Airo WP AI Builder

1. 01Upload the airo-wp folder to /wp-content/plugins/ , or install from your organization’s deployment pipeline.
2. 02Activate the plugin through the Plugins screen in WordPress.
3. 03For development, run composer install in the plugin directory before activation (see CONTRIBUTORS.md).

What does Airo WP AI Builder do right now?

It registers an MCP server on your WordPress site and provides a block pattern library based on the Twenty Twenty-Five theme. You connect an AI client of your choice to the MCP endpoint and use it to read and write site content.

Which AI can I use?

Any MCP-compatible AI client — Claude, GPT, Gemini, or others. The plugin does not bundle or require a specific AI.

Where do the block patterns come from?

Patterns are sourced from the DesignSetGo plugin . If DesignSetGo is active, Airo WP AI Builder defers to it automatically to avoid duplication.

How do I connect an AI client to the MCP server?

The endpoint is:

https://example.com/wp-json/airo-wp/v1/mcp/streamable

Create a credential under Users -> Profile -> Application Passwords, giving it a name such as “Claude”. WordPress shows the generated password once only, so copy it before leaving the screen.

Combine your WordPress username and that password with a colon, base64-encode the result, and send it under the airowp authorization scheme:

Authorization: airowp YWRtaW46YWJjZCBFRkdIIGlqa2wgTU5PUCBxcnN0IFVWV1g=

Some clients offer only a bearer-token field rather than a full header. For those, prefix the same encoded value with airowp_ and send it as a bearer token:

Authorization: Bearer airowp_YWRtaW46YWJjZCBFRkdIIGlqa2wgTU5PUCBxcnN0IFVWV1g=

Both forms are equivalent. Note that base64 is encoding rather than encryption, so treat the encoded string as being exactly as sensitive as the password itself, and keep it out of shared configuration files.

Why does the MCP endpoint reject my credential?

Three common causes:

1. 01The site is not served over HTTPS. WordPress refuses to issue or accept Application Passwords without SSL, so the credential cannot be created in the first place.
2. 02The regular account password was used. The MCP server accepts an Application Password, not your login password.
3. 03The username is wrong. Use the WordPress username, not the email address.

An error mentioning Mcp-Session-Id is not an authentication failure — it means the credential was accepted and the request reached the MCP server. The transport is session-based: call initialize first, then send the returned session id with every subsequent request. AI clients handle this automatically; it only comes up when calling the endpoint by hand.

What can a connected AI actually change?

Whatever the user you created the Application Password for is allowed to change. Authentication only establishes which user the request belongs to; every tool then checks a WordPress capability of its own — edit_posts to create a post, upload_files to add media, activate_plugins to activate a plugin, and so on.

A credential belonging to a Subscriber therefore connects successfully and is refused by every tool that modifies anything. Create the Application Password for a user whose role matches the access you intend to grant, and revoke it under Users -> Profile when it is no longer needed.

Does this support the MCP specification’s OAuth flow?

Not yet. The MCP specification defines an OAuth 2.1 authorization flow with discovery documents and a consent screen. This plugin does not implement it, so clients that require OAuth discovery cannot connect. The Application Password scheme described above is a configured credential instead. OAuth support is under consideration.

What PHP versions are supported?

PHP 7.4 is the minimum. PHP 8.3 is the recommended version for local development. CI validates 7.4, 8.0, 8.1, 8.2, and 8.3.

Why are dependencies in a `dependencies/` folder?

Runtime Composer packages are namespace-prefixed with Strauss into dependencies/ so they do not clash with other plugins’ autoloaders.