Skip to main content
Developers

WordPress MCP server for site management

Let Claude, Cursor or any MCP-capable agent search the catalog, check your credits, inspect your connected WordPress sites and, when you allow it, install, update and roll back plugins with a confirmation step. One token.

What an MCP server does for WordPress

MCP (Model Context Protocol) is the open standard AI assistants use to call tools outside their own chat window. An MCP server exposes a set of named tools; the assistant reads the tool list, decides which one fits your request, and calls it with structured arguments. Claude, Cursor, Windsurf and Codex all speak it.

A WordPress MCP server therefore lets an assistant act on WordPress sites for you. Most implementations wrap one site's REST API. Zeebrar's sits one level up: it wraps your account, so a single token covers every site you have connected through the GPLC Connector, plus the plugin catalog and your credit balance. "Which of my sites still runs an old version of this plugin?" is one tool call, not one per site.

Reads are free and immediate. Anything that changes a site - install, update, activate, deactivate, roll back - is two calls: the first returns a plan with the sites, versions, credit cost and warnings, and nothing runs until you confirm it. Deleting a plugin additionally requires typing its slug. Tokens are scoped per purpose and revocable at any time.

1. Create a token

  1. Log in and open Account > Settings > Integrations.
  2. Name the token after the tool and machine it lives on, pick an expiry, create it.
  3. Copy it once and store it in an environment variable: export ZEEBRAR_MCP_TOKEN=zbr_mcp_...

2. Connect your client

Endpoint: https://zeebrar.com/api/mcp (Streamable HTTP, stateless, POST only). Every request carries the bearer token.

Claude Code (CLI)

claude mcp add --transport http zeebrar https://zeebrar.com/api/mcp \
  --header "Authorization: Bearer $ZEEBRAR_MCP_TOKEN"

Claude Code (project .mcp.json)

{
  "mcpServers": {
    "zeebrar": {
      "type": "http",
      "url": "https://zeebrar.com/api/mcp",
      "headers": { "Authorization": "Bearer ${ZEEBRAR_MCP_TOKEN}" }
    }
  }
}

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "zeebrar": {
      "url": "https://zeebrar.com/api/mcp",
      "headers": { "Authorization": "Bearer ${env:ZEEBRAR_MCP_TOKEN}" }
    }
  }
}

Windsurf (~/.codeium/windsurf/mcp_config.json)

The key is serverUrl, not url.

{
  "mcpServers": {
    "zeebrar": {
      "serverUrl": "https://zeebrar.com/api/mcp",
      "headers": { "Authorization": "Bearer ${env:ZEEBRAR_MCP_TOKEN}" }
    }
  }
}

Codex CLI (~/.codex/config.toml)

The token never touches disk: Codex reads it from the environment variable.

[mcp_servers.zeebrar]
url = "https://zeebrar.com/api/mcp"
bearer_token_env_var = "ZEEBRAR_MCP_TOKEN"

Claude Desktop and other stdio-only clients (mcp-remote bridge)

Claude Desktop custom connectors do not send static headers yet; bridge through mcp-remote. Pin the version.

{
  "mcpServers": {
    "zeebrar": {
      "command": "npx",
      "args": [
        "[email protected]", "https://zeebrar.com/api/mcp",
        "--header", "Authorization: Bearer ${ZEEBRAR_MCP_TOKEN}"
      ]
    }
  }
}

3. Tools

  • zeebrar_get_accountTier, credit balance, reset date, subscription status.
  • zeebrar_search_catalogKeyword, tag, tier and category search over the catalog.
  • zeebrar_get_pluginFull detail with semver-sorted versions and scan status.
  • zeebrar_recommend_pluginsCompanions for a plugin, or matches for a stated purpose.
  • zeebrar_list_tagsThe tag vocabulary with counts.
  • zeebrar_list_sitesConnected sites with a ready / reconnect pre-flight.
  • zeebrar_site_healthWordPress, PHP and connector versions for one site (live).
  • zeebrar_list_site_pluginsInstalled plugins with update availability and cost (live).
  • zeebrar_check_updatesPending updates on one site or, on Pro and Agency, across all sites.
  • zeebrar_get_operationProgress of a bulk install or update run.

Resources: zeebrar://catalog/tags, zeebrar://docs/credits, zeebrar://docs/capabilities.

Write tools (opt-in per token)

Tokens created with the sites:write scope unlock four more tools. Every write is two calls: the first returns a plan (sites, plugins, versions, credit cost, warnings) and a single-use confirmation_token that expires in 5 minutes; nothing runs. The agent shows the plan, and only after you agree does it call again with the identical arguments plus the token. Changed arguments, a reused token or an expired one are rejected by the server. There is no auto-approve setting.

  • zeebrar_install_pluginsInstall or update up to 25 plugins across your sites. Credits apply; two or more items run as a bulk operation (Pro and Agency).
  • zeebrar_set_plugin_stateActivate or deactivate an installed plugin. Free; no backup or health check.
  • zeebrar_delete_pluginDelete an inactive plugin's files. Irreversible; requires confirm_slug.
  • zeebrar_rollback_pluginRoll back to a version you already paid for on that site. Free; guarded by the connector (backup, health check, auto-restore).

Installs and updates spend your normal credit balance and are refunded when the install fails or the connector restores a broken update. Sites need GPLC Connector 1.5.1 or later for agent writes; the plan tells you when a site has not reported its version.

What the agent can and cannot do

  • MCPPlugin catalog - Browse and search the premium plugin catalog with tier, tag and compatibility filters.
  • MCPRemote plugin install and update - Install or update a plugin on a connected WordPress site from the dashboard; credits are charged per plugin per site.
  • MCPBulk plugin updates - Update plugins across every connected site in one run, with per-site progress and error reporting.
  • MCPActivate and deactivate plugins remotely - Toggle installed plugins on a connected site without logging into wp-admin.
  • MCPSite health - WordPress, PHP and connector versions plus reachability for each connected site.
  • DashboardSafety-gated installs - Dashboard installs back up the current version, health-check the site and restore automatically if it breaks.
  • MCPVersion rollback - Roll back to any previously downloaded version, free of charge, from the dashboard or the WordPress admin.
  • MCPVirus scanning - Versions are scanned with VirusTotal v3 before they are offered; results are shown before you install.

FAQ

Does the MCP server spend credits?

Only through zeebrar_install_plugins, and only with a token that has the sites:write scope. Every read tool is free. An install or update costs the plugin's normal credit price per site, exactly as in the dashboard, and the agent must present the plan and receive your confirmation before anything runs.

Does a token count as a connected site?

No. Agent tokens are a separate credential. They never create a site record and never touch your plan's site limit.

How do I revoke a token?

Account > Settings > Integrations. Revocation is immediate; the agent gets a 401 on its next call.

Which plans can use it?

Any account can create a token. Catalog access follows your plan as it does on the website; checking updates across all sites at once is a Pro and Agency feature.

Is there a rate limit?

Yes, per token: 60 catalog reads per minute, 20 live-site reads per minute. Live-site tools reach out to your WordPress site and can take up to 15 seconds each.