| 开发者 | easymcpai |
|---|---|
| 更新时间 | 2026年6月1日 00:40 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
wp_history_* toolswp_history_list, wp_history_get, and wp_history_diff tools — plus a full Change History admin page with retention and on/off controls
Gutenberg & Full Site Editing — create, edit, and reuse Gutenberg blocks; update block templates and global styles for FSE themes
Custom Post Types (CPT) — read and write any registered custom post type — portfolios, listings, courses, reviews, anything
Google Analytics 4 — ask about traffic, top pages, conversions, custom dimensions/metrics, and realtime active users
Google Search Console — ask about top search queries, clicks, impressions, sitemaps, and URL indexing status
Semrush — pull domain overviews, keyword research, organic competitors, keyword difficulty and related keywords, question phrases, and backlink overview / referring domains / anchors for any target
DataforSEO — run on-page SEO audits on any URL, check keyword search volumes and trends, pull live SERP results, analyse backlinks, and look up ranked keywords for any domain
Any Plugin — automatically connects to plugins that support WordPress 6.9+ Abilities API, no custom code needed
Ask your AI anything — for example:
since / until filters and pagination
wp_history_get — fetch a single change record with full before/after JSON snapshots
wp_history_diff — compute a structured diff between any recorded snapshot and either another snapshot or the current live state of the object
Non-admin tokens see only their own changes. Administrators (with the new easy_mcp_ai_view_all_history capability — granted to the Administrator role on activation) see every user's changes. Sensitive keys are redacted before storage, sensitive post meta keys (matching patterns like *_token, *_secret, *password*, *api_key*) are redacted at write time, and snapshot size is capped. The wp_history_diff tool also enforces these gates when reading the current live state: meta requires edit_post, options require manage_options, and protected meta keys are excluded entirely. Site owners can narrow query scope further via the easy_mcp_ai_history_query_scope filter (the self-pin for non-admins cannot be weakened by the filter).
11 Google Analytics 4 Tools
Account & Property — list account summaries, get property details, check compatibility, get metadata
Reports — run standard reports, pivot reports, and realtime reports
Configuration — list data streams, conversion events, custom dimensions, and custom metrics
6 Google Search Console Tools
Sites — list verified properties
Search Analytics — query top search terms, pages, countries, devices with clicks, impressions, CTR, and position
Sitemaps — list and inspect submitted sitemaps
URL Inspection — check indexing status and coverage for any URL on your site
13 Semrush Tools
Domain — domain overview and organic competitor research
Keywords — keyword research tools: domain organic keywords, URL organic keywords, keyword overview, related keywords, keyword difficulty, and phrase questions
Backlinks — backlinks overview, backlinks list, referring domains, and anchors
Account — check your Semrush API units balance at any time
8 DataforSEO Tools
SERP — fetch live search engine results pages for any keyword and location
Keywords — look up monthly search volume and trend data for one or more keywords
Labs — get ranked keywords for any domain, or find keywords a specific page ranks for
Backlinks — get a backlink summary and list of referring domains for any target URL
On-Page — run a full on-page SEO audit on any URL and get a list of actionable issues
Account — check your DataforSEO API account balance at any time
46 WooCommerce MCP Tools
Products — list, get, create, update, delete products
Product Variations — list, get, create, update, delete product variations
Product Attributes — list, create, and set product attributes
Product Categories — list product categories
Orders — list, get, create, update orders; list order notes, create order note; list order refunds (read-only)
Customers — list, get, create, update, delete customers
Coupons — list, get, create, update, delete coupons
Webhooks — list, get, create, update, delete webhooks
Shipping — list shipping zones, list shipping methods
Tax — list tax rates
Payment — list payment gateways
Reports — sales, orders, products, top sellers, customers
Batch — bulk create, update, or delete products, variations, and orders in a single request
7 Plugin Integrations
WooCommerce — 46 WooCommerce AI tools for products, orders, customers, coupons, shipping, reports, and more
Advanced Custom Fields (ACF) — 6 tools to get and update ACF fields on posts, users, and terms; list ACF field groups
The Events Calendar — 10 tools to create and manage events, venues, and organizers
BuddyPress — 10 tools for members, activity stream, groups, group members, and private messages
Yoast SEO — get and update post SEO metadata, meta description, and rendered SEO head output
Rank Math — get and update post SEO metadata, meta description, and rendered SEO head output
All in One SEO (AIOSEO) — get and update post SEO metadata
Connect Any Plugin with Abilities API
WordPress 6.9+ introduces Abilities API — a standard way for plugins to declare what they can do. Easy MCP AI acts as an MCP adapter for any plugin that registers Abilities — automatically discovering and exposing them as MCP tools with no custom code needed. If a plugin supports the Abilities API, your AI can use it out of the box.
