Secure MCP Server for Claude, ChatGPT, Gemini and other AI Agents
| 开发者 | cyberlord92 |
|---|---|
| 更新时间 | 2026年10月15日 23:12 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | Expat |
| 版权网址: | 版权信息 |
详情介绍:
安装:
- WordPress 6.9 or newer (Abilities API required)
- PHP 7.4 or higher (PHP 8.0+ recommended)
- HTTPS enabled (for OAuth login)
- Go to Plugins → Add New Plugin.
- Search for miniOrange Secure MCP Server.
- Click Install Now, then Activate.
- Open Secure MCP Server from the admin sidebar and click Register your first agent.
- Name the agent, set ability access by user role, and click Create & Continue.
- Under Connect your AI client, choose Claude, ChatGPT or another client and follow the setup panel.
- Sign in to WordPress and click Allow Access. Done!
- Download the plugin zip.
- Go to Plugins → Add New → Upload Plugin and upload the zip.
- Activate the plugin and continue from step 4 above.
屏幕截图:
常见问题:
What is an MCP server for WordPress?
MCP (Model Context Protocol) is an open standard that lets AI assistants use tools. This plugin makes your WordPress site an MCP server, so AI clients like Claude and ChatGPT can safely read and update your site through tools you control.
Which AI clients are supported?
Claude, ChatGPT, Gemini, Cursor, Grok, Windsurf and any MCP-compatible client.
How many tools are included?
426 tools in 26 categories, covering WordPress core, WooCommerce, Yoast SEO, Rank Math, Advanced Custom Fields, Elementor, Divi, Kadence, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, theme editing and site maintenance. Integration tools appear only when the related plugin is active.
Is it safe to give AI access to my WordPress site?
Yes. Access uses self-hosted OAuth 2.1 with PKCE, so the AI never sees your password. Every call is limited by role through the agent Registry, checked against WordPress capabilities, rate-limited and logged. You can require human approval for sensitive actions and mask sensitive data.
Can the AI do more than my WordPress user can?
No. Every tool runs as the WordPress user who approved the connection, and every call is checked against that user's capabilities exactly as in wp-admin.
Can AI use the REST API of my other plugins?
Yes. AI can discover and call any WordPress REST route, including those from WooCommerce, Yoast and other plugins, with no plugin update needed. A new agent starts with read-only access to core WordPress content. Writes and routes outside it need an explicit, per-role grant, and you can switch off all create, update or delete REST calls for the whole site. Plugin and theme install, activate, batch and blueprint-import routes are always blocked.
Can AI break my theme or site?
Theme changes never touch the live site directly. They go into a draft, PHP is syntax-checked and JSON validated, and you can preview the draft. Publishing takes a backup and rolls back automatically if the site fails to load, and you can restore any earlier publish.
Does it work with WooCommerce?
Yes. 41 tools cover products, attributes, orders, order notes, refunds, customers, coupons and sales reports.
Does it work with Yoast SEO and Rank Math?
Yes. 14 Yoast SEO tools cover titles, meta descriptions, focus keywords, cornerstone content, robots, canonicals, breadcrumbs, Open Graph, Twitter/X cards, schema and sitemaps. Rank Math SEO metadata is also supported.
Does it support Advanced Custom Fields (ACF)?
Yes. 25 ACF tools cover field values, repeaters, flexible content, relationships, options pages, field groups and location rules.
Does it support Elementor, Divi and Kadence?
Yes. Elementor (10 tools), Divi 3 and Divi 4, and Kadence Blocks (18 tools) are supported, so AI can read, edit, style and build layouts.
Which form plugins are supported?
Contact Form 7 (with Flamingo for submissions), WPForms, Gravity Forms and Fluent Forms, including CSV export of entries.
Can I disable specific tools?
Yes. Every tool has a global on/off toggle, and the agent Registry controls tools per role. Developers can also limit exposed tools with the MOSMCP_EXPOSED_PREFIXES constant.
How do I revoke an AI client's access?
Click Revoke in the agent Registry. Access ends immediately.
Can I connect multiple AI clients at the same time?
Yes. Connect as many as you need, each with separate permissions and its own audit trail.
What happens if an AI edit goes wrong?
Page lock blocks edits to content that changed after the AI read it, post revisions can be restored, theme changes publish with automatic backup and rollback, and destructive actions require confirmation.
Does my data go through a third-party server?
No. The MCP server and OAuth server run on your own WordPress site. Your AI client connects directly to your site.
Why does my AI client say it cannot reach my site?
AI clients need a public HTTPS URL. Sites on localhost or behind a firewall cannot be reached. Also make sure your CDN or cache is not caching the MCP endpoint. Open the Troubleshooting tab in Secure MCP Server to run a connection test; it lists the likely causes with the fix for each.
