Invizo MCP – Secure AI Connector for Claude, Codex, Cursor and WooCommerce
| 开发者 | invizo |
|---|---|
| 更新时间 | 2026年7月14日 16:10 |
| 捐献地址: | 去捐款 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
https://example.com/wp-json/mcp/invizo
Invizo MCP uses WordPress Application Passwords, administrator-only access, granular scopes, and the WordPress Abilities API. Administrators decide exactly what an AI client can discover and execute: read-only content, post creation, WooCommerce operations, media uploads, Elementor workflows, Rank Math metadata, LearnPress course actions, Events Calendar management, and more.
No Invizo account, subscription, license key, telemetry, or Invizo cloud service is required.
Why choose Invizo MCP?
- Self-hosted WordPress MCP server: WordPress serves MCP JSON-RPC at
/wp-json/mcp/invizo. - Security-first access: only authenticated administrators with WordPress Application Passwords can connect.
- Granular permissions: separate read, write, and delete scopes for WordPress content and integrations.
- Compact AI tool surface: exposes
discover-abilities,get-ability-info, andexecute-abilityinstead of flooding clients with dozens of top-level tools. - Official MCP packages: bundles the GPL-compatible WordPress MCP Adapter and PHP MCP Schema packages.
- Works with major clients: copy-ready setup for Claude Code, Claude Desktop, Codex, Cursor, and Antigravity.
- WooCommerce-ready: read, create, edit, and delete store data when WooCommerce scopes are enabled.
- Builder and SEO support: Gutenberg, Elementor, and Rank Math SEO scopes for content and metadata workflows.
- LMS and event workflows: LearnPress and The Events Calendar integrations activate only when those plugins are installed.
- No external Invizo service: no dashboard handshake, no shared secret, no remote Invizo backend.
- Read, create, update, delete, and search posts.
- Read, create, update, and delete pages.
- Upload, edit, read, and delete media.
- Manage categories, tags, and taxonomy terms.
- Read, create, edit, moderate, and delete comments.
- Read revisions and delete revisions.
- Read reusable blocks and patterns.
- Create and edit reusable blocks.
- Read and update block templates.
- Read and update global styles.
- Search site content.
- Read, create, edit, and delete users.
- Read, create, edit, and delete menus.
- Read site settings and structure.
- Update safe site settings through allowlisted handlers.
- Read plugins and themes.
- Discover post types, taxonomies, and post statuses.
- Read custom post types.
- Create and edit custom post type definitions.
- Delete MCP-managed custom post type definitions.
- Read post meta.
- Update post meta.
- Manage MCP-defined metadata fields without deleting existing WordPress content on uninstall.
- Work with Gutenberg content and page-builder workflows.
- Work with Elementor page data when Elementor is active.
- Read and update Rank Math SEO metadata when Rank Math SEO is active.
- Read WooCommerce products, variations, orders, customers, coupons, and terms.
- Create and update WooCommerce products, variations, customers, coupons, order notes, order statuses, and product terms.
- Delete WooCommerce data only when delete scopes are enabled.
- Read LearnPress courses, lessons, quizzes, questions, orders, terms, and enrollments.
- Create and edit LearnPress data when LearnPress is active.
- Delete LearnPress data only when delete scopes are enabled.
- Use LearnPress builder workflows when enabled.
- Read Events Calendar events, venues, and organizers.
- Create and edit event data when The Events Calendar is active.
discover-abilitiesget-ability-infoexecute-ability
- Claude Code
- Claude Desktop
- Codex
- Cursor
- Antigravity
@automattic/mcp-wordpress-remote bridge through npx. Clients that support authenticated remote HTTP MCP can connect directly to the WordPress endpoint.
Built for administrators, developers, stores, agencies, and site managers
Invizo MCP is for WordPress administrators, WooCommerce store owners, agencies, developers, SEO teams, educators, and site maintainers who want trusted AI clients to work with WordPress through a documented, scoped protocol.
Use read-only scopes for research and reporting. Add write scopes for content workflows. Enable delete scopes only for trusted clients and tested workflows.
Authentication
Invizo MCP uses WordPress Application Passwords and WordPress REST authentication.
Only authenticated users with the manage_options capability can access the MCP transport or execute Invizo abilities. In a standard WordPress installation this means administrators only.
Create a dedicated Application Password from Settings > Invizo MCP for every AI client or computer. Passwords can be revoked individually from the same screen.
