Questions, answered
before you install.

Claude (web, desktop, mobile and Claude Code) connects in one click: add your site as a custom connector, sign in to WordPress and approve. Other MCP clients, such as ChatGPT and Cursor, connect the same way or with an access token.

No code and no FTP. Upload and activate the plugin, switch the endpoint on and copy your /mcp address. In Claude, add a custom connector, paste the address, sign in to WordPress and approve - one click, no tokens. Config-file clients use an access token instead.

Yes - you use your own Claude or ChatGPT account. GripMCP is the bridge that runs on your WordPress; it doesn’t resell AI or add a second bill. There are no metered API calls or per-message fees from us.

Open GripMCP → Activity → Connection diagnostics: it lists every token issued and every refused request with the reason. Some hosts strip the Authorization header before WordPress sees it, so the Setup tab tests for this and warns you, with the three-line .htaccess fix. One-click connect needs HTTPS and a site at the root of its domain; a site in a subfolder can connect with an access token instead. If your site already uses the /mcp address, you can give GripMCP a different one with a single line in wp-config.php.

Plenty. The free plugin creates and edits posts, pages and any custom post type; manages media, users, menus, comments, taxonomies and settings; runs Site Health, switches on debug logging and shows recent crashes. Paid plans add plugin and theme management (Creator), WooCommerce, page builders, WP-CLI and read-only SQL (Operator), and theme and plugin file editing (Fleet). That’s 100+ tools across the plans, and longer jobs show up as a live progress card in the chat - see the full map on the Capabilities page.

Yes, on the Operator plan and above. GripMCP works through WooCommerce’s own data layer - orders, products, customers, coupons and sales reports - so it’s HPOS-safe and Woo’s hooks still fire. Stock adjustments and order emails behave exactly as they do in wp-admin.

Elementor, WPBakery and Divi (Divi 4 layouts) are supported. Your assistant sees the page the way the builder shows it - sections, rows, columns and modules - and can change one element, add a new one, or remove one by name. With Elementor it can also create whole pages, use saved templates and update your global colours and fonts. Untouched sections are written back byte-for-byte, each builder’s own escaping is handled so links and quotes survive, cached styling is refreshed so the change actually shows, and a restore point is saved before every edit. Divi 5 isn’t supported yet. GripMCP also auto-detects any registered custom post type and its meta fields, so it works with the content structures your site already defines.

Every tool call runs as the WordPress user your token belongs to and is checked against that user’s real capabilities - GripMCP never elevates privileges or bypasses roles. Only administrators can connect by default, and you choose whether any other role may. Auth uses OAuth 2.1 or a hashed, revocable bearer token over HTTPS that works only at the GripMCP endpoint, and an activity log records every call: what ran, as whom, and when.

Only if you let it. Destructive tools - deletes, refunds, force-writes and changes to admin-level access - are set to Ask me first on a new install, so each one waits for your approval (see below). You can change that to Off, so they never run, or Allow. File edits are syntax-checked and auto-backed-up before every write, a PHP change that crashes the site is undone automatically, theme changes can be tried in a draft sandbox first, and each page-builder edit saves a restore point you can roll back to instantly.

Yes, and it does by default. Destructive actions start on “Ask me first”, so an assistant cannot delete anything on its own. Every destructive call stops and waits: you get a link to a page on your own site showing exactly what it wants to do, with all of its details, and it runs only after you click Approve. Decline and nothing happens. Requests waiting for you are also listed on the Approvals tab in GripMCP, so a lost link never strands one. GripMCP also checks what the delete would break first - shortcodes still on your pages, your homepage, a menu page, your logo, the last administrator - and shows it with the request. You approve in WordPress, signed in as yourself - there is deliberately no way for an assistant to approve its own request. What you approve is exactly what runs, because the action and its details are stored on your site when it is held, so nothing can change between you reading it and it happening. Each approval works once and expires after 30 minutes if nobody answers. It is the safest way to allow deleting at all.

Only for as long as it asks: from 5 minutes up to 24 hours, then it switches itself off. Errors go to a private file on your site and are never shown to visitors. If you’d rather it never did, turn off “Let the assistant switch on debug logging” on the Permissions tab.

No. GripMCP runs on your own WordPress server and tool calls go straight from your assistant to your site - never proxied or metered through us. Your content, tool calls and their results, passwords, tokens and visitor data never leave your site. The plugin has no analytics or tracking. The only extra is licensing: after activation it asks whether you want to opt in to Freemius, the service that sells our plans. Opt in, or buy a plan, and it shares your site address, WordPress, PHP and GripMCP versions and your email with Freemius, then checks your licence once a day. Skip it and nothing is sent. Details are in our privacy policy.

Yes - the free Explorer plan runs on unlimited sites, with no licence needed: content, media, users, categories, menus, comments, custom fields and settings, revisions, approvals for deletes, the debug log, site health and plugin abilities. Creator adds plugin and theme management on 5 sites. Operator adds WooCommerce, Elementor, WPBakery and Divi, WP-CLI, read-only SQL, raw REST requests, and 90 days of activity log with filters and CSV export, on 25 sites. Fleet adds theme and plugin file editing, theme drafts and database search and replace on 50 sites. Compare everything on the Pricing page. Paid plans come with a 14-day money-back guarantee.

Paid plans include a year of updates and support: email on Creator, priority email on Operator, priority email plus onboarding on Fleet. Licenses renew automatically. If a license expires without renewal, the site moves to the free Explorer plan: GripMCP keeps running with the Explorer tools, and your plan’s tools and settings come back as soon as you renew. Explorer shows 3 days of activity log; older entries are kept for 30 more days in case you renew, then cleared. To switch to the free plugin instead, install and activate it first, then delete the paid copy: your settings, connected apps and activity log carry over. Cancel anytime with one click; paid features stay active until the end of the period you’ve already paid for.

Open GripMCP → Activity → Report a problem and describe what happened. GripMCP writes the report for you, adding your WordPress, PHP and plugin versions, your GripMCP settings and the relevant error lines, so we can look into it straight away. It leaves out passwords, tokens, email and IP addresses and your content. On the free plan, click Copy post and send it to us through the contact page. On a paid plan it is an email to support@gripmcp.com. You can also download it as a file. The plugin never sends it - only you do.