DevCubic AI Bridge for MCP

DevCubic AI Bridge for MCP turns your WordPress site into a Model Context Protocol (MCP) server. Any logged-in user can connect an AI assistant — Claude, ChatGPT, Gemini, or any other MCP-compatible client — by pasting a single URL and approving it in their browser, then read and manage site content straight from their AI chat.

Compatible with any MCP client, including Anthropic Claude, OpenAI ChatGPT, and Google Gemini. (These are trademarks of their respective owners; this plugin is an independent project and is not affiliated with or endorsed by Anthropic, OpenAI, or Google.)

The connection is scoped to the person who authorizes it. An AI acting for an Editor can do what that Editor can do; an AI acting for a Subscriber can only read. There are no API keys to generate or share — authorization works like an OAuth “Sign in with WordPress” button, using the user’s own login.

Security by design

This plugin gives an AI real access to your site, so it is built to be conservative:

• Standards-based OAuth 2.1 with PKCE — the same authorization pattern used by major “Sign in with…” buttons.
• Every tool is gated by the connecting user’s own WordPress capabilities, enforced twice: once when tools are advertised, and again inside WordPress core’s REST controllers when a tool runs.
• Access tokens are stored only as SHA-256 hashes and can be revoked at any time.
• Administrators get site-wide policy switches and an audit log of every tool call.
• Your site talks only to the AI client the user connected — no data is sent to any third party.

How it works

1. Open DevCubic AI Bridge for MCP in your WordPress admin menu and copy the connector URL.
2. Paste it into your MCP-compatible client as a new connector.
3. The client opens your browser; you log in and approve the connection on a consent screen that lists exactly what you are granting.
4. The client receives an access token and can call the tools your role allows — nothing more.

Content tools

• Posts and Pages: list, get, create, update, delete
• Media: list, get, upload (from a URL or base64), delete
• Comments: list, get, create, update, delete
• Categories & tags: list, create, update, delete

WooCommerce (automatic when WooCommerce is active)

• Products: list, get, create, update, delete
• Orders: list, get, change status, add order notes
• Customers and coupons, plus a sales-report summary

Store tools require the manage_woocommerce capability (Administrators and Shop Managers) and run through WooCommerce’s own REST controllers, so its validation and permission checks apply unchanged.

Custom post types (automatic)

Every public, REST-enabled post type — events, portfolios, job listings, and thousands of others provided by plugins or themes — automatically gets list, get, create, update, and delete tools, gated by that type’s own capabilities. No per-plugin integration needed. Developers can filter which types are exposed with mcp_connector_custom_post_types.

SEO (automatic with Yoast SEO or Rank Math)

Read and set the SEO title, meta description, focus keyword, canonical URL, and noindex flag for any post or page.

Site policy controls

On top of user roles, administrators get explicit switches (DevCubic AI Bridge for MCP → Site policy):

• Read-only mode — connected AIs can read but never change anything.
• Require human review — AI-created content is saved as Pending Review, and published content cannot be modified through MCP.
• Deletion switch — hide every delete tool with one checkbox.
• Per-tool toggles — disable any individual tool, including tools added by other plugins.

A tool is available only when both the user’s role and the site policy allow it, and the consent screen tells connecting users about active policies up front.

Extend it

Other plugins can register their own capability-gated MCP tools through the mcp_connector_tools filter, so any plugin can expose its features to connected AI clients safely.

Requirements

HTTPS is required in production (OAuth bearer tokens must travel over TLS). Works with any MCP-compatible AI client.

Extending

Other plugins can register their own MCP tools through the mcp_connector_tools filter. Each tool is gated by a WordPress capability, exactly like the built-in ones:

add_filter( 'mcp_connector_tools', function ( $tools ) {
    $tools['my_store_orders'] = array(
        'description' => 'List recent store orders.',
        'capability'  => 'manage_woocommerce',
        'inputSchema' => array(
            'type'       => 'object',
            'properties' => array(
                'limit' => array( 'type' => 'integer', 'description' => 'Max orders to return.' ),
            ),
        ),
        'handler'     => function ( $args ) {
            // Return any JSON-serializable data, or a WP_Error.
            return my_plugin_get_orders( $args );
        },
    );
    return $tools;
} );

Useful filters: mcp_connector_max_upload_bytes (upload size cap, default 20 MB), mcp_connector_enable_audit_log (default true), mcp_connector_log_retention_days (default 30).