AI

WordPress and AI Agents: Why MCP Could Become a Default in WordPress 7.3

Web Brick Studio · · 6 min read

WordPress and AI Agents: Why MCP Could Become a Default in WordPress 7.3

AI agents are starting to build, edit and manage websites. The question for WordPress is whether those agents can work with it easily, or whether they will steer people to other platforms. In October 2026, two pieces of news made that question very real.

First, WordPress’s AI team approved moving MCP (Model Context Protocol) toward becoming a default part of WordPress, with WordPress 7.3 floated as a target. Second, new WordPress Agent Benchmarks found that across 193 sites, AI agents chose WordPress zero times when given a free choice of platform. And the MCP Adapter on its own completed no tasks on existing sites.

Here is what that means in plain English, and what you should do if your business runs on WordPress.

What is MCP, quickly

MCP is an open standard that lets AI assistants such as Claude, ChatGPT and Gemini connect to other software and use it. If a platform supports MCP, an AI agent can ask it for information (“list my draft posts”) and take actions (“publish this post”, “update the price on this product”) in a structured, permissioned way.

Think of it as a universal adapter. Without it, an agent has to click around the admin screen like a person, which is slow and fragile. With it, the agent talks to the site directly.

Where WordPress stands today

Right now, AI features in WordPress live in separate plugins rather than in core:

  • The Abilities API, expanded in WordPress 7.2, gives plugins a standard way to describe what they can do.
  • The MCP Adapter plugin exposes those abilities to AI agents.
  • The AI plugin handles AI features inside the editor.

The problem is that this setup is not on by default, and it is not complete. WPShout noted that the MCP Adapter has no OAuth server yet, so you cannot connect it to claude.ai with a normal sign in. That is why agents struggled in the benchmarks.

The benchmark result that worried everyone

Andy Peatling launched WordPress Agent Benchmarks to measure how well AI agents work with WordPress. When agents were free to choose a platform to build a site, they picked WordPress zero times across 193 sites. When they had to work on existing WordPress sites through the MCP Adapter alone, they completed no tasks.

For a platform that powers a huge share of the web, that is a wake up call. If AI agents become a common way to build and run small business websites, a platform agents avoid will slowly lose ground.

What the AI team decided

The WordPress AI team approved moving MCP toward default status. Options on the table include:

  • Bundling the MCP Adapter with WordPress.
  • Enabling it through existing interfaces, such as the REST API and Application Passwords.
  • Building capabilities directly into core.

Nothing is final, and 7.3 is a target, not a promise. But the direction is clear: WordPress wants agents to be able to work with any site out of the box.

The governance question

Making MCP a default raises a fair concern: do you really want AI agents to be able to change your website? Brad Williams of WebDevStudios argued that production MCP use is a governance decision, comparing it to choosing which rooms a guest can enter: “You decide which rooms it opens into.”

That is the right mindset. Useful agent access might be:

  • Read only for analytics, content audits and SEO checks.
  • Draft only for writing posts that a human reviews before publishing.
  • Limited write access for specific jobs, such as updating stock or prices.

Full administrator access for an agent on a live business site is rarely a good idea.

WooCommerce is moving too

WooCommerce 11.3 removes its old, deprecated MCP endpoint. Requests to /wp-json/woocommerce/mcp now return a 410 error. At the same time, it adds an experimental extensible abilities API, off by default and found under WooCommerce, Settings, Advanced, Features. If you tested an AI integration with the old endpoint, it will stop working after you update.

What site owners should do now

  1. Do not rush to install every AI plugin. Wait for the approach to settle, especially on live stores.
  2. Clean up user accounts and Application Passwords. Agent access will likely build on these, so remove anything old or unknown. WordPress 7.2 also adds email notices when an Application Password is created.
  3. Use the Secrets API when plugins support it, so API keys for AI services are stored encrypted.
  4. Make your content machine readable. Clear headings, structured data and consistent product information help agents whether they come through MCP or through your public pages.
  5. Test on staging. If you want to experiment with Claude or ChatGPT managing content, do it on a copy of your site first.

What this means in the US, UK and Australia

United States: US small businesses are adopting AI agents fastest, including new tools like Anthropic’s Claude Duet. If your developer or agency uses AI to manage your site, ask what access it has and how changes are reviewed.

United Kingdom: If an agent can read customer data from WooCommerce, that is processing under UK GDPR. Keep agent access read only or limited, and make sure your AI provider’s terms cover it.

Australia: Australian businesses should apply the same caution under the Privacy Act. The ACSC’s Essential Eight principle of restricting administrative privileges applies to AI agents just as it does to people.

Is WordPress falling behind?

Not yet, but it needs to move. Hosted platforms like Shopify, Wix and WordPress.com can add agent features centrally. WordPress.com already has a WordPress Agent that can design a custom theme and install plugins. Self hosted WordPress is more open and flexible, which is its strength, but that also makes a standard agent connection harder. Making MCP a default is the right step. The challenge is doing it safely.

Real examples of useful agent jobs on WordPress

Once agent access is safer and easier, these are the jobs we expect small businesses to hand over first:

  • Content audits. An agent lists posts with missing meta descriptions, broken internal links or outdated dates, and prepares a report.
  • Draft creation. An agent writes a first draft from your notes and saves it as a draft for an editor to review.
  • Product updates. An agent updates prices or stock in WooCommerce from a supplier spreadsheet, with changes logged.
  • Image clean up. An agent finds images without alt text and suggests descriptions for approval.
  • Plugin health checks. An agent reports which plugins need updates and which have not been maintained for a year.

Notice that most of these are read only or draft only. That is where the value is today, and where the risk is lowest.

Sources

Need a hand with this on your own site? See our WordPress development services.

Frequently asked questions

Is MCP part of WordPress 7.2?

No. AI and MCP work lives in separate plugins for 7.2. Making MCP a default is being discussed for 7.3.

Can I connect Claude to my WordPress site now?

Yes, with plugins and some setup, but the MCP Adapter has no OAuth server yet, so a direct claude.ai sign in does not work.

Is it safe to let AI agents edit my site?

It can be, with limited permissions, staging tests and human review. Avoid giving agents full admin access on a live site.

Can Web Brick Studio set up AI agents on WordPress?

Yes. We set up safe, limited AI workflows for content, SEO and WooCommerce, tested on staging first. Get in touch.

Keep reading

More from our blog.