MCP WordPress Connector

Lightweight connector plugin for WordPress 6.9+ to allow a Management Control Plane (MCP) to perform safe management actions via REST API and WP-CLI.

---

✨ Features

• 🔌 REST API — Full remote management via authenticated endpoints
• 🖥️ WP-CLI — Command-line interface for SSH-based automation
• 🔒 Secure — API key authentication with env var support
• 📦 Plugin Management — List, update single, or bulk update all plugins
• 📝 Content Management — Create posts remotely
• 🧹 Cache Control — Flush object cache on demand
• 📡 Site Registration — Register your site with an external MCP server

---

📥 Installation

Via ZIP (recommended)

1. Download the latest release from GitHub Releases.
2. In WP Admin go to Plugins → Add New → Upload Plugin, select the zip and click Install Now.
3. Activate the plugin.

Via Composer

composer require apicentraal/mcp-wp-connector

Via Git / Manual

cd /path/to/wordpress/wp-content/plugins
git clone https://github.com/ApiCentraal/mcp-wp-connector.git

Then activate in WP Admin.

---

⚙️ Configuration

1. Go to Settings → MCP Connector.
2. Enter your MCP API URL (e.g. https://mcp.example.com/api).
3. Enter your MCP API Key (generate with openssl rand -hex 32).
4. Click Save Changes.
5. Optionally click Register site to POST site metadata to the MCP.

Environment Variable (recommended for production)

# Add to your server environment or wp-config.php
export MCP_API_KEY="your_64_char_hex_key_here"

The plugin will automatically read from the MCP_API_KEY env var if set.

---

🔗 REST API Endpoints

All endpoints require authentication via Authorization: Bearer <API_KEY> header or X-MCP-API-Key: <API_KEY> header.

Endpoints Overview

Endpoint	Method	Description
/wp-json/mcp/v1/action/ping	POST	Returns site URL, WP version, PHP version, time
/wp-json/mcp/v1/action/status	POST	Returns DB prefix, active plugin count, WP version
/wp-json/mcp/v1/action/create_post	POST	Create a post
/wp-json/mcp/v1/action/clear_cache	POST	Flushes object cache
/wp-json/mcp/v1/action/list_plugins	POST	Returns list of all plugins
/wp-json/mcp/v1/action/update_plugin	POST	Update single plugin
/wp-json/mcp/v1/action/update_all_plugins	POST	Update all plugins with available updates
/wp-json/mcp/v1/register	POST	Register site with MCP server

Request/Response Examples

Ping

curl -X POST https://example.com/wp-json/mcp/v1/action/ping \
  -H "Authorization: Bearer YOUR_API_KEY"

Response:

{
  "url": "https://example.com",
  "wp_version": "6.9",
  "php_version": "8.2.0",
  "time": "2025-12-13 18:00:00"
}

Create Post

curl -X POST https://example.com/wp-json/mcp/v1/action/create_post \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title": "Hello World", "content": "<p>My content</p>", "status": "draft"}'

Response:

{"post_id": 123}

List Plugins

curl -X POST https://example.com/wp-json/mcp/v1/action/list_plugins \
  -H "Authorization: Bearer YOUR_API_KEY"

Response:

{
  "plugins": [
    {"slug": "akismet/akismet.php", "name": "Akismet", "version": "5.0", "active": true},
    {"slug": "hello-dolly/hello.php", "name": "Hello Dolly", "version": "1.7", "active": false}
  ]
}

Update Plugin

curl -X POST https://example.com/wp-json/mcp/v1/action/update_plugin \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"plugin": "akismet/akismet.php"}'

Update All Plugins

curl -X POST https://example.com/wp-json/mcp/v1/action/update_all_plugins \
  -H "Authorization: Bearer YOUR_API_KEY"

Response:

{"updated": ["plugin-a/plugin-a.php"], "failed": []}

---

🖥️ WP-CLI Commands

If WP-CLI is available, the plugin registers these commands:

Command	Description
wp mcp ping	Show site info
wp mcp status	Show DB prefix, active plugins, WP version
wp mcp clear-cache	Flush object cache
wp mcp list-plugins	List all plugins with status
wp mcp update-plugin <slug>	Update a single plugin
wp mcp update-all-plugins	Update all plugins with available updates
wp mcp create-post	Create a post
wp mcp register	Register site with MCP server

Examples

# Basic info
wp mcp ping
wp mcp status

# Plugin management
wp mcp list-plugins
wp mcp update-plugin akismet/akismet.php
wp mcp update-all-plugins

# Create content
wp mcp create-post --title="New Post" --content="Content here" --status=publish

# Register with MCP
wp mcp register

---

🔒 Security

Aspect	Recommendation
API Key Storage	Use MCP_API_KEY env var instead of database
HTTPS	Always use HTTPS for API calls
IP Restriction	Restrict endpoint access via firewall/Cloudflare
Key Rotation	Rotate API keys periodically
Permissions	Plugin update endpoints modify files — use carefully

Best Practices

1. Never commit API keys to version control
2. Use environment variables for sensitive configuration
3. Restrict IP access to the REST endpoints if possible
4. Monitor logs for unauthorized access attempts
5. Keep plugins updated including this connector

---

📁 File Structure

mcp-wp-connector/
├── mcp-wp-connector.php   # Main plugin loader (v1.1.0)
├── README.md              # This file
├── LICENSE                # MIT License
└── includes/
    ├── helpers.php        # API key/URL helpers, registration, auth
    ├── admin.php          # WP Admin settings page
    ├── rest.php           # REST API routes and handlers
    └── cli.php            # WP-CLI commands

---

🧪 Testing

Quick Test

1. Activate the plugin
2. Configure API URL and Key in Settings → MCP Connector
3. Test with cURL:

   curl -X POST https://yoursite.com/wp-json/mcp/v1/action/ping \
     -H "Authorization: Bearer YOUR_KEY"

WP-CLI Test

wp mcp ping
wp mcp list-plugins

Full Test Suite

# 1. Ping
curl -s -X POST https://yoursite.com/wp-json/mcp/v1/action/ping \
  -H "Authorization: Bearer $MCP_KEY" | jq

# 2. Status
curl -s -X POST https://yoursite.com/wp-json/mcp/v1/action/status \
  -H "Authorization: Bearer $MCP_KEY" | jq

# 3. List plugins
curl -s -X POST https://yoursite.com/wp-json/mcp/v1/action/list_plugins \
  -H "Authorization: Bearer $MCP_KEY" | jq

# 4. Clear cache
curl -s -X POST https://yoursite.com/wp-json/mcp/v1/action/clear_cache \
  -H "Authorization: Bearer $MCP_KEY" | jq

# 5. Create test post
curl -s -X POST https://yoursite.com/wp-json/mcp/v1/action/create_post \
  -H "Authorization: Bearer $MCP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title":"Test","status":"draft"}' | jq

---

📋 Changelog

1.1.0 (2025-12-13)

• ✨ Added list_plugins, update_plugin, update_all_plugins REST actions
• ✨ Added WP-CLI integration (wp mcp ...)
• 📚 Improved README with full documentation

1.0.1 (2025-12-13)

• ♻️ Refactored into modular structure (includes/)

1.0.0 (2025-12-13)

• 🎉 Initial release
• Basic REST endpoints: ping, status, create_post, clear_cache, register

---

🤝 Contributing

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

---

📄 License

MIT © ApiCentraal

---

🔗 Links

• GitHub Repository
• Releases
• Issues
• Improved README with full documentation.

1.0.1

• Refactored into modular structure (includes/).

1.0.0

• Initial release.

---

License

MIT © ApiCentraal