DevCubic AI Bridge for MCP

DevCubic AI Bridge for MCP turns your WordPress site into a Model Context Protocol (MCP) server. Any logged-in user can connect an AI assistant — Claude, ChatGPT, Gemini, or any other MCP-compatible client — by pasting a single URL and approving it in their browser, then read and manage site content straight from their AI chat. Compatible with any MCP client, including Anthropic Claude, OpenAI ChatGPT, and Google Gemini. (These are trademarks of their respective owners; this plugin is an independent project and is not affiliated with or endorsed by Anthropic, OpenAI, or Google.) The connection is scoped to the person who authorizes it. An AI acting for an Editor can do what that Editor can do; an AI acting for a Subscriber can only read. There are no API keys to generate or share — authorization works like an OAuth "Sign in with WordPress" button, using the user's own login. Security by design This plugin gives an AI real access to your site, so it is built to be conservative:

• Standards-based OAuth 2.1 with PKCE — the same authorization pattern used by major "Sign in with…" buttons.
• Every tool is gated by the connecting user's own WordPress capabilities, enforced twice: once when tools are advertised, and again inside WordPress core's REST controllers when a tool runs.
• Access tokens are stored only as SHA-256 hashes and can be revoked at any time.
• Administrators get site-wide policy switches and an audit log of every tool call.
• Your site talks only to the AI client the user connected — no data is sent to any third party.

How it works

1. Open DevCubic AI Bridge for MCP in your WordPress admin menu and copy the connector URL.
2. Paste it into your MCP-compatible client as a new connector.
3. The client opens your browser; you log in and approve the connection on a consent screen that lists exactly what you are granting.
4. The client receives an access token and can call the tools your role allows — nothing more.

Content tools

• Posts and Pages: list, get, create, update, delete
• Media: list, get, upload (from a URL or base64), delete
• Comments: list, get, create, update, delete
• Categories & tags: list, create, update, delete

WooCommerce (automatic when WooCommerce is active)

• Products: list, get, create, update, delete
• Orders: list, get, change status, add order notes
• Customers and coupons, plus a sales-report summary

Store tools require the manage_woocommerce capability (Administrators and Shop Managers) and run through WooCommerce's own REST controllers, so its validation and permission checks apply unchanged. Custom post types (automatic) Every public, REST-enabled post type — events, portfolios, job listings, and thousands of others provided by plugins or themes — automatically gets list, get, create, update, and delete tools, gated by that type's own capabilities. No per-plugin integration needed. Developers can filter which types are exposed with mcp_connector_custom_post_types. SEO (automatic with Yoast SEO or Rank Math) Read and set the SEO title, meta description, focus keyword, canonical URL, and noindex flag for any post or page. Site policy controls On top of user roles, administrators get explicit switches (DevCubic AI Bridge for MCP → Site policy):

• Read-only mode — connected AIs can read but never change anything.
• Require human review — AI-created content is saved as Pending Review, and published content cannot be modified through MCP.
• Deletion switch — hide every delete tool with one checkbox.
• Per-tool toggles — disable any individual tool, including tools added by other plugins.

A tool is available only when both the user's role and the site policy allow it, and the consent screen tells connecting users about active policies up front. Extend it Other plugins can register their own capability-gated MCP tools through the mcp_connector_tools filter, so any plugin can expose its features to connected AI clients safely. Requirements HTTPS is required in production (OAuth bearer tokens must travel over TLS). Works with any MCP-compatible AI client.

1.0.3

• Expanded the create/update tools for posts, pages, and custom post types with more standard fields: publish date (backdating and scheduling via "future" status), featured image, author, comment and pingback status, password, template, and — where applicable — post format and sticky (posts) or parent and menu order (hierarchical types). Fields are advertised per post type based on what each type supports, and WordPress still enforces the relevant capability on write. These values are also returned by the get tools so writes can be verified.

1.0.2

• Added Advanced Custom Fields (ACF) support. When ACF is active, custom fields whose field group has "Show in REST API" enabled can be read and written through the existing create/update/get tools for posts, pages, and custom post types, via a nested acf object built automatically from each post type's fields. Adds an admin diagnostic when ACF is active but no field group is exposed to REST.

1.0.1

• Added an optional, dismissible admin notice inviting a WordPress.org review. It appears only to administrators, only after the plugin has been in use for a week and at least one AI client has been connected, and never reappears once dismissed.

1.0.0 Initial release.

• OAuth 2.1 authorization (Dynamic Client Registration, PKCE, refresh-token rotation with a grace window) so any MCP client connects by pasting one URL and logging in through the browser.
• MCP JSON-RPC endpoint (initialize / tools/list / tools/call / ping) authenticated with per-user bearer tokens.
• Core content tools: posts, pages, media, comments, categories, and tags — each gated by the connected user's own WordPress capabilities and routed through core's REST controllers.
• WooCommerce tools (products, orders, customers, coupons, sales report) that appear automatically when WooCommerce is active, gated by manage_woocommerce.
• Automatic tools for every public, REST-enabled custom post type, gated by each type's own capabilities.
• SEO tools (get/set title, meta description, focus keyword, canonical, noindex) when Yoast SEO or Rank Math is active.
• Site policy controls: read-only mode, "require human review" publishing, a deletion kill-switch, and per-tool toggles.
• Audit log of every tool call with an admin viewer, plus admin diagnostics for OAuth discovery and subdirectory installs.
• mcp_connector_tools and mcp_connector_custom_post_types filters for extending the tool catalog.
• Security: SSRF protection and size caps on media uploads, per-IP rate limiting on the registration and token endpoints, hashed token storage, and a daily cleanup cron.