Zanini Site Abilities

WordPress plugin that registers site-management abilities (WordPress 6.9 Abilities API) and exposes them as MCP tools for AI agents to administer zaninisoftware.com and remediate audit findings.

v2.0.1 fixes MCP Adapter exposure (meta.mcp.public on all zanini-site/* abilities) and documents direct vs adapter transport parity for multi-site deployments (e.g. livingwatershop.net + WooCommerce).

v2.0 adds content lifecycle, media library, taxonomies, navigation, allowlisted settings, operation tokens, Jetpack Forms proxies, and administration tools (~57 MCP tools on zanini-site-mcp).

Prerequisites

• WordPress 6.9+ (Abilities API in core)
• PHP 8.1+
• MCP Adapter plugin ≥ 0.5.0 installed and active
• WordPress Application Password for the agent user (edit_posts, upload_files, manage_options as needed)
• Audit baseline from site optimization feature (audit-findings.json)

See docs/mcp-connection-guide.md for direct vs adapter Cursor configuration (WooCommerce sites). Acceptance procedures: specs quickstart.

Table of Contents

• Setup Steps
• MCP Tools
• Troubleshooting
• Development

Setup Steps

Follow these steps in order. Each step should take about 1–2 minutes.

Step 1: Install the MCP Adapter plugin

1. Download or clone WordPress/mcp-adapter.
2. Copy the plugin folder to wp-content/plugins/ on your WordPress site.
3. In WordPress Admin → Plugins, activate MCP Adapter.

Step 2: Install this plugin

Option A — Upload in WordPress Admin (recommended)

1. Open Releases and download zanini-site-abilities-X.Y.Z.zip (the release asset, not "Source code").
2. In WordPress Admin → Plugins → Add New → Upload Plugin, choose that ZIP and click Install Now.

Do not upload GitHub's auto-generated "Source code" archive — it uses a nested folder layout WordPress cannot install.

Option B — Git clone

cd /path/to/wordpress/wp-content/plugins
git clone https://github.com/Joezanini/zanini-wp-site-abilities.git zanini-site-abilities

Step 3: Activate Zanini Site Abilities

1. Open WordPress Admin → Plugins.
2. Find Zanini Site Abilities and click Activate.
3. If activation fails, confirm WordPress is 6.9+ and MCP Adapter is active.

Step 4: Create an Application Password

1. Go to Users → Profile (or your admin user profile).
2. Scroll to Application Passwords.
3. Enter a name (e.g. cursor-mcp) and click Add New Application Password.
4. Copy the generated password — you will not see it again.

The user needs at least read for inventory tools and edit_posts / upload_files / manage_options for write tools.

Step 5: Configure Cursor MCP

Direct transport (full tools/list on zanini-site-mcp):

{
  "mcpServers": {
    "wordpress-zanini-site": {
      "url": "https://YOUR-SITE.com/wp-json/zanini-site/mcp",
      "headers": {
        "Authorization": "Basic BASE64_ENCODED_USER_AND_APP_PASSWORD"
      }
    }
  }
}

Adapter transport (WooCommerce + discover-abilities meta-tools; requires v2.0.1+ for zanini-site/*):

{
  "mcpServers": {
    "wordpress-http-custom": {
      "url": "https://YOUR-SITE.com/wp-json/mcp/mcp-adapter-default-server",
      "headers": {
        "Authorization": "Basic BASE64_ENCODED_USER_AND_APP_PASSWORD"
      }
    }
  }
}

WooCommerce sites may configure both servers. See docs/mcp-connection-guide.md.

Step 6: Approve writes (findings or operation tokens)

Before any write tool runs, the site owner must provide approval:

• v1 remediation: finding_id or batch_id (approved in admin UI or via MCP)
• v2 admin writes: exactly one of finding_id, batch_id, or operation_token

Option A — Admin UI (findings)

1. Go to Settings → Zanini Site Abilities.
2. Enter a finding ID (e.g. perf-mixed-content-69).
3. Click Approve Finding.

Revoke unused operation tokens from the same settings page.

Option B — MCP tools

• zanini-site-register-approved-findings — audit finding/batch IDs
• zanini-site-register-operation-token — single-use admin write tokens

Step 7: Verify tools and run a dry-run

1. Restart Cursor (or reload MCP servers).
2. Confirm tools/list includes v2 tools (e.g. zanini-site-create-post, zanini-site-jetpack-list-forms).
3. Invoke zanini-site-list-pages — expect published pages on zaninisoftware.com.
4. Invoke zanini-site-fix-mixed-content with "dry_run": true, an approved finding_id, and page_id: 69.
5. Check the response for planned HTTP→HTTPS changes without live edits.

Step 8: Verify capability matrix (optional)

wp zanini-site matrix verify --format=json

See docs/admin-capability-matrix.md.

MCP Tools

v2 exposes ~57 tools on zanini-site-mcp (14 v1 remediation + v2 admin + 8 Jetpack proxies). Highlights:

Full contract: ability-registry-v2 (specs repo).

See docs/ability-audit-map.md for audit finding traceability.

Troubleshooting

Development

cd zanini-site-abilities
composer install
composer test

Optional: composer install generates vendor/autoload.php. Without Composer, the plugin falls back to includes/autoload.php.

License

GPL-2.0-or-later