Secure MCP Server for Claude, ChatGPT, Gemini and other AI providers
| 开发者 | cyberlord92 |
|---|---|
| 更新时间 | 2026年8月12日 20:17 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | Expat |
| 版权网址: | 版权信息 |
详情介绍:
miniOrange Secure MCP Server is a complete WordPress MCP server plugin that turns your WordPress site into a fully working Model Context Protocol (MCP) server. Once installed, you can connect Claude to WordPress, connect ChatGPT to WordPress, or link any MCP-compatible AI in just 2 minutes.
Ask AI to write blog posts, update WooCommerce products, manage Yoast SEO, moderate comments, handle contact form submissions, and much more, all through simple chat.
Unlike other WordPress MCP server plugins that give AI full admin access, we put you in complete control. Role-based AI permissions, Turn each tool on or off, self-hosted OAuth 2.1 login, and full activity logs are all included, with no restrictions.
安装:
How to Install the WordPress MCP Server (2 Minutes)
- Log in to your WordPress admin dashboard.
- Go to Plugins → Add New.
- Search "Secure MCP Server"
- Click Install Now, then Activate.
- Done — the plugin is now active.
- Open Tools Secure MCP Server.
- Go to the "Connect to AI" tab.
- Copy your MCP server URL:
https://YOUR-SITE/wp-json/mosmcp/v1/mcp - Open Claude Desktop > Settings > Connector> Add custom connector.
- Paste the URL.
- Sign in to WordPress.
- Approve MCP tool access.
- Start chatting with your site through Claude.
- Open Tools Secure MCP Server.
- Go to the "Connect to AI" tab.
- Copy your MCP server URL:
https://YOUR-SITE/wp-json/mosmcp/v1/mcp - Open Claude Desktop > Settings > Plugins>Browse Plugins> Add New Plugin.
- Paste the URL.
- Sign in to WordPress.
- Approve MCP tool access.
- Start chatting with your site through Chagpt.
- WordPress 6.9 or newer (Abilities API required)
- PHP 7.4 or higher (PHP 8.0+ recommended)
- HTTPS enabled (for OAuth login)
屏幕截图:
常见问题:
What is the NHI Registry?
The NHI (Non-Human Identity) Registry is where you create and manage named, role-based ability policies for AI clients. Each NHI maps WordPress roles to the abilities those roles may invoke. When an AI client makes an MCP request, the effective set of allowed abilities is the union — across every enabled NHI — of the abilities granted to the connecting user's role(s). So two users connecting the same client to the same site can see different tools, based on their roles. You can create as many NHIs as you need and toggle them on or off independently.
Can I disable an NHI without deleting it?
Yes. Every NHI has an enable/disable toggle in the NHI Registry screen. A disabled NHI has no effect on MCP requests but its name and ability list are preserved, so you can re-enable it at any time without reconfiguring it.
Does this WordPress MCP server work with WooCommerce?
Yes — full WooCommerce MCP support with 45 tools covering products, variations, orders, customers, coupons, and reports. Perfect for AI-powered store management.
Does it work with Yoast SEO?
Yes. 8 dedicated Yoast SEO MCP tools for meta descriptions, focus keywords, Open Graph tags, robots meta, and sitemap inclusion. Deepest Yoast integration of any WordPress MCP server.
Does it work with Contact Form 7, WPForms, and Gravity Forms?
Yes — all three form plugins supported with 40 MCP tools total. Read entries, export CSV, moderate submissions, delete for GDPR compliance.
Is it safe to connect AI to my WordPress site?
With this MCP plugin, absolutely. AI never sees your WordPress password (OAuth 2.1 with PKCE). Every action is capability-checked at the WordPress core level. Role-based permissions limit what each AI can do. All actions are logged. You can revoke access anytime.
Can I disable specific MCP tools?
Yes. Every MCP tool has a global on/off toggle. Turn off dangerous actions like "delete permanently" while keeping safe ones enabled. One-click safety.
How do I revoke AI access?
Open the NHI Registry and click Revoke. The AI immediately loses access. You can also disable specific NHIs (preserving their config) or turn off individual tools instantly.
Can multiple AI connect at once?
Yes. Connect Claude, ChatGPT, Cursor, and Gemini simultaneously, each with different permissions. Track their activity separately in the audit log.
Why does the "Source" column show a namespace instead of a plugin name?
The Abilities API does not record which plugin registered a given ability. The namespace prefix (the part before the slash in the ability name) is the most reliable indicator of where an ability comes from.
更新日志:
1.4.5
- ChatGPT is now shown first when connecting a client, with a direct link to the official plugin listing and clearer, more accurate setup steps.
- Added a warning, shown across the plugin, when the site is only reachable on localhost — AI clients running elsewhere can't connect to it until it's made publicly reachable.
- Refreshed the sign-in (OAuth authorization) screen to match the rest of the plugin's design.
- Fixed the connection dialogs occasionally rendering behind the WordPress admin toolbar.