Application Passwords normally require HTTPS. Local HTTP sites can enable them by setting:
define( 'WP_ENVIRONMENT_TYPE', 'local' );
Security plugins can disable Application Passwords. Invizo reports this condition on its settings screen.
Scopes and safeguards
Administrators choose exactly which read, write, and delete scopes are enabled. Abilities outside enabled scopes are hidden from MCP discovery and rejected during execution.
Optional integration scopes are unavailable unless their required plugin is active.
Existing handler safeguards remain in place, including:
- WordPress sanitization and validation.
- Plugin availability checks.
- Scope checks inside action handlers.
- Dry-run previews for supported risky operations.
- Explicit
confirm: truerequirements for supported destructive operations. - Reserved metadata protection and safe site-setting allow lists.
- Read Posts
- Create/Edit Posts
- Delete Posts
- Read Media
- Upload/Edit Media
- Delete Media
- Read Pages
- Create/Edit Pages
- Delete Pages
- Read Categories and Tags
- Create/Edit Categories and Tags
- Delete Categories and Tags
- Read Comments
- Create/Edit Comments
- Delete Comments
- Read Users
- Create/Edit Users
- Delete Users
- Read Menus
- Create/Edit Menus
- Delete Menus
- Read Custom Post Types
- Create/Edit Custom Post Types
- Delete Custom Post Types
- Read Post Meta
- Update Post Meta
- Read Revisions
- Delete Revisions
- Read Reusable Blocks and Patterns
- Create/Edit Reusable Blocks
- Delete Reusable Blocks
- Read Block Templates
- Update Block Templates
- Read Global Styles
- Update Global Styles
- Read Site Settings and Structure
- Update Safe Site Settings
- Read Plugins and Themes
- Search Site Content
- Gutenberg Page Builder
- Elementor Page Builder
- Rank Math SEO
- Read Events Calendar Data
- Create/Edit Events Calendar Data
- Read WooCommerce Data
- Create/Edit WooCommerce Data
- Delete WooCommerce Data
- Read LearnPress Data
- Create/Edit LearnPress Data
- Delete LearnPress Data
- LearnPress Page Builder
- Endpoint enabled/disabled status and selected scopes in the
invizo_mcp_settingsoption. - MCP-managed custom post type definitions in the
invizo_mcp_registered_cptsoption. - MCP-managed post meta definitions in the
invizo_mcp_registered_meta_fieldsoption. - A plugin version option used for upgrades.
安装:
- Install the Invizo MCP release ZIP, including its bundled
vendordirectory. - Activate the plugin on WordPress 6.9 or newer.
- Open Settings > Invizo MCP.
- Enable the MCP endpoint.
- Select only the scopes your agent needs.
- Create an Application Password.
- Choose Claude, Codex, Cursor, or Antigravity and copy the generated configuration.
- Restart or reload the AI client.
- Verify the connection by listing the server tools and running
discover-abilities.
- WordPress 6.9 or newer.
- PHP 7.4 or newer.
- HTTPS for normal Application Password support. WordPress local environments may use HTTP when
WP_ENVIRONMENT_TYPEis set tolocal. - An MCP client that supports remote HTTP MCP or a compatible local STDIO bridge.
常见问题:
What is Invizo MCP?
Invizo MCP is a WordPress MCP server plugin. It gives approved AI clients a secure Model Context Protocol endpoint for reading and managing WordPress content, WooCommerce data, builders, SEO metadata, LMS content, events, custom post types, and metadata.
Is Invizo MCP a WordPress MCP server?
Yes. Invizo MCP hosts a native MCP endpoint inside WordPress at /wp-json/mcp/invizo.
What is the Model Context Protocol?
The Model Context Protocol, or MCP, is an open protocol that lets AI clients discover tools, inspect input schemas, and execute actions on connected systems. Invizo MCP uses MCP to expose WordPress abilities to authorized AI clients.
Which AI clients work with Invizo MCP?
Invizo MCP includes setup instructions for Claude Code, Claude Desktop, Codex, Cursor, and Antigravity. Other MCP-compatible clients can connect when they support authenticated remote HTTP MCP or a local STDIO bridge.
Can I connect Claude to WordPress?
Yes. Use the Claude Code or Claude Desktop configuration generated on the Invizo MCP settings page. The configuration points Claude to your WordPress MCP endpoint and authenticates with a WordPress Application Password.
Can I connect Codex to WordPress?
Yes. Invizo MCP provides a Codex config.toml example for both project-level and global Codex configuration. After adding the generated MCP server block, restart Codex and verify the server exposes discover-abilities, get-ability-info, and execute-ability.
