WordPress MCP Adapter

This page covers the technical details of SitePulse's WordPress MCP adapter. For the CMS patching setup workflow and enabling the integration, see WordPress Integration.

How the adapter works

SitePulse's CMS patching system uses an internal MCP-style adapter layer to translate audit rewrite suggestions into API calls against your WordPress site. The WordPress adapter (shared/cms/wordpress_mcp.py) exposes three tools:

Tool	Description
data_pages_tool	Fetch page or post content by ID or slug
data_posts_tool	Fetch recent posts or search post content
data_update_tool	Patch a page or post field with rewrite content

These tools are called by the CMS patching pipeline when you apply rewrites from the CMS Patches tab in an audit.

Authentication — Application Passwords

WordPress REST API v2 does not use OAuth. SitePulse authenticates using WordPress Application Passwords — a built-in WordPress feature available since WordPress 5.6.

Application Passwords are:

• Scoped to a specific WordPress user account
• Revocable from WordPress Admin → Users → Profile → Application Passwords
• Separate from the account's login password
• Not stored in browser sessions or cookies

SitePulse stores the Application Password encrypted using AES-256-GCM in project.integrations['wordpress']['app_password'], alongside the WordPress site URL and username.

Connecting WordPress

Go to Project Settings → Integrations → WordPress.

You need:

1. WordPress URL — the root URL of your WordPress site (e.g., https://acme-coffee.example)
2. Username — a WordPress user with Editor or Administrator role
3. Application Password — generated in WordPress Admin → Users → Profile → Application Passwords

Click Save & Validate — SitePulse calls GET /wp-json/wp/v2/users/me to verify the credentials before saving.

REST API endpoints used

SitePulse calls the standard WordPress REST API v2:

Operation	Endpoint
Fetch page by ID	GET /wp-json/wp/v2/pages/{id}
Fetch post by ID	GET /wp-json/wp/v2/posts/{id}
Fetch pages (slug lookup)	GET /wp-json/wp/v2/pages?slug={slug}
Update page field	POST /wp-json/wp/v2/pages/{id}
Update post field	POST /wp-json/wp/v2/posts/{id}

All requests use HTTP Basic Auth with the WordPress username and Application Password.

Field mapping

When applying a CMS patch, SitePulse maps each rewrite suggestion type to a WordPress REST API field:

Suggestion type	WordPress field
title	title.raw
meta_description	Requires SEO plugin (see below)
body_rewrite	content.raw
link_text	content.raw (inline patch)
heading_fix	content.raw (inline patch)

Meta description patching

WordPress core does not expose a meta description field in the REST API. SitePulse detects and supports the following SEO plugins:

Plugin	Field	REST namespace
Yoast SEO	yoast_meta.yoast_wpseo_metadesc	/wp/v2/
Rank Math	rank_math_description	/wp/v2/
All in One SEO	aioseo_description	/wp/v2/

If no supported SEO plugin is detected, meta description rewrites are flagged as manual-only in the CMS Patches tab — they cannot be auto-applied and must be copied and pasted.

Disconnect behavior

When you disconnect WordPress (Project Settings → Integrations → WordPress → Disconnect), SitePulse deletes the stored credentials from project.integrations. Existing applied patches are not reversed. Future CMS patch operations for that project revert to manual-only.

Difference from the Webflow adapter

The WordPress adapter uses HTTP Basic Auth against a RESTful JSON API, while the Webflow adapter uses OAuth 2.1 + PKCE against Webflow's proprietary CMS API. Both adapters expose the same internal data_pages_tool / data_cms_tool interface to the patch pipeline — the differences are contained within the adapter implementation.