// AGENT ACCESS
INCLUDED WITH EVERY PLAN

A WORDPRESS MCP SERVER FOR THE WHOLE HOSTING STACK

Move work from prompt to audited action across content, hosting, and growth.

Every Nova plan includes Agent access; learn how an agent can provision and run a WordPress site. See the agent-managed hosting flow →

START WITH NOVA →

Every Nova plan includes Agent access.

// PROTOCOL

WHAT IS A WORDPRESS MCP SERVER?

Model Context Protocol gives supported assistants a structured way to call approved tools. Nova runs an authenticated, stateless Streamable HTTP endpoint at https://mcp.nova.host/mcp. There is no separate MCP plugin to install: Nova's preinstalled platform plugins on every Nova site provide the tenant-side APIs. One account-wide key connects Claude Code CLI, .mcp.json, Codex, and Cursor; claude.ai uses OAuth 2.1.

// WORDPRESS MCP SERVER

YOUR AGENT. YOUR SITE. YOUR ACCOUNT.

Switch on Agent access in your Nova dashboard, grant per-site permissions, and connect Claude Code, Cursor, Codex, or claude.ai to Nova's remote WordPress MCP server. Your agent can then read and edit your content, publish through the link gate, run backups, and read your account. Every capability is a per-site switch that starts off.

Demo: a customer creates an API key, turns on per-site permissions for a sample site, connects their agent with one command, the agent updates the About page in place, then reads the account plan, invoices, and change requests.

WORKS WITH //Claude Code CLI.mcp.jsonCodexCursorclaude.ai
ACCOUNT TOOLS // account summary · sites · usage · invoices · change requests
Explore the WordPress MCP server →

AGENT ACCESS // Included with every Nova plan. All six site capabilities start off.

// OUTCOMES

GIVE YOUR AGENT A REAL JOB

DRAFT & UPDATE

Create drafts, update content and SEO metadata, manage redirects, llms.txt, and CSS, upload media, preview revisions, and trash drafts.

POLICY-CHECKED PUBLISHING

Publish only through Nova's content link gate.

OPERATE THE SITE

Purge cache, capture screenshots, create change requests, and inspect activity.

READ GROWTH SIGNALS

Review keyword rankings, Search Console connection status, Chrome UX, analytics, and form entries with values hidden by default.

PROTECT RECOVERY

List or trigger backups without granting restore authority.

CONFIRM RESTORES

Prepare a restore, then execute only with a five-minute single-use confirmation.

// CAPABILITY MAP

WHAT CAN NOVA'S WORDPRESS MCP SERVER DO?

Capability map // September 2026

CONTENT

  • read
  • draft
  • update
  • SEO metadata
  • redirects
  • llms.txt
  • custom CSS
  • preview
  • revisions
  • media
  • draft trashing
  • policy-checked publishing

SITE DATA

  • keyword rankings
  • Search Console connection status
  • Chrome UX
  • analytics
  • forms
  • entries with values hidden
  • backups
  • activity

OPERATIONS

  • backup triggers
  • cache purge
  • screenshots
  • change requests
  • confirmed restores

Where most WordPress MCP integrations cover posts and pages, Nova's also manages SEO metadata, redirects, llms.txt, custom CSS, backups, confirmed restores, cache, screenshots, and growth data.

// SITE GRANTS

AI AGENT ACCESS FOR WORDPRESS HOSTING, SITE BY SITE

SITE.PERMISSION.CONSOLE

Content read

Read pages, posts, media, previews, and revisions.

OFF

Content write

Create and edit drafts and media.

OFF

Publish

needs Content write

Publish or update live content through Nova's link gate.

OFF

Site data read

View keyword rankings, Search Console connection status, Chrome UX, analytics, forms, backup listings, and activity.

OFF

Operations

Trigger backups, purge cache, capture screenshots, and create change requests.

OFF

Destructive

acknowledge + confirm

Prepare and execute backup restores that overwrite the live site.

OFF

Every capability starts off for every site. Publish turns off with Content write. The dashboard asks you to acknowledge that a restore overwrites the live site before you enable Destructive, and every restore still needs a five-minute single-use confirmation. One account key identifies the account but never bypasses a site grant; OAuth consent never expands site permissions.

