內容簡介
Sokket 外掛將您的 WordPress 網站轉變為 MCP 伺服器，使 Claude、ChatGPT、Cursor 等 AI 代理能夠直接連接並操作網站，提升管理效率，簡化錯誤檢查與內容更新過程。
【主要功能】
• 將網站轉換為 MCP 伺服器
• 直接讀取 PHP 錯誤日誌
• 自動檢查外掛更新狀態
• 搜尋並更新內容
• 自動化草稿撰寫與圖片上傳
• 管理評論與分類標籤
外掛標籤
開發者團隊
② 後台搜尋「Sokket – MCP Server: Connect Claude, ChatGPT, Cursor & Any AI Agent to WordPress」→ 直接安裝（推薦）
原文外掛簡介
Sokket turns your WordPress site into its own MCP server.
MCP — the Model Context Protocol — is the standard AI clients use to work with outside systems. Install Sokket and your site becomes one: a single endpoint that Claude, ChatGPT, Cursor, VS Code, Windsurf and any other MCP-compatible AI agent can connect to and actually use.
Instead of copying error logs and post content into a chat window, the agent reads them itself. Instead of describing your site to an AI, you connect it — and every tool call runs through a permission model you control.
Stop pasting your site into a chat window
Ask your AI agent to do the work directly:
“Why is this site throwing a 500 error?” — it reads the PHP error log, checks the environment, and lists which plugins updated recently.
“Which plugins have updates available, and what versions are we on?” — it tells you, with the WordPress and PHP versions to match.
“Find every post mentioning the old pricing and fix it.” — it searches, reads, and updates the content.
“Draft a post from these notes and set a featured image.” — it creates the draft, uploads the image, and attaches it.
“Clear the comment moderation queue.” — it reads the pending queue, approves the real ones, and spams the rest.
“Tidy up our categories and tag these twelve posts properly.” — it lists terms, creates what’s missing, and assigns them.
“Put a call-to-action above the footer on every page.” — it reads the theme’s footer template part, edits the block markup, and saves it as a customisation you can revert.
“Make the buttons use our brand colour.” — it reads the theme’s palette, adds the colour, and points the button block at it.
“Build a landing page and make it the home page.” — it writes the page, checks its own block markup against the block registry, sets it as the front page, and adds it to the menu.
This is not an AI content generator. Sokket writes nothing by itself and calls no AI provider. It is the connector that lets the AI client you already pay for reach your site safely.
Works with every MCP client
The endpoint speaks Streamable HTTP with JSON-RPC 2.0, so any MCP-compatible client works. The built-in setup generator produces the exact command or config for yours, with your endpoint already filled in:
Claude Code — one claude mcp add command
Claude Desktop — a custom connector via OAuth, or a bearer token through mcp-remote
ChatGPT — a developer-mode connector with bearer authentication
Cursor — a ready-made .cursor/mcp.json block
VS Code — a ready-made .vscode/mcp.json block
Windsurf — a ready-made mcp_config.json block
Any other MCP client — the raw endpoint, transport, and auth header
No AI keys. No SaaS. No data leaving your site.
This is the part most “AI for WordPress” plugins can’t say:
100% self-hosted. The MCP server runs inside your WordPress install. There is no SaaS component, no account to create, and no middleman marking up API calls.
No external service calls. This plugin makes no outbound requests to any AI provider or any other external service. It never sends your data anywhere. It only receives inbound connections from the AI clients you configure, on an endpoint you can switch off at any time.
No AI API keys. Sokket is provider-agnostic and stores no AI credentials. Your AI client authenticates to your site — not the other way around.
Two ways to connect
Bearer tokens — create a token in the admin, bind it to a WordPress user, and tick exactly which tools it may call. Tokens are stored as SHA-256 hashes and shown in plaintext exactly once. This is the option with the finest control, and it works with Claude Code, ChatGPT, Cursor, VS Code, and Windsurf.
OAuth 2.1 — for connector interfaces that have no field for a token, such as Claude Desktop’s custom connectors. Turn it on and clients configure themselves from the endpoint URL alone: RFC 9728 and RFC 8414 discovery, dynamic client registration, PKCE (S256) required, and refresh tokens. The person connecting signs in to WordPress, approves on a consent screen, and chooses read-only or full access. Every grant is listed in the admin and revocable in one click.
WordPress Application Passwords are accepted too, for quick local testing.
Security model
Sokket is built on the assumption that you should never have to simply trust the agent.
The server is disabled by default after activation, and rejects every request until you switch it on.
Every credential is bound to a WordPress user — a request can never do anything that user could not do in wp-admin.
Three independent gates on every single tool call: the connection’s tool allowlist, a read-only ceiling, and a real current_user_can() capability check. The token is never trusted on its own.
Every write tool is off by default and must be enabled explicitly, one at a time.
Tools that remove content are marked with a delete badge in the allowlist, and are announced to the client with the MCP destructiveHint annotation so it can ask you to confirm before calling one. They count as writes, so a read-only connection can never call them.
