MCP server

FleetWP speaks the Model Context Protocol two ways, with the same tools and the same token:

Hosted: connect any MCP client that supports remote servers to https://app.fleetwp.io/api/mcp. Nothing to install.
Local: run @fleetwp/mcp alongside an agent that launches MCP servers as local commands (Claude Desktop, Claude Code).

Either way the agent can do exactly what its token allows, through the same checks as the REST API.

Hosted server

In FleetWP, open Agents & API and create a token (see Authentication). Copy it; it starts with fwp_.
In your MCP client, add a remote (Streamable HTTP) server:
- URL: https://app.fleetwp.io/api/mcp
- Header: Authorization: Bearer fwp_your_token_here

Check the connection from a terminal:

curl -s https://app.fleetwp.io/api/mcp \
  -H "Authorization: Bearer fwp_your_token_here" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

The hosted server is stateless and always answers in plain JSON. A missing or invalid token is rejected with HTTP 401. When a single tool is refused (for example a read-only token asking for a backup), that call returns an error result and the connection stays up.

Local server

The server reads FLEETWP_URL and FLEETWP_TOKEN from its environment. In an MCP client config:

{
  "mcpServers": {
    "fleetwp": {
      "command": "npx",
      "args": ["-y", "@fleetwp/mcp"],
      "env": {
        "FLEETWP_URL": "https://app.fleetwp.io",
        "FLEETWP_TOKEN": "fwp_your_token_here"
      }
    }
  }
}

Tools

Tool	Description	Token scope
`list_sites`	List all sites in the workspace	read
`get_site`	Show details for one site	read
`list_backups`	List a site's backups	read
`create_backup`	Start a backup (`type`: full / db / files); returns a `job_id`	write
`restore_backup`	Restore a backup onto the live site (destructive); returns a `job_id`	write
`update_site`	Apply updates, optionally limited to specific plugins	write
`site_login_url`	Generate a one-click admin login URL	write
`get_activity`	Recent activity, for the workspace or one site	read
`log_activity`	Log maintenance done outside FleetWP against a site	write
`get_inventory`	Live plugin, theme and core list with available updates	read
`get_security`	Open security findings, for one site or the whole fleet	read
`list_site_tweaks`	Security fixes (Site Tweaks) and which are applied	read
`apply_security_fix`	Apply or revert security fixes	write
`get_performance`	Latest performance sample and recent trend	read
`get_uptime`	Recent uptime checks	read
`get_errors`	Deduped PHP error log	read
`get_broken_links`	Broken links from the last scan	read
`get_job`	Check one backup, restore or update by `job_id`	read
`list_jobs`	Recent backups, restores and updates	read

Each tool also carries standard MCP hints (read-only, destructive, idempotent) so clients can ask for confirmation before risky actions. restore_backup and update_site are marked destructive.

Scope your token

Give the agent a token whose scope matches what you want it to do. A read token lets it observe the fleet without being able to trigger backups, updates, or logins.

Hosted server

Local server

Tools

On this page