Royal MCP
| 开发者 | royalpluginsteam |
|---|---|
| 更新时间 | 2026年4月3日 11:46 |
| 捐献地址: | 去捐款 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Read all your posts, pages, and media
- Create or delete content
- Access user data and plugin information
- Overwhelm your server with rapid-fire requests
- Posts — create, read, update, delete, search, count
- Pages — full CRUD with parent page support
- Media — library browsing, metadata, deletion
- Comments — create (respects moderation settings), read, delete
- Users — display names and roles (emails and usernames are not exposed)
- Categories & Tags — create, assign, delete, count
- Menus — list menus and menu items
- Post Meta — read, update, delete custom fields
- Site Info — site name, description, WordPress version, timezone
- Plugins & Themes — list installed plugins and themes with active status
- Search — full-text content search across post types
- Options — read allowlisted safe options only
- Browse and search products by category, status, or type
- Create and update products with prices, SKUs, stock levels
- View orders, order details, and update order status
- List customers with order count and total spent
- Get store statistics — revenue, order count, average order value by period
- Get current security score and grade with factor breakdown
- View security statistics — failed logins, blocked IPs, alerts
- Run vulnerability scans and review results
- List blocked IP addresses and failed login attempts
- Browse the security audit log filtered by severity
- List available backups filtered by status or type
- Trigger new backups (full, database, files, plugins, themes)
- Check backup progress in real time
- View backup statistics — total size, last backup, counts
- List and review backup schedules
- Claude (Anthropic) — Full MCP support via Claude Desktop, Claude Code, and VS Code
- OpenAI / ChatGPT — GPT-4o, GPT-4 Turbo, GPT-3.5 Turbo
- Google Gemini — Gemini 1.5 Pro, 1.5 Flash
- Groq — Llama 3.3, Mixtral, Gemma 2
- Azure OpenAI — Azure-hosted OpenAI deployments
- AWS Bedrock — Claude, Llama, Titan models
- Ollama / LM Studio — Local self-hosted models (no external data transmission)
- Custom MCP Servers — Connect to any MCP-compatible endpoint
- Single
/mcpendpoint for all JSON-RPC communication - POST for client messages, GET for server-sent events, DELETE for session termination
- Cryptographically secure session IDs with transient-based storage
- Origin header validation to prevent DNS rebinding attacks
- Proper CORS handling for browser-based MCP clients
安装:
- Upload the
royal-mcpfolder to/wp-content/plugins/ - Activate the plugin through the 'Plugins' menu in WordPress
- Go to Royal MCP → Settings to configure
- Copy your API key — you will need this to authenticate MCP connections
- Add your AI platform(s) and enter their API keys
- In your AI client (Claude Desktop, VS Code, etc.), configure the MCP server URL and API key
屏幕截图:
常见问题:
What is MCP and why does my WordPress site need it?
Model Context Protocol (MCP) is an open standard created by Anthropic that lets AI assistants interact with external data sources. Without MCP, AI tools like Claude or ChatGPT can only work with content you copy and paste into them. With Royal MCP installed, these AI platforms can directly read your WordPress posts, create new content, manage your WooCommerce products, check your security status, and trigger backups — all through a structured, authenticated protocol.
How is Royal MCP different from other WordPress MCP plugins?
Security. Most MCP plugins — and 41% of all public MCP servers — have no authentication at all. Royal MCP requires an API key for every session, rate-limits requests to prevent abuse, logs every interaction for audit purposes, and filters sensitive data (emails, PHP version, admin credentials) from responses. We built this plugin with the same security standards we apply to GuardPress, our WordPress security plugin used on thousands of sites.
Will WordPress core make this plugin unnecessary?
No. WordPress is adding MCP support through the Abilities API, which will allow plugins to register "abilities" that AI agents can call. Royal MCP complements this by adding security controls (API key auth, rate limiting, activity logging), plugin-specific integrations (WooCommerce, GuardPress, SiteVault), and sensitive data filtering that the core implementation does not include.
Does Royal MCP work with WooCommerce?
Yes. When WooCommerce is active, Royal MCP automatically adds 9 additional MCP tools for product management (create, update, search), order management (view, update status), customer data, and store statistics. No additional configuration is needed — the tools appear automatically in the MCP tools list.
