OpenClaw
OpenClaw reads MCP servers from ~/.openclaw/openclaw.json, under mcp.servers. That file usually already has other settings, so add the mcp block below rather than replacing the whole file. The plugin’s EMCP Tools → Connection screen generates every block on this page for your exact site.
Sign in with OAuth (recommended)
Section titled “Sign in with OAuth (recommended)”Add the server with auth: oauth, then run one login command:
"mcp": { "servers": { "emcp-tools": { "url": "https://your-site.test/wp-json/mcp/emcp-tools-server", "transport": "streamable-http", "auth": "oauth" } }}openclaw mcp login emcp-toolsOpenClaw prints a sign-in URL. Open it, approve access from your WordPress login, then follow OpenClaw’s instruction to finish (recent builds ask you to paste the code back with openclaw mcp login emcp-tools --code <code>).
Paste only the code, the part between
code=and&in the callback URL, not the whole query string. On PowerShell an unescaped&throws a parser error.
Requires an HTTPS site with OAuth enabled (EMCP Tools → Connection: on by default on HTTPS). Only administrators can approve. Authorization codes last 5 minutes, so complete the login in one pass and do not re-run
openclaw mcp loginbefore exchanging the code (that regenerates the security check and invalidates the first code).
HTTP with an Application Password
Section titled “HTTP with an Application Password”"mcp": { "servers": { "emcp-tools": { "url": "https://your-site.test/wp-json/mcp/emcp-tools-server", "transport": "streamable-http", "headers": { "Authorization": "Basic BASE64_ENCODED_CREDENTIALS" } } }}Or set it from the terminal:
openclaw mcp set emcp-tools '{"url":"https://your-site.test/wp-json/mcp/emcp-tools-server","transport":"streamable-http","headers":{"Authorization":"Basic BASE64_ENCODED_CREDENTIALS"}}'Generate the base64 credentials:
echo -n "admin:xxxx xxxx xxxx xxxx xxxx xxxx" | base64Application passwords come from WordPress admin → Users → Profile → Application Passwords.
Node proxy (most reliable)
Section titled “Node proxy (most reliable)”If the direct HTTP transport times out during the handshake, run the bundled proxy over stdio instead. It handles the session and protocol negotiation and is the most dependable path:
"mcp": { "servers": { "emcp-tools": { "command": "npx", "args": ["-y", "@msrbuilds/emcp-proxy@latest"], "env": { "WP_URL": "https://your-site.test", "WP_USERNAME": "admin", "WP_APP_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx", "MCP_PROTOCOL_VERSION": "2024-11-05" } } }}Note WP_URL is the bare site (no /wp-json/..., the proxy adds the route), and the app password goes in plain.
Windows notes
Section titled “Windows notes”Two things trip up OpenClaw on Windows specifically:
-
spawn npx ENOENT. OpenClaw launches the command without a shell, and Windows cannot resolve barenpxthat way (the real file isnpx.cmd). Wrap it incmd:"command": "cmd","args": ["/c", "npx", "-y", "@msrbuilds/emcp-proxy@latest"] -
Slow start /
Request timed out.npx -y @latestre-checks the npm registry on every launch, which can add five to seven seconds and blow past OpenClaw’s probe timeout. Install the proxy once and point straight at it:Terminal window npm install -g @msrbuilds/emcp-proxy"command": "cmd","args": ["/c", "%APPDATA%\\npm\\emcp-proxy.cmd"]
Verify
Section titled “Verify”openclaw mcp probe emcp-toolsIf probe reports a timeout but the server is otherwise healthy, that is usually the probe’s short timeout against a remote round-trip, not a real failure, the server still works in a normal session. A clean HTTP 401 means the application password or username is wrong; a text/html response means the URL is missing the /wp-json/mcp/emcp-tools-server path and is hitting the site homepage.