v1.4.0 - Vision, undo, batching, link and sitemap auditing

The agent can see, and every change can be taken back

Images

Every route into the media library — upload_media, product images, variation images — now goes through one ingest engine.

• Four sources, one shape — an existing attachment id, a url the server downloads, raw base64 bytes (a data URI works), or a path to a file already on the server. No more "upload it, then attach it".
• SEO filenames — IMG_2831.JPG lands as black-cotton-hoodie.jpg, numbered -2, -3 through the gallery.
• De-duplication — bytes are hashed on the way in. Re-importing the same photo across twenty products reuses one attachment.
• Processed before storage — max_dimension downscales, convert writes WebP or AVIF, quality re-encodes, all before the file becomes an attachment.
• A gallery you can edit — mode (replace/append/prepend), remove_ids, reorder, detach_main, per-image title, caption and description.
• One bad URL no longer loses the batch — each source reports its own error and everything else still saves.
• get_image_bytes returns an image as an inline picture rather than a filename, so alt text and product copy can be written from what is actually in the photograph — and so you can confirm the right image is on the right product.

New media tools: optimize_image (restorable original, never replaces a file with a larger one, optional URL rewriting), restore_image, regenerate_thumbnails, find_duplicate_media, find_unused_media, bulk_set_image_alt, bulk_assign_variation_images.

Undo

Writes are journalled. Every instrumented tool records the value it overwrites, returns an operation_id, and undo_operation puts the whole change back in reverse order — bulk repricing, inventory, search and replace, bulk content and SEO writes, schema, alt text, product images. list_operations shows the last 40; create_restore_point snapshots a set of posts before a risky run.

Batching

batch runs up to 50 tool calls in a single request. Each step reports its own result or error, and the whole batch reverses as one operation. Editing 200 products used to be 200 round trips.

Broken links and sitemaps

• find_broken_links — resolves internal links against the database first, requests the rest over HTTP with redirects followed, reports redirects separately from failures, caches results for six hours, and resumes where it stopped.
• get_sitemap — reads the sitemap from core, Yoast or Rank Math and follows an index into its children.
• sitemap_audit — noindexed URLs sitting in the sitemap, published content missing from it, URLs that 404 or redirect, stale lastmod dates.
• indexnow_submit — instant indexing for Bing, Yandex, Naver and Seznam. The verification key is generated and served at /<key>.txt automatically.

Product SEO

• set_seo / get_seo gain og_image and twitter_image, accepting an attachment ID or a URL and writing both the URL and the attachment ID the SEO plugin needs.
• generate_product_schema — Merchant-grade Product data: gtin/mpn/sku, brand, priceValidUntil, shippingDetails, hasMerchantReturnPolicy, itemCondition, colour/size/material, embedded reviews. Variable products become a ProductGroup with every variation as a hasVariant offer. Policy facts can be saved once and reused.
• product_seo_fix — bulk repair of missing titles, descriptions, alt text and schema, trimmed to the pixel width Google renders.
• bulk_set_seo and serp_preview — template-driven SEO across any post type, and a pixel-accurate preview showing where each result is truncated.
• product_seo_audit now also reports duplicated descriptions and missing social images.

Knowing what happened

• get_audit_log — every tool call: arguments with secrets redacted, status, duration, requesting IP, and the operation that would undo it.
• get_progress — call it on a second connection while a long sweep is working.
• A time budget — long sweeps stop before PHP's execution limit and return a resume offset instead of being killed mid-write.

162 tools. Requires WordPress 5.6+ and PHP 7.4+.

Install

Download wordpress-mcp.zip below and upload it under Plugins → Add New → Upload Plugin.

v1.3.0 — Page builders, full WooCommerce operations, site speed, robust errors

Major release. 55 → 140 tools. Page-builder aware editing, complete WooCommerce store operations, a site-speed audit and optimiser, and a structured error-handling system.

