How to Connect Cursor to WordPress (2026): Link, mcp.json

By Ira Bodnar, Ryze AI · Updated November 13, 2026

Quick answer

To connect Cursor to WordPress, connect your site in Ryze AI with an application password (self-hosted) or WordPress.com sign-in, then add https://connector.get-ryze.ai/mcp to Cursor with the Add to Cursor link or a url entry in mcp.json, and sign in when Cursor asks.

In WordPress admin create an application password under Users, Profile
In Ryze AI open Integrations, click Connect on WordPress and enter the site URL, username and password
In Cursor add the Ryze AI server (Add to Cursor link or mcp.json) and finish the sign-in
Start a new Cursor chat, approve the tool call and ask about your posts and pages

Before you start

A Cursor install. Cursor's MCP documentation names no plan for using MCP servers. On Enterprise, admins can control which MCP servers users may run in Team Settings > MCP Configuration, so a blocked server needs an admin to allow it.
WordPress access. Self-hosted: a user who can create an application password, on a site served over HTTPS (WordPress offers the feature by default only there, and an administrator can turn it off). WordPress.com or Jetpack: a WordPress.com account that reaches the site, plus the Jetpack JSON API module for Jetpack sites. Installing plugins, the SEO bridges and head code require an administrator.
A Ryze AI workspace on a plan or free trial. SEO Starter is $129 per month with a 3-day free trial. Connecting the Ryze AI connector is free, but the WordPress tools need any active Ryze AI plan or trial.

How to connect Cursor to WordPress

The first two steps are done in WordPress and Ryze AI, the next two in Cursor, and the last is your first question. Every user adds the same connector URL.

Create an application password in WordPress
For a self-hosted site, sign in to wp-admin and go to Users, then Profile. Under Application Passwords enter a label such as Ryze AI for Cursor and press Add New Application Password. WordPress shows the password one time, so copy it before leaving the page. A WordPress.com or Jetpack site skips this step.
Connect WordPress in Ryze AI
Sign in to Ryze AI (or create an account), open Integrations and click Connect on the WordPress card. Self-hosted site tab: fill in the Site URL, your wp-admin username and the application password, then click Continue. WordPress.com / Jetpack tab: sign in on WordPress.com, approve access and pick the site. If you like, click View on the card afterwards to set the Author and Category that new posts use, then Save.
Add the Ryze AI server to Cursor
Click Add to Cursor on this page or on the Ryze AI developers page. It opens a cursor:// install link that adds a server called ryze pointing at https://connector.get-ryze.ai/mcp. If you would rather edit a file, create ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project) with the url entry below.
{ "mcpServers": { "ryze": { "url": "https://connector.get-ryze.ai/mcp" } } }
Sign in from Cursor
Accept the install prompt in Cursor. The sign-in is OAuth with PKCE and dynamic client registration, so you never enter a client ID or secret. On the Ryze AI page, sign in and press Allow connection. The Customize page in the sidebar lets you toggle the server later.
Ask your first question in Cursor
Open a fresh Cursor chat, approve the tool call when it appears, and ask: List my 10 most recent WordPress posts with title, status and publish date.

The Ryze AI help center article for WordPress covers the WordPress side of the connection. Ryze AI has no help page for Cursor; the Ryze AI developers page carries the Add to Cursor link and the same config.

Sources: Cursor MCP documentation, application passwords guide, Ryze AI WordPress guide. Checked November 13, 2026.

mcp.json, API key and Cloud Agents

mcp.json

Put this in ~/.cursor/mcp.json to use it in every project, or in .cursor/mcp.json inside a single project. A remote server needs only the url field, and Cursor runs the OAuth sign-in on its own.

{
  "mcpServers": {
    "ryze": {
      "url": "https://connector.get-ryze.ai/mcp"
    }
  }
}

Cursor can talk to stdio, SSE and Streamable HTTP servers. When a server needs OAuth, Cursor reads its protected resource metadata (RFC 9728) and registers itself as a public client by dynamic client registration. Afterwards the Customize page in the sidebar lets you toggle or manage the entry.

mcp.json with a Ryze AI API key

To skip the browser sign-in, add a headers entry and export RYZE_API_KEY with the rk_live_ key from Workspace Settings > Profile > API keys in Ryze AI. That key belongs to Ryze AI and has nothing to do with the WordPress application password. Commit neither one.

