Back to Browse

Shilpi MCP Server

Developer ToolsLow Risk9.9MCP RegistryRemote
Free

Server data from the Official MCP Registry

Edit a WordPress site through scoped abilities: pages, templates, design system, SEO, shop.

About

Edit a WordPress site through scoped abilities: pages, templates, design system, SEO, shop.

Remote endpoints: streamable-http: https://{site_domain}/wp-json/mcp/shilpi-oauth

Security Report

9.9
Low Risk9.9Low Risk

Valid MCP server (1 strong, 1 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry. 1 finding(s) downgraded by scanner intelligence.

Endpoint verified · Open access · 1 issue found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

How to Connect

Remote Plugin

No local installation needed. Your AI client connects to the remote endpoint directly.

Add this to your MCP configuration to connect:

{
  "mcpServers": {
    "com-shilpibuilder-shilpi": {
      "url": "https://{site_domain}/wp-json/mcp/shilpi-oauth"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

Shilpi MCP server

Listed on mcpservers.org

Connect Claude, ChatGPT or any MCP-capable agent to a WordPress site running the Shilpi theme, and let it build and edit that site through scoped abilities rather than server access.

This repository holds the public interface: the registry manifest, the tool list, the authentication guide and example client configurations. The server itself ships inside the Shilpi theme and runs on your own WordPress install, so there is no service to sign up for and no third party sits between the agent and your site.

Why this exists

Most WordPress page builders store a layout in their own format. An agent asked to edit such a page has to learn a proprietary widget tree, guess at its invariants and hope the vendor does not change them.

Shilpi stores a page as three plain fields: body HTML, a real stylesheet, and focused JavaScript. An agent editing a Shilpi page is editing markup it already understands. What it needs from the site is not raw access but vocabulary: which global classes exist, which design variables are defined, and what the house rules are. That is what these tools provide.

Endpoints

The server runs on your own site. Replace example.com with your domain.

PurposeURL
Streamable HTTP, OAuthhttps://example.com/wp-json/mcp/shilpi-oauth
Streamable HTTP, application passwordhttps://example.com/wp-json/shilpi/v1/mcp
OAuth protected-resource metadatahttps://example.com/wp-json/shilpi/v1/oauth/protected-resource
Site summary for agentshttps://example.com/llms.txt

Both endpoints require an active licence. Without one they return 404, and no credential will authenticate. Switching the server off in Shilpi → Dashboard → Connect an AI agent removes both endpoints, which makes it a genuine kill switch rather than a setting.

Requirements

  • WordPress 6.4 or newer
  • PHP 8.0 or newer
  • HTTPS, required for OAuth
  • The Shilpi theme, active, with a valid licence

Getting connected

See docs/authentication.md for the OAuth flow and the application-password fallback, and examples/ for ready-to-paste client configuration.

Abilities

Every tool is scoped. There is no filesystem access, no SSH, and no route to wp-config.php or to theme and plugin files. Writing PHP snippets is a temporary permission the site owner grants at Shilpi → Security and revokes in one click.

The list below is generated from a live install running Shilpi 1.9.4. Counts change between releases, and the WooCommerce Kit plugin adds its own tools when it is active.

Pages, posts and templates

ToolWhat it does
shilpi-site-infoSite identity, versions, inventory, breakpoints, limits, template routing
shilpi-list-pagesList pages, posts and templates with ids, slugs and permalinks
shilpi-get-pageRead one document: body HTML, page CSS, page JS, header and footer
shilpi-save-pageCreate or update a page, post or template, idempotent by slug
shilpi-set-page-codeSet a document's page CSS and JavaScript
shilpi-delete-pageRemove a document
shilpi-import-pageImport one static HTML file as a Shilpi document
shilpi-import-siteImport a folder of static HTML: templates, CSS, images and menu

Design system

ToolWhat it does
shilpi-manage-variablesList and upsert design tokens, with per-breakpoint values
shilpi-manage-classesList and manage global CSS classes and their states
shilpi-get-globalsRead global CSS and JS, and the default header, footer and front page
shilpi-set-globalsWrite those global settings

Structure and content

ToolWhat it does
shilpi-manage-menuCreate and order navigation menus, assign them to locations
shilpi-manage-taxonomyManage categories, tags and custom taxonomies
shilpi-get-seoRead title, description, canonical, robots and social fields
shilpi-set-seoWrite them through whichever SEO plugin the site runs
shilpi-upload-mediaSideload an image into the media library, idempotent by source URL
shilpi-search-iconsSearch the installed icon libraries
shilpi-manage-icon-librariesAdd and remove icon libraries

Code and assets

ToolWhat it does
shilpi-list-php-snippetsList Code Hub snippets with their enabled and error state
shilpi-get-php-snippetRead one snippet and its content hash
shilpi-save-php-snippetCreate or update a snippet, syntax-checked, hash-guarded
shilpi-configure-php-snippetEnable or disable a snippet, test-run before enabling
shilpi-delete-php-snippetRemove a snippet
shilpi-list-script-filesList managed JavaScript files
shilpi-upload-script-fileUpload a trusted library or bundle
shilpi-configure-script-fileSet enabled state, load priority and jQuery dependency
shilpi-list-project-filesList project JSON and asset files
shilpi-upload-project-fileUpload generated JSON, returns a same-origin URL
shilpi-delete-project-fileRemove a project or script file
shilpi-set-site-manifestActivate a web-app manifest
shilpi-list-fontsList self-hosted font faces
shilpi-upload-fontUpload a WOFF2, WOFF, TTF or OTF face and register it
shilpi-delete-fontRemove a font face

Agent instructions

ToolWhat it does
shilpi-get-skillLoad a Markdown skill: shilpi-theme or wordpress-core

Skills are how the site tells the agent its own conventions. You can upload your own Markdown skill to add house rules, and the agent reads it before writing.

What the server cannot do

This is the part worth reading before you connect anything.

  • No filesystem access. It cannot read or write theme or plugin files.
  • No shell, no SSH, no wp-config.php.
  • No customers, orders, addresses or payment data through the WooCommerce tools.
  • Writing PHP is off by default and is a permission with an off switch, not a setting you enable and forget.
  • Uploading JavaScript requires an account with unfiltered_html.

Licence

The contents of this repository (manifest, docs and examples) are released under the MIT licence. The Shilpi theme itself is commercial software; see https://shilpibuilder.com/pricing/.

Reviews

No reviews yet

Be the first to review this server!