Directus vs WordPress

Directus

The built-in MCP server works under the connecting user's permissions, supports OAuth limited to the MCP endpoint and blocks deletes unless an administrator allows them. Since version 12 a licence check caps the free Core tier at 3 Studio seats, 25 collections and 5 flows, and the default tool list carries about 79 KB of instructions.

WordPress

The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Revisions can be read and deleted but not restored over REST, and a critical flaw was fixed on 22 September 2026.

Directus

1. Connect with OAuth or an Authorization: Bearer header. Don't put the token in the URL as ?access_token=, where it can be logged
2. Use /mcp?tool_mode=registry when the client loads every tool definition. Default mode sends each tool's full instructions, about 79 KB in total
3. Read the schema tool before writing. Item payloads are untyped objects, so field names and types come only from the data model
4. Publish a version with POST /versions/{id}/promote over REST. The MCP items tool refuses system collections such as directus_versions
5. Count translation and junction tables against the 25-collection Core limit before creating collections

WordPress

1. Ask the owner for a dedicated user with the lowest role that fits. A Contributor can draft and edit its own posts but can't publish them
2. Send the Application Password as Basic auth over HTTPS only. Core disables Application Passwords on plain HTTP outside a local environment
3. Upload a file with POST /wp-json/wp/v2/media first, then set featured_media or reference the returned URL in the post content
4. To roll back, GET /wp/v2/posts/<id>/revisions/<rev>?context=edit and POST its title and content to the post. There's no restore route
5. Pass _fields=id,status,link,modified on lists and read X-WP-TotalPages. per_page stops at 100