Can I connect Cursor to WordPress?
Yes. Invizo MCP provides Cursor mcp.json examples for project and global configuration. Cursor can use the local @automattic/mcp-wordpress-remote bridge when needed.
Does Invizo MCP work with ChatGPT?
Invizo MCP is built on the open Model Context Protocol. It can work with MCP-compatible clients that support remote HTTP MCP or a local bridge. Use the client configuration format supported by your ChatGPT MCP environment.
Does Invizo MCP require Node.js?
WordPress itself does not need Node.js to run Invizo MCP. Some desktop clients use npx @automattic/mcp-wordpress-remote as a local bridge on the computer running the AI client.
Does Invizo MCP contact an Invizo cloud service?
No. Invizo MCP does not contact api.mcp.invizo.io, does not require an Invizo account, and does not send usage analytics to Invizo. WordPress hosts the MCP endpoint.
Does Invizo contact api.mcp.invizo.io?
No. Version 2.0 does not require or contact an Invizo backend.
Is WordPress itself the MCP server?
Yes. WordPress serves MCP JSON-RPC requests at /wp-json/mcp/invizo.
How is Invizo MCP different from hosted WordPress AI connectors?
Invizo MCP is self-hosted. Your WordPress site runs the endpoint, uses WordPress Application Passwords, and relies on administrator-selected scopes. No Invizo-hosted relay is required.
How is Invizo MCP different from a generic REST API wrapper?
Invizo MCP uses the Model Context Protocol and the WordPress Abilities API. AI clients can discover available abilities, inspect schemas, and execute scoped actions through MCP instead of guessing REST routes.
What tools does Invizo MCP expose?
It exposes three compact tools: discover-abilities, get-ability-info, and execute-ability. Those tools provide access to the allowed WordPress abilities without publishing every action as a separate top-level MCP tool.
Can I control what AI is allowed to do?
Yes. Administrators select the exact read, write, and delete scopes. Disabled scopes are hidden from MCP discovery and rejected during execution.
Can I make a read-only AI connection?
Yes. Enable only read scopes, such as Read Posts, Read Pages, Read Media, Read WooCommerce Data, or Read Site Settings and Structure.
Can AI create or edit posts and pages?
Yes, when Create/Edit Posts or Create/Edit Pages is enabled. You can keep those scopes disabled for read-only clients.
Can AI delete content?
Only when the relevant delete scope is enabled. Keep delete scopes disabled unless the client and workflow are trusted.
Does Invizo MCP work with WooCommerce?
Yes. When WooCommerce is active and WooCommerce scopes are enabled, Invizo MCP can expose abilities for products, variations, orders, order notes, order statuses, coupons, customers, and product terms.
Does Invizo MCP work with Elementor?
Yes. Elementor scopes become available when Elementor is active. Invizo MCP can expose Elementor page-builder workflows to authorized MCP clients.
Does Invizo MCP work with Gutenberg?
Yes. Invizo MCP includes Gutenberg page-builder support and abilities for reusable blocks, patterns, block templates, and global styles.
Does Invizo MCP work with Rank Math SEO?
Yes. Rank Math SEO scopes become available when Rank Math SEO is active.
Does Invizo MCP work with LearnPress?
Yes. LearnPress read, write, delete, and builder scopes become available when LearnPress is active.
Does Invizo MCP work with The Events Calendar?
Yes. Events Calendar read and write scopes become available when The Events Calendar is active.
Does Invizo MCP work with custom post types and custom fields?
Yes. Invizo MCP includes scopes for custom post types, custom post type items, post meta, and MCP-managed metadata definitions.
Why do some clients still use npx?
Some desktop clients communicate with local STDIO MCP processes more reliably than remote authenticated HTTP endpoints. @automattic/mcp-wordpress-remote is a local transport bridge; it is not an Invizo-hosted server.
Can editors connect?
No. Invizo requires manage_options at the MCP transport and ability layers.
How does authentication work?
Invizo MCP uses WordPress Application Passwords. Create a dedicated Application Password for each AI client or computer, then store that credential in the client configuration.
Why should I create one Application Password per AI client?
Separate credentials make revocation simple. If one computer, client, or workflow should stop connecting, revoke only that Application Password.
Can I revoke AI access?
Yes. Revoke the Application Password from the Invizo MCP settings page or the WordPress user profile. Revocation immediately stops that credential.
What happens when the endpoint is disabled?
The Invizo MCP route is not initialized. Existing Application Passwords remain valid WordPress credentials until revoked, but they cannot access an inactive Invizo endpoint.
