NB Connect IA

WordPress connector for ChatGPT. Independent extension, not affiliated with OpenAI.

Reusable OAuth 2.1 security layer for the official WordPress MCP Adapter.

The plugin is intentionally a companion package, not a fork. It can be installed as a release ZIP on multiple WordPress sites while the upstream adapter remains upgradeable through Composer.

Architecture

ChatGPT Web
   │ OAuth 2.1 Authorization Code + PKCE S256
   ▼
NB Connect IA
   │ opaque, audience-bound Bearer token
   ▼
WordPress MCP Adapter
   │ capability + Ability permission checks
   ▼
WordPress Abilities API

Security model

• Disabled immediately after installation.
• Mandatory HTTPS except localhost development redirects.
• Exact redirect URI matching.
• Mandatory PKCE S256.
• resource validation in authorization, token and MCP requests.
• Access, refresh and authorization-code values stored only as keyed hashes.
• 15-minute default access tokens.
• Rotating refresh tokens; reuse revokes the whole token family.
• Consent uses the authenticated WordPress session and a one-time nonce.
• Transport-wide WordPress capability check plus per-Ability permission checks.
• Conservative scope handling: unknown executions require mcp:write.
• Dynamic-registration rate limiting.
• Daily expired-token cleanup and emergency global revocation.
• Optional, allowlisted proxy for WordPress AI abilities. Source permissions and schemas remain authoritative; image generation and Media Library writes are opt-in.

WordPress AI bridge

Version 0.2.0 can expose selected abilities from the official WordPress AI plugin through the OAuth-protected MCP server. The bridge is disabled by default. When enabled, text analysis and suggestion abilities are selected by default. Image generation and image import must be enabled explicitly because they can consume paid provider resources or write to the Media Library.

The bridge registers nb-ai/* proxy abilities and does not alter the upstream ai/* registrations. This keeps both plugins independently upgradeable.

Operational WordPress abilities

Version 0.3.0 added two separately disabled-by-default modules and a dedicated NB MCP Operator role:

• nb-content/* lists, reads, creates, modifies, publishes, trashes, and deletes articles and pages.
• nb-plugins/* lists, updates, activates, deactivates, installs from the official WordPress.org directory, and deletes inactive plugins.
• nb-learning/get-lesson and nb-learning/update-lesson provide a narrow fallback for existing LearnPress lessons when the upstream LearnPress abilities are unavailable or incompatible.

The LearnPress fallback reuses the configured content read/update permissions and WordPress object capabilities. It can update only the title, content, and excerpt of an existing lp_lesson. It cannot create, publish, move, trash, or delete lessons, and it supports an expected_modified_gmt concurrency guard.

The Roles and permissions tab grants these operations independently to the dedicated role and to the selected WordPress roles. Each operation requires both its MCP-specific permission and the corresponding native WordPress capability. Managing the bridge itself is a separate opt-in. Arbitrary package URLs and plugin file editing are not accepted.

Version 0.5.0 adds clear Configuration, Roles and permissions, and Connect ChatGPT tabs, plus a complete French user guide included with release packages.

Version 0.4.1 adds a bundled French translation and retains the administrator-managed matrix for every registered WordPress role. For each role, an administrator can allow OAuth connection and set independent ceilings for AI, content, and plugin operations. The matrix never adds native WordPress capabilities: the connected user's real capabilities, object permissions, post-type permissions, and source-Ability checks remain authoritative. Removing role access blocks existing tokens on their next request.

Content updates use the normal WordPress save APIs, including the site's revision policy. Plugin updates use the WordPress upgrader and its temporary-backup mechanism.

Development

Requirements: PHP 7.4+, Composer 2.

composer install
composer syntax
composer lint

Build a production ZIP with:

php tools/build-release.php

The release includes production Composer dependencies and excludes development files according to .gitattributes.

Installation

Download the installable archive from the latest GitHub release. Do not use GitHub's automatically generated "Source code" archives because they do not contain the production Composer dependencies.

Upload the release ZIP in WordPress, activate it, then visit:

Settings → NB Connect IA

The MCP endpoint and discovery URLs are site-specific and shown on that page.

Documentation

The complete French user guide covers installation, OAuth configuration, role permissions, emergency revocation, security recommendations and troubleshooting:

Guide utilisateur en français

Updating

1. Update wordpress/mcp-adapter in composer.json deliberately.
2. Run the syntax, coding-standard and integration tests.
3. Review upstream MCP Adapter migration notes.
4. Build a new versioned ZIP.
5. Deploy to one test site before rolling it out to other sites.

Data removal

OAuth tables are retained on uninstall to prevent accidental loss of revocation state. To remove them intentionally, define:

define( 'NB_MCP_OAUTH_REMOVE_DATA', true );

before uninstalling the plugin.