NDsoft MCP HTTP Connector releases

Direct HTTP MCP connector for WordPress.

Current release: 1.1.0
Status: Stable

The plugin connects an MCP-compatible client such as VS Code/Copilot directly to WordPress over HTTP(S), without requiring a separate Node.js bridge, npm server, local MCP server folder, or WP-CLI MCP adapter.

Architecture

VS Code / MCP Client
        |
        | HTTP(S) MCP
        v
NDsoft MCP HTTP Connector
        |
        v
WordPress

Features

• Direct HTTP MCP endpoint
• 7 WordPress MCP tools
• Local development mode
• HTTPS enforcement for public/live sites
• Secure connection-token authentication for live sites
• Unique per-site MCP server ID
• Read-only by default
• Separate Create and Update page permissions
• Draft-only safety guard
• Token rotation and revocation
• Token created / last-used information
• Per-IP rate limiting
• MCP self-test
• Audit log
• No Node.js bridge
• No npm install
• No WP-CLI MCP adapter dependency

Available MCP Tools

Read tools

• wordpress_site_info
• wordpress_list_themes
• wordpress_list_plugins
• wordpress_list_pages
• wordpress_get_page

Write tools

• wordpress_create_page
• wordpress_update_page

Write tools require the relevant permission to be enabled in WordPress.

Requirements

• WordPress 6.5+
• PHP 8.1+
• An MCP-compatible HTTP client
• HTTPS for public/live sites

Installation

1. Download the plugin ZIP.
2. In WordPress, go to Plugins → Add Plugin → Upload Plugin.
3. Upload and activate the plugin.
4. Open Settings → NDsoft MCP HTTP.
5. Run MCP self-test.

Local Development Setup

On positively identified local/development environments such as LocalWP .local sites, the plugin can use local no-auth mode.

1. Open Settings → NDsoft MCP HTTP.
2. Keep Disable authentication on this local/development site enabled.
3. Copy the generated VS Code configuration.
4. Create:

<wordpress-root>/.vscode/mcp.json

5. Paste the generated configuration.
6. Start the MCP server in VS Code.
7. Confirm that VS Code reports the server as running and discovers 7 tools.

Example:

{
  "servers": {
    "ndsoft-example-local-a1b2c3": {
      "type": "http",
      "url": "http://example.local/wp-json/ndsoft-mcp/v1/mcp"
    }
  },
  "inputs": []
}

Live / Production Setup

Public/live environments require HTTPS and a connection token.

1. Open Settings → NDsoft MCP HTTP.
2. Confirm:
   • Environment = Public / live
   • HTTPS MCP endpoint
   • Authentication = token required
   • Write permissions disabled unless needed
3. Generate a connection token.
4. Copy the token once and store it securely.
5. Copy the generated VS Code configuration.
6. Paste it into the live-site workspace .vscode/mcp.json.
7. Start the MCP server.
8. Enter the token when VS Code requests it.

Example:

{
  "servers": {
    "ndsoft-example-com-a1b2c3": {
      "type": "http",
      "url": "https://example.com/wp-json/ndsoft-mcp/v1/mcp",
      "headers": {
        "X-NDsoft-MCP-Key": "${input:ndsoft-mcp-token-v1}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "ndsoft-mcp-token-v1",
      "description": "WordPress MCP connection token",
      "password": true
    }
  ]
}

Do not commit actual tokens or credentials to Git.

Permissions and Safety

The plugin is read-only by default.

For write operations, Create and Update permissions are controlled separately.

For live sites, Draft-only guard is recommended. When enabled:

• New MCP-created pages must remain drafts.
• Existing published/private/pending pages cannot be modified.
• Drafts cannot be promoted to published/private/pending through MCP.

After a write task is complete, disable write permissions again.

Token Security

• Only a SHA-256 hash of the connection token is stored in WordPress.
• The plaintext token is shown only when generated.
• Tokens can be rotated.
• Tokens can be revoked immediately.
• The generated VS Code token input ID changes after rotation/revocation to avoid stale secret reuse.
• Public/live MCP traffic requires HTTPS.

Audit Log

The connector records recent MCP activity including:

• UTC timestamp
• tool/action
• success/error status
• source IP
• message

The log retains up to 100 recent events.

VS Code Troubleshooting

If an old OAuth/client-registration prompt appears after changing an MCP server configuration:

1. Cancel the popup.
2. Use the VS Code command: Authentication: Remove Dynamic Authentication Providers
3. Restart the MCP server.

Each WordPress site receives a unique MCP server ID to reduce stale authentication-state reuse.

Tested

The release candidate has been tested with:

• Multiple LocalWP WordPress installations
• Direct read operations
• Draft page creation
• Live HTTPS WordPress
• Secure token authentication
• Live read and controlled draft-write operations

Development Status

1.1.0 is the first stable release after successful local and live regression testing.

Ongoing release maintenance should continue to include security review, WordPress coding-standard checks, Plugin Check, and compatibility testing across supported WordPress/PHP versions.

License

GPLv2 or later.

Author

NDsoftdesign