One-Click Connect with OAuth 2.0/2.1
Skip manual token copy-paste. Your WordPress MCP endpoint ships with a full OAuth 2.0/2.1 authorization server — PKCE, refresh-token rotation, and Dynamic Client Registration (RFC 7591) built in. Compatible MCP clients like Claude Desktop can connect with a single click: they register themselves, you approve the scopes on a consent screen, and you're done. Bearer tokens still work for power users and automation.
Built for Security
Giving an AI access to your site is serious — so security is built into every layer:
Easy MCP AI is a free WordPress AI connector that turns your site into a remote MCP (Model Context Protocol) server. Once activated, any MCP-compatible AI assistant or AI agent — Claude (Anthropic), ChatGPT (OpenAI), Cursor, Gemini AI, n8n, and more — can read and write content, manage media, users, and settings, and pull SEO and analytics data through 204 ready-to-use tools. No Node.js, no proxy, no extra hosting.
Yes. Easy MCP AI acts as a WordPress MCP adapter — a full MCP server implementing the Model Context Protocol spec (v2025-11-25, with backwards compatibility for v2025-06-18 and v2025-03-26) directly inside WordPress. Your site exposes a single MCP endpoint at /wp-json/easy-mcp-ai/v1/mcp that any MCP client can connect to over HTTPS.
MCP is an open standard created by Anthropic that lets AI assistants and AI agents securely connect to external tools and data sources. It's quickly becoming the universal protocol for AI-to-app communication, supported by Anthropic, OpenAI, Google, and dozens of other platforms. Learn more at modelcontextprotocol.io.
Most WordPress AI plugins embed a single AI provider (OpenAI, Claude, etc.) inside the wp-admin and bill you for usage. Easy MCP AI does the opposite — it makes your WordPress site an agent-ready backend that any AI assistant can connect to over MCP. You bring your own AI client, you bring your own model, and the plugin focuses on giving that AI safe, scoped access to your site: 214 tools, OAuth 2.0/2.1 one-click connect, per-token permissions, and a full audit trail.
Yes. This WordPress MCP plugin is free and open source on the WordPress.org plugin directory. There are no paid tiers, no usage limits, and no telemetry. Optional external integrations (Semrush, DataForSEO, Google Analytics, Search Console) use your own third-party accounts — Easy MCP AI never bills you for API usage.
After activation, go to Easy MCP AI → Dashboard and copy your MCP server URL. Then:
Yes. Easy MCP AI ships with first-party WooCommerce AI tool sets: WooCommerce (46 tools — products, orders, customers, coupons, reports, shipping, webhooks), Advanced Custom Fields (ACF) (6 tools to get and update ACF fields and ACF field groups on posts, users, and terms), The Events Calendar (10 tools), BuddyPress (10 tools), Yoast SEO, Rank Math, and All in One SEO (AIOSEO). Each integration only loads if the underlying plugin is active, and each tool group can be toggled individually under Easy MCP AI → Plugin Integrations.
Yes. Once connected, your AI acts as a writing assistant for WordPress — drafting posts, editing existing content, updating meta descriptions for SEO, and publishing — all from a single conversation. It works with Claude, ChatGPT, Gemini AI, or any other AI tool that supports MCP.
Go to Easy MCP AI → External Data. Each service has its own section:
No. Easy MCP AI does not call any AI provider. The flow is the opposite: your AI assistant (Claude by Anthropic, ChatGPT by OpenAI, etc.) calls your WordPress site, and the plugin executes whatever tool the AI requested. Your content only leaves your server in the response that goes back to the AI client you connected — never to a third party you didn't choose. Outbound connections to Semrush / DataForSEO / Google APIs only happen if you explicitly configure those credentials, and they only receive the per-call parameters (keywords, target URLs, date ranges) — not your post content.
Two options, both production-grade:
Skip the copy-paste. In a supported client like Claude Desktop or Cursor, paste your MCP URL, sign in to WordPress, tick the permission categories (Read / Write per content type, GA4, Google Search Console, Semrush, etc.) on the consent screen, and click Approve. The client receives a short-lived access token plus a rotating refresh token, and you can revoke it anytime from the admin. Under the hood the plugin implements the full OAuth 2.1 spec: PKCE (S256), RFC 7591 Dynamic Client Registration, refresh-token reuse detection (RFC 9700), RFC 8707 audience binding, RFC 8414 and RFC 9728 discovery endpoints, and RFC 7009 revocation. No AI client ever sees your WordPress password.
No configuration required — OAuth 2.0/2.1 endpoints are live as soon as the plugin is activated. You can manage registered clients and revoke per-user grants under Easy MCP AI → API Token & OAuth → OAuth tab. Bearer tokens continue to work alongside OAuth for power users and automation.
