Download

Quick start

Install the plugin on your site, give it a signing secret, create a token, and connect Claude or ChatGPT. Five steps; the only thing you type by hand is your site’s address.

Plugin 1.7.0Xaflo Desktop 2.0.2MCP server 1.3.0

On this page

Before you start

  • A WordPress site you administer, running WordPress 6.0 or later and PHP 8.1 or later, served over HTTPS. The plugin refuses plain-HTTP requests (local development hosts such as localhost or *.test are exempt).
  • An AI client that speaks MCP: Claude Code, Claude Desktop or ChatGPT Desktop.
  • Either Xaflo Desktop (Windows & Linux), or Node.js 18 or later if you want to run the MCP server without the app.

1. Install the plugin

Download xaflo-wp-connect-1.7.0.zip from the Download page (you can verify its checksum first). In WordPress go to Plugins → Add New Plugin → Upload Plugin, choose the file, click Install Now, then Activate.

A new Xaflo menu appears in the admin, with Dashboard, Connect, Audit Log, Tokens, Settings, Maintenance and About. Since 1.7.0 the screens follow your WordPress language, English or Italian.

2. Add the signing secret

Tokens are signed with a secret that lives in wp-config.php, never in the database. Until it exists the plugin shows a notice: “A signing secret must be added to wp-config.php before API tokens can be issued.”

Open Xaflo → Settings. If WordPress can write to wp-config.php, you can let the plugin install a freshly generated secret there. If it cannot, copy the 64-character value it suggests and add it yourself, above the line that says That’s all, stop editing!

wp-config.php
define( 'WPCB_JWT_SECRET', 'paste-the-64-character-value-here' );

The secret must be at least 32 characters. Changing or removing it invalidates every token issued with it, which is exactly what you want if a token ever leaks.

3. Create a token

Go to Xaflo → Tokens and create a new token. Give it a name you will recognise later (“Claude on my laptop”), choose its scopes and how long it lasts: the default is 30 days, anything from 1 to 365. The screen groups the scopes and warns you about each dangerous one.

Start read-only. This set lets the assistant look at everything that matters without changing a thing:

auth:readcontent:readseo:readanalytics:readsite:read

Copy the token with the copy button when it appears. It is shown only once; keep it in your password manager. The token is tied to your WordPress user, so it can never do more than your account can. Token scopes explains every scope and when to add write access.

4. Connect your assistant

With Xaflo Desktop (recommended)

Install Xaflo Desktop from the Download page. Since 2.0.1 it carries the MCP server and its own Node, so there is nothing else to install.

  1. In Sites, click Add site and fill in the three steps: Address, Token and Name in Claude Code, the name Claude lists the site’s tools under. Check and continue tests the connection.
  2. Restart Claude Code to use the new site. For Claude Desktop or ChatGPT Desktop, open the site’s sheet and use Set up Claude and ChatGPT for a ready-to-paste snippet; the token stays in the environment, never in the arguments.
  3. On the same sheet, Instructions for the AI → Copy instructions gives you a briefing about the site to paste into a new chat. It contains no token.
  4. Open wp-admin signs you in directly when the token has admin:login (plugin 1.7.0).

The sidebar has five places: Sites, Remote, Library, Licence and Settings. Desktop Lite is €0 for 1 site; see Multiple sites for more. Desktop 2.0 is the Windows build; the Linux build is still 1.1.1, with the earlier layout and its Setup instructions button.

With Claude Code only

The MCP server ships inside the plugin, so your own site serves it. Install it once with Node.js 18 or later (replace the address with your site’s):

Terminal
npm install -g https://your-site.example/wp-content/plugins/wp-claude-bridge/mcp/claude-wp-mcp-1.3.0.tgz

Then register the site with Claude Code. --scope user makes it available in every project:

Terminal
claude mcp add --scope user my-site -- claude-wp-mcp --site https://your-site.example --token YOUR_TOKEN

On Linux you can do both steps with the installer your site serves. It checks Node.js, installs the package, backs up and updates the Claude Desktop and Claude Code configuration it finds, and tests the connection. It registers the site under the name wordpress:

bash
WPCB_TOKEN=YOUR_TOKEN bash -c "$(curl -fsSL https://your-site.example/wp-json/wpcb/v1/install/script.sh)"

With a config file

Claude Desktop (claude_desktop_config.json) and other MCP clients run the same command. Pass the site and token in the environment, so the token never appears in a process list (--site and --token also work):

JSON
{
  "mcpServers": {
    "my-site": {
      "command": "claude-wp-mcp",
      "env": { "WPCB_SITE": "https://your-site.example", "WPCB_TOKEN": "YOUR_TOKEN" }
    }
  }
}

5. Check the connection

Restart your AI client completely: MCP servers are started when the client starts. In Claude Code, run /mcp and look for your site in the list. Then ask:

Run wp_health_check on my-site and tell me the plugin, WordPress and PHP versions.

Calls
wp_health_check

With MCP server 1.3.1 (in Xaflo Desktop 2.0.2) and plugin 1.7.0, the answer also lists the scopes of the token in use. You can also open https://your-site.example/wp-json/wpcb/v1/health in a browser: it needs no token and answers with the plugin version, WordPress and PHP versions, your site URL and the time.

Every call the assistant makes is now in Xaflo → Audit Log.

Next