Site-level InstaMCP
One authenticated endpoint works inside one InstaWP-hosted site. InstaWP positions it for structured WordPress work from chat and coding clients. Setup starts with a dashboard toggle and a generated connection URL.
Independent server or managed WordPress platform
Choose WPGuard when your sites cannot live inside one hosting platform.
WPGuard connects the WordPress sites you already manage, keeps corrections with the work, previews guarded edits, and returns desktop and mobile proof. No hosting migration required.
What is the difference between WPGuard and InstaWP?
Managed InstaMCP starts inside the InstaWP hosting platform. WPGuard Core runs on infrastructure you control and reaches WordPress through SSH with WP-CLI or the WPGuard companion plugin.
| Question | InstaMCP | WPGuard |
|---|---|---|
| Where does it run? | InstaWP documents a managed, per-site MCP endpoint for WordPress sites hosted on its platform. | You install the Python server or build it with Docker, then register one or more sites you can reach. |
| How does it connect? | Enable MCP in the InstaWP dashboard and paste the generated token-authenticated URL into a compatible client. | Add the Streamable HTTP endpoint and bearer token to Claude, Cursor, Codex, or another compatible client. |
| What can it operate? | InstaWP documents 43 typed tools for content, taxonomies, blocks, meta, plugins, themes, media, diagnostics, skills, memory, and capabilities. | WPGuard includes named inspection, content, metadata, settings, file, block, packet, snapshot, and advanced administration tools. Permissions and safeguards vary by tool. |
| How is powerful access gated? | InstaWP documents read, write, delete, and admin scopes. Safe Mode narrows access. Raw PHP, SQL, and file tools start disabled and require separate opt-in. | WPGuard uses recon, mutate, and admin token tiers. Its companion key remains an administrative credential, and advanced operations are outside the three correction-aware write paths. |
| What does recovery mean? | InstaWP offers disposable sandboxes, hosting backups and snapshots, plus CLI restore workflows. Those platform controls are not automatic rollback for every MCP action. | Supported value mutations save prior values. WPGuard does not promise that every operation is reversible, so normal site backups remain required. |
InstaMCP, the InstaWP account MCP, and the InstaWP CLI solve different jobs.
Separate the site-level connector from the tools around it before comparing products.
Account-level MCP
InstaWP documents a separate OAuth connection for account and fleet operations. It can manage hosting-level work across sites. That surface is different from the tools inside one WordPress installation.
InstaWP CLI
The CLI handles provisioning, local-to-cloud workflows, deployment, synchronization, and rollback around hosted sites. Do not attribute those CLI abilities to every site-level MCP mutation.
Open-source mcp-wp
InstaWP also maintains a separate open-source Node MCP server that uses WordPress REST credentials. Its setup and security model differ from managed InstaMCP.
Which WordPress MCP fits your workflow?
Use the site you actually operate and the change you actually need. Product labels do not prove field coverage, preview behavior, or recovery.
Choose managed InstaMCP for an InstaWP-hosted site
The platform removes a separate server install and provides a site URL, scoped token, Safe Mode, and surrounding hosting controls. It is the direct path when the site already lives on InstaWP.
Choose WPGuard for an independent runtime
WPGuard fits teams that want to operate the MCP server themselves, connect sites across hosting environments, retain local change records, and configure exact-target correction checks on its supported mutations.
Test approval at the operation level
InstaMCP documents client-side tool approvals, scopes, Safe Mode, and separate enablement for powerful tools. Its public docs reviewed here do not describe a native approval packet for every change. WPGuard packets cover guarded value writes, but a mutate-scoped caller can approve them.
Test verification in the browser
List the page, preview a guarded edit, apply it, and read the result back. WPGuard then captures desktop and mobile screenshots and checks expected text, headings, overflow, and broken images.
Run the same staging task through both.
Name the site, target, expected value, preserved requirement, and recovery plan before either tool writes.