REST API and MCP Integration

Turn WordPress into an MCP server so Claude and Cursor can create and read articles. REST API too

WordPress becomes an MCP server

With the Pro or Cloud edition installed (including the free trial), this WordPress site works as an MCP server. Just register the URL and API key with an MCP client such as Claude Code, Claude Desktop, or Cursor, and you can ask things like "write an article with the keyword XX" or "read the article you made last week and summarize it." You don't need any extra software or a Node.js wrapper.

There's a single MCP endpoint (using Streamable HTTP; it accepts JSON-RPC over POST).

https://your-site/wp-json/sorabun/v1/mcp

How to register

Claude Code

claude mcp add --transport http sorabun "https://your-site/wp-json/sorabun/v1/mcp" \
  --header "Authorization: Bearer sbk_xxxxxxxxxxxxxxxx"

Cursor / Windsurf / VS Code (for config files that let you specify a URL and headers)

{
  "mcpServers": {
    "sorabun": {
      "url": "https://your-site/wp-json/sorabun/v1/mcp",
      "headers": { "Authorization": "Bearer sbk_xxxxxxxxxxxxxxxx" }
    }
  }
}

Claude Desktop (for clients that can't add headers from the settings screen, go through mcp-remote. Requires Node.js 18 or later)

{
  "mcpServers": {
    "sorabun": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://your-site/wp-json/sorabun/v1/mcp",
               "--header", "Authorization: Bearer sbk_xxxxxxxxxxxxxxxx"]
    }
  }
}

The URL and API key are shown under "Settings > REST API / MCP Integration" in a ready-to-copy form.

If you'd rather not write the API key into a config file, keep it in 1Password and pass it in only at startup (Using 1Password).

You can also ask for article drafts and checks from My Page in your browser, without an MCP client (View and manage sites from My Page (web)).

Which tools are available?

The three tools that create articles let you choose how each article is made. Anything you leave out uses your settings.

The length is a target for the outline, so the finished article won't match it exactly. If you ask for "about 6,000 characters, polite style, no diagrams," the AI turns that into these parameters.

Article generation is asynchronous. The tool returns a job_id right away, and the article takes a few minutes to finish. The server tells the AI to "check get_job every 30 to 60 seconds" and "save as a draft rather than publish unless asked to," so it usually behaves this way without you saying anything.

Reading the security status (security_status)

Turn on "Security status" under "Settings > REST API / MCP Integration," and the AI in your MCP client can read the results of the daily security monitor. Ask "Is there anything on my site I should fix right away?" and it answers with:

• Known vulnerabilities in installed plugins, themes and WordPress (severity, CVE and the fixed version). As the data source (Wordfence Intelligence) requires, the source and its copyright and license notices come with them, and the AI is told to show them too
• Urgent (security fix) updates you haven't applied yet
• WordPress core files that were changed, are missing, or don't belong
• How many login lockouts happened in the last 7 days (it never returns the usernames tried or IP addresses)
• Which hardening options (such as XML-RPC) are on

It only reads. It doesn't run a new scan, change settings, or update anything. You fix things under "Security / Speed" in the admin.

You can also call it as a REST API

With the same API key, you can also trigger article generation from Zapier, Make, or your own scripts.

Authentication

Issue an API key under "Settings > REST API / MCP Integration" and attach it to your request header.

X-Sorabun-Key: sbk_xxxxxxxxxxxxxxxx

Endpoints

The following parameters can be passed in an article generation request.

• keyword (required)
• type: optimization type
• length: character count
• post_status: draft or publish
• custom_prompt: additional instructions
• tone: writing style (desumasu / dearu / casual)
• diagrams: number of diagrams (0 to 5; -1 lets the AI add them only where they help)
• eyecatch: whether to generate a featured image (true / false)

In the REST API, leaving out length lets the AI decide the length from search intent (in MCP, create_article uses the site default instead). Any other parameter you leave out uses your settings.