Connect an AI agent to WordPress over MCP

RankKit SEO has a built-in MCP server (Model Context Protocol), so an AI agent such as Claude, ChatGPT, Cursor or GitHub Copilot in VS Code can read your SEO data and make changes for you. There is no companion plugin to install and no RankKit SEO account: the agent talks straight to your WordPress site.

Agent access is off until you turn it on. When it is on, every change an agent proposes waits for your approval by default, and every applied change can be undone. This is free on every site.

What an agent can do

Once connected, an agent can use 101 tools on a free site and 128 with RankKit SEO Pro, plus a few more once Google Search Console and GA4 are connected. For example, it can:

• Run the site audit and work through the issues one by one.
• Find posts without a meta description, read each one and write a description that matches the content.
• Suggest internal links, find keyword cannibalization and set focus keywords.
• Create redirects, edit robots.txt rules, update sitemap and llms.txt settings.
• Read Search Console and GA4 data (when Google is connected).

The full list is in the MCP tool reference. RankKit SEO also ships ready-made workflows that your client can run as slash commands.

Step 1: Turn on agent access

1. Go to RankKit SEO → AI Agents.
2. In the Access card, turn on Allow AI agents to connect. This turns on the MCP server and registers RankKit SEO abilities with WordPress.
3. Leave Agents' changes need my approval on. Agent edits then wait in the Change Log until you approve them. Site-wide changes, such as settings, redirects, robots.txt and backups, always wait for your approval, even with this off.

The Server card now shows Status: Accepting connections and your MCP endpoint (Streamable HTTP), which looks like this:

https://example.com/wp-json/speedrank/v1/mcp

Note You can also turn agent access on or off from the AI agents (MCP) toggle in the Modules card on the Dashboard. Both control the same setting.

Step 2: Choose how your client signs in

The Connect an AI client card has a tab for each client. Web apps sign in with OAuth. Desktop and terminal clients use a token you create.

Client	How it signs in	Guide
claude.ai, ChatGPT	Paste the Connector URL, sign in to WordPress and choose an access level. No token needed.	Connect claude.ai or ChatGPT
Claude Code	Agent token in a claude mcp add command	Connect Claude Code
Claude Desktop	Agent token in claude_desktop_config.json	Connect Claude Desktop
Cursor	Agent token in mcp.json	Connect Cursor
VS Code	Agent token in .vscode/mcp.json	Connect VS Code
Any other MCP client	Agent token as Authorization: Bearer header	See below

claude.ai and ChatGPT can only reach a public HTTPS site. A local or staging site that isn't reachable from the internet works with Claude Code, Claude Desktop, Cursor and VS Code.

Step 3: Create a token (desktop and terminal clients)

1. In the Agent tokens card, click Create token.
2. Give it a Name, for example "Claude Code on my laptop". The name appears in the Change Log next to every edit this agent makes.
3. Pick when it Expires (default In 90 days) and a Permissions preset: Read only, Content editor (default) or Full.
4. Click Create token.

The token starts with sr_ and is shown once. RankKit SEO fills it into the snippets in the Connect an AI client card, so open your client's tab and copy the snippet straight away. Details: Agent tokens, scopes and access levels.

Step 4: Test the connection

Ask the agent something simple, for example:

Run site_overview and tell me what you see.

site_overview returns the site name, enabled modules, content counts, the latest audit score and pending approvals. If the agent answers with your site's details, you are connected. In wp-admin, the token's Last used column and the Activity card on RankKit SEO → AI Agents show the call.

You can also test from a terminal with the cURL tab:

curl -s https://example.com/wp-json/speedrank/v1/mcp \
  -H "Authorization: Bearer sr_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"site_overview","arguments":{}}}'

Other MCP clients

Any client that supports the Streamable HTTP transport can connect. Point it at the MCP endpoint and send the token in an Authorization: Bearer sr_… header. The server accepts JSON-RPC 2.0 over POST, supports MCP protocol versions 2025-06-18, 2025-03-26 and 2024-11-05, and does not offer an SSE stream or batch requests.

RankKit SEO also accepts WordPress Application Passwords (Basic auth) while Also accept WordPress Application Passwords is on. A token is safer: it is limited to the areas you choose and it expires.

How RankKit SEO keeps agents safe

• Off by default. Nothing can connect until you turn on Allow AI agents to connect.
• Scoped access. Each token or connection only sees the tools its permissions allow, and never more than its WordPress user can do.
• Approval mode. With Agents' changes need my approval on, writes are queued until a person approves them. Site-wide changes always wait for an administrator, even with it off. Agents can't approve their own changes. See Approval mode, dry runs and undo.
• Undo. Every applied change is in the Change Log with its old value and can be reverted.
• Locked settings. Agent, AI and tracking settings can only be changed by a person in wp-admin. Agents can't read or change API keys, and can't switch the agent, AI assistant or AI crawler tracking modules on or off.

FAQ

Do I need RankKit SEO Pro to connect an agent?

No. The MCP server, tokens, the claude.ai and ChatGPT connector and the ready-made workflows are free. Pro adds more tools, for example bulk edits, the 404 log and Search Console reports.

Does the agent use my AI provider key?

Only for tools that generate text with RankKit SEO's AI, such as ai_suggest_meta or ai_write_draft. Those need the ai permission and a key in RankKit SEO → Settings → AI provider. The agent's own reasoning runs on its own service.

Can I connect more than one agent?

Yes. Create one token per client or person, so you can see who did what and revoke one without breaking the others.

What happens if I turn agent access off?

Every request is refused with "AI agent access is turned off. Enable it in RankKit SEO → AI Agents." Your tokens are kept, so the clients work again when you turn it back on.