MCP Container

mcp-bridge-wp

MCP (Model Context Protocol) interface for WordPress with Application Password authentication.

GitHub

GitHub Stars

0

User Rating

Not Rated

Forks

0

Issues

0

Views

3

Favorites

0

README
MCP Bridge

A WordPress plugin that provides MCP (Model Context Protocol) interface with Application Password authentication, enabling AI agents to interact with WordPress sites through a standardized interface.

Important: This plugin does not support streaming functionality. It only supports simple request-response HTTP communication and intentionally excludes complex SSE (Server-Sent Events) or long-lived connections.

Features
  • MCP Protocol Support: Full JSON-RPC 2.0 compliant MCP implementation
  • WordPress Integration: Native WordPress REST API integration
  • Application Password Authentication: Secure authentication using WordPress Application Passwords
  • Extensible Tool System: Easy registration and management of MCP tools
  • Comprehensive Logging: Debug and audit logging with configurable levels
  • PSR-4 Autoloading: Modern PHP development standards
  • StreamableHTTP Support: MCP over HTTP compliant endpoints (without streaming)
Technical Specifications
✅ Supported Features
  • Streamable HTTP Transport: Single endpoint (/mcp) communication
  • JSON-RPC 2.0: Standard request-response format
  • WordPress REST API: Existing API MCP tool integration
  • Authentication: Application Password, Bearer Token support
  • Stateless Communication: Simple HTTP request-response pattern
❌ Intentionally Excluded Features
  • Streaming Communication: SSE, WebSocket, or long-lived connections
  • Real-time Notifications: Server-push communication
  • Bidirectional Communication: Client-to-server communication only
  • Session Management: Stateless communication only
  • Complex Transport Protocols: Simple HTTP only
Available Tools
Phase 1 (Core)
  • wp_get_site_info - Get basic WordPress site information
  • wp_get_posts - Retrieve WordPress posts with filtering options
  • wp_create_post - Create new WordPress posts
Phase 2 (Posts & Pages) - Complete in v1.5.0+
  • Posts API (5 tools)
    • wp_posts_search - Search and filter WordPress posts with pagination
    • wp_get_post - Get a WordPress post by ID
    • wp_update_post - Update an existing WordPress post
    • wp_delete_post - Delete a WordPress post
    • wp_create_post - Create new WordPress posts
  • Pages API (5 tools)
    • wp_pages_search - Search and filter WordPress pages with pagination
    • wp_get_page - Get a WordPress page by ID
    • wp_add_page - Create a new WordPress page
    • wp_update_page - Update an existing WordPress page
    • wp_delete_page - Delete a WordPress page
  • Post Metadata API (5 tools)
    • wp_get_post_meta - Get metadata for a WordPress post
    • wp_get_post_meta_value - Get a specific post meta value by meta ID
    • wp_add_post_meta - Add metadata to a WordPress post
    • wp_update_post_meta - Update post metadata by meta ID
    • wp_delete_post_meta - Delete post metadata by meta ID
  • Page Metadata API (5 tools)
    • wp_get_page_meta - Get metadata for a WordPress page
    • wp_add_page_meta - Add metadata to a WordPress page
    • wp_update_page_meta - Update page metadata
    • wp_delete_page_meta - Delete page metadata
Phase 3 (Taxonomy) - Complete in v1.6.0
  • Categories API (5 tools)
    • wp_list_categories - List WordPress categories with optional filtering
    • wp_get_category - Get a specific WordPress category by ID
    • wp_add_category - Create a new WordPress category
    • wp_update_category - Update an existing WordPress category
    • wp_delete_category - Delete a WordPress category
  • Tags API (5 tools)
    • wp_list_tags - List WordPress tags with optional filtering
    • wp_get_tag - Get a specific WordPress tag by ID
    • wp_add_tag - Create a new WordPress tag
    • wp_update_tag - Update an existing WordPress tag
    • wp_delete_tag - Delete a WordPress tag
  • Taxonomy API (4 tools)
    • wp_list_taxonomies - List all registered taxonomies
    • wp_get_taxonomy - Get a specific taxonomy by slug
    • wp_get_taxonomy_terms - Get terms for a specific taxonomy
    • wp_get_post_taxonomies - Get all taxonomies and terms for a specific post
Phase 4 (Media & Users) - Complete in v1.7.0
  • Media API (5 tools)
    • wp_list_media - List media items from WordPress media library
    • wp_get_media - Get a specific media item by ID
    • wp_upload_media - Upload a new media file to WordPress
    • wp_update_media - Update an existing media item
    • wp_delete_media - Delete a media item from WordPress
  • Users API (6 tools)
    • wp_list_users - List WordPress users with optional filtering
    • wp_get_user - Get a specific WordPress user by ID
    • wp_add_user - Create a new WordPress user
    • wp_update_user - Update an existing WordPress user
    • wp_delete_user - Delete a WordPress user
    • wp_get_current_user - Get the currently authenticated user
Installation
  1. Download the latest release
  2. Upload to /wp-content/plugins/ directory
  3. Activate the plugin through WordPress admin
  4. Configure Application Passwords for API access
API Endpoints
  • Primary MCP Endpoint (StreamableHTTP compliant): POST /wp-json/mcp/v1/mcp
  • Legacy Endpoint: POST /wp-json/mcp/v1/rpc (maintained for backward compatibility)
  • Tools Manifest: GET /wp-json/mcp/v1/tools
Authentication