// SIGNAL PATH

FROM ACCOUNT TO FIRST AUTHORIZED CALL

STEP 01 // CREATE YOUR ACCOUNT

CREATE YOUR ACCOUNT

Sign up, verify your email, and provision the WordPress site your agent will help run. Already hosted elsewhere? We migrate it for free. Agent access needs a site to attach to, so the site comes first.

ACCOUNT VERIFIED → SITE PROVISIONED

STEP 02 // SWITCH ON AGENT ACCESS

SWITCH ON AGENT ACCESS

Agent access is included with every Nova plan. Open it in your dashboard and turn on only the per-site capabilities you want. All six start off. Publish depends on Content write, and Destructive asks you to acknowledge that restores overwrite the live site.

AGENT ACCESS ENABLED → SITE GRANTS SELECTED

STEP 03 // CONNECT YOUR AGENT

CONNECT YOUR AGENT

Create your API key, copy it from the one-time reveal, and paste one command into Claude Code, Cursor, or Codex. On claude.ai, add Nova as a connector and approve with OAuth. Then make your first call. One key is active per account: Regenerate replaces it, Revoke disconnects key-based agents.

CREDENTIAL SAVED → CONNECTOR ADDED → FIRST CALL AUTHORIZED

// TOOL MANIFEST

33 TOOLS. SIX SITE-BOUND GRANTS.

NOVA.MCP: TOOL MANIFEST33 TOOLS

CONTENT READ // 8

content_listread
content_getread
content_preview_urlread
content_revisions_listread
seo_meta_getread
redirects_listread
llms_txt_getread
custom_css_getread

CONTENT WRITE // 8

content_create_draftwrite
content_update[optimistic concurrency]write
media_uploadwrite
seo_meta_set[optimistic concurrency]write
redirect_upsert[optimistic concurrency]write
redirect_delete[optimistic concurrency]write
llms_txt_set[optimistic concurrency]write
custom_css_set[optimistic concurrency]write

PUBLISH // 1

content_publish[Nova link gate]write

SITE DATA READ // 9

seo_keywords_getread
search_console_get[connection status + properties]read
crux_getread
analytics_getread
forms_listread
form_entries_list[values hidden by default]read
form_entry_get[values hidden by default]read
backups_listread
activity_listread

OPERATIONS // 4

backup_triggerwrite
cache_purgewrite
screenshot_capturewrite
change_request_createwrite

DESTRUCTIVE // 3

backup_restore_prepareread
backup_restore_execute[five-minute single-use confirmation]destructive
content_delete_draft[drafts only]destructive
TOTAL // 23 · ALL GRANTS // OFF BY DEFAULT
// CONNECTORS

CONNECT CLAUDE TO WORDPRESS

https://mcp.nova.host/mcp
claude mcp add --transport http nova https://mcp.nova.host/mcp --header "Authorization: Bearer $NOVA_MCP_API_KEY"

The first four use your account API key. claude.ai uses OAuth 2.1: add the connector, sign in, review the named scopes, approve. One active key per account; Regenerate replaces it, Revoke disconnects key-based agents; revoke OAuth apps under Connected apps.

// CONTROL PLANE

REMOTE MCP SERVER. NO SEPARATE PLUGIN.

REQUEST→CREDENTIAL SCOPE→AGENT ACCESS→ACTIVE PLAN→SITE OWNERSHIP→SITE GRANT→RATE LIMIT→TOOL

TENANT-BOUND DELEGATION

Backends receive one-shot delegation tokens bound to your site.

IDEMPOTENT WRITES

Write calls carry idempotency keys, so retries never double-apply.

APPEND-ONLY AUDIT

Tool calls are written to an append-only audit trail.

CONFIRMED RESTORE

Prepare first; execute only with a five-minute single-use confirmation.

Limits apply per user, site, and operation, with 24-hour caps on screenshots, backups, and restores.

// AVAILABILITY

AGENT ACCESS // EVERY PLAN

Agent access is included with every Nova plan once your site is provisioned.

Start with NovaOpen Agent accessSee hosting options →

Included with every plan.

// DIAGNOSTICS

WORDPRESS MCP SERVER FAQ

PROVISION THE SITE. SWITCH ON AGENT ACCESS. CONNECT YOUR AGENT.

START WITH NOVA →Homepage overview →