{"id":357699,"date":"2026-09-03T20:03:19","date_gmt":"2026-09-03T20:03:19","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/ai-mcp-connector\/"},"modified":"2026-09-04T16:05:05","modified_gmt":"2026-09-04T16:05:05","slug":"sokket-site-connector-for-mcp","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/sokket-site-connector-for-mcp\/","author":23087444,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.1.0","stable_tag":"1.1.0","tested":"7.1","requires":"6.4","requires_php":"7.4","requires_plugins":null,"header_name":"Sokket \u2013 Site Connector for MCP","header_author":"BeautifulPlugins","header_description":"Turn your site into a self-hosted MCP (Model Context Protocol) server so AI clients such as Claude, ChatGPT, and Cursor can connect with permissions you control.","assets_banners_color":"c6f2eb","last_updated":"2026-09-04 16:05:05","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/beautifulplugins.com\/sokket-site-connector-for-mcp\/","header_author_uri":"https:\/\/beautifulplugins.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":83,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"beautifulplugins","date":"2026-09-03 20:02:57","revision":3680317},"1.1.0":{"tag":"1.1.0","author":"beautifulplugins","date":"2026-09-04 16:05:05","revision":3681488}},"upgrade_notice":{"1.1.0":"<p>Adds media, taxonomy, comment moderation, and settings-read tools. All new write tools are off by default and existing tokens are unchanged; enable what you need per token.<\/p>","1.0.0":"<p>Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3681488,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3681488,"resolution":"256x256","location":"assets","locale":"","width":265,"height":265}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3681488,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3681488,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3681488,"resolution":"1","location":"assets","locale":"","width":1920,"height":1080},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3681488,"resolution":"2","location":"assets","locale":"","width":1920,"height":1080},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3681488,"resolution":"3","location":"assets","locale":"","width":1920,"height":1080},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3681488,"resolution":"4","location":"assets","locale":"","width":1920,"height":1080},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3681488,"resolution":"5","location":"assets","locale":"","width":1920,"height":1080}},"screenshots":{"1":"Dashboard \u2014 server status, endpoint URL, active connections, and recent AI tool calls at a glance.","2":"Settings \u2192 General \u2014 enable the MCP server, switch on OAuth 2.1, copy the endpoint, and test the connection.","3":"Settings \u2192 Access \u2014 create bearer tokens bound to a WordPress user, with a per-token tool allowlist and read-only ceiling.","4":"Connections \u2192 OAuth \u2014 approved AI connections and registered clients, each revocable in one click.","5":"Connections \u2192 Connect your AI client \u2014 ready-made setup commands and configs for Claude, ChatGPT, Cursor, VS Code, and Windsurf."}},"plugin_section":[],"plugin_tags":[232494,216196,229563,242115,260626],"plugin_category":[],"plugin_contributors":[231761],"plugin_business_model":[],"class_list":["post-357699","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-agent","plugin_tags-chatgpt","plugin_tags-claude","plugin_tags-mcp","plugin_tags-mcp-server","plugin_contributors-beautifulplugins","plugin_committers-beautifulplugins"],"banners":{"banner":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/banner-772x250.png?rev=3681488","banner_2x":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/banner-1544x500.png?rev=3681488","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/icon-128x128.png?rev=3681488","icon_2x":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/icon-256x256.png?rev=3681488","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/screenshot-1.png?rev=3681488","caption":"Dashboard \u2014 server status, endpoint URL, active connections, and recent AI tool calls at a glance."},{"src":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/screenshot-2.png?rev=3681488","caption":"Settings \u2192 General \u2014 enable the MCP server, switch on OAuth 2.1, copy the endpoint, and test the connection."},{"src":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/screenshot-3.png?rev=3681488","caption":"Settings \u2192 Access \u2014 create bearer tokens bound to a WordPress user, with a per-token tool allowlist and read-only ceiling."},{"src":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/screenshot-4.png?rev=3681488","caption":"Connections \u2192 OAuth \u2014 approved AI connections and registered clients, each revocable in one click."},{"src":"https:\/\/ps.w.org\/sokket-site-connector-for-mcp\/assets\/screenshot-5.png?rev=3681488","caption":"Connections \u2192 Connect your AI client \u2014 ready-made setup commands and configs for Claude, ChatGPT, Cursor, VS Code, and Windsurf."}],"raw_content":"<!--section=description-->\n<p><strong>Sokket turns your WordPress site into its own MCP server.<\/strong><\/p>\n\n<p>MCP \u2014 the Model Context Protocol \u2014 is the standard AI clients use to work with outside systems. Install Sokket and your site becomes one: a single endpoint that <strong>Claude, ChatGPT, Cursor, VS Code, Windsurf<\/strong> and any other MCP-compatible AI agent can connect to and actually <em>use<\/em>.<\/p>\n\n<p>Instead of copying error logs and post content into a chat window, the agent reads them itself. Instead of describing your site to an AI, you connect it \u2014 and every tool call runs through a permission model you control.