The Model Context Protocol (MCP) is an open standard that lets AI agents call tools on another system. KanbanWP includes an MCP server, so an MCP-compatible agent can work with your boards the way a teammate would: read them, add tasks, move cards and leave comments.
This is different from the built-in AI features. There, KanbanWP calls a model with your key. Here, an outside agent calls KanbanWP, and the agent brings its own model and billing.
How it works
The server is a single endpoint on your site that accepts JSON-RPC 2.0 messages over HTTP POST. It is available at:
https://your-site.example/wp-json/kanbanwp/v1/mcpA GET request to that address returns a “Method Not Allowed” response. Agents authenticate with a site-wide token you generate in Settings. See Connecting an agent.
The server supports the initialize, tools/list and tools/call methods.
Tools
The server exposes seven tools.
| Tool | What it does | Main inputs |
|---|---|---|
list_boards | Lists all boards. | none |
get_board | Returns a board with its stages and tasks. | board_id |
list_tasks | Lists tasks on a board, optionally for one stage. | board_id, optional stage_id |
create_task | Creates a task. | board_id, title, optional description, stage, priority, assignee and due date |
update_task | Changes task fields. | task_id and any fields to change |
move_task | Moves a task to a stage. | task_id, stage_id, optional position |
add_comment | Adds a comment to a task. | task_id, content, optional author name |
Priorities are low, normal, high and urgent. Due dates use the YYYY-MM-DD format. If you omit stage_id when creating a task, the board’s first stage is used.
There is no delete tool. Destructive actions stay in the WordPress admin or WP-CLI, which keeps an agent from removing work.
What agents are good for
- Turning a meeting transcript into tasks on the right board.
- Triaging a backlog by priority.
- Posting a progress comment when a coding agent finishes a task.
- Creating a task from a bug report in another tool.
Audit trail
Every tool call is written to the activity log, and the entry records the agent’s name. Agents can identify themselves with an X-KanbanWP-Agent header, or with a field in the request. If they do not, the name defaults to mcp.
Writes made through MCP fire the same events as changes made in the interface. Your notifications, Slack or Discord messages and webhooks all react to them.
Security in one paragraph
The token grants read and write access to every board, regardless of who created it. Treat it like an admin key, keep it out of shared documents and client-side code, and regenerate it if it leaks. You can also switch the server off in Settings.