easyMCP

Connect any AI assistant to your WordPress site via the Model Context Protocol (MCP).

easyMCP turns your WordPress site into a fully-featured MCP server. Any MCP-compatible AI client — Claude Code, Claude Desktop, Cursor, Windsurf, Cline, and others — can connect to it and manage your site through natural language.

Features

• MCP server over HTTP (Streamable HTTP transport, MCP spec 2025-06-18)
• OAuth 2.1 with PKCE — one-click browser-based login for any MCP client
• Static API keys — paste a Bearer token for scripts, CLI tools, and manual configs
• Per-credential permission control — 22 granular checkboxes per key or OAuth client
• Full site management — posts, pages, media, users, categories, tags, comments, plugins, themes, and settings
• Activity log — every tool call is logged with credential name, status, and timestamp
• Auto-registration — AI clients that generate their own client ID connect without pre-setup

Requirements

• WordPress 6.0 or higher
• PHP 7.4 or higher
• Pretty permalinks enabled (Settings → Permalinks → any option except Plain)

Installation

1. Download easymcp.zip
2. In your WordPress admin, go to Plugins → Add New → Upload Plugin
3. Upload the zip and click Install Now
4. Click Activate Plugin

A new easyMCP menu item appears in your WordPress admin sidebar.

Quick Start

Connect an AI client (OAuth — recommended)

1. Go to easyMCP → Connect in your WordPress admin
2. Copy your MCP Server URL — it looks like:

   https://yoursite.com/wp-json/easymcp/v1/mcp

3. In your AI client, add a new MCP server and paste that URL
4. Your browser opens your WordPress site — log in if needed
5. Check the permissions you want to grant, click Allow Access
6. Done — the AI client is connected

Connect via API Key (manual)

1. Go to easyMCP → API Keys → create a new key
2. Choose permissions with the checkboxes
3. Copy the token (shown once only)
4. Add to your client config:

{
  "mcpServers": {
    "my-wordpress": {
      "type": "http",
      "url": "https://yoursite.com/wp-json/easymcp/v1/mcp",
      "headers": {
        "Authorization": "Bearer emcp_your_token_here"
      }
    }
  }
}

Permissions

Each API key or OAuth connection has its own set of permissions. Grant only what each client needs.

Tip: plugins_manage and themes_manage are powerful — only grant them to clients you fully trust.

Available Tools

Once connected, the AI client has access to these tools:

Security

• API key tokens are stored as SHA-256 hashes — the raw token cannot be recovered
• Every tool call is logged in easyMCP → Activity Log with credential, tool, status, and timestamp
• Logs are automatically pruned after 90 days
• Revoked keys stop working immediately
• OAuth access tokens expire after 1 hour; refresh tokens rotate every use and expire after 30 days
• Any localhost redirect URI is accepted for OAuth (supports Claude Code's random-port callback)
• Non-localhost redirect URIs must be pre-registered

OAuth Technical Details

• Protocol: OAuth 2.1 with PKCE (S256)
• Discovery: https://yoursite.com/.well-known/oauth-authorization-server
• Authorization endpoint: https://yoursite.com/wp-json/easymcp/v1/oauth/authorize
• Token endpoint: https://yoursite.com/wp-json/easymcp/v1/oauth/token
• Registration endpoint: https://yoursite.com/wp-json/easymcp/v1/oauth/register
• Supported grant types: authorization_code, refresh_token
• Access token lifetime: 1 hour
• Refresh token lifetime: 30 days (rotated on each use)

Uninstalling

Go to Plugins → easyMCP → Delete. The uninstall script removes all database tables and options cleanly.

Changelog

1.0.0

• OAuth 2.1 with PKCE authorization server
• Auto-registration for clients that generate their own client ID
• Permissive localhost redirect URI handling for random-port clients (Claude Code)
• Step-based connect page with copy buttons
• Tool name validation enforced at registration time (MCP spec compliance)
• Added OAuth 2.1 support alongside static API keys
• Admin consent screen with permission checkboxes
• OAuth Apps management page
• Activity log
• Initial release
• MCP server over HTTP (Streamable HTTP transport)
• Static API keys with per-key permission matrix
• Full site management: posts, pages, media, users, taxonomies, comments, plugins, themes, settings

License

GPL-2.0-or-later — https://www.gnu.org/licenses/gpl-2.0.html

Author

Mahdi El Masaoudi — elmasaoudimahdi@gmail.com
https://github.com/mem212/easymcp