There is a specific moment the first time an assistant reads your live site back to you, correctly, without you pasting anything. Then you remember it can also write.
The Model Context Protocol is a single standard that lets an AI assistant talk to your tools, replacing a custom integration per tool with one shared interface. It went from a rounding error to universal in about sixteen months and every major vendor now supports it. On WordPress it is excellent at reading: audits, inventories, bulk metadata, and drafting straight into the CMS. It is poor at anything visual, and page-builder markup will bury it. Treat the connection as credentials with a wide blast radius, not as a convenience, and start read-only.
What This Protocol Actually Solves
Before any of this existed, connecting an assistant to a tool meant building that connection yourself, one at a time. Ten tools and three assistants meant thirty separate integrations, each with its own authentication, its own quirks, and its own maintenance burden when either end shipped an update.
The Model Context Protocol collapses that. Anthropic released it in November 2024 as an open standard: the tool exposes a server, the assistant acts as a client, and any client can talk to any server. Build the connector once and every compatible assistant can use it.
The nearest comparison is what USB did for peripherals, and that analogy gets used so often it has worn smooth, but it is accurate. The value was never the cleverness of the protocol. It was everyone agreeing to the same shape.
Why It Suddenly Matters
The adoption curve here is genuinely unusual, and worth knowing even if you never wire one up yourself.
Monthly SDK downloads went from about 100,000 at launch to 97 million by March 2026, a rise of roughly 970 times. For scale, that put the standard at a comparable download volume to React inside sixteen months, where React itself took three years to get there. The TypeScript and Python packages have each since crossed a billion downloads in total.
More telling than the raw numbers is who signed on. OpenAI, Google, Microsoft and Salesforce all shipped support within thirteen months of launch, which is close to unheard of for a specification introduced by a direct competitor. Stewardship has since moved to the Agentic AI Foundation under the Linux Foundation, giving it a neutral home rather than a vendor owner, and the official registry now lists close to 10,000 servers.
A format proposed by one company, adopted by its rivals, then handed to a foundation is roughly the cleanest signal available that something has stopped being a product decision and started being infrastructure.
What It Looks Like on a WordPress Site
Concretely: a server sits inside your WordPress install and exposes a set of tools. An assistant connects as a client, and when you ask for something in plain language it selects a tool and makes the corresponding REST API call. Nothing mystical is happening. It is your existing API with a menu attached and a translator in front.
We run this through AI Engine by Meow Apps, which has a server built in alongside its chatbot and image features. Two other options worth knowing if you go looking: WPVibe, which is purpose-built for exactly this and nothing else, and AtlasAI Connector, which ships a wider ability set including WooCommerce.
The tool surface is broader than most people expect on first contact. Reads cover posts, pages, custom post types, post meta, taxonomies and terms, media, users, plugins, and individual option values. Writes cover creating and updating posts, altering content, uploading and attaching media, managing terms and comments, and changing options.
That last list is worth reading twice. Managing options means an assistant with write access can change site settings.
Live on reads for a week before you enable a single write. You will learn what the assistant is genuinely good at, you will find out how your content is actually structured underneath the editor, and you will discover which requests it misreads while the worst possible outcome is still a wrong answer rather than a wrong edit.
What It Is Genuinely Good At
The wins are less glamorous than the demos and considerably more useful.
Answering “what do I actually have.” Ask which posts are missing a meta description, which categories have nothing in them, which drafts never shipped, or which pages have not been touched since 2024, and you get an answer in seconds rather than forty minutes of clicking through admin screens. On a site that has accumulated a few years of content, the first audit is usually mildly embarrassing.
Bulk metadata and taxonomy work. Tagging, recategorizing, filling in missing SEO fields, cleaning up the near-duplicate tags that every WordPress site grows over time. This is the work everyone postpones because it is dull, and dull-but-structured is precisely where this shines.
Drafting into the content management system instead of beside it. The old loop was write somewhere else, paste in, reformat, fix what broke. A draft created directly through the API arrives with its categories, tags and meta fields already attached.
Reading the shape of a site fast. Post types, taxonomies, term counts, the plugin list. Fifteen minutes of questions gives you a clearer picture of an unfamiliar install than an afternoon in the dashboard.
