Title: Honeycup Author: Finn Hillebrandt Published: September 12, 2026 Last modified: September 12, 2026 --- Search plugins ![](https://ps.w.org/honeycup/assets/icon.svg?rev=3692499) # Honeycup By [Finn Hillebrandt](https://profiles.wordpress.org/finnhillebrandt/) [Download](https://downloads.wordpress.org/plugin/honeycup.0.2.0.zip) * [Details](https://wordpress.org/plugins/honeycup/#description) * [Reviews](https://wordpress.org/plugins/honeycup/#reviews) * [Installation](https://wordpress.org/plugins/honeycup/#installation) * [Development](https://wordpress.org/plugins/honeycup/#developers) [Support](https://wordpress.org/support/plugin/honeycup/) ## Description Honeycup Free connects a supported AI client directly to your WordPress site. You stay in control of the WordPress user and its permissions. An Ability is a task that your AI client can discover. Honeycup Free provides 34 Abilities: 18 read WordPress state, 13 write within explicit boundaries, and 3 remain manual-only. #### What can it do? The 18 read Abilities can: * Read and list posts. * Read terms, media files, and comments. * Inspect SEO metadata when a supported SEO plugin is active. * Check WordPress blocks and the content format. * Read basic site context and system diagnostics. * List saved working instructions. The 13 write Abilities can: * Create posts and pages from Markdown as drafts by default. * Update titles, excerpts, page parents and Markdown content. * Change post status, including publishing with permission and explicit confirmation. * Move posts to Trash with confirmation and restore them as drafts. Permanent deletion is not exposed. * Create and update public taxonomy terms and assign existing term IDs to posts. * Upload validated raster images from local base64 data, update alt text and set featured images. * Update local site context as an administrator. * Refresh Honeycup’s isolated local cache with `honeycup/refresh-hooks`. Markdown is converted on the server into a bounded set of native WordPress core blocks. Raw HTML and shortcode execution are not supported. Honeycup Free does not replace page-builder layouts. #### How do writes work? Read the object first, then pass the returned state hash as `expected_hash`. Post fields, taxonomy assignments, featured images, terms, media and site context expose their own hashes. A stale hash stops the write. Honeycup serializes its own changes and reads the saved state back after WordPress runs its native hooks. These checks are optimistic. They do not make WordPress admin edits or other plugins participate in a single atomic transaction. Avoid simultaneous editing. A verification failure requires inspection of the current state; Honeycup does not automatically overwrite it to roll back. Creation of a post, term or upload requires a unique `idempotency_key`. Repeating the same successful request with that key returns the current authorized object instead of creating a duplicate. Reusing the key for different input is rejected. If a creation was interrupted, inspect WordPress before trying again and do not simply send a new key. Receipts remain local until uninstall; they store identifiers and fingerprints, not copies of content. A crashed write can retain its resource lock for administrator recovery. For `honeycup/list-posts`, Honeycup applies WordPress’s native status and privacy- policy-page capability rules before pagination, then checks every returned item again. `total` and `returned_count` count only the authorized items returned on the requested page. `total_scope` is always `page`. Honeycup Free intentionally does not report a cross-page total or perform a full enumeration, because either could reveal metadata about posts the connected WordPress user cannot edit. A user without `edit_private_posts` can list only that user’s own private posts. For `honeycup/list-media`, Honeycup checks `edit_post` for every attachment, including individual capability restrictions. Its `total` and `returned_count` likewise count only authorized items on the requested page, with `total_scope` set to `page`. A page can contain fewer items after permission filtering. #### What stays manual? The remaining 3 change Abilities are manual-only: SEO metadata changes, comment moderation and comment replies. They remain visible for planning but return HTTP 409 with `honeycup_core_manual_only` and `manual_only: true` before changing WordPress. Complete those steps in the WordPress dashboard. #### Privacy and data Honeycup Free has no account requirement, license key, hosted relay, remote package loader, or timed feature restriction. The plugin itself makes no outbound network request. Your chosen AI client and AI provider may process information that you ask the client to read. Their terms and privacy policy apply to that separate connection. Honeycup stores its own local settings, cryptographic secrets, write locks, creation receipts and a bounded activity ledger under the `honeycup_core_` option namespace. Posts, terms and media you create are normal WordPress data. ## Installation 1. Install and activate Honeycup. 2. Open Honeycup in wp-admin. The setup page checks your local WordPress, PHP, HTTPS, and Application Password requirements. 3. Create a separate WordPress user with only the permissions needed for your tasks. 4. Sign in as that user and open Users > Profile. Under Application Passwords, create a password with a clear name. 5. Copy the password directly into your private local client configuration. Never place it in a URL, repository, prompt, or shared file. 6. Use the secret-free template on the Honeycup setup page to connect Codex or Claude Code. The local MCP endpoint is `/wp-json/honeycup/v1/mcp`. It uses WordPress authentication and checks the current user’s permission for every Ability. Claude Desktop does not directly load this remote HTTP configuration, and Honeycup Free does not include a local desktop transport. ChatGPT requires a public HTTPS OAuth connection. Honeycup Free does not provide an OAuth server or pass an Application Password to ChatGPT. ## FAQ ### Does Honeycup Free change my posts? Yes, when your connected WordPress user has the required permissions. New posts default to drafts. Publishing and moving content to Trash require explicit confirmation, and edits require a fresh state hash. ### Does activation contact an external service? No. Activation creates local cryptographic secrets for the activity ledger and authenticated MCP sessions when they are missing. ### Does the setup page send a connection test to another service? No. Its checks read local WordPress and PHP state only. The page does not create, store, or display an Application Password. ### How do I disconnect a client? Open the connected WordPress user’s profile and revoke the individual Application Password used by that client. This leaves the user’s other passwords and connections unchanged. ### Can Honeycup Free run beside the commercial Honeycup plugin? Yes. The Free plugin does not register duplicate Abilities while the commercial plugin owns the shared Ability namespace. Its own local options remain separate. ### Does uninstall remove its data? Yes. It removes only Honeycup Free options, locks, creation receipts and transient data. It leaves your WordPress posts, taxonomy terms and media intact. Uninstalling removes duplicate-creation protection for old keys. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Honeycup” is open source software. The following people have contributed to this plugin. Contributors * [ Finn Hillebrandt ](https://profiles.wordpress.org/finnhillebrandt/) [Translate “Honeycup” into your language.](https://translate.wordpress.org/projects/wp-plugins/honeycup) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/honeycup/), check out the [SVN repository](https://plugins.svn.wordpress.org/honeycup/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/honeycup/) by [RSS](https://plugins.trac.wordpress.org/log/honeycup/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.2.0 * Native post, taxonomy, raster image and site-context writes with capability checks, optimistic state hashes, creation receipts and readback. * Publishing and Trash confirmation; restore to draft. * SEO changes and comment mutations remain manual-only. #### 0.1.0 * Initial standalone Free release. ## Meta * Version **0.2.0** * Last updated **13 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.9 or higher ** * Tested up to **7.1** * PHP version ** 8.1 or higher ** * Tags * [AI](https://wordpress.org/plugins/tags/ai/)[automation](https://wordpress.org/plugins/tags/automation/) [content](https://wordpress.org/plugins/tags/content/)[mcp](https://wordpress.org/plugins/tags/mcp/) [productivity](https://wordpress.org/plugins/tags/productivity/) * [Advanced View](https://wordpress.org/plugins/honeycup/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/honeycup/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/honeycup/reviews/) ## Contributors * [ Finn Hillebrandt ](https://profiles.wordpress.org/finnhillebrandt/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/honeycup/)