Mumega MCP

Mumega MCP gives a site owner’s configured MCP client a small authenticated interface to WordPress. The retained tools cover site information, posts, pages, individual drafts, local media, categories, and tags. Media can be uploaded from multipart form data or base64 content supplied by the client.

Security and authority:

• API keys are stored as password hashes, bound to an explicit existing WordPress user, and shown in plaintext only once.
• All usable API keys have non-empty scopes. A key may allow read, write, or admin authority according to its stored scope list.
• New post and page content is created as a draft by default.
• Publishing, private-content mutation, and draft deletion require the stronger admin scope and the corresponding WordPress user permissions.
• Request limits are enforced locally. Optional metadata-only activity logging stores tool, status, duration, key ID, and time, but not request arguments or response content. Retention is configurable.

Setup & Keys requires a non-empty label, selected non-empty scopes, and selected non-empty tool categories. A key created there is bound to the current explicit WordPress user. Direct REST child-key creation inherits the authenticated parent key’s explicit existing WordPress-user owner. REST child-key scopes are required; tool categories are optional, and empty tool categories mean all retained categories.

Privacy and data flow:

There are no plugin-initiated outbound requests, no telemetry, and no contact with Mumega. Authenticated responses travel from WordPress to the MCP client configured by the site owner. That client may send the response to an AI or other provider chosen and configured by the site owner; the plugin does not select or contact that provider.

The WordPress.org directory edition cannot write PHP, JavaScript, or CSS; edit plugin or theme files; install or update software; or self-update.