---
title: "Saddle for WordPress"
url: "https://plugpress.co/saddle-for-wordpress.md"
canonical: "https://plugpress.co/saddle-for-wordpress/"
published: "2026-08-15"
modified: "2026-08-15"
author: "Fahim"
description: "Connect Claude, ChatGPT & Cursor to WordPress safely with Saddle. Read-only defaults, no code execution. Install the free plugin today."
tags:
  - "Saddle"
  - "WordPress"
  - "AI"
  - "MCP"
  - "wordpress"
---

# Saddle for WordPress

**Saddle for WordPress** is a free plugin that turns your site into an MCP server. Connect Claude, ChatGPT, Cursor or another AI app, and it can write posts, build pages and manage media directly in WordPress. No copying and pasting, and no handing over your admin login.

It installs read-only. It asks before it deletes anything. It cannot run code at any access level. This post covers how each of those works, because that is the part people actually ask about before they install it.

![The Saddle dashboard in WordPress admin, showing the current access level, connected apps and recent activity](https://plugpress.co/wp-content/uploads/2026/08/saddle-dashboard.png)
*Saddle adds one screen to WordPress. The access level, the connected apps and everything an AI changed are all visible from it.*

## Why Saddle exists

Most people connecting AI to WordPress end up in one of two camps, and both have a real cost.

**Copy and paste.** You ask the AI for a draft, then move it into WordPress by hand. Nothing can go wrong, because the AI never touches your site. It is also slow, it loses formatting, and it does not scale past a few pages.

**Full credentials.** You give an AI tool your admin login, or install a plugin whose headline feature is running arbitrary PHP. This is fast and completely unbounded. There is no list of permitted actions, because everything is permitted. When something goes wrong you often find out later, from the site rather than from a log.

Saddle is the third option. The AI gets real write access, but only through actions you can see, limit and switch off.

## What Saddle does when an AI connects

MCP stands for Model Context Protocol, an open standard published at [modelcontextprotocol.io](https://modelcontextprotocol.io/). It is the shared language AI apps use to talk to external tools, so one integration works across Claude, ChatGPT, Cursor and the rest instead of each needing its own.

Saddle adds a single authenticated endpoint to your site at `/wp-json/saddle/v1/mcp`. Everything runs through it, and four things make it different from an open door.

- **The tool list is fixed.** Saddle publishes 61 tools in the free plugin. Each one declares what arguments it takes and what access level it needs. An AI can call a tool or be refused. It cannot write its own.
- **Sign-in uses WordPress core.** Connections authenticate with [Application Passwords](https://wordpress.org/documentation/article/application-passwords/), a built-in WordPress feature. You can see and revoke every one at Users then Profile, without involving the plugin.
- **The credential is scoped.** A key Saddle issues works on Saddle’s endpoint and nowhere else. It cannot be pointed at the rest of the REST API or at XML-RPC.
- **Nothing is hosted by PlugPress.** The endpoint is on your domain. Your content never leaves your site, because there is no relay or proxy in the middle to leave it to.

## The three Saddle access levels

Access is set site-wide, and a new install starts at the most restrictive level. You raise it deliberately or not at all.

| Access level | What an AI can do | Default |
| --- | --- | --- |
| Just reading | Read posts, pages and media. No changes of any kind. | Yes, on a fresh install |
| Reading and writing | Also create and edit content, upload media, and build layouts. | No |
| Managing the site | Also activate plugins, switch themes, change settings and flush the cache. | No |

![The Saddle Permissions screen, showing the three access levels with Just reading selected](https://plugpress.co/wp-content/uploads/2026/08/saddle-access-levels.png)
*The Permissions screen. Every tool the selected level allows is listed underneath, so the setting is never abstract.*

The level is one of three independent controls. There is also a switch for every individual tool, so you can run at Reading and writing while leaving a specific tool off. And there is a master pause that blocks every call from every connected app without losing any settings.

If any of the three says no, the call is refused and nothing partial happens. A refusal is also written for the assistant to act on rather than as a generic error. Ask a read-only site to publish something and the reply comes back like this:

> This tool needs the “write” access level, but this site allows “read”. Only the site owner can raise it (Saddle → Permissions).
> 
> Saddle, refusing a `create-post` call at the default access level

Changing the level takes effect on the next request, so you do not need to reconnect your apps after adjusting it.

## What happens before Saddle deletes anything

Destructive actions take two calls, not one.

The first call changes nothing. It returns a preview of what would happen, plus a single-use confirmation token. Only a second call carrying that token executes. The token is tied to that specific action and expires, so it cannot be saved and reused later.