Why is an integration scope disabled?
WooCommerce, Elementor, Rank Math SEO, LearnPress, and The Events Calendar scopes require the corresponding plugin to be active.
Does Invizo MCP publish posts automatically?
Invizo MCP executes what the authenticated AI client requests and what enabled scopes allow. Review client prompts carefully, use read-only scopes when possible, and test write workflows on staging before using them on production.
Is Invizo MCP safe for live WooCommerce stores?
It can be used on live stores, but write and delete scopes can affect products, orders, coupons, customers, and terms. Use dedicated credentials, least-privilege scopes, and staging tests for risky workflows.
Does Invizo MCP store my AI prompts?
Invizo MCP stores plugin settings, selected scopes, MCP-managed CPT definitions, and MCP-managed metadata definitions. It does not collect analytics or send usage data to Invizo.
What happens when I uninstall Invizo MCP?
Invizo-created Application Passwords are revoked. Plugin settings and MCP-managed CPT/meta definitions are deleted only if uninstall cleanup is enabled. Existing posts and post meta values are never deleted by the uninstaller.
Why do I see 401 Unauthorized?
Check that the Application Password is correct, the WordPress user is an administrator, Application Passwords are available on the site, and the client is sending HTTP Basic authentication correctly.
Why do I see no abilities in my AI client?
Confirm the endpoint is enabled, at least one scope is selected, required integration plugins are active, and the AI client has been restarted after adding the configuration.
Can I use Invizo MCP on localhost or staging?
Yes. Application Passwords normally require HTTPS. Local HTTP sites can enable them by setting WP_ENVIRONMENT_TYPE to local.
Does Invizo MCP support multisite?
Invizo MCP is designed for administrator-only access on the site where it is active. Test multisite workflows carefully because scopes and capabilities can vary by network and site configuration.
Where do I report security issues?
Please report security issues privately through https://invizo.io/ so they can be handled before public disclosure.
更新日志:
- Updated the WordPress.org short description to better target Claude, ChatGPT, Codex, Cursor, WooCommerce, SEO, media, users, builders, LMS, and events.
- Bumped the plugin header, runtime version, and stable tag for the listing copy update.
- Rewrote the WordPress.org title, short description, feature overview, scope list, and FAQ for clearer MCP, Claude, Codex, Cursor, WooCommerce, builder, SEO, LMS, and security positioning.
- Updated the plugin header description to better describe the standalone WordPress MCP server and supported integrations.
- Bumped the release version for WordPress.org resubmission after the bundled dependency diagnostic and settings header fixes.
- Confirmed the settings page no longer shows the source-archive dependency warning when Composer dependencies are bundled.
- Replaced dynamic option keys in site settings handlers with explicit WordPress core option references to satisfy plugin review requirements.
- Added a Composer autoloader fallback so bundled MCP dependencies are detected in both generated release and standard Composer layouts.
- Removed the standalone architecture tagline from the settings page header.
- Enqueued settings-page CSS and JavaScript through the WordPress asset APIs.
- Limited dependency notices to the Plugins and Invizo MCP settings screens.
- Restricted WooCommerce customer address updates to an explicit field and setter allowlist.
- Updated the bundled Jetpack Autoloader dependency.
- Prepared the standalone release for WordPress.org review and distribution.
- Added GPL license and third-party dependency notices.
- Added optional uninstall cleanup and automatic revocation of Invizo-created Application Passwords.
- Added privacy, data storage, security reporting, source, build, and external-service documentation.
- Fixed prepared SQL handling for LearnPress enrollment queries.
- Improved local HTTPS connection snippets for
.test,.local, and WordPress local environments. - Removed manual translation loading because WordPress.org loads translations automatically.
- Converted Invizo into a standalone MCP server hosted by WordPress.
- Bundled the official WordPress MCP Adapter, PHP MCP Schema, and Jetpack package autoloader.
- Added
/wp-json/mcp/invizo. - Exposed all 143 existing actions as scoped WordPress abilities through compact discovery, information, and execution tools.
- Replaced shared-secret HMAC authentication with administrator-only WordPress Application Passwords.
- Added endpoint enable/disable control and Application Password creation and revocation.
- Added generated setup instructions for Claude Code, Claude Desktop, Codex, Cursor, and Antigravity.
- Removed the external Invizo dashboard, handshake, server URL, shared secret, and legacy signed execution endpoint.
- Added automatic 1.x settings migration while preserving scopes and managed definitions.