Yes, fully. Each token has its own permission set — you choose exactly which of the 214 tools it can call. Create a read-only token for a summarization AI, a content-only token for your AI writing assistant, and a full-access token for your trusted automation workflows.
Permissions are enforced at the WordPress capability level, not per-post. Easy MCP AI runs every tool call as the WordPress user the token is bound to, so the AI inherits exactly that user's edit_posts / edit_others_posts / publish_posts caps. If you want an AI restricted to, say, drafts only, create a dedicated low-privilege WordPress user (Contributor or Author) and bind the token to that user. Additionally, the Force Draft setting under Settings forces every create operation to draft status regardless of the AI's request.
For OAuth-connected clients, go to Easy MCP AI → API Token & OAuth → OAuth and click Revoke next to the grant — the client immediately loses access and any active refresh tokens are invalidated. For Bearer tokens, go to Easy MCP AI → API Tokens and delete the token. Either action is instant and irreversible.
Go to Easy MCP AI → Audit Log. Every tool call is recorded in the user activity log with the token used, the tool name, the arguments, the result, the client IP, and a timestamp. The audit trail is paginated and searchable, and retention is configurable under Settings (default 30 days, after which old rows are auto-purged).
Only if you let it. By default, the AI can create posts in whatever status it asks for (draft, publish, etc.) — but you can flip the Force Draft on Create setting under Easy MCP AI → Settings and every newly created post or page will be forced to draft regardless of what the AI requested. Combine that with a Contributor-level WordPress user for the AI to require human review before anything goes live.
Yes — Easy MCP AI is built for production. Every request is authenticated (OAuth 2.0/2.1 or Bearer), capability-checked against WordPress core permissions, rate-limited (default 60 req/min per token, configurable), and recorded in the audit trail. You can additionally restrict the endpoint to specific IP addresses, force all created content to draft, disable specific tools globally, and bind tokens to low-privilege WordPress users. The plugin only requires HTTPS for OAuth flows — bearer-token access is allowed over HTTP for local development but should never be exposed that way on a live site.
Yes. Easy MCP AI runs per-site on a multisite network — each subsite has its own MCP endpoint, its own tokens, and its own audit log. Network-scoped operations (network options, sitewide plugin/theme activation) are additionally gated on Super Admin + manage_network_options / manage_network_plugins capabilities, so a per-site admin token cannot reach network-level state.
Yes. On loopback addresses (127.0.0.1, ::1) the OAuth HTTPS requirement is automatically relaxed so you can test against http://localhost. For non-loopback dev setups behind a reverse proxy that terminates TLS elsewhere, add define('EASY_MCP_AI_OAUTH_ALLOW_HTTP', true); to wp-config.php. Never set that flag on a production site. Bearer-token access works over HTTP without any flag, but again, only for dev.
Yes to both. The post and page tools accept a post_type parameter so your AI can work with any registered CPT on your site (wp_list_cpt_items, wp_create_cpt_item, etc.). For Gutenberg, there are dedicated tools for AI blocks and reusable blocks (wp_list_blocks, wp_create_block, wp_update_block) and block templates (wp_list_templates, wp_get_template, wp_update_template), plus full global styles support (wp_get_global_styles, wp_update_global_styles).
Yes. Create one token (or one OAuth grant) per assistant. Each tracks its own usage, has its own scoped permissions, and is logged independently in the user activity log — so you can see exactly which AI did what.
WordPress 6.0+ and PHP 7.4+. PHP 8.0 or higher is recommended. WordPress 6.9+ unlocks the Abilities API auto-discovery feature, which exposes any Abilities-compatible plugin as MCP tools with no extra code.
No long-running processes, no Node.js, no Docker. The plugin runs entirely inside WordPress as a normal PHP plugin. The plugin contacts external services (Semrush, DataForSEO, Google Analytics 4, Google Search Console) only if you explicitly add those third-party account credentials under Easy MCP AI → External Data — see the External services section above. Out of the box, nothing leaves your server.
Authorization: Bearer <token> header is being sent (some reverse proxies strip it).Please report security bugs found in the source code of the Easy MCP AI for WordPress plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.
wp_history_list, wp_history_get, wp_history_diff) let any AI client query its own change historywp_semrush_*): domain overview, organic keywords, organic competitors, keyword overview, related keywords, keyword difficulty, phrase questions, backlinks overview/list/referring-domains/anchors, URL organic keywords, and a free API-units balance checkmcp:semrush:read covering all 13 Semrush tools, with consent-screen entry gated on a saved API keymcp:ga:read (Google Analytics tools) and mcp:gsc:read (Search Console tools)wp-mcp/v1 to easy-mcp-ai/v1