=== SPD MCP for WordPress ===
Contributors: softpulse
Tags: mcp, ai, claude, page-builder, seo
Requires at least: 6.6
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.3.4
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Free MCP server for WordPress. Connect Claude and other AI clients with scoped keys, change previews, recovery snapshots and an activity log.

== Description ==

SPD MCP for WordPress adds a Model Context Protocol (MCP) endpoint to your site so an AI client can read and, when you allow it, change your content with a clear record of every change. It is free, with no license key and no trial period.

**What you get**

* Scoped, revocable connection keys (read, write) with an expiry date.
* Live-content writes through any tool require confirm_live_change after human approval. Every change is previewed first. Committing needs a short-lived token tied to the exact arguments.
* Recovery snapshots of the content, media text, SEO fields and products the tools change, plus an activity log.
* Read-only mode is on by default.
* Page builder tools: create draft landing pages from sections (hero, features, pricing, FAQ, contact, footer) as native Gutenberg blocks, edit them, and get preview links. Live pages are never changed without explicit approval.
* Tools for posts and pages, Gutenberg block inspection, media metadata, featured images, categories and tags, menus, revisions, SEO metadata (Rank Math, Yoast, SEOPress), WooCommerce products, REST-enabled ACF fields and project notes.
* Optional integrations that appear only when their plugin is active: SoftPulse Visual Page Builder (read and write layouts through the builder's own Abilities), SEO reports for Rank Math / Yoast SEO / SEOPress, Wordfence status, WP Rocket, ShortPixel, UpdraftPlus, Fluent Forms, FluentSMTP, Google Site Kit (Search Console) and a WooCommerce summary. Call `integrations_status` to see exactly what is available.
* Read-only diagnostics: environment and update status, a redacted error-log summary, security hardening checks and a WordPress core file integrity check.
* Works with MCP clients that support Streamable HTTP with a custom Authorization header. A Node stdio bridge (client/bridge.mjs) is included for other clients.

**This public edition contains no PHP execution, shell, WP-CLI or file-editing tools.** It can only read and change WordPress content through core APIs, using previews, confirmations and recovery snapshots.

Free download page and guides: https://softpulsedigital.com/FixMySiteAI/free-wordpress-mcp/

== Installation ==

1. Upload the plugin and activate it.
2. Open **SPD MCP** in the admin menu.
3. In **Connect**, copy the endpoint and create a connection key.
4. In your MCP client use Streamable HTTP, the copied URL, and the header `Authorization: Bearer YOUR_KEY`.
5. Turn off Read-only mode in **Controls** only when you are ready to commit reviewed changes.


== Frequently Asked Questions ==

= Is it really free? =
Yes. All tools are included. There is no license key, trial or paid tier.

= Does it work with Claude's "Add custom connector"? =
Yes, from version 1.1.0. Paste the endpoint URL; Claude opens a WordPress approval screen where you choose the permissions. Access renews automatically and can be revoked under SPD MCP → Connect. The site must use HTTPS and must serve `/.well-known/` URLs through WordPress (default on most hosts). Bearer keys, Application Passwords and the stdio bridge still work.

= Which plugins does it integrate with, and are the integrations verified? =
Integrations are optional and appear only while the plugin is active. The SoftPulse Visual Page Builder integration uses the builder's documented WordPress Abilities. The other integrations read each plugin's own settings, classes or documented fields defensively and report what they cannot read. They were exercised in development against test doubles, not every real plugin version, so treat them as read-focused helpers and report problems. Security, backup, cache and mail integrations never change settings, restore or delete backups, or expose keys, passwords or customer data; the only plugin action is an explicitly confirmed WP Rocket cache clear.

= Does it include a PHP or file-editing developer tool? =
No. Version 1.2.1 removed it from the public edition. If you upgrade from an older version, stored developer settings and developer key permissions are deleted automatically.

= Are snapshots a full backup? =
No. They cover only the content fields and products the tools changed. Keep normal site backups.

= What data is removed on uninstall? =
None by default. Add `define('SPDMCP_DELETE_DATA_ON_UNINSTALL', true);` to wp-config.php before deleting the plugin to remove settings, keys, snapshots and the activity log.

== Upgrade Notice ==

= 1.3.4 =
Fixes Claude's "Add custom connector" sign-in not opening on hosts that do not pass /.well-known/ to WordPress.

= 1.3.3 =
After upgrading, revoke and reconnect existing Claude sign-in connections once. Changes to live content now need explicit approval.

== Changelog ==

= 1.3.4 =
* OAuth discovery now also works through the REST API (/wp-json/spd-mcp/v1/oauth/...), so the Claude sign-in window opens even when the host answers /.well-known/ itself (Hostinger, LiteSpeed).
* openid-configuration now includes the fields OpenID clients require.
* HTTPS is detected behind proxies and CDNs (X-Forwarded-Proto, Cloudflare).
* The Authorization header is read from fallback server variables when the host strips it.
* The Origin check now applies only to dashboard sessions, so connector requests get a proper 401 and start sign-in.
* Removed "with a clear trail" from the admin footer.

= 1.3.3 =
* Release package for WordPress.org: readme cleanup and escaped admin output.

= 1.3.2 =
* Fixed UpdraftPlus detection.
* All live content mutations and restores require confirm_live_change. Generic creation of pages cannot publish directly.
* Snapshots protect later edits with a post-change fingerprint; older unguarded snapshots require manual recovery. Page parent/template are included in preview and recovery.
* Credential changes serialize across requests. Refresh families keep their original 30-day expiry and replay markers.
* Shortcode widgets are read-only through MCP; indirect callback execution is blocked in layout writes and restores.
* Builder updates verify persistence and recover layout/content when a save fails.

= 1.3.0 =
* Added optional plugin integrations (shown only when the plugin is active): SoftPulse Visual Page Builder, Rank Math / Yoast SEO / SEOPress reports, Wordfence status, WP Rocket status and confirmed cache clear, ShortPixel status, UpdraftPlus backup history, Fluent Forms, FluentSMTP, Google Site Kit Search Console reports and a WooCommerce summary.
* Added core tools: integrations_status (capability discovery), diagnostics_summary, updates_status, menus_list, error_log_summary (redacted), snapshot_inspect, term_create, post_terms_set, featured_image_set, security_diagnostics and core_integrity_check.
* Added an Integrations tab. Existing tool names, schemas and permissions are unchanged. The public edition still contains no PHP execution, shell or file-editing tools.

= 1.2.1 =
* Public edition: removed the developer module (PHP execution, file editing, WP-CLI, database schema and Abilities tools), the developer scope and its settings. Upgrading removes stored developer permissions.
* Fixed a database query style warning; refreshed tests. Page, OAuth and preview tools are unchanged.

= 1.2.0 =
* Added page-building tools: pages_list, page_get, page_preview_link, page_blocks_validate, page_sections_build, categories_list, page_create, page_update and page_set_status.
* Builds native Gutenberg blocks (hero, headings, text, image, buttons, features, pricing, FAQ, contact, footer). New pages are always drafts; changing a live page needs explicit approval (confirm_live_change).
* media_list can filter by media type and returns size and MIME type. Added a build-landing-page prompt.

= 1.1.0 =
* Added OAuth 2.1 sign-in (authorization code + PKCE, dynamic client registration, rotating refresh tokens) so Claude's custom connector can connect.
* OAuth connections appear in the Connect tab and can be revoked there.

= 1.0.0 =
* First release.
