WordPress MCP Server: Query Your Site with Claude, Edit with REST
What is a WordPress MCP server?
A WordPress MCP server is a single endpoint on a WordPress site that lists typed, discoverable tools an AI client can call directly — instead of guessing at REST routes or scraping the screen. Kantan ships one for WordPress: 35 read-only analytics and SEO tools behind a single endpoint.
MCP — the Model Context Protocol — is an open standard for connecting an AI agent to a defined set of tools, instead of having it guess at an API or scrape a screen. A server built on it lists every tool it offers, each with a name and a typed shape for its arguments and its result, so any compatible AI client can discover and call them directly.
A WordPress MCP server is that same idea applied to a WordPress install: one endpoint — /wp-json/kantan/mcp in Kantan’s case — that an AI client connects to once and gets back the full list of what it’s allowed to do on that site. Kantan exposes 35 such tools, every one of them read-only, discovered dynamically: installing Kantan SEO alongside Kantan Analytics adds its tools to the same server automatically, with nothing extra to configure.
Read tools covering traffic, visitors, journeys and conversions. Ships free, on every install.
Read tools covering keywords, rankings, health audits and content scores. Joins the same server the moment the plugin is active.
Why read-only is a design choice.
Not a gap in the tool list — three categories, deliberately kept out.
Plenty of MCP servers ship a tool that writes. Kantan’s doesn’t, and the gap runs deeper than content edits — three whole categories of action stay behind an explicit REST call instead of an MCP tool call, because each one spends something real the moment it’s triggered.
POST /health · POST /aeo · POST /performance/scanEach one spends a call against Google PageSpeed Insights’ own quota — shared across everything else on that account, not something to burn on an agent’s own initiative.
Keyword research, backlinks and competitor-gap analysis run on the site owner’s own DataForSEO credentials — billable, per-call, third-party charges, not a free lookup.
Scanning a competitor’s sitemap fires a batch of outbound requests at someone else’s server — not something that should happen just because a conversation drifted that way.
An agent that can trigger billable work — a scan, a paid research call, a batch of outbound requests — on its own, mid-conversation, is a liability: the person running it finds out after the quota is gone or the invoice arrives, not before. So all three stay behind an explicit REST call the user makes, or approves, themselves — the same principle Kantan applies to content edits in §04, just for spend instead of content.
Querying over MCP.
The client sees tool names exactly as the server hands them out — the plugin prefix stays attached. A tool called get-keywords inside Kantan SEO’s own code shows up to your AI client as kantan-seo-get-keywords — that flattened form is what you’ll actually see the agent call.
All 35 tools.
| TOOL | RETURNS | PLUGIN |
|---|---|---|
kantan-analytics-get-analytics-overview |
Visits, unique visitors, bounce rate, and duration for any date range | ANALYTICS · FREE |
kantan-analytics-get-top-pages |
Most-viewed pages with entries, exits, and time on page | ANALYTICS · FREE |
kantan-analytics-get-traffic-sources |
Sessions by channel — organic, direct, referral, social, paid | ANALYTICS · FREE |
kantan-analytics-get-referrers |
Referring domains ranked by visits | ANALYTICS · FREE |
kantan-analytics-get-referrer-detail |
Every session a single referrer sent, with landing pages | ANALYTICS · FREE |
kantan-analytics-get-utm-campaigns |
Captured UTM parameters with their sessions and conversions | ANALYTICS · FREE |
kantan-analytics-get-conversions |
Conversion events with type, label, value, and source | ANALYTICS · FREE |
kantan-analytics-get-user-journeys |
Page-by-page paths of individual sessions | ANALYTICS · FREE |
kantan-analytics-get-visitors |
Visitor profiles with generated names, visit counts, and last seen | ANALYTICS · FREE |
kantan-analytics-get-visitor-detail |
One visitor’s full history across return visits | ANALYTICS · FREE |
kantan-analytics-get-visitor-tech |
Device, browser, OS, and screen-resolution breakdowns | ANALYTICS · FREE |
kantan-analytics-get-geo |
Visitor countries and regions | ANALYTICS · FREE |
kantan-analytics-get-interactions |
Click positions and scroll depth per page | ANALYTICS · FREE |
kantan-analytics-get-realtime |
Who is on the site right now | ANALYTICS · FREE |
kantan-analytics-get-videos |
Video impressions, plays, and watch time | ANALYTICS · FREE |
kantan-analytics-get-video-detail |
One video’s play-through and audience detail | ANALYTICS · FREE |
kantan-analytics-get-ai-crawlers |
GPTBot, ClaudeBot, and other AI crawler hits by page | ANALYTICS · FREE |
kantan-analytics-get-business-profile |
The site’s canonical business facts, maintained by the owner | ANALYTICS · FREE |
kantan-seo-get-seo-overview |
Organic sessions, clicks, impressions, and conversion value | SEO |
kantan-seo-get-gsc-status |
Search Console connection state and last sync | SEO |
kantan-seo-get-keywords |
Ranked queries with position, clicks, impressions, and CTR | SEO |
kantan-seo-get-keyword-movers |
Keywords climbing or dropping versus the prior period | SEO |
kantan-seo-get-keyword-history |
Daily position history for a single keyword | SEO |
kantan-seo-get-keyword-cannibalization |
Queries where multiple pages compete against each other | SEO |
kantan-seo-get-content-performance |
Per-page traffic, engagement, and organic metrics in one table | SEO |
kantan-seo-get-content-detail |
One page’s full picture — traffic, keywords, conversions, health | SEO |
kantan-seo-get-content-scores |
A 0–100 optimization score for every page | SEO |
kantan-seo-get-content-pruning |
Pages worth updating, merging, or removing | SEO |
kantan-seo-get-internal-linking |
Suggested links between pages covering related terms | SEO |
kantan-seo-get-health-audit |
On-page issues by severity across the whole site | SEO |
kantan-seo-get-performance-results |
PageSpeed scores and Core Web Vitals per page | SEO |
kantan-seo-get-performance-history |
Score history over time for a single page | SEO |
kantan-seo-get-aeo-audit |
Answer-engine readiness checks and overall score | SEO |
kantan-seo-get-competitors |
Side-by-side scans of competitor sites | SEO |
kantan-seo-get-monthly-report |
A month-over-month summary of everything above | SEO |
You don’t call these directly — you ask a question, and a connected client such as Claude Code or Gemini CLI picks the matching tool for you.
