A WordPress MCP plugin has one job on the site: be the hands. It does not open a chat in wp-admin. It does not store your Claude key. You install it like any plugin, paste a pairing code from the account, and leave it running.
Pairing, not an application password
The companion receives a one-time code. After that, heartbeats keep the inventory fresh — core, PHP, plugins, last seen. If the plugin is off, the site disappears from the fleet view. That is the signal, not a surprise on Friday.
What it will execute
Only what you confirmed in the dashboard: block an IP, update a plugin, flush cache, close comments. MCP never triggers those calls. If you did not click confirm, the plugin does nothing.
One plugin per site, not a must-use stack
You do not install a different MCP stack per host. Same companion on every WordPress. The difference between sites is the account they are paired to, not twenty forks of a server.
