About this plugin
ai can connect to. Once connected, Claude can inspect your site’s architecture in real time — plugins, database schema, source code, ACF fields, REST routes, cron jobs and more — so it can write plugins, debug issues and answer questions tailored to your exact setup.
Read-only by default. Claude cannot write, delete or modify anything unless you explicitly enable the opt-in write mode — and even then it can only work with drafts, allowlisted options, plugin toggles, caches and terms, with every action audited.
Features
- Full OAuth 2.1 authorization server with PKCE (S256), dynamic client registration (RFC 7591) and auto-discovery (RFC 8414 + RFC 9728).
- Bearer Token auth as a simpler alternative to OAuth — never expires.
- Configurable OAuth token lifetime — 1 hour, 24 hours, 7 days or 30 days, plus an emergency “Revoke all tokens” button.
- 25 read-only MCP tools covering site info, plugins, themes, post types, taxonomies, options, posts, database schema, structured table reads, files, code search, logs, hooks, ACF fields, users, menus, cron, transients, widgets, REST routes, Action Scheduler, WooCommerce and Elementor.
- MCP resources (site snapshots at wordpress:// URIs) and canned prompts for site analysis, debugging and plugin writing.
- Opt-in write mode (off by default): six scoped write tools — create/update DRAFT posts, update allowlisted options, toggle plugins, clear caches, create terms. OAuth sessions additionally need a write grant ticked on the consent screen; everything is audited. Deleting, publishing, user management and write SQL are never possible.
- WordPress Abilities API integration (WP 6.9+): tools are discoverable by the WordPress AI ecosystem, admin-only. Stands down automatically when the official AI Provider for Anthropic plugin is active.
- MCP specification 2025-11-25 compliant.
- Rate limiting, path-traversal guards, credential redaction and clickjacking protection.
- Apache + FastCGI compatible (Authorization header normalization built in).
- Zero dependencies — pure WordPress, no Composer required.
Available tools
Read: wp_get_site_info, wp_get_plugins, wp_get_themes, wp_get_post_types, wp_get_taxonomies, wp_get_options, wp_query_posts, wp_get_post, wp_get_db_schema, wp_db_query, wp_list_files, wp_read_file, wp_search_code, wp_get_logs, wp_get_hooks, wp_get_acf_fields, wp_get_users, wp_get_menus, wp_get_cron_jobs, wp_get_transients, wp_get_scheduled_actions, wp_get_active_widgets, wp_get_rest_routes, wp_get_woocommerce, wp_get_elementor.
Write (only with write mode enabled): wp_create_draft_post, wp_update_draft_post, wp_update_option, wp_toggle_plugin, wp_clear_cache, wp_create_term.
External services
ai, the AI assistant operated by Anthropic. ai connects to so it can read your WordPress data and help you build and debug your site.
ai (Anthropic) is a third‑party AI assistant. ai app. Claude then reads your site through the plugin’s tools to answer questions, write code and debug issues tailored to your setup.
ai to this site and authenticate (with the Bearer token or by completing the OAuth login). env, wp-config copies, keys and database dumps blocked). Options and query results have secret‑shaped values redacted, user passwords are never returned, and — unless you explicitly turn on the optional write mode — nothing on your site is ever modified.
ai/api/mcp/auth_callback and the app. / www. variants) carrying a short‑lived authorization code.
ai always initiates the connection.
com/legal/aup