Page builders (new)

A WordPress page is only "HTML in post_content" on a classic site. Elementor keeps a JSON tree in post meta, Gutenberg keeps block comments in the content, Divi and WPBakery keep nested shortcodes. Overwriting post_content on any of those either does nothing or destroys the layout.

So the plugin now detects what actually built a page and edits it in that builder's own structure.

• detect_page_builder — which builder renders this page, and whether overwriting the body is safe
• get_page_structure — the page as an addressable tree of sections, widgets and blocks
• edit_page_element — change one heading, button, link or image in place; the builder's CSS cache is regenerated
• insert_page_section, delete_page_element, list_builder_templates, manage_global_styles, render_page_preview

Full read/write for Elementor and Gutenberg blocks; text and attribute editing for Divi and WPBakery; read support for Beaver Builder, Oxygen, Bricks, Breakdance, SiteOrigin.

WooCommerce — complete store operations

Catalogue (26 tools): products of any type with the full field set, variations including generate_product_variations, global attributes and their terms, categories with images and SEO, image and gallery management, catalogue-wide repricing and scheduled sales, inventory control, an inventory report, coupons, whitelisted store settings, and sales reporting.

Orders & customers (8 tools): a separate wc_orders group, off by default — orders, order notes, refunds, customers, retention analysis. It carries personal data and can move money, so a catalogue or SEO engagement never gets it. refund_order records a manual refund unless via_gateway=true and never exceeds the refundable balance.

Performance — "make my website faster"

• performance_audit — measures the live page (response time, HTML weight, render-blocking scripts, compression, cache headers), the platform (PHP version, object cache, OPcache, caching plugin) and the database (autoload bloat, revisions, transients, orphaned meta) → a ranked fix list and a score
• optimize_site — preset=safe or preset=aggressive, dry run by default, every flag reversible
• database_cleanup, clear_cache, image_optimization_report, analyze_page_speed, list_autoloaded_options

Appearance (new)

Navigation menus, widgets and sidebars, customizer theme mods, and site identity — title, tagline, logo, favicon, timezone, front page.

Robust error handling

Every failure returns structured JSON — a stable code, a message, an actionable hint, and details — instead of a bare sentence.

• Arguments validated and coerced against each tool's schema before the handler runs
• PHP warnings raised during a call captured and returned alongside the result
• A shutdown guard turns a fatal into a readable JSON-RPC error rather than a blank 500
• Rolling error log, readable with get_error_log, mcp_status, and a panel on the settings screen
• PHP is parsed before every file write and refused if it would not compile — a fatal in a theme file would otherwise take down the site and this endpoint
• Automatic backups on every overwrite and delete, restorable with restore_file

Also new

Content: bulk updates, dry-run search and replace, duplication, revisions, comment moderation, media management. Site management: plugin and theme updates and deletion, user CRUD, cron inspection, permalinks. Filesystem: search_files, copy_file, file_info, create_child_theme.

Fixes

• Redirects to another domain are honoured instead of bouncing to wp-admin
• SERP length checks count characters, not bytes — non-Latin meta descriptions are no longer flagged as too long
• Word counts understand CJK, Devanagari, Cyrillic and Arabic, so non-English pages stop reading as thin content
• Order status handling used ltrim with a character list, turning completed into ompleted
• install_plugin goes through the core upgrader instead of hand-rolled zip extraction
• sql_execute blocks SQL-level file I/O and requires confirmation for DROP, TRUNCATE and unbounded DELETE/UPDATE; describe_tables resolves table names against the real table list
• URL arguments reaching wp_remote_get are validated, so the measurement and preview tools cannot probe localhost or private ranges
• seo_audit streams post IDs instead of loading thousands of full objects into memory
• Sales and customer reports are bounded rather than unlimited
• Unreadable directories no longer abort a recursive file scan
• The Heartbeat throttle hooked init from within init and never fired

Upgrading

Drop-in. New capability groups default sensibly: Page builders, Performance and Appearance on; WooCommerce orders off alongside Site Management, Filesystem and Raw Database. Tools that write site-wide — bulk_update_products, search_replace_content, optimize_site, database_cleanup — default to dry_run=true.