The practical effect is that an AI cannot delete anything in a single step, including a confused one. Deletions also go to the trash by default rather than being removed permanently, so there is a second layer of recovery behind the first.

## What Saddle will not do at any access level

This is the part worth checking in any AI plugin you evaluate, including this one.

- **No code execution.** There is no way to run PHP, shell commands or WP-CLI. Not at the highest access level, and not as a hidden option for power users.
- **No writing files.** Saddle writes to the database, not to disk.
- **No editing its own permissions.** An AI cannot raise the access level, re-enable a tool you switched off, undo the pause, or create a connection. Those are owner-only, from the dashboard.

The reason to care is that a plugin offering a general “run this code” tool has no meaningful permission model, whatever its settings screen suggests. Anything reachable from PHP is reachable, and a preview of a code block tells you very little about what it will do.

## Which AI apps connect to Saddle today

Saddle generates the setup for six apps: Claude, ChatGPT, Claude Code, Cursor, VS Code in Copilot agent mode, and Gemini CLI. Any other MCP client can connect using the generic settings.

![The Saddle connect wizard, listing Claude, ChatGPT, Claude Code, Cursor, VS Code and Gemini CLI as connection options](https://plugpress.co/wp-content/uploads/2026/07/saddle-connect-wizard-choose-app.png)
*Pick the app and Saddle writes the configuration for it, including the key. There is nothing to assemble by hand.*

ChatGPT is the one exception worth knowing about. Its connector screen has nowhere to paste a sign-in key, so Saddle can run a standard OAuth 2.1 sign-in inside your own WordPress instead. You approve the connection from your admin, and an approval can never grant more than the site’s access level. That sign-in is off until you turn it on.

## What you need to run Saddle

- WordPress 6.9 or later, and PHP 7.4 or later.
- HTTPS. WordPress disables Application Passwords on plain HTTP, so Saddle cannot issue a key without it.
- An AI app that speaks MCP, and a few minutes to connect it.

## Saddle free and Saddle Pro

The free plugin is complete. All 61 tools work on install, with nothing locked behind an upgrade and no usage limit. That includes content, media, block editing against your theme’s own colours and spacing, a design check that runs before you publish, and an activity log of every change an AI made.

![The Saddle Activity screen, listing changes an AI made to the site grouped by day](https://plugpress.co/wp-content/uploads/2026/08/saddle-activity.png)
*Activity records every change an AI made, and every attempt that was blocked. Reads are not logged.*

Saddle Pro adds 47 Divi-native tools, for 108 in total. It is worth buying for one specific reason: your site runs Divi 5 and you want an AI building real Divi modules rather than generic blocks. If it does not, the free plugin is the whole product.

## Frequently asked questions

### What is Saddle for WordPress?

Saddle is a free WordPress plugin that turns your site into an MCP server, so AI apps like Claude and ChatGPT can read and edit it through a fixed set of tools. It is made by PlugPress. The PlugPress Saddle plugin runs entirely on your own site, with no account to create and no service in the middle.

### Is a WordPress MCP server safe?

It depends entirely on what the server permits. A WordPress Saddle MCP connection starts read-only, refuses anything above the level you set, requires a two-step confirmation before deleting, and cannot execute code at any level. Judge any MCP plugin on those four questions rather than on its marketing.

### Does my content leave my site?

No. The MCP endpoint is on your own domain, and connections are inbound. Your content and your credentials stay in your WordPress. The free plugin makes no outbound request unless you start one, for example by asking it to import an image from a URL you supplied.

### Which AI apps work with Saddle?

Claude, ChatGPT, Claude Code, Cursor, VS Code and Gemini CLI have generated setup instructions. Any other MCP client works with the generic settings. You can connect several at once, each with its own key, and revoke one without affecting the others.

### Do I need Saddle Pro?

Only if your site runs Divi 5. Pro adds 47 tools that build and edit real Divi modules. On any other theme, the free plugin already does the job.

---

## Get Saddle for WordPress

Download it from the [Saddle product page](https://plugpress.co/saddle/), then follow the [Getting Started guide](https://plugpress.co/docs/getting-started/) to connect your first app. It installs at the Just reading level, so the safe thing is also the default thing. Raise it when you are ready, not before.

The interesting question is no longer whether an AI can edit your site. It is what you are willing to let it do unsupervised, and whether your tools make that a decision rather than an accident.

*Written by Fahim, founder of [PlugPress](https://plugpress.co/) and the developer of Saddle. The access levels, tool counts and refusal behaviour described here were checked against Saddle 1.0.0 running on WordPress 7.0.*