Today WP is a free MCP server that gives your AI agent everything about WordPress, fresh every day: plugins, security, news, docs and more. Read‑only, nothing to install on your site, ready in seconds.
https://todaywp.com/mcpCopied a setup prompt. Paste it to your agent.
Paste it to Claude, ChatGPT or Cursor. Done.
Your AI agentChatGPT · Claude · Cursor · Codex
Its own connection
Writes a post
Updates a plugin
Edits a page
Separately, your agent works on your website through its own connection.
Your websiteVia the MCP connector of your choice
Asks, now and then?
Today WPAlways up to date
Synchronizes
Official sources
WordPress.org, PHP.net
Docs
Page builders
Plugins
Security (Wordfence, Patchstack, WPScan)
News
etc.
Why your agent will be better with it
One everyday task: check a plugin, today's news and the latest WordPress release. Measured both ways. Point at the card to watch it.
Today WP
pluginnewsnowDone
3calls
Without
Donestill searching…
99+steps
Fewer callsA handful of calls, not a search spiral through page after page.
Fewer tokensShort answers instead of whole pages to read. How we measured
Today's factsChecked at the source today, not remembered from training.
News & Docs
Read for you, every day.
Today's news and the right doc page.
WWordPress.com Blog13 Nov
WordPress.com Changelog: Easily Migrate Your Site and Get Developer Tools on Every Paid Plan
Move your site to WordPress.com, get SSH and WP-CLI on every paid plan, and let your AI assistant do more.
WordPress 7.2 is coming. Here's what changed for plugin and theme developers: the Secrets API, SVG admin icons, random redirects, and what to test before string freeze.
“What’s new in Gutenberg…” posts (labeled with the #gutenberg-new tag) are posted following every Gutenberg release on a biweekly basis, showcasing new features included in each release.
CVE-2026-119618 (rated critical by Apache) is in mod_http2 of Apache HTTP Server 2.4.55 to 2.4.70 and can lead to remote code execution when the server accepts HTTP/2 (h2 or h2c).
What to doAsk the host whether its Apache accepts h2 or h2c and has the fix (vendor packages may carry other version numbers) and was restarted.
The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauth
The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for