Requires WordPress 5.6+ and PHP 7.4+.

---

Install: download wordpress-mcp.zip below and upload it via Plugins → Add New → Upload.

1.2.0 — Deep SEO/AEO/GEO, dynamic file editing, brute-force protection

WordPress MCP 1.2.0

Built exclusively for Claude (Claude Code + Claude chat/Desktop). 55 tools.

Deeper SEO / AEO / GEO

• analyze_content — deep per-page audit: keyword placement (title, meta, slug, first paragraph, headings), density, word count, H1–H6 outline, internal/external links, missing-alt images, meta-length checks, AEO question-coverage + FAQ-schema detection, issue list and score.
• generate_schema — auto-build JSON-LD (Article, BlogPosting, FAQPage, HowTo, BreadcrumbList, Product) from a post and apply in one call.
• internal_link_opportunities — find posts mentioning a keyword that don't yet link to a target.
• manage_robots_txt — control AI/GEO crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot…) via the virtual robots.txt.
• manage_redirects — managed 301/302/307/308 redirects served by the plugin.
• sitekit_keyword_opportunities — mine Search Console for striking-distance keywords (positions 5–20, high impressions, low CTR).

More dynamic filesystem

• edit_file — targeted in-place edits (exact replace, replace_all, or append/prepend) — no full-file resend.
• make_dir, move_file; write_file now auto-creates parent directories.

Hardened transport

• Per-IP brute-force lockout on the auth endpoint (10 failed attempts → 15-minute 429), clearing on success.

Install: download wordpress-mcp.zip below and upload via Plugins → Add New → Upload.

v1.1.0

WordPress MCP 1.1.0

Claude chat (web/desktop) connector support

The API key can now be passed in the endpoint URL (?key=...). Claude.ai chat custom connectors accept a URL only (no header field), so this is what lets you add a site as a custom connector in chat. Claude Code Bearer/header auth is unchanged. The settings screen now shows a ready-to-paste chat connector URL.

https://your-site.com/wp-json/wp-mcp/v1/mcp?key=YOUR_KEY

Google Site Kit data fix

• The bridge now resolves the administrator who is actually connected to Google instead of the first administrator found, so Search Console / GA4 / PageSpeed requests stop silently returning nothing.
• Integration status verifies and reports the real connection state (connected / active but not connected) and lists active modules.
• Site Kit errors are surfaced with the underlying cause instead of being swallowed.

Install

Download wordpress-mcp.zip below and upload via Plugins -> Add New -> Upload, or update the files in place. Requires WordPress 5.6+ and PHP 7.4+.

WordPress MCP v1.0.0

Universal Model Context Protocol (MCP) server for WordPress. Connect any client site to Claude (chat & Claude Code) for hands-on SEO / AEO / GEO work.

Highlights

• JSON-RPC 2.0 MCP endpoint, single Bearer key (constant-time auth)
• ~46 tools across 7 capability groups; dangerous groups OFF by default
• Engine-agnostic SEO (Yoast / Rank Math), WooCommerce product SEO
• Read-only Google Site Kit bridge (Search Console / GA4 / PageSpeed)
• Per-post JSON-LD schema + site-wide llms.txt for AEO/GEO
• Material 3 admin UI

Security hardening

• Media-upload RCE blocked (mime allowlist + byte verify)
• JSON-LD stored-XSS neutralised (hex-escaped output)
• Path-traversal containment fix (sibling-dir escape)
• "Read-only" SQL blocks INTO OUTFILE / DUMPFILE / LOAD_FILE
• User-meta access gated behind Site Management capability

Install

Download wordpress-mcp.zip, upload via Plugins > Add New > Upload, activate, then open the WordPress MCP screen for the endpoint, key, and connect command.

Requires WordPress 5.6+ and PHP 7.4+. GPL-2.0-or-later.