Zen MCP Bridge
| 开发者 | guramzhgamadze |
|---|---|
| 更新时间 | 2026年7月27日 01:45 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Full OAuth 2.1 authorization server with PKCE (S256), dynamic client registration (RFC 7591) and auto-discovery (RFC 8414 + RFC 9728).
- Bearer Token auth as a simpler alternative to OAuth — never expires.
- Configurable OAuth token lifetime — 1 hour, 24 hours, 7 days or 30 days, plus an emergency "Revoke all tokens" button.
- 25 read-only MCP tools covering site info, plugins, themes, post types, taxonomies, options, posts, database schema, structured table reads, files, code search, logs, hooks, ACF fields, users, menus, cron, transients, widgets, REST routes, Action Scheduler, WooCommerce and Elementor.
- MCP resources (site snapshots at wordpress:// URIs) and canned prompts for site analysis, debugging and plugin writing.
- Opt-in write mode (off by default): six scoped write tools — create/update DRAFT posts, update allowlisted options, toggle plugins, clear caches, create terms. OAuth sessions additionally need a write grant ticked on the consent screen; everything is audited. Deleting, publishing, user management and write SQL are never possible.
- WordPress Abilities API integration (WP 6.9+): tools are discoverable by the WordPress AI ecosystem, admin-only. Stands down automatically when the official AI Provider for Anthropic plugin is active.
- MCP specification 2025-11-25 compliant.
- Rate limiting, path-traversal guards, credential redaction and clickjacking protection.
- Apache + FastCGI compatible (Authorization header normalization built in).
- Zero dependencies — pure WordPress, no Composer required.
wp_get_site_info, wp_get_plugins, wp_get_themes, wp_get_post_types, wp_get_taxonomies, wp_get_options, wp_query_posts, wp_get_post, wp_get_db_schema, wp_db_query, wp_list_files, wp_read_file, wp_search_code, wp_get_logs, wp_get_hooks, wp_get_acf_fields, wp_get_users, wp_get_menus, wp_get_cron_jobs, wp_get_transients, wp_get_scheduled_actions, wp_get_active_widgets, wp_get_rest_routes, wp_get_woocommerce, wp_get_elementor.
Write (only with write mode enabled): wp_create_draft_post, wp_update_draft_post, wp_update_option, wp_toggle_plugin, wp_clear_cache, wp_create_term.
安装:
- Upload the plugin to
wp-content/plugins/zen-mcp-bridge, or install it from your WordPress admin. - Activate the plugin through the Plugins screen.
- Go to Settings → MCP Bridge to find your endpoint URL and Bearer token.
- Flush rewrite rules once: Settings → Permalinks → Save Changes.
屏幕截图:
常见问题:
How do I connect with a Bearer token (simplest)?
- In Claude.ai: Profile → Settings → Connectors → Add custom connector.
- Paste your MCP endpoint URL (shown on Settings → MCP Bridge), for example
https://your-site.com/wp-json/zen-mcp/v1/bridge. - Set the auth type to Bearer Token (or API Key) and paste the token from the settings page.
- Save. Bearer tokens never expire.
How does the OAuth 2.1 login flow work?
Claude.ai auto-discovers the OAuth server from the /.well-known/ URLs and opens a login page on your site, where an administrator clicks Allow Access. If Claude.ai asks for details manually, use the Authorization URL and Token URL shown in the OAuth (advanced) section of the settings page, any Client ID except the literal text "Bearer Token", and the scope claudeai.
I get a 404 / rest_no_route error
Go to Settings → Permalinks and click Save Changes to flush rewrite rules, and confirm the plugin is active.
The Authorization header is always empty (Apache + FastCGI)
This is handled automatically. If it persists, add this line to your .htaccess:
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
How do I enable debug logging?
Define WP_DEBUG, WP_DEBUG_LOG (true) and WP_DEBUG_DISPLAY (false) in wp-config.php, then read wp-content/debug.log or use the wp_get_logs tool.
Is it safe?
By default, yes — everything is read-only: credentials are redacted, database reads are structured (no raw SQL — table and column names are whitelisted against the live schema and every value is parameterized), file access is contained within wp-content, and OAuth uses mandatory PKCE with single-use, expiring authorization codes. Write access exists only when an administrator switches on write mode, is limited to drafts, allowlisted options, plugin toggles, caches and terms, and every write is recorded in the audit log. Deleting content, publishing, managing users and write SQL are impossible regardless of settings.
How does write mode work?
Enable it under Settings → MCP Bridge → Write mode (off by default). The static Bearer token then gains write access; OAuth sessions must additionally tick "Allow write access" on the consent screen (the claudeai:write scope). Six scoped tools become available; drafts can never be published, options must be on an allowlist you control (site identity, code-execution and secret options are refused even if listed), and the plugin can never toggle itself off. Each write tool can be disabled individually and every call is audited.
How does this relate to the "AI Provider for Anthropic" plugin?
They point in opposite directions and can coexist: that plugin lets WordPress call Claude's API; Zen MCP Bridge lets Claude.ai read this site. When AI Provider for Anthropic is active, Zen MCP Bridge automatically stops registering its tools as WordPress Abilities so the site's AI surface has a single owner — Claude.ai access via the MCP endpoint is unaffected. The zenmcp_enable_abilities filter overrides this.
