Home

xNetVN Agent Hub WP

A private, capability-scoped MCP server for WordPress. The 1.0.0 source in this repository defines 62 reviewed abilities in six toolsets — system (5), content (19), taxonomy (9), media (7), comments (10) and users (12) — reachable over HTTP only through user-owned API keys (README.md, readme.txt).

Who it is for

Site owners, agencies and developers who want an AI agent to work with posts, media, comments, taxonomy and users under a real WordPress identity, without code execution, SQL, file edits or security settings (readme.txt). Each key belongs to one WordPress user, so an agent inherits exactly that person's permissions.

Security model

A call succeeds only when the owner's core capability and object permission, the key scope, the ability tier against both the key and site ceilings, the enabled toolset, any explicit allow/deny list, the admin-tier switch and an authenticated HTTP context all allow it — and the owner's capabilities are rechecked on every request, so role changes and revocation apply immediately (docs/en/architecture/overview.md). Keys are shown once and stored as HMAC-SHA256 with a separate random per-site pepper; the MCP route accepts bearer keys only while management uses a cookie plus REST nonce; audit rows keep top-level argument names but never values, tokens, passwords or cookies (README.md, docs/user-guide.md). Arbitrary SQL, PHP, shell execution, file editors and secret or key-management tools are permanently excluded (docs/en/architecture/overview.md).

Start here

Page	What it answers
Requirements	WordPress, PHP, database, HTTPS and MCP Adapter versions, and what happens without the adapter.
Installation	Install from a release ZIP or a source checkout, activation order, upgrades and uninstall data behaviour.
Quick-Start	Create a key, configure a client, make the first tools/list call and verify the activity log.
Configuration	Settings groups, real option keys and the defaults that matter.
Compatibility	Supported version matrix, single site and multisite, what CI verifies and known limits.

All pages

Using the plugin

• Abilities-and-Toolsets — the 62 abilities by toolset, the tier model and per-key scope.
• Key-Management — create, scope, rotate and revoke a key; what is stored and what a leak requires.
• Audit-and-Logging — what the activity log keeps, what it never keeps, and how to investigate a call.
• Troubleshooting-and-FAQ — symptom, cause, check and fix for the common failures.
• Agent skill pack — what the public pack covers, how to load it, the safety rules and its limits.

Security

• Security-Model — authentication, scope narrowing, origin and rate limits, audit guarantees and the permanent exclusions.

Engineering

• Architecture — the request path from route to audit and the adapter boundary.
• Development — local setup, standards and the lab rule.
• Testing — every test layer, the exact command and what it proves.
• Operations — deployment, cache, retention, multisite and monitoring.
• Release-and-Versioning — version sources, changelog rules and the release flow.
• Contributing — branch, commit and review expectations.
• Glossary — the project's vocabulary.

Project links

• Repository: https://github.com/xnetvn-com/xnetvn-agent-hub-wp
• Issues and feature requests: https://github.com/xnetvn-com/xnetvn-agent-hub-wp/issues
• User guide: https://github.com/xnetvn-com/xnetvn-agent-hub-wp/blob/main/docs/user-guide.md
• Agent skill pack: https://github.com/xnetvn-com/xnetvn-agent-hub-wp/blob/main/docs/en/guides/agent-skill-pack.md
• Changelog: https://github.com/xnetvn-com/xnetvn-agent-hub-wp/blob/main/CHANGELOG.md
• Security reports: security@xnetvn.net (SECURITY.md)

Compatibility at a glance

WordPress 6.9 or later · PHP 8.2 or later · official MCP Adapter 0.7.x (>=0.7.0 <0.8.0) · MySQL 8.0+ or MariaDB 10.6+ with InnoDB · HTTPS in production · single site and multisite (README.md, readme.txt).