Novamira HQ in beta: all your WordPress sites, one connection for your AI. Get it free →

Connecting Your AI Client

You can connect any MCP-compatible AI client to your WordPress site running Novamira with OAuth sign-in or an Application Password. Coding agents in the terminal can also connect with the Novamira CLI, a leaner route than MCP. Every method creates a direct connection between your AI client and your site. Nothing passes through Novamira’s servers.

The Novamira > Configuration page is built around your client: choose your AI tool there and it shows only the routes that work for it, with your real site URL already filled in. This page is a reference for the OAuth and Application Password routes.

There is no single best method for every site. The Novamira > Configuration page recommends the one that fits your client and host: OAuth is the security-first default (no secret stored, revocable), but on hosting that filters cloud AI traffic it recommends the Application Password instead, and some clients (such as Claude.ai) only support OAuth. On a plain HTTP site it recommends neither. If your host or a firewall is blocking the connection, see When your host or firewall blocks the connection.

Option A: Sign in with OAuth

Available from Novamira 1.9.1.

Copy the ready-to-use version from Novamira > Configuration, where each command is generated with your real site URL and server name already filled in. The examples below use your-site.com as a placeholder.

With OAuth, your AI client connects to your site and you authorize it from your own WordPress login, in the browser. There is no password to generate, copy, or paste, and you can revoke access at any time from Novamira > Manage Connections.

OAuth requires HTTPS (or a local development environment). The server URL your client connects to is:

https://your-site.com/wp-json/mcp/novamira-oauth

Pick your client below. The Novamira > Configuration page shows the same steps with your real URL filled in.

Claude Desktop and Claude.ai

  1. Open Settings > Connectors in Claude.
  2. Click Add custom connector and give it a name you will recognize, with “Novamira” in it.
  3. Paste the server URL above and save. Leave the OAuth Client ID and Secret (under Advanced settings) empty.
  4. Sign in when the browser opens, and approve the connection from your WordPress login.

Claude Code

Run this in your terminal, then sign in when your browser opens:

claude mcp add novamira-your-site --transport http https://your-site.com/wp-json/mcp/novamira-oauth

Codex CLI

Add this to your config.toml, then sign in with codex mcp login:

[mcp_servers.novamira-your-site]
url = "https://your-site.com/wp-json/mcp/novamira-oauth"

Cursor

Add this to your mcp.json (global ~/.cursor/mcp.json or project .cursor/mcp.json):

{
  "mcpServers": {
    "novamira-your-site": {
      "url": "https://your-site.com/wp-json/mcp/novamira-oauth"
    }
  }
}

ChatGPT

Connect ChatGPT with OAuth through its developer-mode custom connector: enable developer mode, add a custom connector pointing at the OAuth server URL above, and approve the sign-in from your WordPress login.

Other clients, and local sites

Clients that do not run the OAuth flow themselves (Antigravity, Cline, Roo Code, Amazon Q, Zed, Kilo Code, OpenCode), and any site that runs locally, connect through the mcp-remote bridge. It runs the browser sign-in on the client’s behalf:

{
  "mcpServers": {
    "novamira-your-site": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://your-site.com/wp-json/mcp/novamira-oauth"]
    }
  }
}

The exact snippet and file location for your client are shown on the Novamira > Configuration page.

Terminal agents whose browser is elsewhere

When you use the Novamira CLI from a shell over SSH or inside a container, it cannot open a browser for OAuth. The CLI then signs in with a device code automatically: it shows a short code, and you approve it from any device where you are signed in to this site. Only approve a code you started yourself.

Revoke access

Go to Novamira > Manage Connections in the WordPress admin to see every client you have authorized and revoke any of them. Revoking takes effect immediately.

Option B: Application Password

Application Passwords still work, and are the right choice when your client does not support OAuth or you prefer a manual setup. An Application Password is a WordPress credential, separate from your login password, that you can revoke independently.

Claude Desktop one-click bundle: the one-click .mcpb bundle is available again on the Connect page. It requires Claude Desktop 1.24012.1 or later; on an older version, update Claude Desktop first. You can also connect with OAuth sign-in (Option A) or with the manual configuration below.

  1. In the WordPress admin, go to Novamira > Configuration.
  2. Under Application Passwords, optionally enter a name (defaults to “Novamira”) and click Create New Application Password.
  3. Copy the password immediately. It will not be shown again after you leave the page.

Paste the setup prompt into your AI client

The Novamira > Configuration page generates a setup prompt that contains your connection URL, username, application password, and the rules your AI client needs to write its own config. Click Copy prompt, paste it into a new conversation with your AI client, and it writes the MCP server config for you. Restart or reload the MCP session when it asks, then verify it lists Novamira’s tools.

Note: the prompt contains an application password that grants access to your site. Don’t share it with anyone.

Or write the config manually

If your client can’t modify its own config from inside a conversation, expand Need the JSON config for a specific client? on the Connect page to copy a ready-made snippet. The general pattern (adapt the field names for your client):

{
  "mcpServers": {
    "novamira-your-site": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://your-site.com/wp-json/mcp/novamira",
        "WP_API_USERNAME": "your-wordpress-username",
        "WP_API_PASSWORD": "your-application-password"
      }
    }
  }
}

Replace the placeholder values with your actual site URL, WordPress username, and the application password you created above. Note that the Application Password endpoint is /wp-json/mcp/novamira, without the -oauth suffix.

Connect without Node.js (direct HTTP)

If your client can’t reach the npx-based config above (Node.js not installed, npx blocked by IT, sandboxed environment), use direct HTTP transport instead. On the Novamira > Configuration page, expand Configs above not working? Try this npx-free alternative. for a ready-to-paste snippet with a pre-encoded Authorization header.

{
  "mcpServers": {
    "novamira-your-site": {
      "type": "http",
      "url": "https://your-site.com/wp-json/mcp/novamira",
      "headers": {
        "Authorization": "Basic BASE64_ENCODED_CREDENTIALS"
      }
    }
  }
}

The credentials string is base64(your-wordpress-username:your-application-password). Note: this header grants access to your site. Treat it like a password.

Supported clients

The Novamira > Configuration page provides specific instructions and configuration file locations for Claude Code, Claude Desktop, Claude.ai, ChatGPT, Codex CLI, Codex in ChatGPT Desktop, Cursor, VS Code, GitHub Copilot, Windsurf, Cline, Antigravity, Antigravity CLI, Roo Code, Amazon Q, Zed, Kilo Code, and OpenCode. Novamira works with any MCP-compatible client, not just these. The protocol is standard.

Verify the connection

After connecting, start a new session and look for the Novamira tools in your client’s tool list. You should see three tools exposed by the MCP adapter: Discover Abilities, Get Ability Info, and Execute Ability. Through these, your AI client can discover and invoke all Novamira abilities (Execute PHP, Read/Write/Edit/Delete/Disable/Enable File, List Directory, and more).

Try a simple command to verify everything works: ask your AI to “list the plugins installed on this WordPress site.” It should use the Execute PHP tool to run a query and return the list of active plugins.

Troubleshooting

Hit a snag connecting? See Connection troubleshooting for fixes to the most common problems, including Windows TLS errors, HTTPS requirements, and authentication.