> For the complete documentation index, see [llms.txt](https://docs.hostinger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hostinger.com/wordpress/hostinger-plugins/ai-plugin/mcp-server.md). # WordPress Site MCP Server How the Hostinger AI plugin's WordPress site MCP server works, how it differs from the Hostinger API MCP server, and how to connect an AI tool to it directly. The [Hostinger AI plugin](/wordpress/hostinger-plugins/ai-plugin.md) runs an MCP (Model Context Protocol) server on your WordPress site. AI tools such as Claude, Cursor, and VS Code connect to it and work inside the site. They can manage content, media, users, menus, WooCommerce, Elementor, SEO, plugins, and themes, using the same abilities as Hostinger Agent. ## WordPress site MCP server or Hostinger API MCP server? Hostinger runs two different MCP servers, and both have WordPress tools: | | WordPress site MCP server | Hostinger API MCP server | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Runs on** | Your WordPress site, through the AI plugin | Hostinger, at `https://mcp.hostinger.com` or locally with `npx @hostinger/mcp` | | **Address** | One per site: `https://yourdomain.com/wp-json/hostinger-ai-assistant/v1/mcp` | The same for every account | | **Signs in with** | Your Hostinger account through Hostinger Connector, or a WordPress administrator account | Your Hostinger account, or an hPanel API token | | **Manages** | What's inside one site: posts, pages, media, comments, users, menus, settings, SEO, WooCommerce, Elementor, plugins and themes | Your hosting account: installing WordPress, updating plugins and themes, cache, maintenance mode, one-click sign-in links, and every other Hostinger product | | **Works when** | The site is online and the AI plugin is active | The site is offline or broken, too | | **Reference** | [Abilities Reference](/wordpress/hostinger-plugins/ai-plugin/abilities.md) | [API reference](/api-reference/overview.md) and [Tools & integrations](/api-reference/tools.md#hostinger-api-mcp-server) | Both servers can install, update, and remove plugins and themes. The Hostinger API does it from outside the site, so it still works when the site is down. The WordPress site MCP server does it from inside WordPress, alongside the content changes it makes. [Hostinger Connector](/hostinger-connector/overview.md) connects your AI tool to both servers at once, so most people never have to choose. For all of Hostinger's MCP-based services, including Web2Agent, see [AI assistants and MCP](/api-reference/tools.md#ai-assistants-and-mcp). ## Connect with Hostinger Connector Hostinger Connector is the recommended way to connect. It finds your WordPress sites that have the AI plugin active and signs in with your Hostinger account, so there's nothing to copy or rotate. See [Connect AI tools over MCP](/wordpress/hostinger-plugins/ai-plugin.md#connect-ai-tools-over-mcp). ## Connect directly Connect directly when your AI tool can't use Hostinger Connector, or when you're scripting against a single site. You need: * **The server address:** `https://yourdomain.com/wp-json/hostinger-ai-assistant/v1/mcp` * **An administrator account** on the site. Other roles are refused. The server uses the Streamable HTTP transport. Sign in with an application password or an access token. Send one or the other, not both. If a request carries an invalid access token, it's refused even when the application password is valid. ### With an application password 1. In the WordPress admin, go to **Users** → **Profile** → **Application Passwords**, enter a name, and click **Add New Application Password**. 2. Copy the password exactly, spaces included. 3. Encode `username:application password` in Base64 and send it as an `Authorization: Basic` header. For example, in an AI tool that reads a JSON MCP configuration: ```json { "mcpServers": { "my-site": { "type": "http", "url": "https://yourdomain.com/wp-json/hostinger-ai-assistant/v1/mcp", "headers": { "Authorization": "Basic BASE64_OF_USERNAME_AND_APPLICATION_PASSWORD" } } } } ``` > **Note:** If [Hostinger Tools](/wordpress/hostinger-plugins/tools.md#security) has **Disable application passwords** turned on, this method stops working. Turn the setting off, or use an access token. ### With an access token Access tokens are issued by the AI plugin and last one hour by default. Get one in either of these ways: * **From the Hostinger API**, with an hPanel API token and no SSH access: call [Get installation JWT token](/api-reference/endpoints/wordpress/installations/get-installation-jwt-token.md) with the installation's ID from [List WordPress installations](/api-reference/endpoints/wordpress/installations/list-wordpress-installations.md). The response includes the token, its expiry, and the server address. * **On the server**, over [SSH](/websites/ftp-ssh.md) with WP-CLI: ```bash wp hostinger-ai jwt --user=admin --expires-in=86400 ``` `--expires-in` sets the lifetime in seconds, from `3600` (1 hour) to `2592000` (30 days). Add `--format=json` to also print the server address. Send the token as `Authorization: Bearer `. If something between your AI tool and the site strips the `Authorization` header, send it as `X-Hostinger-JWT-Token: ` instead. When a token expires, create a new one. ## How AI tools use the abilities The server doesn't list every ability as a separate tool. It offers three tools that the AI tool uses in turn: | Tool | What it does | | --------------------------------- | ------------------------------------------------ | | `hostinger-ai-discover-abilities` | Lists the abilities available on the site | | `hostinger-ai-get-ability-info` | Returns one ability's description and parameters | | `hostinger-ai-execute-ability` | Runs an ability | This keeps the tool list short no matter how many abilities the site has. The [Abilities Reference](/wordpress/hostinger-plugins/ai-plugin/abilities.md) lists every ability with its required parameters. Some abilities only appear when the plugin they work with is active: WooCommerce, Elementor, LiteSpeed Cache, or Hostinger Tools. Each ability runs as the user you connected with and checks that user's WordPress permissions, as it would in the admin. > **Note:** Every action goes through `hostinger-ai-execute-ability`, which is marked as able to change or delete data. AI tools that ask before such actions will ask every time, including when the AI only reads content. ## Troubleshooting ### The AI tool gets a 401 error The request had no valid credentials. Check that: * the application password was pasted with its spaces and encoded together with the right username * the access token hasn't expired * **Disable application passwords** is off in Hostinger Tools, if you use an application password ### The AI tool gets a 403 error The credentials are valid, but the user isn't an administrator. A 403 is also returned when a request sends an invalid access token together with an application password. Remove the token header. ### The AI tool connects but finds no WooCommerce or Elementor abilities Those abilities are only available while WooCommerce or Elementor is active on the site. ## Related guides * [Hostinger AI plugin](/wordpress/hostinger-plugins/ai-plugin.md) * [Hostinger Connector](/hostinger-connector/overview.md) * [Hostinger API tools & integrations](/api-reference/tools.md) *** *Last updated: October 9, 2026*