Title: DevCubic AI Bridge for MCP Author: M.Ahmad Sultan Published: July 24, 2026 Last modified: July 24, 2026 --- Search plugins ![](https://ps.w.org/devcubic-ai-bridge-for-mcp/assets/banner-772x250.png?rev=3621032) ![](https://ps.w.org/devcubic-ai-bridge-for-mcp/assets/icon-256x256.png?rev=3621032) # DevCubic AI Bridge for MCP By [M.Ahmad Sultan](https://profiles.wordpress.org/mahmadsultan/) [Download](https://downloads.wordpress.org/plugin/devcubic-ai-bridge-for-mcp.1.0.1.zip) * [Details](https://wordpress.org/plugins/devcubic-ai-bridge-for-mcp/#description) * [Reviews](https://wordpress.org/plugins/devcubic-ai-bridge-for-mcp/#reviews) * [Installation](https://wordpress.org/plugins/devcubic-ai-bridge-for-mcp/#installation) * [Development](https://wordpress.org/plugins/devcubic-ai-bridge-for-mcp/#developers) [Support](https://wordpress.org/support/plugin/devcubic-ai-bridge-for-mcp/) ## Description DevCubic AI Bridge for MCP turns your WordPress site into a Model Context Protocol( MCP) server. Any logged-in user can connect an AI assistant — Claude, ChatGPT, Gemini, or any other MCP-compatible client — by pasting a single URL and approving it in their browser, then read and manage site content straight from their AI chat. Compatible with any MCP client, including Anthropic Claude, OpenAI ChatGPT, and Google Gemini. (These are trademarks of their respective owners; this plugin is an independent project and is not affiliated with or endorsed by Anthropic, OpenAI, or Google.) The connection is scoped to the person who authorizes it. An AI acting for an Editor can do what that Editor can do; an AI acting for a Subscriber can only read. There are no API keys to generate or share — authorization works like an OAuth “Sign in with WordPress” button, using the user’s own login. **Security by design** This plugin gives an AI real access to your site, so it is built to be conservative: * Standards-based OAuth 2.1 with PKCE — the same authorization pattern used by major “Sign in with…” buttons. * Every tool is gated by the connecting user’s own WordPress capabilities, enforced twice: once when tools are advertised, and again inside WordPress core’s REST controllers when a tool runs. * Access tokens are stored only as SHA-256 hashes and can be revoked at any time. * Administrators get site-wide policy switches and an audit log of every tool call. * Your site talks only to the AI client the user connected — no data is sent to any third party. **How it works** 1. Open **DevCubic AI Bridge for MCP** in your WordPress admin menu and copy the connector URL. 2. Paste it into your MCP-compatible client as a new connector. 3. The client opens your browser; you log in and approve the connection on a consent screen that lists exactly what you are granting. 4. The client receives an access token and can call the tools your role allows — nothing more. **Content tools** * Posts and Pages: list, get, create, update, delete * Media: list, get, upload (from a URL or base64), delete * Comments: list, get, create, update, delete * Categories & tags: list, create, update, delete **WooCommerce (automatic when WooCommerce is active)** * Products: list, get, create, update, delete * Orders: list, get, change status, add order notes * Customers and coupons, plus a sales-report summary Store tools require the `manage_woocommerce` capability (Administrators and Shop Managers) and run through WooCommerce’s own REST controllers, so its validation and permission checks apply unchanged. **Custom post types (automatic)** Every public, REST-enabled post type — events, portfolios, job listings, and thousands of others provided by plugins or themes — automatically gets list, get, create, update, and delete tools, gated by that type’s own capabilities. No per-plugin integration needed. Developers can filter which types are exposed with `mcp_connector_custom_post_types`. **SEO (automatic with Yoast SEO or Rank Math)** Read and set the SEO title, meta description, focus keyword, canonical URL, and noindex flag for any post or page. **Site policy controls** On top of user roles, administrators get explicit switches (DevCubic AI Bridge for MCP Site policy): * **Read-only mode** — connected AIs can read but never change anything. * **Require human review** — AI-created content is saved as _Pending Review_, and published content cannot be modified through MCP. * **Deletion switch** — hide every delete tool with one checkbox. * **Per-tool toggles** — disable any individual tool, including tools added by other plugins. A tool is available only when both the user’s role and the site policy allow it, and the consent screen tells connecting users about active policies up front. **Extend it** Other plugins can register their own capability-gated MCP tools through the `mcp_connector_tools` filter, so any plugin can expose its features to connected AI clients safely. **Requirements** HTTPS is required in production (OAuth bearer tokens must travel over TLS). Works with any MCP-compatible AI client. ### Extending Other plugins can register their own MCP tools through the `mcp_connector_tools` filter. Each tool is gated by a WordPress capability, exactly like the built-in ones: ``` add_filter( 'mcp_connector_tools', function ( $tools ) { $tools['my_store_orders'] = array( 'description' => 'List recent store orders.', 'capability' => 'manage_woocommerce', 'inputSchema' => array( 'type' => 'object', 'properties' => array( 'limit' => array( 'type' => 'integer', 'description' => 'Max orders to return.' ), ), ), 'handler' => function ( $args ) { // Return any JSON-serializable data, or a WP_Error. return my_plugin_get_orders( $args ); }, ); return $tools; } ); ``` Useful filters: `mcp_connector_max_upload_bytes` (upload size cap, default 20 MB),` mcp_connector_enable_audit_log` (default true), `mcp_connector_log_retention_days`( default 30). ## Screenshots [⌊The DevCubic AI Bridge for MCP admin page: copy one connector URL to paste into your AI client.