- Fixed a brief flicker on the dashboard when it first loads.
- Onboarding UI improvements.
- Minor bug fixes.
- Redesigned the role & ability editor as a matrix: abilities are grouped by resource down the left, with every role shown as its own column, so you can compare what each role can do without switching roles one at a time. Includes quick select all / clear controls for an entire role or an entire resource category.
- Added a guided onboarding checklist for new installs: register an agent, add the MCP URL to your AI client, and approve the connection, shown on the dashboard until setup is complete.
- New ability — "Update Page": edits the title and/or content of an existing page.
- New — bundled abilities library: 260+ ready-to-use, security-reviewed WordPress abilities exposed as MCP tools out of the box. Core content (posts, pages, categories, tags, media, revisions), users & roles, and comments are always available; ability sets for WooCommerce, Advanced Custom Fields, Yoast SEO, Contact Form 7 (with Flamingo), WPForms, and Gravity Forms activate automatically when those plugins are present.
- Every bundled ability is capability-gated, carries explicit MCP tool annotations (read-only / destructive / idempotent / open-world), declares full input/output JSON schemas, and is reachable only through the governed MCP endpoint — never the public REST API.
- Security hardening in the bundled abilities: reserved user-meta keys (capabilities, role level, session tokens) can never be read or written through an ability; role grants are limited to roles whose capabilities the caller already holds; and CSV entry exports are neutralized against spreadsheet formula injection.
- Fixed the role & ability editor incorrectly flagging object-level abilities (those gated by per-object capabilities such as editing or deleting a specific post or page) as capability conflicts for every role, including Administrator. These capabilities are resolved per request against the target object, so they are no longer shown as conflicts; the runtime permission check is unchanged and was always correct.
- Added a "Test Connection" check that confirms an AI client will actually be able to reach and sign in to your site, run from both your server and an outside vantage so it catches firewall, CDN, and reverse-proxy issues a same-server check would miss. Available on the Connect to AI page and beside Register Agent on the AI Agents screen.
- Added a Troubleshooting guide, always available from the toolbar, that explains the common reasons an AI client can't connect and gives copy-paste Apache/Nginx fixes for each. When a connection test finds an issue, the most likely cause is highlighted automatically.
- Reliability on CDN/cached hosts: the OAuth and MCP endpoints (discovery, registration, the MCP transport, and the authentication challenge) now send "Cache-Control: no-store", so an edge cache or CDN — such as Pantheon's Varnish, Cloudflare, WP Engine, or Kinsta — can no longer cache and misdeliver these per-request responses, which could otherwise intermittently break AI-client connections.
- Minor fixes and reliability improvements.
- Execution activity log: a full audit trail of every tool call, filterable by agent, status, or time range, with per-event detail including latency and error context.
- Dashboard redesign: four focused metrics — Active Agents, Total Executions, Success Rate, and Average Latency — for an at-a-glance view of MCP server health.
- Activity timeline on the agent overview: the last 5 executions appear inline on each NHI's overview tab.
- Denied and unknown-tool calls are now correctly attributed to the responsible NHI, so the audit log is never missing an agent name.
- Clearer role & ability editor: a single Select all / Clear all control (instead of separate All and None buttons), role names shown in each NHI's summary, and a smoother role & ability layout.
- Refined the admin/member view switcher to a clearer segmented control.
- Fixed the support form's country picker so it no longer shifts the page or scrolls unexpectedly when opened.
- General UI polish across the NHI Registry and connection screens.
- NHI Registry is now role-based: grant abilities to each WordPress role, with live capability-conflict detection. A request receives the abilities its user's role(s) are granted across all enabled NHIs.
- Added a "My AI Access" member view so any logged-in user can see the tools available to their role, with an admin/member view switcher for administrators.
- Rebuilt NHI create/edit as full-screen pages (guided create wizard ending in a connection step); removed the cramped modal editor.
- Existing NHIs are migrated automatically and keep working; review each one to scope its abilities per role.
- Support and deactivation-feedback emails now include the customer's email address in the subject line.
- Added a Settings link to the plugin's row on the Plugins page.
- Added a floating Contact Support button, available throughout the admin app.
- Added a Setup Guide link in the toolbar for quick access to the connection guide.
- Redesigned the deactivation feedback prompt with a clearer, on-brand layout, guided reason selection, and the option to get help instead of deactivating.
- Added NHI Registry: a new admin screen to view and manage all non-human identity (AI client) registrations, including OAuth client details and token status.
- Added per-ability toggle to enable or disable individual abilities from being exposed as MCP tools.
- Revamped the plugin UI.
- Added in-plugin support form and deactivation feedback modal.
- Added a remote MCP server endpoint that exposes registered abilities as MCP tools.
- Added a self-hosted OAuth 2.1 authorization server with Dynamic Client Registration, PKCE, and discovery metadata so ChatGPT and Claude can connect.
- Initial release: read-only viewer for abilities registered through the WordPress Abilities API.