The plugin supports multiple authentication methods:

  1. X-API-Key Header: Base64 encoded username:application_password
  2. Authorization Header: Bearer token with Base64 encoded credentials
  3. HTTP Basic Auth: Standard HTTP authentication
Usage Example
# Using the StreamableHTTP compliant endpoint
curl -X POST https://your-site.com/wp-json/mcp/v1/mcp \
  -H "Content-Type: application/json" \
  -H "X-API-Key: base64(username:app_password)" \
  -d '{"method": "getPosts", "params": {"limit": 5}}'

# Legacy endpoint (still supported)
curl -X POST https://your-site.com/wp-json/mcp/v1/rpc \
  -H "Content-Type: application/json" \
  -H "X-API-Key: base64(username:app_password)" \
  -d '{"method": "getPosts", "params": {"limit": 5}}'
Requirements
  • WordPress 5.0+
  • PHP 8.0+
  • Application Passwords enabled
License

GPL v2 or later

Contributing

Contributions are welcome! Please read the contributing guidelines before submitting pull requests.

Changelog
1.7.1
  • 🐛 Media Upload Fix
    • Fixed wp_upload_media to support base64 encoded file uploads
    • Added support for remote file uploads via MCP clients
    • Improved file type detection and MIME type handling
    • Added proper temporary file cleanup
    • Enhanced error handling for upload failures
1.7.0
  • 🚀 Phase 4 Complete - Media & Users APIs
    • Added complete Media management tools (5 tools)
    • Implemented wp_list_media, wp_get_media, wp_upload_media, wp_update_media, wp_delete_media
    • Custom handler for media upload functionality with local file support
    • Added complete Users management tools (6 tools)
    • Implemented wp_list_users, wp_get_user, wp_add_user, wp_update_user, wp_delete_user, wp_get_current_user
    • Enhanced tool organization with dedicated Media and Users namespaces
    • Total tools count: 48+ MCP tools for comprehensive WordPress management
1.6.0
  • 🚀 Phase 3 Complete - Taxonomy APIs
    • Added complete Categories management tools (5 tools)
    • Implemented wp_list_categories, wp_get_category, wp_add_category, wp_update_category, wp_delete_category
    • Added complete Tags management tools (5 tools)
    • Implemented wp_list_tags, wp_get_tag, wp_add_tag, wp_update_tag, wp_delete_tag
    • Added Taxonomy information and utility tools (4 tools)
    • Implemented wp_list_taxonomies, wp_get_taxonomy, wp_get_taxonomy_terms, wp_get_post_taxonomies
    • Enhanced tool organization with dedicated Taxonomy namespace
    • Total tools count: 37+ MCP tools for comprehensive WordPress management
1.5.4
  • 🔧 Build Process Optimization
    • Fixed oversized release files (reduced from 978MB to 44KB - 99.99% reduction)
    • Improved create-release.sh script to exclude unnecessary files
    • Removed dist/, reference-code/, and nested zip files from releases
    • Optimized build process for production deployment
1.5.3
  • 🐛 Metadata API Bug Fixes
    • Fixed inputSchema parameter mapping in RegisterMcpTool
    • Corrected empty properties issue in tools/list manifest
    • Improved metadata tool registration
    • All metadata tools now properly expose their parameters
1.5.2
  • 🔧 Tool Registration Fixes
    • Fixed "no executable handler" error for metadata tools
    • Added support for 'handler' parameter in RegisterMcpTool
    • Added support for 'inputSchema' parameter mapping
    • Improved tool registration compatibility
1.5.1
  • 🐛 Metadata API Implementation Fix
    • Changed Post and Page metadata tools from REST API aliases to direct WordPress functions
    • Fixed WordPress REST API metadata endpoint limitations (disabled by default)
    • Implemented direct handlers using get_post_meta, add_post_meta, update_post_meta, delete_post_meta
    • Improved error handling for metadata operations
1.5.0
  • 🚀 Phase 2 Complete - Page Metadata Tools
    • Added complete Page Metadata management tools
    • Implemented wp_get_page_meta, wp_add_page_meta, wp_update_page_meta, wp_delete_page_meta
    • Achieved 100% Phase 2 completion with all Posts and Pages APIs
    • Enhanced tool organization with PageMetaTools class
    • Full parity between Post and Page metadata operations
1.4.0
  • 🚀 Phase 2 Implementation Complete - Posts & Pages Tools
    • Added comprehensive Posts tools with full CRUD operations
    • Implemented wp_posts_search for advanced post filtering and pagination
    • Added wp_get_post, wp_update_post, wp_delete_post for single post operations
    • Implemented complete Post Meta management tools
    • Added wp_get_post_meta, wp_add_post_meta, wp_update_post_meta, wp_delete_post_meta
    • Implemented comprehensive Pages tools with hierarchical support
    • Added wp_pages_search, wp_get_page, wp_add_page, wp_update_page, wp_delete_page
