內容簡介
DevCubic AI Bridge for MCP 將您的 WordPress 網站轉變為 Model Context Protocol (MCP) 伺服器，允許已登入的使用者透過 AI 助手直接管理網站內容，提升使用效率與互動性。
【主要功能】
• 支援多種 AI 助手，如 Claude、ChatGPT、Gemini
• 簡單的連接過程，無需生成 API 金鑰
• 依據使用者角色限制 AI 的操作權限
• 安全的 OAuth 2.1 認證機制
• 實時審計日誌，監控所有工具調用
• 僅與連接的 AI 客戶端通訊，無資料外洩
外掛標籤
開發者團隊
原文外掛簡介
DevCubic AI Bridge for MCP turns your WordPress site into a Model Context Protocol (MCP) server. Any logged-in user can connect an AI assistant — Claude, ChatGPT, Gemini, or any other MCP-compatible client — by pasting a single URL and approving it in their browser, then read and manage site content straight from their AI chat.
Compatible with any MCP client, including Anthropic Claude, OpenAI ChatGPT, and Google Gemini. (These are trademarks of their respective owners; this plugin is an independent project and is not affiliated with or endorsed by Anthropic, OpenAI, or Google.)
The connection is scoped to the person who authorizes it. An AI acting for an Editor can do what that Editor can do; an AI acting for a Subscriber can only read. There are no API keys to generate or share — authorization works like an OAuth “Sign in with WordPress” button, using the user’s own login.
Security by design
This plugin gives an AI real access to your site, so it is built to be conservative:
Standards-based OAuth 2.1 with PKCE — the same authorization pattern used by major “Sign in with…” buttons.
Every tool is gated by the connecting user’s own WordPress capabilities, enforced twice: once when tools are advertised, and again inside WordPress core’s REST controllers when a tool runs.
Access tokens are stored only as SHA-256 hashes and can be revoked at any time.
Administrators get site-wide policy switches and an audit log of every tool call.
Your site talks only to the AI client the user connected — no data is sent to any third party.
How it works
Open DevCubic AI Bridge for MCP in your WordPress admin menu and copy the connector URL.
Paste it into your MCP-compatible client as a new connector.
The client opens your browser; you log in and approve the connection on a consent screen that lists exactly what you are granting.
The client receives an access token and can call the tools your role allows — nothing more.
Content tools
Posts and Pages: list, get, create, update, delete
Media: list, get, upload (from a URL or base64), delete
Comments: list, get, create, update, delete
Categories & tags: list, create, update, delete
WooCommerce (automatic when WooCommerce is active)
Products: list, get, create, update, delete
Orders: list, get, change status, add order notes
Customers and coupons, plus a sales-report summary
Store tools require the manage_woocommerce capability (Administrators and Shop Managers) and run through WooCommerce’s own REST controllers, so its validation and permission checks apply unchanged.
Custom post types (automatic)
Every public, REST-enabled post type — events, portfolios, job listings, and thousands of others provided by plugins or themes — automatically gets list, get, create, update, and delete tools, gated by that type’s own capabilities. No per-plugin integration needed. Developers can filter which types are exposed with mcp_connector_custom_post_types.
SEO (automatic with Yoast SEO or Rank Math)
Read and set the SEO title, meta description, focus keyword, canonical URL, and noindex flag for any post or page.
Site policy controls
On top of user roles, administrators get explicit switches (DevCubic AI Bridge for MCP → Site policy):
Read-only mode — connected AIs can read but never change anything.
Require human review — AI-created content is saved as Pending Review, and published content cannot be modified through MCP.
Deletion switch — hide every delete tool with one checkbox.
Per-tool toggles — disable any individual tool, including tools added by other plugins.
A tool is available only when both the user’s role and the site policy allow it, and the consent screen tells connecting users about active policies up front.
Extend it
Other plugins can register their own capability-gated MCP tools through the mcp_connector_tools filter, so any plugin can expose its features to connected AI clients safely.
Requirements
HTTPS is required in production (OAuth bearer tokens must travel over TLS). Works with any MCP-compatible AI client.
Extending
Other plugins can register their own MCP tools through the mcp_connector_tools filter. Each tool is gated by a WordPress capability, exactly like the built-in ones:
add_filter( 'mcp_connector_tools', function ( $tools ) {
$tools['my_store_orders'] = array(
'description' => 'List recent store orders.',
'capability' => 'manage_woocommerce',
'inputSchema' => array(
'type' => 'object',
'properties' => array(
'limit' => array( 'type' => 'integer', 'description' => 'Max orders to return.' ),
),
),
'handler' => function ( $args ) {
// Return any JSON-serializable data, or a WP_Error.
return my_plugin_get_orders( $args );
},
);
return $tools;
} );
Useful filters: mcp_connector_max_upload_bytes (upload size cap, default 20 MB), mcp_connector_enable_audit_log (default true), mcp_connector_log_retention_days (default 30).