How do I connect Claude Desktop to WordPress?
Install Royal MCP, go to Royal MCP → Settings, and copy your API key and MCP server URL. In Claude Desktop, add a new MCP server configuration with the URL and include the X-Royal-MCP-API-Key header with your API key. Full step-by-step guide at royalplugins.com/support/royal-mcp/.
Is my content safe?
Royal MCP is designed with defense in depth. API key authentication is required for all MCP sessions. Rate limiting prevents abuse (60 requests per minute per IP). Activity logging records every tool call. Sensitive data is filtered — user emails, usernames, admin email, and PHP version are never exposed through MCP. Comment creation respects your WordPress moderation settings. Post meta values are sanitized before storage. And the plugin starts disabled by default — nothing is accessible until you explicitly enable it.
Can I use local AI models instead of cloud services?
Yes. Royal MCP supports Ollama and LM Studio for fully local AI inference. When using local models, no data leaves your server — the AI model runs on your own hardware and communicates with WordPress through the MCP protocol on localhost.
What happens if I uninstall Royal MCP?
Royal MCP performs a clean uninstall. All plugin options, database tables (activity logs), transients, and user meta are removed. No orphaned data is left behind.
更新日志:
- New: OAuth 2.0 authorization server — Claude Desktop's "Add Connector" flow now works natively
- New: Dynamic Client Registration (RFC 7591) for seamless MCP client onboarding
- New: PKCE-secured authorization code flow per MCP spec (2025-03-26)
- New: Token refresh with automatic rotation for long-lived sessions
- New: WordPress login integration — consent screen after authentication
- New: Metadata discovery endpoint at /.well-known/oauth-authorization-server
- New: Daily cleanup of expired OAuth tokens via scheduled event
- Improved: MCP endpoint now accepts both Bearer tokens and API key authentication
- Improved: CORS headers include Authorization for OAuth-based clients
- Security: Access tokens stored as SHA-256 hashes (never stored in plain text)
- Security: Authorization codes are single-use with 10-minute expiry
- Security: PKCE (S256) required for all authorization requests
- Security: Redirect URI validation enforces localhost or HTTPS only
- New: WooCommerce integration — 9 MCP tools for products, orders, customers, and store stats (auto-detected)
- New: GuardPress integration — 7 MCP tools for security score, scans, firewall logs, and audit trail (auto-detected)
- New: SiteVault integration — 6 MCP tools for backup management, scheduling, and progress tracking (auto-detected)
- Security: MCP endpoint now requires API key authentication via X-Royal-MCP-API-Key header
- Security: Added rate limiting (60 requests/minute per IP) to prevent abuse and accidental DoS
- Security: API key comparison uses timing-safe hash_equals() to prevent timing attacks
- Security: Sanitized wp_update_post_meta values before storage
- Security: Comments created via MCP now respect WordPress moderation settings
- Security: Removed admin_email and php_version from wp_get_site_info response
- Security: Removed user_login and user_email from wp_get_users/wp_get_user responses
- Improved: CORS headers include X-Royal-MCP-API-Key for cross-origin MCP clients
- Security: Added SSRF protection — validates all outbound URLs against private/reserved IP ranges
- Fixed: Text domain changed from 'wp-royal-mcp' to 'royal-mcp' to match plugin slug
- Fixed: Menu slugs updated for WP.org compliance
- Improved: REST API permission callbacks include explanatory comments for reviewers
- Compatibility: Tested up to WordPress 6.9
- Added: Documentation link on Plugins page (Settings | Documentation)
- Added: Documentation banner on settings page
- Fixed: Claude Connector setup guide link displaying raw HTML
- Security: Origin header validation to prevent DNS rebinding attacks
- Security: Session ID format validation (ASCII visible characters only)
- Improved: MCP 2025-03-26 Streamable HTTP spec compliance
- Added: Filter hook
royal_mcp_allowed_originsfor custom origin allowlist
- Added multi-platform AI support (Claude, OpenAI, Gemini, Groq, Azure, Bedrock)
- Added Claude Desktop MCP connector
- Added activity logging
- Added connection testing
- Initial release