Description
Sigma MCP Connector implements the Model Context Protocol (MCP) on top of your WordPress site, so AI assistants can act on your content as a real, authenticated WordPress user — never anonymously, never with more access than that user already has.
It exposes a JSON-RPC 2.0 MCP endpoint secured by a full OAuth 2.0 Authorization Code + PKCE flow. An administrator registers each AI client (Claude.ai, Codex, VS Code, Cursor AI, or any other MCP-aware tool) as an OAuth client; a WordPress user then explicitly signs in and approves a consent screen before that client can do anything. From then on, every tool call is checked against that specific user’s WordPress capabilities and written to a full audit log.
Key Features
- OAuth 2.0 + PKCE — Authorization Code grant with mandatory PKCE, hashed client secrets, short-lived access tokens, and long-lived refresh tokens
- 27 Role-Aware MCP Tools — Read and write posts, pages, media, taxonomies, menus, ACF fields, post meta, and users, each gated by a specific WordPress capability
- Live Role Access Matrix — Generated at runtime from real WordPress role capabilities, shown identically on the Connections page, the Documentation page, and the OAuth consent screen, so it can never drift out of sync with what’s actually enforced
- Per-Role Rate Limiting — Configurable request ceilings so no single connection can overwhelm the site
- Full Activity Log — Filterable, paginated audit trail of every OAuth and tool-call event, with before/after snapshots on content-mutating calls and configurable retention
- Built-In Setup Documentation — Step-by-step configuration instructions for Claude.ai, Claude Desktop, Codex, VS Code (GitHub Copilot), and Cursor AI
- No External Dependencies — No bundled third-party service, no analytics, no phone-home; the plugin only responds to requests from clients you explicitly register and authorize
Who Is This For?
- Site owners who want to let an AI assistant help manage content without handing out admin passwords or API keys with unlimited access
- Agencies and developers building AI-assisted editorial workflows on top of WordPress
- Teams who need an auditable, revocable, role-scoped way to connect AI tools to a WordPress site
Additional Information
System Requirements
Minimum
* WordPress 6.0
* PHP 8.0
* MySQL 5.7 or MariaDB 10.3
Recommended
* HTTPS enabled
* Pretty permalinks enabled
Custom Database Tables
{prefix}sigma_mcp_oauth_clients— Registered OAuth applications{prefix}sigma_mcp_oauth_codes— Short-lived, single-use authorization codes{prefix}sigma_mcp_oauth_tokens— Access and refresh tokens{prefix}sigma_mcp_log— Legacy per-call log{prefix}sigma_mcp_event_log— Full structured audit log
Support
- Support Forum: https://wordpress.org/support/plugin/sigma-mcp-connector/
- Email: mahipatsinh.r@sigmainfo.net
Screenshots
Installation
From the WordPress Plugin Directory
- Go to Plugins > Add New in your WordPress admin
- Search for Sigma MCP Connector
- Click Install Now, then Activate
- Navigate to Sigma MCP in the admin sidebar to get started
Manual Installation
- Download the plugin ZIP file
- Go to Plugins > Add New > Upload Plugin
- Select the ZIP file and click Install Now
- Activate the plugin
- Navigate to Sigma MCP in the admin sidebar
After Activating
- Go to Sigma MCP Connections and generate an OAuth client for the AI tool you want to connect.
- Copy the Authorization URL, Token URL, and MCP Server URL shown there.
- Follow Sigma MCP Documentation for exact setup steps in Claude.ai, Claude Desktop, Codex, VS Code, or Cursor AI.
- Approve the WordPress consent screen when the client first connects.
HTTPS is strongly recommended in production — OAuth tokens should not travel over plain HTTP. Pretty permalinks must be enabled so /wp-json/... and /.well-known/... requests resolve correctly.
FAQ
-
Does this plugin send my data to Claude, OpenAI, or any other third party?
-
No, not automatically. Sigma MCP Connector does not make outbound connections to any AI provider and does not phone home for analytics, licensing, or updates. It works the other way around: it turns your own WordPress site into an MCP server that a client you explicitly register can connect into — and only after a logged-in WordPress user explicitly approves an OAuth consent screen naming that specific client. From that point on, every request runs as that WordPress user, restricted to their existing WordPress role and capabilities, and is written to the Activity Log.
-
What can a connected AI tool actually do?
-
Exactly what the authorizing WordPress user’s role allows — nothing more. Every one of the 27 tools is checked with
current_user_can()against a specific WordPress capability on every single call, not just at connection time. Revoke the user’s role, or revoke the token from the Connections page, and access stops immediately. -
What data is stored, and where?
-
OAuth client registrations, tokens, and the activity log are stored in five plugin-owned database tables on your own WordPress database — nothing is sent off-site. You control log retention (or disable it) from the Activity Log screen.
-
Which AI tools does this work with?
-
Any MCP-aware client that supports OAuth 2.0 Authorization Code + PKCE — Claude.ai, Claude Desktop, Codex, VS Code (GitHub Copilot), and Cursor AI are documented in detail on the plugin’s Documentation screen, with copy-paste config examples for each.
-
Can I revoke access?
-
Yes. Deactivate or delete an OAuth client, or revoke an individual token or all tokens for a user, from Sigma MCP Connections — access is checked on every request, so revocation takes effect immediately.
-
Does this require HTTPS?
-
It works over HTTP for local development, but HTTPS is strongly recommended (and the admin screen will warn you) in production, since OAuth access and refresh tokens should never travel unencrypted.
-
What happens if I deactivate the plugin?
-
Deactivating stops the OAuth/MCP endpoints and clears the scheduled log-purge cron job, but does not delete any data. Uninstalling (deleting) the plugin removes its database tables, options, and transients.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Sigma MCP Connector” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Sigma MCP Connector” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
Initial release.
- OAuth 2.0 Authorization Code + PKCE flow with client registration, token issuance/refresh/revocation, and a WordPress-native consent screen
- MCP server endpoint (JSON-RPC 2.0) exposing 27 role-aware tools
- Per-tool WordPress capability checks enforced on every call, plus per-role rate limiting
- Role Access Matrix generated at runtime from real WordPress role capabilities
- Connections, Activity Log, and Documentation admin screens
- Custom database tables: OAuth clients, authorization codes, tokens, and event log
- Nonce verification, capability checks, prepared statements, and full output escaping throughout