WPVibe MCP setup

Check the WordPress prerequisites

Use the actual WordPress installation address, including a subdirectory when applicable. WPVibe needs a publicly reachable WordPress REST API and Application Password authorization. A local-only installation needs a separate connectivity arrangement; localhost in your browser is not reachable by WPVibe’s hosted service. Site connection requirements.

For the plugin, the WordPress.org listing currently requires WordPress 6.0 or later and PHP 7.4 or later. Find WPVibe by SeedProd under Plugins → Add New; its directory slug is vibe-ai. Check your host’s compatibility before installation. Official plugin listing.

Basic WordPress REST operations can work without the plugin. Install it when you need WPVibe’s deeper functions, such as theme drafts, file operations, WP-CLI-style tools or richer diagnostics. Installation alone does not connect an account or prove those operations work. Core REST versus plugin capabilities.

Choose the client connection

Claude chat / Desktop: WPVibe’s current instructions prefer its Connectors Directory listing. Sign in with the same WPVibe email you intend to use elsewhere; avoid duplicate directory and custom entries.

Claude is rolling out a unified Plugins page that replaces the Customize menu. If you see the newer interface, find the connection under Plugins and use its connector controls; menu wording can differ during rollout. Claude’s interface transition.

ChatGPT: use WPVibe’s published plugin if it is available to your account, and attach it to the conversation. A manual custom-MCP entry is a separate route with account/workspace restrictions.

Claude Code: register the remote server, then complete the browser sign-in when prompted:

claude mcp add --transport http wpvibe https://mcp.wpvibe.ai/mcp

Cursor: add the remote URL in MCP settings, or merge the following entry into your existing configuration:

{
  "mcpServers": {
    "wpvibe": {
      "url": "https://mcp.wpvibe.ai/mcp"
    }
  }
}

WPVibe sign-in sends a six-digit code to your email; enter it on the WPVibe sign-in page, not into the AI conversation. WPVibe’s client-specific instructions. Cursor’s native HTTP transport supports OAuth. Cursor configuration reference.

For ChatGPT, published-app availability varies by plan, region and workspace; current OpenAI documentation lists custom MCP creation for Business and Enterprise/Edu on the web. A published plugin’s availability does not establish permission to add arbitrary custom servers. This is native MCP, not a Custom GPT Action or a visitor chatbot installed on your site. Connected-app availability · Custom MCP requirements.

Authorize the WordPress site separately

Ask the connected client to list your WPVibe sites. If the target is absent, ask it to connect the exact WordPress address. Open the returned authorization link and inspect its domain. Sign in on that site as the WordPress user whose permissions you want the connection to have, approve the Application Password request, then return to the client. WPVibe connection flow.

Ask for a site summary and compare the URL, site name, active theme and plugin availability with wp-admin. Stop if you expected staging but the summary identifies production. Never put your normal WordPress login password into chat.

Check the site before any write

Adapt this original prompt with your actual authorized test site:

Use WPVibe to inspect https://example.com only.
First list my connected sites and confirm the exact matching address.
Read a site summary and report the authorized WordPress user or role if exposed,
the plugin availability, and the actions the connection can actually perform.
Check my current WPVibe allowance before further site inspection.
Do not create, edit, publish, delete, install, update, change options or run write commands.
Do not read customer records or private content. Stop if the site or permission is unclear.

This prompt limits the requested task; it does not technically turn an administrator credential into a read-only credential. Choose a user with permissions appropriate to the work. WPVibe’s plugin runs under the WordPress user you authorized, and tool results pass through WPVibe to your AI provider. Authorization and data flow.

Keep client tool confirmations and WPVibe’s risky-operation approvals enabled for a first session. They are independent controls. WPVibe also has an administrator-controlled Dangerously bypass approvals setting; do not assume approvals are enforced if it has been enabled. Ordinary writes should not be assumed to pause at every step. Approval controls.

Understand the usage unit

The pricing page lists Free at $0 with 100 tool calls per day, and Pro at $99 billed annually with 500 calls per day. The annual price is a yearly charge, not a monthly $99 bill. Free includes write/publish tools; it is not a read-only trial. Check the current checkout and account before purchasing. WPVibe pricing.

The allowance uses a rolling 24-hour window, shared by the account’s sites. Site reads as well as writes can count. Connecting or listing sites, checking the profile, and loading/saving skills do not count; failed calls do not count. A single conversational request can trigger several successful tool calls. Use the account’s current usage figure, not a midnight-reset assumption. Usage accounting.

WPVibe allowance and the AI client’s message limits are different. Confirm both accounts before paying to resolve a limit. For example, a read → edit → read sequence contains multiple site actions, not one task-sized quota unit.

A draft is a write, too

After the read-only check, decide whether you actually want a write. For a first authorized content task, specify one new draft with a unique title, ask for the proposed content first, and explicitly prohibit publication or unrelated changes. Inspect the returned post ID, draft status and preview in wp-admin. Draft themes and draft posts are different objects; verify the one you requested.

If a response is interrupted, check whether that draft already exists before asking for it again. A client reporting an error does not by itself prove that the site stayed unchanged.

WPVibe is connected but no site appears: check the WPVibe email, exact WordPress installation address and whether the wp-admin approval finished. A site saved under /blog or another account will not be fixed by reconnecting only the AI client.

REST API unreachable or returning HTML: inspect the documented ?rest_route=/ check and the connection report. Coming-soon pages, login gates, redirects or firewall challenges may intercept the request. Ask the host for a narrowly scoped correction; do not disable site security globally.

Application Passwords unavailable: check HTTPS and the site’s Application Password settings. WPVibe documents an Allow for WPVibe control for relevant configurations; verify applicability with the site administrator rather than granting blanket access. Connection-error diagnostics.

One operation is forbidden: identify the actual WordPress user, target and required capability. A valid connection is not unrestricted access. Do not switch to a full administrator merely because a diagnostic or edit is unavailable.

ChatGPT loses WPVibe tools mid-chat: begin a fresh conversation with the plugin attached. The provider documents this separately from a broken site connection; repeatedly calling connect_site will not restore tools the client did not expose. Its published directory plugin also currently omits save_skill, while other connection routes may expose it. ChatGPT-specific troubleshooting.

Daily allowance reached: read the current usage and the time at which allowance becomes available. Wait or choose an appropriate plan; changing sites does not create a new per-site allowance. Rolling usage limits.

An edit failed or timed out: inspect the target object, draft and approval log before retrying. Save the tool name, time, exact error and site address for support. Remove private content and credentials from any shared report.

There are three different access paths to check:

1. AI client → WPVibe: disconnect the client’s plugin or revoke the app session from the WPVibe account. This does not remove the sites stored in WPVibe.
2. WPVibe → WordPress site: remove the exact site from the WPVibe Account page or through the connected assistant. Check for duplicate addresses such as www and apex.
3. WordPress credential: under the authorized user’s Users → Profile → Application Passwords, revoke any remaining WPVibe credential. Check the removal result; not every hosting-managed connection can be revoked automatically.

Deactivating or deleting the WordPress plugin alone does not revoke the Application Password. Core REST access can remain. After removal, verify the site entry and credential rather than assuming a missing plugin means access has ended. WPVibe removal and revocation guide.

Removing access is not an undo operation for posts, theme changes or settings. Review existing changes separately. Keep backups and a record of the objects you approved before a write session.