ClearComet Cloak for MCP

Description

We love MCP. Strangers see nothing.

We just want your site locked when you’re not around. ClearComet Cloak for MCP is a simple on/off lock for your site’s AI connections, built for MCP security on WordPress.

WordPress sites now have “doors” that AI tools use: the MCP Adapter’s mcp routes, the Abilities API, and MCP servers added by other plugins. Anyone on the internet can find them in your site’s public route list and start knocking.

Cloak hides those doors, so you can hide REST API endpoints for MCP without breaking anything for yourself. Strangers get WordPress’s own ordinary “not found” answer (rest_no_route, 404) and the doors disappear from the public /wp-json index. It works the moment you activate it. There are no keys to set up and nothing to configure. The people and tools you choose still get in:

• You, when logged in: your dashboard and the block editor keep working.
• Apps with your secret key (optional, Advanced): your own apps and scripts send it in the X-Cloak-Key header.
• AI assistants and bots by address (optional, Advanced): any AI assistant, bot, server or tool that connects from a fixed IP address or range.

WordPress still checks the app password after the door, so Cloak adds a lock; it never removes one.

Why this matters

People are already scanning the internet for MCP servers:

• A two-week log study of one small web host (one of its sites runs WordPress) saw MCP initialize handshakes POSTed to /mcp from 49 different IP addresses, on a server that runs no MCP at all. SANS Internet Storm Center, diary 33150
• GreyNoise put MCP honeypots online, and every one was found within days. GreyNoise
• Knostic found 1,862 MCP servers exposed to the internet. All 119 it checked by hand listed their tools without any authentication. Knostic
• Bitsight found roughly 1,000 internet-reachable MCP servers with no authorization at all. Bitsight
• On WordPress, CVE-2025-11749 (AI Engine 3.1.3 and earlier, with its “No-Auth URL” option on) leaked an MCP bearer token through the public /wp-json route list; it is fixed in 3.1.4. Wordfence
• A public Metasploit module (also published on Packet Storm) automates that attack against /wp-json/mcp/v1/. Rapid7 Metasploit, Packet Storm via Vulners

To be honest about it: most of these knocks are reconnaissance, not attacks. GreyNoise saw no MCP-specific exploitation attempts in its honeypots. But being listed is how a site ends up on someone’s target list, and Cloak keeps your MCP doors off that list.

Protected from the first click

Activate the plugin and protection is on. There’s no wizard and no setup notice. Strangers can’t find your site’s AI connections, and you still get in when you’re logged in.

Everyday use

Settings > Cloak for MCP shows one door-slot switch and one line telling you whether you’re protected. Click the slot to pause or resume. Everything else is optional and lives on the Advanced pages: doors, the guest list, a secret key for your own apps, Cloudflare, access rules, an activity log and tools (export/import).

Secret key (optional)

You don’t need a key. It’s only for your own apps or scripts that connect from changing addresses. Generate a key, or paste your own (20+ characters: letters, digits, _ and -). Apps send it in the X-Cloak-Key header. Rotate keeps the old key working for 24 hours so you can update your apps; Turn off stops it. The key page has ready-made snippets for a desktop AI assistant, curl and n8n.

Cloak stores only a fingerprint of the key (a salted HMAC-SHA256), never the key itself, so a new key is shown once, right after it is made. Lost it? Make a new one. Keys are never exported and are compared in constant time.

Cloudflare

Cloak trusts the CF-Connecting-IP header only when the request really comes from one of Cloudflare’s published ranges. X-Forwarded-For is never used. The plugin ships with Cloudflare’s list (checked 2026-10-06); Refresh from Cloudflare on the Guest list page downloads the current official list from Cloudflare’s public API over a checked HTTPS connection, and keeps the old list if anything looks wrong.

Advanced: wp-config.php overrides

These optional constants pin a setting in code. The matching field shows as locked on the settings screen. They apply once protection is on, except CLOAK_DISABLED, which always switches protection off.

define( 'CLOAK_KEY', 'your-long-random-key' ); (20+ characters; works alongside a key made on the screen)
define( 'CLOAK_GUESTS', array( '203.0.113.7', '198.51.100.0/24' ) );
define( 'CLOAK_MODES', array( '/acme/v1' => 'lights_out' ) ); (modes: `open`, `unlisted`, `lights_out`)
define( 'CLOAK_DISABLED', true ); (emergency off switch)

Advanced: filters for developers

• cloak_presets: change or add guest presets (for example an address range an AI assistant or bot publishes). Each preset is id => array( 'label' => ..., 'cidr' => ... ).
• cloak_cf_ranges: change the Cloudflare ranges used to trust CF-Connecting-IP.
• cloak_client_ip: supply the visitor address yourself if your site sits behind another trusted proxy. It must return a valid IP.

Privacy

Cloak never phones home: no tracking, no analytics, no account, no ads. It makes no outside requests except two optional ones that only run when an administrator clicks a button: the quick check, which asks your own site for one hidden door, and Refresh from Cloudflare (see “External services” below). The activity log keeps the last 200 visits to hidden doors (time, IP address, door, result) on your site only and never records headers or keys. Deleting the plugin deletes all of its data.

Disclaimer

Cloak is one layer of protection, not a guarantee. Keep WordPress, your plugins and your passwords up to date. Cloak is provided as-is, without warranty of any kind, under the GPL (see license.txt).

External services

Cloak connects to one outside service, and only when an administrator asks it to.

Cloudflare IP list (optional, manual). When you click Refresh from Cloudflare on Settings > Cloak for MCP > Guest list, the plugin sends one HTTPS GET request to https://api.cloudflare.com/client/v4/ips to download Cloudflare’s public list of its own server address ranges. The list is used only to decide when the CF-Connecting-IP header can be trusted.

• What is sent: a plain request with no data from your site, no API key and no account. Like any web request, it reveals your server’s IP address and WordPress’s standard user agent (which includes your site address) to Cloudflare.
• When: only when an administrator clicks the button. Never automatically, on a schedule, or on visitor requests.
• If you never click it, the plugin uses the list bundled with it and makes no request.
• Service provider: Cloudflare, Inc. Terms of use and Privacy policy.

The optional quick check sends one request from your site to your own site’s address; nothing goes to a third party.