Connect via MCP JSON Config

Step 2

Generate an Application Password

Click Generate password in the wizard. This creates a standard WordPress Application Password — not your login password — scoped to this connection and revocable at any time from your user profile. It becomes the value of WP_API_PASSWORD.

The password is shown once, at creation. Copy it whole, including the spaces — WordPress accepts them, and JSON has no problem with spaces inside a string. If you lose it, generate a new one rather than trying to recover it.

Step 3

Read every field in the object

This is the whole thing. The outer key is the client’s own (mcpServers here); everything inside it is identical across every client:

{
  "mcpServers": {
    "your-site-mcp-adapter-default-server": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://example.com/wp-json/acrossai/mcp",
        "WP_API_USERNAME": "your-wp-username",
        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

The server key — your-site-mcp-adapter-default-server — is just a label. Quick Connect builds it as <site-slug>-<last-url-segment> so that several sites, or several servers on one site, never collide in the same file. It is the name your client shows in its UI, so make it recognisable. Keep it to letters, digits and hyphens: some clients reject spaces and dots.

command is the executable your client launches — npx, which ships with Node.js. The client runs it as a child process and speaks MCP to it over stdio; the bridge then speaks HTTP to your site. Nothing listens on a port on your machine.

args is an array, one element per argument — never a single string with spaces in it. -y tells npx to install the package without prompting, which matters because nothing is attached to a terminal to answer the prompt. @automattic/mcp-wordpress-remote@latest is the bridge package; @latest re-resolves on each launch, so pin a version here if you would rather control upgrades yourself.

env is a flat map of environment variables handed to that child process. Three are required:

• WP_API_URL — the full URL of your MCP server route, not your homepage. The default is https://example.com/wp-json/acrossai/mcp. No trailing slash. If you created additional servers in MCP Manager, each has its own final segment and its own entry here.
• WP_API_USERNAME — the WordPress username the connection acts as. Not the display name and not the email address. Every ability runs that user’s capability checks, so this field decides what the AI is allowed to do.
• WP_API_PASSWORD — the Application Password from step 2, spaces and all. Never your login password.

There is one optional fourth variable. On a local development site with a self-signed certificate, Node rejects the TLS handshake and the server never starts. Add "NODE_TLS_REJECT_UNAUTHORIZED": "0" to env for that entry only:

"env": {
  "WP_API_URL": "https://mysite.local/wp-json/acrossai/mcp",
  "WP_API_USERNAME": "your-wp-username",
  "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx",
  "NODE_TLS_REJECT_UNAUTHORIZED": "0"
}

Note the value is the string "0", not the number 0 — environment variables are strings. Never set it on an entry pointing at a production site; it disables certificate verification for that process.

Step 4

Paste it under your client’s top-level key and restart

Open your client’s config file, find its top-level key — use the table below — and add the server entry inside it, alongside any MCP servers already there. Do not replace the file. Then restart the client completely: MCP clients read this file at startup and receive their tool list once, at connection time.

Ask something harmless to confirm it is live — “Which plugins on this site need updating?” is a good first test.