Do I need to know how to code?
No. Install, follow the onboarding checklist, and paste one URL into your AI client.
更新日志:
- Fixed AI clients failing to connect, or not seeing a new agent, on sites using LiteSpeed Cache or another page cache. MCP and OAuth responses are no longer cached.
- Fixed AI edits removing forms, scripts and styles and dropping backslashes, which broke pages with custom code such as calculators. AI edits to pages, posts, custom content, Elementor, Kadence, Fluent Forms messages and media now follow the same rules as editing by hand: anyone allowed to add HTML there keeps it exactly as written, and markup a user is not allowed to add is refused with a reason instead of being silently removed.
- Fixed Kadence block edits damaging links and settings in other blocks on the same page. Pages already affected can be restored from WordPress revisions.
- Fixed the Kadence duplicate and delete abilities reporting an error even though the change was made.
- Minor bug fixes in the WordPress MCP Server.
- Improved the Troubleshooting page to show only likely connection problems.
- Minor bug fixes in the WordPress MCP Server.
- Added support for REST APIs in the WordPress MCP Server.
- Added a Troubleshooting page.
- Improved MCP connection reliability with AI providers.
- Minor bug fixes in the WordPress MCP Server.
- Added theme editing for block themes: templates, template parts, global styles, style variations and patterns.
- Added theme file editing: read, search and change theme code in a private draft.
- Every theme change now waits in a draft you can preview before it goes live. Before publishing, the site is checked with the draft applied, publishing backs up first, and every change is rolled back automatically if the site breaks.
- Improved: AI assistants are now told which inputs each tool requires and why a change was refused, including the closest matching text when wording is not found.
- Minor Bug Fixes in the WordPress MCP Server
- Added surgical content editing: change part of the text in a post, a custom field or a setting without rewriting the whole thing.
- Added 8 maintenance abilities covering scheduled events, permalinks, caches, and the site error log.
- Added Fluent Forms support: 14 abilities for forms, fields, confirmation messages, email notifications and submissions.
- Minor Bug Fixes in the WordPress MCP Server
- Added 34 site administration abilities covering site settings, plugin management, theme details, and update and Site Health checks.
- Minor bug fixes in the WordPress MCP Server
- Security and performance improvements to the MCP connection flow.
- Added SEO post meta update ability for Rank Math.
- Added product sale schedule date fields to the WooCommerce abilities.
- Fixed: the health endpoint is no longer cacheable. Page and edge caches (e.g. LiteSpeed, Cloudflare) could previously serve a stale "no agent" state, causing a connected client to report "No agent configured" even after an agent was enabled.
- Minor bug fixes in the WordPress MCP Server
- Debug logging framework: a built-in diagnostic log for MCP and OAuth activity.
- Minor bug fixes in the WordPress MCP Server
- Minor bug fixes in the WordPress MCP Server
- Elementor integration: Added 10 MCP Server abilities to read and edit Elementor pages, posts, and custom post types, including layout elements, text, images, links, widget types, and rendering changes for verification.
- Elementor editing: Update text, images, links, and selected styling without affecting the rest of the design, with separate tablet/mobile values.
- Custom post types: Added 19 abilities to read and edit items and custom fields, manage taxonomies, featured images, status, duplication, trash, and restore. Unsupported fields remain read-only with clear reasons.
- Media uploads: Upload files from public URLs or supplied content, validate the real file type, and use attachment IDs for featured images or Elementor widgets.
- Duplication: Copies now retain layout, theme settings, taxonomies, and featured images while clearing the canonical URL.
- Yoast SEO: Added more editable fields, including breadcrumb title, canonical URL, SEO title, focus keyphrase, social/X cards, robots directives, cornerstone content, and schema types.
- Slugs: Posts, pages, and custom post type slugs can now be edited with warnings about changed URLs and redirects.
- Minor bug fixes in the WordPress MCP Server.
- Kadence integration: Added 17 abilities to the MCP Server for AI clients to read, edit, and build Kadence Blocks pages, including reading nested blocks, block settings, and searching blocks by type or text.
- Edit Kadence blocks: Update text across 16 fields in 9 block types, styling and responsive attributes across all 59 block types, and duplicate or delete blocks with unique IDs.
- Build layouts: Insert rows, columns, headings, images, and buttons; create draft pages with pre-built layouts; or build nested row-and-column structures in one request.
- Added abilities to read and set Kadence per-page theme layout options.
- Safe editing: MCP Server edits change only the targeted block, preserve the rest of the page, support optional page locks, and return previous and new values for verification.
- Kadence-compatible markup: Inserted blocks match Kadence editor markup and CSS.
