The MCP Server turns your site into a tool an AI assistant can build with. The plugin is the server: it exposes a single Model Context Protocol endpoint that Claude, Cursor or VS Code connect to, so your assistant can create pages, edit blocks and manage content on your real site.
Where: WP Admin → Tiger Blocks → Settings → MCP. Enable it under Modules & Widgets → MCP Server.
What the assistant can do
- Create, update, schedule, publish and delete pages and posts built from nested Tiger and core blocks.
- Edit a specific block’s attributes — colours, styles and text — and read the page’s block tree so it can refine an existing layout rather than start over.
- Manage nav menus, taxonomy terms and media, and work with your global design tokens and editor fonts.
- Reach the data engine and Theme Builder surfaces where those modules are active.
Connecting a client
- On the MCP screen, generate a bearer token (you can regenerate it any time to revoke old access).
- Copy the endpoint URL — it lives at
/wp-json/tiger-blocks/v1/mcpon your site. - In your MCP-capable client (Claude Desktop, Cursor, VS Code), add a server pointing at that URL and authenticate with the token as
Authorization: Bearer <token>.
The transport is standard Streamable-HTTP JSON-RPC 2.0, so any compliant MCP client works. Once connected, the assistant sees the Tiger tools and builds against your live install.
Describe outcomes, not steps
The tools handle block structure for you, so ask for the result you want — “a pricing section with three plans” — rather than dictating each block. Sibling Tiger plugins can contribute their own tools; for example, Tiger Forms registers its form tools into this same connector.
Troubleshooting
The client connects but every call is rejected
Two common causes: a mismatched or stale token (regenerate it and update the client), or an inactive Pro subscription. The MCP server is gated on an active license and fails closed when the license is definitively expired — renew it to restore access. A brief network blip is tolerated by a grace window, so a one-off failure should not lock you out.
Is exposing this endpoint safe?
Access requires the secret bearer token, and the token is the only credential — treat it like a password and regenerate it if it leaks. Because authorisation is re-checked server-side on every request (including the license state), a client cannot bypass the gate.