{
  "mcpServers": {
    "ryze": {
      "url": "https://connector.get-ryze.ai/mcp",
      "headers": {
        "Authorization": "Bearer ${env:RYZE_API_KEY}"
      }
    }
  }
}

Cloud Agents

A Cloud Agent has its own MCP sign-ins, stored on Cursor's servers, so your desktop sign-in does not carry over. To let a Cloud Agent edit WordPress, connect the Ryze AI server for it too.

Claude and ChatGPT

Other MCP clients take the same URL, and the WordPress connection stays where it is in Ryze AI.

Claude

Add https://connector.get-ryze.ai/mcp as a custom connector under Customize > Connectors, pick the workspace and start a new chat. If the connector was added before WordPress was connected, remove and re-add it, then start a new chat. The full steps are in the Claude to WordPress guide.

ChatGPT

Add the same URL as an app under Settings > Apps, pick the workspace and start a new chat. Re-add the app if WordPress was connected in Ryze AI afterwards, so the tool list refreshes. See the ChatGPT to WordPress guide for plan requirements.

WordPress access and permissions

WordPress never talks to Cursor directly. Ryze AI holds the WordPress credential, and Cursor signs in to Ryze AI with OAuth. Four things decide what Cursor can change.

The WordPress user behind the credential: An application password acts as the user who created it. If that user cannot delete posts in wp-admin, Cursor cannot delete them either. Plugin installs, the SEO bridges and head code need an administrator.
Application passwords: The feature arrived in WordPress 5.6 and is on by default for HTTPS sites. Administrators can disable it site-wide or limit it by role. Each password can be revoked from the user's profile, and a Last Used column shows which ones are idle.
Self-hosted or WordPress.com: A self-hosted connection reaches every REST route the site exposes. A WordPress.com connection reaches only the core /wp/v2 routes, with no plugin installs, SEO bridges or head code.
What Cursor asks first: Out of the box Cursor asks before it uses an MCP tool, under the same Run Modes as terminal commands. A post edit or delete therefore waits for you, unless you allowlist the tool.

What WordPress allows

WordPress has no scope list for application passwords. A password acts as the user who created it, so the table shows what each job needs from that user and from the site.

Action in Ryze AI	WordPress access
Read posts, pages, media, categories, tags and plugins	A user that can view them; works on self-hosted and WordPress.com connections
Create or update a post or page	A user with permission to publish or edit that content in wp-admin
Delete a post	A user with delete permission in wp-admin
Install a plugin or add head code	An administrator on a self-hosted site (activate_plugins capability)
Write Yoast or Rank Math fields	An administrator, a self-hosted site and the one-time bridge

Removing access

Revoke the application password in WordPress (Users, Profile, Application Passwords) to cut the credential. Click View on the WordPress card in Ryze AI to manage or remove the site. In Cursor, toggle ryze off under Customize or delete its mcp.json entry.

What Cursor can do in WordPress

The Ryze AI connector exposes nine WordPress tools. Each runs against the connected site, and the plugin install, bridge and head-code tools need an administrator user on a self-hosted site.

Tool	Type	What it does
wordpress__read	Read	GET requests against the site's REST API. Use it to look at posts, pages, media, categories, tags, users, plugins and custom post types.
wordpress__search_content	Read	Looks inside one text field, such as the raw body of a post, and returns each matching line with its line number and nearby context.
wordpress__write	Write	POST, PUT or PATCH requests: create a new post, change a page, or update another resource the REST API exposes.
wordpress__edit_content	Write	Find-and-replace inside a field such as content, excerpt or title, saved back without sending the entire text again.
wordpress__delete	Delete	DELETE requests, for instance removing a post.
wordpress__installPlugin	Write	Installs and activates a wordpress.org directory plugin on a self-hosted connection.
wordpress__enableYoastRestBridge	Write	Self-hosted only, run once per site. Opens the Yoast SEO title, meta description, focus keyword, canonical and noindex fields to REST API writes using a Code Snippets plugin snippet.
wordpress__enableRankMathRestBridge	Write	Self-hosted only, run once per site. Opens the Rank Math title, description, canonical URL and focus keyword fields to REST API writes using a Code Snippets plugin snippet.
wordpress__addHeadCode	Write	Places an HTML block in the head of every page on a self-hosted site, for tracking snippets, pixels or verification tags.