kantan-seo-get-keyword-movers {"days":30}Editing over REST.
None of the 35 MCP tools can write anything. When an agent does change a page — and only Kantan SEO’s agent can, in either of its two write modes — it does that over the standard WordPress REST API, the same wp/v2 path every other WordPress client already uses, not through MCP.
The documented write is a single call: POST /wp/v2/posts/{id} with a body of {"title","content"} and no status field — which is what makes it immediate. The moment that request lands, the change is live; WordPress doesn’t hold it back for anyone to look at first. The approval happens earlier, in the conversation: the agent proposes the exact new copy, you say yes, and only then does the request go out. WordPress still keeps a revision of whatever the edit replaced, so a bad edit is a rollback through the post’s revision history, not a support ticket.
Edits Gutenberg block content directly over wp/v2. The agent proposes the exact change, you approve it in the conversation, and the edit goes live immediately — with a revision kept of whatever it replaced.
Reads and writes ACF field values over the same wp/v2 path — the mode to pick on ACF Flexible Content builds, with the identical propose-then-approve loop.
A mode that never sends that request at all. It still reads your SEO data over MCP and still tells you what to change — it just hands back the finished replacement copy for you to paste into your own page builder, instead of a change already made on your behalf.
The read-only guarantee belongs to the 35 MCP tools, not to your credential. The Application Password an agent authenticates with carries the full access of the WordPress account that generated it — WordPress doesn’t scope it to read-only — so the same credential that lets the MCP tools read your data is also what authorises that REST write.
Setup, in brief.
Four steps get an agent talking to your site over MCP. This is the short version — the full walkthrough, with the exact commands, the environment-variable setup and a troubleshooting section for the parts that trip people up, lives on its own page.
Update to WordPress 6.9+ and install the MCP Adapter plugin from its GitHub release — it’s not on wordpress.org yet.
Download the agent from your Kantan dashboard, and generate a WordPress Application Password for it to authenticate with.
Point your client — Claude Code or Gemini CLI — at /wp-json/kantan/mcp, once per site.
Ask a question. That’s the whole read path — nothing to approve, because there’s nothing it can write.
Frequently asked.
Does Kantan’s MCP server let AI edit my content?
No. All 35 tools it exposes are read-only — none of them creates, updates or deletes anything. When an agent does make an edit, it’s instructed to ask before writing and to make the change through the separate WordPress REST API — but that request takes effect the moment it’s sent, not after some further review step. WordPress keeps a revision of whatever it replaced, so a bad edit is a rollback, not a support ticket.
Do I need WordPress 6.9?
Yes, for the MCP connection specifically — it depends on the Abilities API that arrived in 6.9. Older versions still serve Kantan’s plain REST endpoints, so an agent can fall back to those; it just can’t connect over MCP.
Why isn’t the MCP adapter on wordpress.org?
It’s a separate, actively developed open-source project that hasn’t reached a wordpress.org release yet. Until it does, you install it from its GitHub releases page rather than searching for it inside Plugins → Add New.
Is my data sent to Kantan’s servers?
No. The MCP server that answers these tool calls runs on your own WordPress install, reading straight from your own database. Kantan doesn’t operate a separate service the requests pass through, and doesn’t receive or store a copy of the data.
Which AI clients work with this?
Any client that speaks standard MCP over HTTP. Kantan documents the exact setup for Claude Code and Gemini CLI — neither is special-cased, so the same server URL and header work with either.
Is the Application Password read-only?
No — worth being precise here. The read-only guarantee belongs to the MCP tools, not the credential. WordPress doesn’t scope Application Passwords, so the one your agent uses carries the full access of the account that created it, including whatever REST writes that account is allowed to make.
Give your agent the full picture.
The analytics tools are free forever. The SEO tools — keywords, health audits, content scores, PageSpeed — ship with Kantan SEO.