⌉⌊The DevCubic AI Bridge for MCP admin page: copy one connector URL to paste into your AI client.⌉[ The DevCubic AI Bridge for MCP admin page: copy one connector URL to paste into your AI client. [⌊Site policy controls: read-only mode, human-review publishing, a deletion switch, and per-tool toggles.⌉⌊Site policy controls: read-only mode, human-review publishing, a deletion switch, and per-tool toggles.⌉[ Site policy controls: read-only mode, human-review publishing, a deletion switch, and per-tool toggles. [⌊The audit log — every tool call recorded with user, tool, and status.⌉⌊The audit log — every tool call recorded with user, tool, and status.⌉[ The audit log — every tool call recorded with user, tool, and status. ## Installation 1. Upload the `devcubic-ai-bridge-for-mcp` folder to `/wp-content/plugins/`. 2. Activate the plugin through the “Plugins” screen in WordPress. 3. Go to **DevCubic AI Bridge for MCP** in the admin menu to get your connector URL. ## FAQ ### Does every user get the same tools? No. Tool availability is derived from each user’s own WordPress capabilities. An Administrator sees everything in scope; a Contributor might only see read tools and the ability to create a draft post. ### Where are access tokens stored? In dedicated database tables created on activation. Tokens are stored as SHA-256 hashes, never in plaintext, and can be revoked at any time from the DevCubic AI Bridge for MCP admin page. ### Does this require HTTPS? Yes, for production use. OAuth bearer tokens should only ever be sent over HTTPS. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “DevCubic AI Bridge for MCP” is open source software. The following people have contributed to this plugin. Contributors * [ M.Ahmad Sultan ](https://profiles.wordpress.org/mahmadsultan/) * [ itsakbar ](https://profiles.wordpress.org/itsakbar/) [Translate “DevCubic AI Bridge for MCP” into your language.](https://translate.wordpress.org/projects/wp-plugins/devcubic-ai-bridge-for-mcp) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/devcubic-ai-bridge-for-mcp/), check out the [SVN repository](https://plugins.svn.wordpress.org/devcubic-ai-bridge-for-mcp/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/devcubic-ai-bridge-for-mcp/) by [RSS](https://plugins.trac.wordpress.org/log/devcubic-ai-bridge-for-mcp/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Added an optional, dismissible admin notice inviting a WordPress.org review. It appears only to administrators, only after the plugin has been in use for a week and at least one AI client has been connected, and never reappears once dismissed. #### 1.0.0 Initial release. * OAuth 2.1 authorization (Dynamic Client Registration, PKCE, refresh-token rotation with a grace window) so any MCP client connects by pasting one URL and logging in through the browser. * MCP JSON-RPC endpoint (initialize / tools/list / tools/call / ping) authenticated with per-user bearer tokens. * Core content tools: posts, pages, media, comments, categories, and tags — each gated by the connected user’s own WordPress capabilities and routed through core’s REST controllers. * WooCommerce tools (products, orders, customers, coupons, sales report) that appear automatically when WooCommerce is active, gated by `manage_woocommerce`. * Automatic tools for every public, REST-enabled custom post type, gated by each type’s own capabilities. * SEO tools (get/set title, meta description, focus keyword, canonical, noindex) when Yoast SEO or Rank Math is active. * Site policy controls: read-only mode, “require human review” publishing, a deletion kill-switch, and per-tool toggles. * Audit log of every tool call with an admin viewer, plus admin diagnostics for OAuth discovery and subdirectory installs. * `mcp_connector_tools` and `mcp_connector_custom_post_types` filters for extending the tool catalog. * Security: SSRF protection and size caps on media uploads, per-IP rate limiting on the registration and token endpoints, hashed token storage, and a daily cleanup cron. ## Meta * Version **1.0.1** * Last updated **23 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.0.2** * PHP version ** 7.4 or higher ** * Tags * [AI](https://wordpress.org/plugins/tags/ai/)[ChatGPT](https://wordpress.org/plugins/tags/chatgpt/) [Claude](https://wordpress.org/plugins/tags/claude/)[Gemini](https://wordpress.org/plugins/tags/gemini/) [mcp](https://wordpress.org/plugins/tags/mcp/) * [Advanced View](https://wordpress.org/plugins/devcubic-ai-bridge-for-mcp/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/devcubic-ai-bridge-for-mcp/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/devcubic-ai-bridge-for-mcp/reviews/) ## Contributors * [ M.Ahmad Sultan ](https://profiles.wordpress.org/mahmadsultan/) * [ itsakbar ](https://profiles.wordpress.org/itsakbar/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/devcubic-ai-bridge-for-mcp/)