ask in the support forum – our team responds quickly. For private or enterprise questions, email info@xecurify.com or use the Contact Support button inside the plugin.