    • Enhanced REST API alias integration for all WordPress standard endpoints
    • Improved tool organization with dedicated namespace structure
    • All tools maintain existing functionality while adding advanced features
    • Full backward compatibility maintained for existing implementations
1.3.0
  • 🛡️ Enhanced Security Features
    • Added comprehensive Security class with multi-layer protection
    • Implemented CORS origin validation with configurable allowed domains
    • Added IP address restrictions with CIDR range support
    • Implemented rate limiting (100 requests per hour per IP)
    • Enhanced logging with automatic credential sanitization
    • Added proxy-aware client IP detection (Cloudflare, X-Forwarded-For support)
    • Improved authentication with enhanced error handling
  • ⚙️ Advanced Admin Settings
    • Added Security Settings section in admin panel
    • Configurable CORS origins management
    • IP restriction management interface
    • Rate limiting toggle with admin controls
    • Enhanced input validation and sanitization
  • 🔧 Core Improvements
    • Refactored WpMcp class with security integration
    • Enhanced session management with validation
    • Improved error responses with security headers
    • Better logging structure with sensitive data protection
    • Enhanced MCP protocol compliance
1.1.7
  • 🚀 Post Creation Bug Fixes
    • Fixed HTTP 500 error when creating posts via MCP
    • Improved REST API route handling and request processing
    • Enhanced error handling with detailed logging for post creation
    • Added direct callback implementation for wp_create_post tool
    • Better parameter validation and sanitization
    • Improved MCP-compliant response formatting for created posts
1.1.6
  • Fixed logging configuration and enhanced debugging capabilities
  • Improved tool registration system with better error handling
  • Enhanced MCP protocol compliance
1.1.5
  • 🔧 MCP Inspector v0.14.0 Zod Validation Fix
    • Fixed capabilities.logging field type compatibility with MCP Inspector v0.14.0
    • Changed logging capabilities from array to object to meet Zod schema validation requirements
    • Resolved "Expected object, received array" validation error in MCP Inspector
    • Enhanced MCP protocol compliance for better client compatibility
    • Improved initialization response format for modern MCP clients
1.1.4
  • 🔧 MCP Inspector Compatibility Fixes
    • Fixed sessionId undefined error in MCP Inspector console output
    • Enhanced session management to accept and use client-provided session IDs
    • Improved Connection Error handling with better session tracking
    • Added comprehensive CORS headers for MCP Inspector compatibility
    • Enhanced debugging output with session status tracking
    • Added X-Session-Status and X-Server-Name headers for better client identification
    • Improved error responses with consistent session ID headers
    • Enhanced logging for MCP Inspector specific debugging
1.1.3
  • Enhanced MCP Inspector compatibility with improved CORS handling
  • Added comprehensive preflight OPTIONS request support
  • Enhanced session management with guaranteed session ID availability
  • Improved authentication flow for initialization methods
  • Added prompts capability to server capabilities
  • Enhanced logging for better connection debugging
  • Fixed connection errors in MCP Inspector UI
1.1.2
  • Fixed MCP Inspector sessionId undefined issue
  • Enhanced session management with guaranteed session ID generation
  • Improved Streamable HTTP transport compatibility
  • Added X-MCP-Protocol-Version header for better client compatibility
  • Enhanced logging for session tracking and debugging
1.1.1
  • Added complete MCP Inspector compatibility
  • Implemented notifications/initialized handshake support
  • Enhanced MCP protocol compliance with proper initialization sequence
  • Added detailed session tracking with X-MCP-Session-ID headers
  • Improved authentication method detection and error handling
  • Enhanced logging for better debugging and monitoring
  • Maintained backward compatibility with legacy endpoints
1.1.0
  • Added StreamableHTTP compliant /mcp endpoint
  • Maintained backward compatibility with legacy endpoints
  • Enhanced MCP over HTTP support
1.0.0
  • Initial release
  • Basic MCP protocol implementation
  • WordPress REST API integration
  • Application Password authentication
  • Core tool set (site info, posts CRUD)
Author Information
benridane
benridane
GitHub

1

Followers

38

Repositories

10

Gists

22

Total Contributions

Top Contributors

benridanebenridane
22
Tags
APIFile SystemAI/LLMAuthenticationCloudMonitoring
Threads