DEV Community

Piotr
Piotr

Posted on Originally published at thebuzzbazaar.com

Connect ChatGPT, Claude or Codex to WordPress — without handing over an admin password

The problem nobody says out loud

You want an AI — ChatGPT, Claude, Codex — to actually do things on your WordPress site: draft posts, fix SEO, update products. The usual advice is "create an application password and paste it in."

Here's what that quietly means: a WordPress application password grants full REST API access at that user's permission level. Give an AI your admin app password and it can change everything — settings, users, plugins, content — with no scoping and no easy audit. That's a lot of trust to hand a tool you're still getting to know.

There's a better model, and it's the same standard your AI already speaks: MCP.

MCP, with a scoped token instead of a master key

The Model Context Protocol is how modern AI assistants connect to external tools. GOMAX ULTIMATE ships an authenticated MCP server for your WordPress site, so an AI connects with a single Bearer token — not your application password.

The token (an "Agent Passport") is:

  • Scoped — read, write, or admin. Destructive actions always require admin.
  • Bound to a WordPress user — it can never do more than that user's role allows. Bind an Editor and the token literally cannot touch settings or plugins.
  • Revocable — kill it in one click and the next request gets a 401. Your agent's real power is the intersection of those gates plus the plugin's own feature flags. That's the difference between "here are the keys to the building" and "here's a badge that opens two doors until I deactivate it."

Connecting, step by step

  1. In wp-admin → GOMAX → AI Connect (MCP), mint a token: name it, choose a scope (start with Read), and pick the user to act as.

  2. Copy the token (shown once) and the MCP URL:

https://your-site/wp-json/gomax-ultimate/v1/agent-connect/mcp

  1. In ChatGPT (Settings → Connectors → custom connector), Claude (Connectors), or Codex (add an MCP server), paste the URL and set Authorization: Bearer <token>.

  2. Ask the AI to call list_capabilities first — it reports exactly what this token may do — then run { endpoint, action, params } to work.

If a call is outside the token's scope, run refuses with a clear message and nothing changes on the site.

Why this fits a "pay once, own your stack" philosophy

GOMAX is pay-once and bring-your-own-key: the AI runs on your provider key or a local model, and the MCP server, the tokens and the activity log all live on your server. Nothing routes through a vendor cloud. Connecting an AI shouldn't mean surrendering control of your site or your data — it should mean handing out a badge you can revoke.

The 30-second version

  • App password = full control, forever, to whoever holds it.
  • MCP + scoped token = only what you allow, only as the user you choose, revocable instantly. Mint the badge, not the master key.

GOMAX ULTIMATE is a pay-once, self-hosted, BYOK AI operating system for WordPress. Learn more.

By Piotr Rosiak — founder of Unlimited Possibilities and creator of GOMAX Ultimate.

Run WordPress with AI — pay once, your own key.

Download GOMAX Connect — FreeGet GOMAX UltimateMore: GOMAX Ultimate · Help Center

Top comments (0)