What It Is Bad At
Page-builder markup. This is the big one and nobody warns you. A single page built with a visual builder is mostly shortcode attributes, not content. Reading one page of ours returned just over 203,000 characters, and the overwhelming majority of that was styling parameters wrapped around a few hundred words of actual prose. Two or three of those and an assistant has spent its entire working memory on padding values. Most servers offer a prose mode that strips the attribute noise, and on a builder site that is not a nicety, it is the only way the thing is usable.
Anything visual. The assistant cannot see your site. It can confirm the content saved correctly and be completely unaware that the layout now collapses on mobile. Every write still needs a human to look at the rendered page.
The moving parts underneath. Caching, cron, and CDN behavior are mostly invisible through this interface. A change can be live in the database and stale on the page for another twenty minutes, which produces some genuinely confusing debugging if you have forgotten your own cache layer exists.
Reach For It, or Don’t
| Task | Use | Because |
|---|---|---|
| Auditing content across a whole site | The protocol | Structured queries over hundreds of items, answered in seconds |
| Bulk tags, categories, SEO fields | The protocol | Repetitive, structured, and no visual outcome to verify |
| Building or restyling a page layout | The editor | It is a visual task and the assistant has no eyes |
| Drafting a post with its metadata | Both | Draft through the API, then always review the rendered page |
| Changing site options or settings | The dashboard | Small blast radius in theory, very large one in practice |
The Security Part Nobody Enjoys
This needs saying plainly, because the convenience is seductive and the risk is not obvious.
A connection with write access is, functionally, an application password that an AI assistant can use on your behalf. The industry knows this. In surveys from late 2025, half of the people building on the standard named security and access control as their single biggest challenge, and 38% said security concerns were actively holding back wider adoption.
The specification has been moving to address it. The revision published on 28 July 2026 introduced incremental scope consent, so a client requests the minimum access needed for a given operation instead of asking for everything at connection time, and it reaffirmed that a human must remain able to deny any tool invocation. Tools can now carry risk annotations so destructive or irreversible operations can be gated behind explicit approval.
The live risk to understand is prompt injection. If an assistant reads untrusted content, and comment threads, contact form submissions and syndicated feeds all qualify, then instructions hidden in that content can attempt to steer what it does next. An assistant that can only read will produce a wrong answer. One that can write may take an action. That asymmetry is the entire argument for keeping write access narrow and approvals manual.
What We Got Wrong
Honest pass, as always.
We connected several sites at once. With three installs available in the same session, “publish that draft” is an ambiguous instruction, and the assistant has no way to know which site you meant. Naming the target site out loud before every single write became a hard rule here, and it became one the way most rules do, which is not through foresight.
We underestimated what a builder page costs. Two full page reads can consume more working memory than an entire afternoon of ordinary conversation. We spent a while wondering why the assistant kept losing the thread before realizing we had handed it a quarter of a million characters of padding attributes and asked it to remember anything else.
We thought of it as a feature rather than as access. It arrives feeling like a plugin, so it gets evaluated like one. It is closer to handing out a key. Nothing went wrong, but the correct time to think that through is before you connect it, and we did it afterward.
It Removes a Tax, It Does Not Remove You
The honest summary is that this is not automation. Nothing here runs while you sleep, and nothing here makes a decision you were not going to make anyway.
What it removes is the click tax. The forty minutes of navigating admin screens to answer a question you could state in one sentence. The copy, paste, reformat loop. The tagging job you have rescheduled four times.
That is a smaller promise than the demos make, and it is worth considerably more, because it is the part that actually holds up on a Tuesday. Same as it ever was: the boring version is the one still running.
- One standard replaced a connector per tool. Build it once, and every compatible assistant can use it.
- Adoption was extraordinarily fast. Roughly 970 times growth in sixteen months, with every major vendor shipping support.
- Reading is where the value is. Audits, inventories and bulk metadata beat anything glamorous.
- Page-builder markup will bury it. One of our pages is over 203,000 characters. Use prose mode or drown.
- It cannot see your site. Every write still needs human eyes on the rendered page.
- Name the target before every write. Multiple connected sites make instructions ambiguous in a way that is easy to miss.
- Treat it as credentials, not a convenience. Start read-only, keep approvals manual, and assume untrusted content is hostile.
⊕ Read more AI inspired posts on our AI Blog
⊕ Check out the latest AI News
About the Author: Gavin Stacey
