Claude Bridge – WordPress plugin

Claude Bridge is a WordPress plugin that exposes a secure REST API allowing Claude (through a local MCP server) to read and edit your theme files and to manage your site’s plugins, options, media library and database. Every write is preceded by an automatic backup and PHP syntax validation.

Version 1.0.0 · WordPress 5.6 or later · PHP 7.4 or later · GPL-2.0+ license · Synaptic CRM Dev Team

Features

Claude Bridge groups its functions into seven tools, which you enable or disable one by one:

• Theme: list, read, create and edit the active theme’s files, including targeted edits (insert, replace or delete by line or by anchor).
• Plugins: list, search, install, activate, deactivate and update plugins.
• Plugin code: read and edit the source code of installed plugins (Claude Bridge itself is protected).
• Options: read, search and edit WordPress options.
• Database: list tables and run read-only queries. SQL writes additionally require the CLAUDE_BRIDGE_ALLOW_SQL_WRITE constant in wp-config.php.
• Media library: upload images (logos, illustrations…), with alt text and attachment to a post.
• Backups: list and restore the copies created automatically before each change.

Large files are sent in several chunks, with a SHA-256 integrity check.

Security

• Access restricted to administrator accounts, authenticated with a dedicated WordPress application password (never the regular password).
• HTTPS required: a warning is shown in the admin area if the site is not using SSL.
• Only three tools are enabled by default (Theme, Plugins, Options). A disabled tool returns a 403 error on all its routes, even with valid credentials.
• Automatic backup before every change and PHP syntax check before writing.
• The most dangerous SQL operations (DROP DATABASE, GRANT, CREATE USER, deleting WordPress core tables…) are always forbidden.

Installation

Option A: from the ZIP file (the easiest)

1. Download the ZIP file with the button above (it already contains the claude-bridge folder, do not unzip it).
2. Log in to the WordPress admin: https://your-site.tld/wp-admin.
3. In the left-hand menu, click Plugins then Add New Plugin.
4. At the top of the page, click Upload Plugin.
5. Click Choose File, select the downloaded ZIP file, then click Install Now.
6. Once the installation is complete, click Activate Plugin.

Option B: by file transfer (FTP, SFTP or file manager)

1. Unzip the archive and copy the claude-bridge folder as is into wp-content/plugins/claude-bridge/.
2. In the WordPress admin, open Plugins then Installed Plugins.
3. Find Claude Bridge in the list and click Activate under its name.

Configuration: choose the allowed tools

Open Settings then Claude Bridge. Each tool has its own checkbox:

• Theme: enabled by default
• Plugins: enabled by default
• Plugin code: disabled by default (risky)
• Options: enabled by default
• Database: disabled by default (direct SQL access)
• Media library: disabled by default
• Backups: disabled by default

Check only the tools you need, then click Save. You can come back to this page at any time.

Create an application password

Claude Bridge does not work with the account’s regular password. You need to create a dedicated application password, with an administrator account, on a site using HTTPS.

1. In the admin area, click your name at the top right (or Users then Profile).
2. Scroll down to the Application Passwords section, at the bottom of the page.
3. Enter a name to recognize it, for example Claude Bridge.
4. Click Add New Application Password.
5. WordPress displays the password only once (4 groups of 4 characters). Copy it immediately into a password manager.

Information to give to the local MCP server (or to the tool calling the API):

• Site URL: https://your-site.tld
• Username: your WordPress login
• Password: the generated application password (not your regular password)

Test the connection (optional)

curl -u "your_username:xxxx xxxx xxxx xxxx" 
     https://your-site.tld/wp-json/claude-bridge/v1/info

If everything is correct, the command returns a JSON object with the plugin version, the WordPress version and the active theme.

To revoke access later, go back to your profile page, Application Passwords section, and click Revoke next to the “Claude Bridge” password.