- Unsupported block types are declined with a duplicate-and-edit option.
- Minor bug fixes.
- ChatGPT is now shown first when connecting a client, with a direct link to the official plugin listing and clearer, more accurate setup steps.
- Added a warning, shown across the plugin, when the site is only reachable on localhost — AI clients running elsewhere can't connect to it until it's made publicly reachable.
- Refreshed the sign-in (OAuth authorization) screen to match the rest of the plugin's design.
- Fixed the connection dialogs occasionally rendering behind the WordPress admin toolbar.
- Fixed a brief flicker on the dashboard when it first loads.
- Onboarding UI improvements in the MCP Server plugin.
- Minor bug fixes in the MCP Server plugin.
- Redesigned the role & ability editor as a matrix: abilities are grouped by resource down the left, with every role shown as its own column, so you can compare what each role can do without switching roles one at a time. Includes quick select all / clear controls for an entire role or an entire resource category.
- Added a guided onboarding checklist for new installs: register an agent, add the MCP URL to your AI client, and approve the connection, shown on the dashboard until setup is complete.
- New ability — "Update Page": edits the title and/or content of an existing page.
- New — MCP Server abilities library: 260+ ready-to-use, security-reviewed WordPress abilities exposed as MCP tools, covering core content, users & roles, comments, WooCommerce, Advanced Custom Fields, Yoast SEO, Contact Form 7, WPForms, and Gravity Forms. Plugin-specific abilities activate automatically when available.
- All abilities are capability-gated with MCP tool annotations and full input/output JSON schemas, and are accessible only through the governed MCP Server endpoint, never the public REST API.
- Security hardening: Protected user-meta keys cannot be accessed, role grants require existing caller capabilities, and CSV exports are protected against spreadsheet formula injection. Fixed: Object-level abilities no longer show false capability conflicts in the role & ability editor. Runtime permission checks remain unchanged.
- Test Connection: Checks AI-client access and sign-in from both your server and an external location to detect firewall, CDN, and reverse-proxy issues.
- Troubleshooting guide: Provides common AI-client connection fixes, including copy-paste Apache/Nginx solutions, with likely causes highlighted automatically.
- Reliability: OAuth and MCP Server endpoints now use Cache-Control: no-store to prevent CDN/edge caching issues that can disrupt AI-client connections.
- Minor fixes and reliability improvements in the MCP Server plugin.
- Execution activity log: a full audit trail of every tool call, filterable by agent, status, or time range, with per-event detail including latency and error context.
- Dashboard redesign: four focused metrics — Active Agents, Total Executions, Success Rate, and Average Latency — for an at-a-glance view of MCP server health.
- Activity timeline on the agent overview: the last 5 executions appear inline on each agent overview tab.
- Denied and unknown-tool calls are now correctly attributed to the responsible agent , so the audit log is never missing an agent name.
- Clearer role & ability editor: a single Select all / Clear all control (instead of separate All and None buttons), role names shown in each Agents summary, and a smoother role & ability layout.
- Refined the admin/member view switcher to a clearer segmented control.
- Fixed the support form's country picker so it no longer shifts the page or scrolls unexpectedly when opened.
- General UI polish across the agent Registry and connection screens.
- Agent Registry is now role-based: grant abilities to each WordPress role, with live capability-conflict detection. A request receives the abilities its user's role(s) are granted across all enabled agents.
- Added a "My AI Access" member view so any logged-in user can see the tools available to their role, with an admin/member view switcher for administrators.
- Rebuilt agent create/edit as full-screen pages (guided create wizard ending in a connection step); removed the cramped modal editor.
- Existing agents are migrated automatically and keep working; review each one to scope its abilities per role.
- Support and deactivation-feedback emails now include the customer's email address in the subject line.
- Added a Settings link to the plugin's row on the Plugins page.
- Added a floating Contact Support button, available throughout the admin app.
- Added a Setup Guide link in the toolbar for quick access to the connection guide.
- Redesigned the deactivation feedback prompt with a clearer, on-brand layout, guided reason selection, and the option to get help instead of deactivating.
- Added agents Registry: a new admin screen to view and manage all non-human identity (AI client) registrations, including OAuth client details and token status.
- Added per-ability toggle to enable or disable individual abilities from being exposed as MCP tools.
- Revamped the plugin UI.
- Added in-plugin support form and deactivation feedback modal.
- Added a remote MCP server endpoint that exposes registered abilities as MCP tools.
- Added a self-hosted OAuth 2.1 authorization server with Dynamic Client Registration, PKCE, and discovery metadata so ChatGPT and Claude can connect.
- Initial release: read-only viewer for abilities registered through the WordPress Abilities API.