更新日志:
wp_db_queryno longer accepts raw SQL. It is now a structured, injection-proof table reader: you name a table, columns, WHERE conditions, ordering and a limit, and the plugin builds the query — table/column names are validated against the live schema and every value is bound through$wpdb->prepare(). Credential columns stay blocked and secret values redacted. Joins and aggregate expressions are no longer supported (usewp_query_postsor the dedicated inspector tools).
- Dynamic client registration now derives
client_idfrom a dedicated plugin secret instead of the WordPressAUTH_KEY, keeping core authentication secrets scoped to authentication. - The OAuth consent page loads its styles from an external stylesheet (no inline
<style>). - Documented the Claude.ai / Anthropic external service in the readme.
- Added
X-Content-Type-Options: nosniffto all plugin responses (MCP endpoint, OAuth token/discovery endpoints, consent page) — hardening surfaced by an OWASP ZAP scan.
- Opt-in write mode (off by default) with six scoped write tools:
wp_create_draft_post/wp_update_draft_post(status locked to draft/pending — publishing always needs a human),wp_update_option(admin-managed allowlist with hard denies for site identity, code-execution and secret options),wp_toggle_plugin(cannot touch Zen MCP Bridge itself),wp_clear_cacheandwp_create_term. - Consent-screen write grant: OAuth sessions receive write access only when "Allow write access" is explicitly ticked during authorization (
claudeai:writescope); the static Bearer token has write access only while write mode is on. - MCP tool annotations: all tools now declare
readOnlyHint(and write toolsdestructiveHint: false) per the 2025-11-25 specification. - Write tools are hidden from
tools/listfor credentials without write access, individually toggleable, registered as Abilities only in write mode, and fully audited.
- Cache-safe token revocation: "Revoke all" now bumps a token-generation counter instead of deleting options-table rows, so it works instantly under Redis/Memcached object caches too. Existing OAuth sessions must re-authenticate once after this update.
- Token manager: active OAuth tokens are listed in the admin (client, user, issued, expires, last used) with per-token revocation.
- Secret-exfiltration hardening:
wp_db_querynow rejects queries referencing the plugin's own credentials and redacts secret-bearing values (API keys, session tokens, consumer secrets) from results;wp_get_optionsapplies the same secret-name heuristic; sensitive files (.env, wp-config copies, SQL dumps, keys/certificates) cannot be read or searched, and credential-like lines are masked in code-search results. - Audit log: every tool call is recorded (credential, tool, arguments, IP, outcome) with an admin viewer, filtering and automatic retention.
- Per-tool switches: any of the 25 tools can be disabled entirely from the settings page — hidden from tools/list, rejected by tools/call, and excluded from Abilities.
- Configurable rate limit (10–1000 tool calls per minute per IP) and an in-admin health check that runs the same initialize/tools/discovery checks a Claude.ai connection performs.
- Developer: PHPUnit test suite with GitHub Actions CI, phpcs.xml ruleset.
- Renamed from "WordPress MCP Bridge" to Zen MCP Bridge (new slug,
zenmcp_code prefix, text domain and REST namespacezen-mcp/v1). Existing installs keep their Bearer token, redirect URIs and token lifetime via a one-time migration on activation. The MCP endpoint URL changed — reconnect Claude.ai to…/wp-json/zen-mcp/v1/bridge. - Rebuilt the admin settings page to the Zen family theme: card layout, external stylesheet/script (no inline styles or handlers), and setup/troubleshooting docs moved into a Help tab. Settings consolidated into a single option.
- Six new read-only tools:
wp_search_code,wp_get_post,wp_get_transients(auth/secret values redacted),wp_get_scheduled_actions,wp_get_woocommerce(no customer data or credentials) andwp_get_elementor— 25 tools total. - MCP
resources(site snapshots atwordpress://URIs) andprompts(site analysis, error debugging, plugin writing) capabilities. - WordPress Abilities API bridge (WP 6.9+): tools registered as admin-only abilities; stands down automatically when AI Provider for Anthropic is active.
- Added
uninstall.php(removes options and transients on delete) and internationalization.
- Configurable OAuth token lifetime (1 hour / 24 hours / 7 days / 30 days) and an emergency "Revoke all tokens" button.
- MCP specification 2025-11-25 support: latest protocol version,
client_id_metadata_document_supported,scopeinWWW-Authenticate, anddescriptioninserverInfo. - Hardened a SQL-injection vector in the DB-schema tool and corrected the OAuth consent nonce sanitizer (2.7.0).
- Fixed an OAuth consent 403 (two-nonce form) and blocked the plugin's own Bearer token from the options tool. Crash-hardened the cron tool and added transient cleanup on deactivation.
- Added dynamic client registration (RFC 7591), corrected the required PHP version, and closed path-containment and OAuth parameter-handling gaps.
- Implemented the full OAuth 2.1 PKCE authorization server with discovery endpoints, plus CORS, clickjacking, path-traversal and Apache/FastCGI fixes.
- Initial hardened release: GET/OPTIONS handling, CORS headers and the read-only tool suite.