GET MCP Client Config Snippet​
Generate a copy-paste configuration snippet for a specific MCP client.
Every client authenticates with WordPress Application Passwords. The snippet contains placeholders, never real credentials — <base64(your-username:application-password)>, <your-username>, and <your-application-password> — which the Settings screen swaps for the values the user types in. Nothing secret is ever returned by this endpoint.
Supported client values:
| Value | Output |
|---|---|
claude-code |
A claude mcp add command over HTTP transport. The default — an unrecognised value also lands here. |
claude-desktop |
JSON for claude_desktop_config.json. Claude Desktop cannot speak HTTP MCP directly, so this routes through the @automattic/mcp-wordpress-remote npx proxy. |
cursor |
JSON for Cursor's native HTTP MCP support. |
codex |
Step-by-step instructions for OpenAI Codex's custom-MCP screen. |
generic |
Raw URL, auth header, and a ready-to-run curl test. |
For claude-desktop on a local install, NODE_TLS_REJECT_UNAUTHORIZED=0 is added to the snippet so the npx proxy tolerates a self-signed Valet/MAMP/Local certificate. That is decided by local_dev when supplied, and by auto-detection otherwise.
Required capability: fcrm_manage_settings
Enforced by SettingsPolicy::verifyRequest(), the policy default for this route group.
Authorizations​
WordPress Application Passwords — use Basic auth with your WordPress username and an application password in the format: username:application_password
Parameters​
Query Parameters
Target MCP client. Unrecognised values fall back to claude-code.
"claude-code""claude-desktop""cursor""codex""generic""claude-code"Override local-development detection. yes/1/true force it on, no/0/false force it off, and omitting it uses auto-detection.
"yes""no""1""0""true""false"Responses​
The generated snippet and its instructions.