Mumega MCP

Mumega MCP gives a site owner's configured MCP client a small authenticated interface to WordPress. The retained tools cover site information, posts, pages, individual drafts, local media, categories, and tags. Media can be uploaded from multipart form data or base64 content supplied by the client. Security and authority:

• API keys are stored as password hashes, bound to an explicit existing WordPress user, and shown in plaintext only once.
• All usable API keys have non-empty scopes. A key may allow read, write, or admin authority according to its stored scope list.
• New post and page content is created as a draft by default.
• Publishing, private-content mutation, and draft deletion require the stronger admin scope and the corresponding WordPress user permissions.
• Request limits are enforced locally. Optional metadata-only activity logging stores tool, status, duration, key ID, and time, but not request arguments or response content. Retention is configurable.

Setup & Keys requires a non-empty label, selected non-empty scopes, and selected non-empty tool categories. A key created there is bound to the current explicit WordPress user. Direct REST child-key creation inherits the authenticated parent key's explicit existing WordPress-user owner. REST child-key scopes are required; tool categories are optional, and empty tool categories mean all retained categories. Privacy and data flow: There are no plugin-initiated outbound requests, no telemetry, and no contact with Mumega. Authenticated responses travel from WordPress to the MCP client configured by the site owner. That client may send the response to an AI or other provider chosen and configured by the site owner; the plugin does not select or contact that provider. The WordPress.org directory edition cannot write PHP, JavaScript, or CSS; edit plugin or theme files; install or update software; or self-update.

3.4.14

• Security and stability hardening pass.
• Load wp-admin/includes/media.php only for audio and video uploads, immediately before the metadata function that needs it; image uploads no longer load it at all.
• Add an explicit permission_callback literal at every REST route registration so authorization is visible to static analysis.
• Authenticate before any resource existence check in REST permission callbacks.
• Remove the mcpwp_manage_settings capability from the API agent role.
• Load only the current-namespace API keys; the legacy cross-prefix key path has been removed from this edition.

3.4.13

• Default Setup & Keys selections include read and write access for draft-first content testing.

3.4.3

• Reduce the directory edition to 17 authenticated MCP tools and 19 REST route patterns for content, local media, taxonomy, and local administration.
• Keep four minimal administration pages: Setup & Keys, Tool Inventory, Settings, and Activity.
• Remove remote, commercial, code-editing, and software-management surfaces.