The tools work only while the Ryze AI workspace has an active plan or free trial. On WordPress.com connections only the core /wp/v2 REST routes are reachable, and only wordpress.org directory plugins can be installed, not zip files or URLs.

Cursor asks before it runs an MCP tool by default. Leave it on if you want to see every write and delete before it runs. The Ryze AI app chat works differently: its Tool approvals picker starts on Skip all approvals, so WordPress tools run there without a prompt until you pick Approve write & delete or Manual approve. Scheduled tasks never pause for approval. The Yoast bridge, Rank Math bridge and head-code tools need your explicit yes in chat before the Code Snippets plugin is installed, and plugin installs can crash a WordPress site.

First 3 prompts to run

1. Review recent posts and drafts

List my 10 most recent WordPress posts with title, status, publish date and category, then show which of them are still drafts.

Tools used: wordpress__read on posts

What comes back: A table of posts from your site with the fields you asked for, and a separate list of drafts, shown in the Cursor chat. Nothing on the site is changed.

2. Fix a phrase in one post

Search the post about our pricing for the old plan name, show me the matching lines, then replace it with the new name in that post only.

Tools used: wordpress__search_content, wordpress__edit_content

What comes back: The matching lines with line numbers and context, then a targeted edit written back without resending the whole post. Cursor asks for approval before the edit runs.

3. Create a draft page

Create a draft WordPress page called Contact with a short intro paragraph and our support email address. Do not publish it.

Tools used: wordpress__write

What comes back: A new page created through the REST API with the status you asked for, which you can open in wp-admin to review.

Each answer comes from your own site, so this page describes what comes back instead of showing sample output. Cursor uses the primary site unless you name another one. On a self-hosted site with Yoast SEO or Rank Math, you can also ask Cursor to enable the one-time bridge and then update SEO titles and meta descriptions.

Ryze AI vs WordPress's own MCP options

WordPress has an official hosted MCP server for WordPress.com, listed with a Cursor Marketplace plugin, and an official MCP Adapter plugin. Both differ from the Ryze AI connector in who sets them up and which sites they cover.

Option	Setup	WordPress coverage	Auth and limits
Ryze AI connector	Application password or WordPress.com sign-in inside Ryze AI, then one URL in Cursor (Add to Cursor link or mcp.json). OAuth with PKCE for the Ryze AI sign-in	Self-hosted, WordPress.com and Jetpack sites. 9 tools: read, write and delete content, search and targeted edits, plus plugin installs, Yoast and Rank Math bridges and head code on self-hosted sites	Application password user rights, or the WordPress.com account; multiple sites per workspace
WordPress.com MCP server (https://public-api.wordpress.com/wpcom/v2/mcp/v1)	In Cursor run /add-plugin wordpress-com to install the WordPress.com plugin from the Cursor Marketplace, or add the URL to a client. The first call opens OAuth 2.1 in your browser	WordPress.com paid plans, WordPress.com free sites through November 30, 2026, and Jetpack-connected self-hosted sites on Jetpack AI or Complete plans	OAuth 2.1 with PKCE and dynamic client registration; choose Full access or Read only; no rate limits stated in the docs
WordPress MCP Adapter (official plugin)	A developer installs the plugin on the site; clients reach the default server at /wp-json/mcp/mcp-adapter-default-server or over STDIO through WP-CLI	Abilities that developers register through the Abilities API and mark public; abilities are private by default	Per-server authentication and per-ability permission checks

If your site is on WordPress.com, its own server is the shorter path and offers a Read only access level. If it is a self-hosted site and you want Cursor to edit posts and manage Yoast or Rank Math fields without writing plugin code, the Ryze AI connector covers that. The MCP Adapter fits teams that want to define exactly which abilities are exposed. See the WordPress MCP page for the full tool reference.

Sources: WordPress.com MCP server docs, WordPress MCP Adapter on GitHub, Cursor MCP documentation, application passwords guide, Ryze AI WordPress guide. Checked November 13, 2026.

