Connect Claude, ChatGPT, Codex, Gemini, Cursor and other MCP clients to WordPress through a bridge built around least privilege, human approval and reversibility.
Policy + execution layer
Bridgistic separates what an AI assistant can do from what it is technically capable of asking for.
A generic admin credential can turn a small prompt mistake into a production incident with very little containment.
Mint a dedicated key, narrow its scopes, preview risky actions, require approval, snapshot first and keep an audit trail.
The WordPress wizard generates the connection details; your MCP client handles the rest.
Upload the free WordPress plugin and activate it. Your content and theme are not modified during activation.
Choose your client and a permission preset in AI / MCP Connections. Start Read-only and widen later.
Install the desktop extension or paste the generated config, then call bridgistic_get_site_info to verify.
Local mode keeps the connection between your own machine and WordPress. Bridgistic Cloud exists for remote-only clients such as ChatGPT.
Your MCP server runs on your computer and talks directly to your WordPress site with signed HTTPS requests.
A hosted OAuth relay lets remote-only MCP clients connect without running a local server process.
Bridgistic authenticates each request, checks the key’s scope, applies the safety policy, creates a recovery point and records the result.
Read security modelHMAC-SHA256 signs method, path, timestamp, nonce and body hash. Replay protection rejects reused nonces and stale requests.
Each key carries explicit scopes. A denied action fails before the underlying WordPress operation runs.
Risky operations can dry-run first and wait in the Approvals queue until a human allows them.
Destructive writes can capture the target before mutation, creating a recovery point for rollback.
The action runs with its result attached to the key’s audit trail so changes stay attributable.
From content tasks to admin workflows, Bridgistic gives AI a structured tool surface without giving up operational control.
Choose a permission preset or individual scopes. Rotate, revoke or delete keys from WordPress at any time.
Least privilege by designTrack the key, action, status, source IP and time for operations while keeping secrets out of logs.
Attributable activityCapture pre-change state around destructive writes and restore snapshots when a change needs to be reversed.
Recovery built inLocal clients can use a shared connections registry and target WordPress sites by alias from the same MCP server.
Agency-friendly foundationSave repeatable routines and run supported playbooks from WordPress or through the MCP tool surface.
Repeatable automationStructured WooCommerce operations sit behind the same authentication, scopes, guard parameters and audit controls.
Commerce-aware MCPDatabase, filesystem and PHP execution require Developer Mode scopes; PHP writes are confined to a protected sandbox.
High-risk tools gatedBuilt-in checks help identify REST, permalink, signing, hosting and configuration problems before they become mysteries.
Faster troubleshootingGenerate ready-to-use configs and setup packages from WordPress instead of hand-building connection files from scratch.
Less setup frictionBridgistic speaks MCP, so the security model stays on the WordPress side while the AI client can change.
Use the one-click .mcpb extension. Claude Desktop prompts for the site URL, key ID and secret and stores the secret in its own extension storage.
# 1. Create a Read-only key in WordPress Bridgistic → AI / MCP Connections # 2. Download the desktop extension bridgistic.mcpb # 3. Double-click it and paste: WordPress Site URL https://example.com Key ID wpk_... Key Secret wps_... # 4. Verify in Claude run bridgistic_get_site_info
Install Bridgistic from the Claude Code plugin marketplace, then provide your site connection through environment variables.
/plugin marketplace add wordpressistic/bridgistic /plugin install bridgistic@bridgistic-marketplace export BRIDGISTIC_SITE_URL="https://example.com" export BRIDGISTIC_KEY_ID="wpk_..." export BRIDGISTIC_KEY_SECRET="wps_..." # Verify run bridgistic_get_site_info
Run the published MCP server through npx and configure it in Codex using the mcp_servers section.
[mcp_servers.bridgistic] command = "npx" args = ["-y", "bridgistic-mcp-server"] env = { BRIDGISTIC_SITE_URL = "https://example.com", BRIDGISTIC_KEY_ID = "wpk_...", BRIDGISTIC_KEY_SECRET = "wps_..." }
Gemini CLI can launch Bridgistic locally through npx. The consumer Gemini web/mobile app is a different connector model.
{
"mcpServers": {
"bridgistic": {
"command": "npx",
"args": ["-y", "bridgistic-mcp-server"],
"env": { "BRIDGISTIC_SITE_URL": "https://example.com" }
}
}
}
ChatGPT uses a remote MCP connector over HTTPS, so it connects through Bridgistic Cloud rather than launching the local server.
# In ChatGPT Settings → Connectors → Advanced settings → Enable Developer mode → Create connector → Paste the Bridgistic Cloud MCP URL shown in WP Admin → Approve the WordPress consent screen # Verify run bridgistic_get_site_info # Note Bridgistic Cloud is currently a public beta.
The repository’s automated checks cover the MCP server, shipped bundle, WordPress behavior, cloud connector and real plugin activation in WordPress CI.
Independent integration checks verify signatures and signed round trips instead of testing only helper functions.
The bundled server and plugin ZIP are validated separately from source builds to catch packaging drift.
The built plugin ZIP is installed and activated in real WordPress via WP-CLI in automated checks.
Live cloud end-to-end, load/abuse testing and independent security review remain explicitly tracked.
The open-source plugin is not a demo. Paid SaaS layers on team, agency and advanced automation capabilities.
For developers and site owners who want controlled AI access to their own WordPress sites.
For agencies and teams that need centralized operations, advanced skills and managed automation across sites.
connections.json registry and site aliases. The WordPress Multi-Site screen helps build the file. The hosted cloud connector uses a separate connector entry per site.Install the free plugin, mint a Read-only key, connect your MCP client and verify the bridge before granting write access.