Rate limiting, origin validation (DNS-rebinding protection), timing-safe token comparison, and session handling per the MCP spec.
A capped audit log of every tool call: user, tool, outcome, and the object id it acted on. Tool arguments are never stored.
Instant revocation of any token or OAuth connection.
Deliberately no filesystem-write, database-query, or command-execution tools — the free plugin’s attack surface stays small on purpose. The template and global styles tools are no exception: they write database rows, exactly as the Site Editor does, and never modify a theme’s files. Every design change they make is revertible from the plugin, from the Site Editor, or by switching theme.
Content written through the tools is filtered the way WordPress filters it — callers who can already post unfiltered HTML are not filtered, matching core’s behaviour for those same users in the block editor, and everyone else is filtered block by block so the filtering cannot corrupt valid block markup.
Included tools
39 tools, grouped by area, each individually switchable per connection — plus 2 more when a supported SEO plugin is active.
Site & diagnostics
get_site_info — WordPress/PHP/DB versions, active theme, environment, debug flags
list_plugins — installed plugins, versions, update availability
list_themes — installed themes
get_php_error_log_tail — last lines of the server-configured PHP error log (admins only)
get_site_settings — general, writing, reading, discussion, and permalink settings from a fixed allowlist
update_site_settings — change the site title, tagline, front page, posts per page, and date, time and timezone formats (off by default, per token; a fixed allowlist that can never reach the site address, the admin email, registration defaults, or the permalink structure)
Content
list_posts, get_post, search_content — content inspection
create_post, update_post — content writes (off by default, per token)
delete_post — move a post or page to the trash (off by default, per token; permanent deletion is refused unless the site opts in, and the front page and posts page are always refused)
restore_post — bring a trashed post back to its previous status (off by default, per token)
set_post_meta — assign a page template to a page (off by default, per token; an allowlist of meta keys, not an arbitrary meta writer)
Media
list_media — browse the media library
upload_media — add an image from base64 data (off by default, per token)
set_featured_image — set or clear a post’s featured image (off by default, per token)
Templates & parts — block themes
list_block_templates — every template and template part available to the active theme, including the ones that exist only as theme files
get_block_template — a template’s block markup, or the original theme file version of one that has been customised
update_block_template — create a template or override a theme-provided one (off by default, per token; the theme’s files are never modified)
revert_block_template — discard a customisation so the theme file takes over again (off by default, per token)
Global styles — block themes
get_theme_json — the active theme’s palette, gradients, spacing scale, font sizes and font families, with the exact reference strings for each, plus the layout widths and which blocks the theme styles
update_global_styles — change colours, typography, spacing, and per-block styling (off by default, per token; writes the same user layer the Site Editor saves to)
reset_global_styles — discard the style customisations and fall back to the theme (off by default, per token)
Blocks & validation — block themes
list_block_types — every block registered on the site, including ones a theme or plugin adds, with their attribute schemas
validate_block_markup — check block markup against the registry before saving it: unregistered blocks, attributes that do not exist, values outside what an attribute accepts, blocks used outside the parent they need, unbalanced delimiters
render_block_template — render markup or a template to HTML, so the agent can see what its own output actually produces
Navigation menus — block themes
list_navigation_menus — menus with their items as a nested list rather than raw block markup
create_navigation_menu — build a menu from a list of items and get back the id a template’s navigation block needs (off by default, per token)
update_navigation_menu — replace a menu’s items or rename it (off by default, per token)
Taxonomies & terms
list_taxonomies, list_terms — taxonomy inspection
create_term, assign_terms, update_term — term writes (off by default, per token)
delete_term — remove a term (off by default, per token; posts using it are never deleted, they simply lose the assignment)
Comments
list_comments — review the moderation queue
moderate_comment — approve, unapprove, spam, unspam, trash, untrash (off by default, per token)
reply_to_comment — reply as the connected user (off by default, per token)
SEO — registered only when Yoast SEO, Rank Math, or SEOPress is active
get_seo_meta — read the meta description and focus keyword for a post or page
update_seo_meta — write them back through the active SEO plugin’s own post meta (off by default, per token)
Who it’s for
Developers and agencies debugging and maintaining sites with an AI coding assistant instead of a support ticket queue.
Site owners who want an AI assistant that can actually see the site it’s advising them about.
Content teams letting an agent draft, update, illustrate, and categorise posts under editorial control.
Anyone who wants AI help with WordPress without shipping their content to another SaaS platform.
Built for developers
Register your own tools with a single filter, sokket_register_tools. Anything you add inherits the whole permission model, the audit log, and the transport for free, and shows up in the admin allowlist automatically. Filters are also provided for rate limits, upload restrictions, audit retention, the settings-read allowlist, and OAuth authorization rights.
Full documentation: beautifulplugins.com/docs/sokket-site-connector-for-mcp/
