Skip to content

Shim MCP 1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@justadityaraj justadityaraj released this 30 Aug 20:23
· 1 commit to main since this release
v1.0.0
a70a817

First public release. An MCP (Model Context Protocol) server for WordPress, submitted to the WordPress.org plugin directory.

What it does

Turns a WordPress site into an MCP server that Claude Code, Claude Desktop, Cursor, Windsurf, Cline, or any MCP-compatible client can drive. 56 abilities across posts, pages, taxonomy, search, revisions, media, users, plugins, menus, widgets, comments, options and system diagnostics.

Two ways to connect

Local, over stdio — the reason this exists:

wp shim-mcp serve --user=admin

JSON-RPC over STDIN/STDOUT. No HTTP, no port, no token. Other WordPress MCP plugins expose WP-CLI as a tool reachable over an authenticated HTTP connection; here WP-CLI is the transport itself.

Remote, over HTTP — Streamable HTTP with an application password, for sites you aren't sitting in front of.

Security

  • Every ability declares a capability, and every ability that touches a specific object re-checks the per-object capability (edit_post, delete_post, read_post, edit_user, delete_user, edit_comment) against that object before reading or mutating it.
  • Installing plugins from external sources is not supported by design. Plugin abilities cover only what is already installed.
  • Writing to wp-config.php is off unless you opt in with define( 'SHIM_MCP_ALLOW_CONFIG_WRITES', true );, and is refused again under DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS, on a non-writable file, or if the rewritten contents fail a sanity check.
  • No proxy, no relay, no telemetry, no vendor account.

Requirements

WordPress 6.9 or later (for the core Abilities API) and PHP 8.0 or later.

Verification

Tested on WordPress 7.1 / PHP 8.5.9: activation, admin dashboard, MCP handshake, all 56 abilities registering through core's native Abilities API, and a full create/update/patch/read/delete cycle.

Clean across WordPress Plugin Check (0 errors, 0 warnings), PHP_CodeSniffer with WordPress-Extra (0 violations), PHPStan level 5 with WordPress stubs, php -l on all 73 files, and PHPCompatibility for PHP 8.0 through 8.5.

Credits

The MCP protocol layer under includes/Server/ is derived from the WordPress MCP Adapter (GPL-2.0). Abilities are registered through WordPress's own Abilities API. See CREDITS.md.

Assets 3
Loading