Sokket – MCP Server: Site Connector for Claude, ChatGPT, Cursor & Any AI Agent

Sokket – Site Connector for MCP exposes your WordPress site as a lightweight, self-hosted MCP (Model Context Protocol) server. Any MCP-compatible AI client — Claude Code, Claude Desktop, ChatGPT, Cursor, VS Code, Windsurf, and others — can connect to your site and work with it using a tool set and permission level that you, the admin, control.

The primary use case is a developer or site owner pointing an AI agent at their own site to audit it, debug it, and fix issues: check versions and environment, list plugins and themes, read the tail of the PHP error log, search and inspect content, and (only when explicitly enabled) create or update posts.

Your site stays under your control

• 100% self-hosted. The MCP server runs inside your WordPress install. There is no SaaS component and no account to create.
• No external service calls. This plugin makes no outbound requests to any AI provider or any other external service. It never sends your data anywhere. It only receives inbound connections from the AI clients you configure, on an endpoint you can switch off at any time.
• No AI API keys. The plugin is provider-agnostic and stores no AI credentials. Your AI client authenticates to your site with a token you create.

Security model

• The server is disabled by default after activation.
• Access requires a bearer token created in the admin. Tokens are stored only as SHA-256 hashes; the plaintext is shown exactly once. WordPress Application Passwords are also accepted.
• Every token is bound to a WordPress user — a request can never do anything that user could not do. Every tool call passes a real capability check.
• Per-token tool allowlist and a read-only ceiling: write tools are off by default and must be enabled explicitly per token.
• Rate limiting, origin validation, timing-safe token comparison, and a capped audit log of recent tool calls.

Included tools (v1.0)

• get_site_info — WordPress/PHP/DB versions, active theme, environment, debug flags
• list_plugins — installed plugins, versions, update availability
• list_themes — installed themes
• get_php_error_log_tail — last lines of the server-configured PHP error log (admins only)
• list_posts, get_post, search_content — content inspection
• create_post, update_post — content writes (off by default, per token)

Developers can register additional tools via the sokket_register_tools filter.