Cursor and WordPress errors and fixes

Ryze AI says the credentials are wrong: Use the same username you type at wp-admin, a Site URL that starts with https://, and the application password exactly as WordPress displayed it. A lost password cannot be viewed again, so create a new one.
Users, Profile has no Application Passwords area: By default WordPress offers the feature only on HTTPS sites, and an administrator can disable it for the whole site or for some roles. Ask whoever manages the site to turn it on.
Connecting stops at a firewall or security message: A security plugin, web application firewall or host rule that blocks /wp-json requests prevents the connection. Allowlist those requests and connect again.
A Jetpack site will not connect: Enable the Jetpack JSON API module on the site, then sign in with WordPress.com again.
Cursor lists no WordPress tools: Cursor reads the tool list when the server is added. If WordPress was connected in Ryze AI later, delete the ryze entry, add it again and open a new chat.
Cursor never opens the sign-in: Go to Customize in the sidebar, find the ryze server and reconnect it. Cursor discovers the connector's protected resource metadata and registers itself, so there is no client ID to paste.
The plugin, bridge or head code tools refuse: They need a self-hosted connection and an administrator user. On WordPress.com connections, change those settings in wp-admin.
Yoast or Rank Math values are ignored: WordPress silently drops those fields when they are sent through the plain REST API. Run the Yoast or Rank Math bridge first, on a self-hosted site.
A Cloud Agent has no WordPress access: Cloud Agents keep their own MCP sign-ins on Cursor's servers. Connect the Ryze AI server for the agent on its own, apart from your desktop sign-in.
Your team's Cursor blocks the server: Enterprise admins can allowlist which servers and tools the team may run. Ask an admin to allow the Ryze AI server in Team Settings > MCP Configuration.
A tool reply mentions a subscription: The WordPress tools need an active Ryze AI plan or free trial. Start the trial and retry.

Frequently asked questions

How do I connect Cursor to WordPress?

Connect your site in Ryze AI under Integrations with an application password (self-hosted) or WordPress.com sign-in, then add https://connector.get-ryze.ai/mcp to Cursor with the Add to Cursor link or a url entry in mcp.json. Sign in when Cursor asks.

Is there a WordPress MCP server for Cursor?

Yes. WordPress.com runs a server at https://public-api.wordpress.com/wpcom/v2/mcp/v1 with a Cursor Marketplace plugin, installed with /add-plugin wordpress-com. WordPress also publishes the MCP Adapter plugin for self-hosted sites. The Ryze AI connector at https://connector.get-ryze.ai/mcp exposes 9 WordPress tools.

Which should I use, Ryze AI or the WordPress.com server?

Ryze AI is the best way to edit a self-hosted WordPress site and its Yoast or Rank Math fields from Cursor, though a site on WordPress.com can use the WordPress.com server directly and it offers a Read only access level.

Do I need a WordPress.com site or will self-hosted work?

Both work in Ryze AI. A self-hosted site connects with its URL, an admin username and an application password. A WordPress.com or Jetpack site connects with WordPress.com sign-in, and for Jetpack the JSON API module must be enabled.

Which Cursor plan do I need?

Cursor's MCP page does not name a plan. Enterprise admins can decide which MCP servers people may run, under Team Settings > MCP Configuration.

Can Cursor edit or delete WordPress content?

Yes. Through Ryze AI it can create, update and delete posts, pages, media, categories, tags and custom post types, and make targeted text edits, within the rights of the WordPress user behind the credential.

Does Cursor ask before changing a post?

Normally yes: Cursor requests approval for MCP tools, under the same Run Modes as terminal commands. Allowlisting a tool removes the prompt for it.

Can Cursor change Yoast SEO or Rank Math fields?

On self-hosted sites, yes, after a one-time bridge for Yoast or Rank Math that needs your explicit yes in chat. On WordPress.com connections the bridges do not work, so those fields are edited in wp-admin.

Can I connect more than one WordPress site?

Yes. Click View on the WordPress card in Ryze AI and choose Add one more account. The agent uses the primary site unless you name another one. How several sites interact with the one-website rule of an SEO plan is not documented, so ask Ryze AI support before relying on it.

Can I use a Ryze AI API key instead of the browser sign-in?

Yes. Give the entry a headers field with Authorization set to Bearer and your rk_live_ key (Workspace Settings > Profile > API keys), read from an environment variable like RYZE_API_KEY.

How much does it cost to connect Cursor to WordPress?

The connector is free to add. The WordPress tools need an active Ryze AI plan or free trial: SEO Starter is $129 per month with a 3-day free trial, and annual billing is 30% off the first year.

How do I disconnect WordPress from Cursor?

In Cursor, switch the ryze server off under Customize or delete its mcp.json entry. To cut WordPress access, revoke the application password under Users, Profile and manage the site on its Ryze AI card.