cwp mcp

cwp mcp [env] [flags]

Acts on the local site unless an environment is named.

Argument	What it is	Default
[env]	environment to point the client at (omit for the local site)

Flag	What it does	Default
--client <name>	AI client (default: claude-code)	claude-code
--print	write the config block to stdout and do nothing else	off
--rotate	replace an existing application password of the same name	off
--force	override the protected-environment refusal	off
--no-backup	skip the remote backup taken before the write	on
--yes	answer the confirmation prompts with yes	off

Plus the shared flags --json, --verbose and --dry-run.

What it does

Generates the MCP client configuration that points an AI client at one environment, and mints the application password it needs.

This exists because the setup is per site, per environment and per credential — Bricks’ own documentation says the skills repository cannot ship a .mcp.json for exactly that reason. cwp already knows every environment’s URL and already owns the conduits that can mint a credential, so it is the piece that was missing.

All 19 clients get the same server descriptor and differ only in the envelope, which cwp emits in whichever of the seven shapes your client wants. A local DDEV site additionally gets NODE_TLS_REJECT_UNAUTHORIZED=0, because its certificate comes from a local CA that the bridge’s Node process does not trust.

The password is shown once. WordPress stores only its hash, so cwp cannot print it again — which is why re-running refuses when a password of that name already exists, and tells you to pass --rotate. Rotating invalidates the credential every other client is already using, so it is never silent.

--print writes the block to stdout and does nothing else; it cannot be combined with --json, since both claim stdout.

Example

cwp mcp                          # Claude Code, local site
cwp mcp --client cursor          # any of the 19 clients Bricks supports
cwp mcp --client codex --print   # just the config block, on stdout
cwp mcp prod --rotate            # replace the existing credential

What it does not do

It does not edit your client’s config files. Nineteen clients means nineteen merge semantics over JSON and TOML in paths outside your project, and cwp has no business there. The one exception is not really one: the Claude Code form is a command line, so cwp offers to run it for you.

It does not install the MCP Adapter plugin. It checks for it, and gives you the command.

It is not between the agent and WordPress. Once this command has wired the connection, the client talks to the site’s own MCP server directly, and no guard in cwp is in that path. What bounds an agent is which site its credentials point at — see Why cwp for the version of this that matters.