<\/p>\n\n<h4>Stop pasting your site into a chat window<\/h4>\n\n<p>Ask your AI agent to do the work directly:<\/p>\n\n<ul>\n<li><em>\"Why is this site throwing a 500 error?\"<\/em> \u2014 it reads the PHP error log, checks the environment, and lists which plugins updated recently.<\/li>\n<li><em>\"Which plugins have updates available, and what versions are we on?\"<\/em> \u2014 it tells you, with the WordPress and PHP versions to match.<\/li>\n<li><em>\"Find every post mentioning the old pricing and fix it.\"<\/em> \u2014 it searches, reads, and updates the content.<\/li>\n<li><em>\"Draft a post from these notes and set a featured image.\"<\/em> \u2014 it creates the draft, uploads the image, and attaches it.<\/li>\n<li><em>\"Clear the comment moderation queue.\"<\/em> \u2014 it reads the pending queue, approves the real ones, and spams the rest.<\/li>\n<li><em>\"Tidy up our categories and tag these twelve posts properly.\"<\/em> \u2014 it lists terms, creates what's missing, and assigns them.<\/li>\n<\/ul>\n\n<p><strong>This is not an AI content generator.<\/strong> Sokket writes nothing by itself and calls no AI provider. It is the <em>connector<\/em> that lets the AI client you already pay for reach your site safely.<\/p>\n\n<h4>Works with every MCP client<\/h4>\n\n<p>The endpoint speaks Streamable HTTP with JSON-RPC 2.0, so any MCP-compatible client works. The built-in setup generator produces the exact command or config for yours, with your endpoint already filled in:<\/p>\n\n<ul>\n<li><strong>Claude Code<\/strong> \u2014 one <code>claude mcp add<\/code> command<\/li>\n<li><strong>Claude Desktop<\/strong> \u2014 a custom connector via OAuth, or a bearer token through <code>mcp-remote<\/code><\/li>\n<li><strong>ChatGPT<\/strong> \u2014 a developer-mode connector with bearer authentication<\/li>\n<li><strong>Cursor<\/strong> \u2014 a ready-made <code>.cursor\/mcp.json<\/code> block<\/li>\n<li><strong>VS Code<\/strong> \u2014 a ready-made <code>.vscode\/mcp.json<\/code> block<\/li>\n<li><strong>Windsurf<\/strong> \u2014 a ready-made <code>mcp_config.json<\/code> block<\/li>\n<li><strong>Any other MCP client<\/strong> \u2014 the raw endpoint, transport, and auth header<\/li>\n<\/ul>\n\n<h4>No AI keys. No SaaS. No data leaving your site.<\/h4>\n\n<p>This is the part most \"AI for WordPress\" plugins can't say:<\/p>\n\n<ul>\n<li><strong>100% self-hosted.<\/strong> The MCP server runs inside your WordPress install. There is no SaaS component, no account to create, and no middleman marking up API calls.<\/li>\n<li><strong>No external service calls.<\/strong> This plugin makes <strong>no outbound requests to any AI provider or any other external service<\/strong>. It never sends your data anywhere. It only <em>receives<\/em> inbound connections from the AI clients you configure, on an endpoint you can switch off at any time.<\/li>\n<li><strong>No AI API keys.<\/strong> Sokket is provider-agnostic and stores no AI credentials. Your AI client authenticates to <em>your site<\/em> \u2014 not the other way around.<\/li>\n<\/ul>\n\n<h4>Two ways to connect<\/h4>\n\n<p><strong>Bearer tokens<\/strong> \u2014 create a token in the admin, bind it to a WordPress user, and tick exactly which tools it may call. Tokens are stored as SHA-256 hashes and shown in plaintext exactly once. This is the option with the finest control, and it works with Claude Code, ChatGPT, Cursor, VS Code, and Windsurf.<\/p>\n\n<p><strong>OAuth 2.1<\/strong> \u2014 for connector interfaces that have no field for a token, such as Claude Desktop's custom connectors. Turn it on and clients configure themselves from the endpoint URL alone: RFC 9728 and RFC 8414 discovery, dynamic client registration, PKCE (S256) required, and refresh tokens. The person connecting signs in to WordPress, approves on a consent screen, and chooses read-only or full access. Every grant is listed in the admin and revocable in one click.<\/p>\n\n<p>WordPress <strong>Application Passwords<\/strong> are accepted too, for quick local testing.<\/p>\n\n<h4>Security model<\/h4>\n\n<p>Sokket is built on the assumption that you should never have to simply trust the agent.<\/p>\n\n<ul>\n<li>The server is <strong>disabled by default<\/strong> after activation, and rejects every request until you switch it on.<\/li>\n<li>Every credential is <strong>bound to a WordPress user<\/strong> \u2014 a request can never do anything that user could not do in wp-admin.<\/li>\n<li><strong>Three independent gates<\/strong> on every single tool call: the connection's tool allowlist, a <strong>read-only ceiling<\/strong>, and a real <code>current_user_can()<\/code> capability check. The token is never trusted on its own.<\/li>\n<li><strong>Every write tool is off by default<\/strong> and must be enabled explicitly, one at a time.<\/li>\n<li>Rate limiting, origin validation (DNS-rebinding protection), timing-safe token comparison, and session handling per the MCP spec.<\/li>\n<li>A capped <strong>audit log<\/strong> of every tool call: user, tool, outcome, and the object id it acted on. Tool arguments are never stored.<\/li>\n<li><strong>Instant revocation<\/strong> of any token or OAuth connection.<\/li>\n<li>Deliberately <strong>no filesystem-write, database-query, or command-execution tools<\/strong> \u2014 the free plugin's attack surface stays small on purpose.<\/li>\n<\/ul>\n\n<h4>Included tools<\/h4>\n\n<p>20 tools, grouped by area, each individually switchable per connection.<\/p>\n\n<p><strong>Site &amp; diagnostics<\/strong><\/p>\n\n<ul>\n<li><code>get_site_info<\/code> \u2014 WordPress\/PHP\/DB versions, active theme, environment, debug flags<\/li>\n<li><code>list_plugins<\/code> \u2014 installed plugins, versions, update availability<\/li>\n<li><code>list_themes<\/code> \u2014 installed themes<\/li>\n<li><code>get_php_error_log_tail<\/code> \u2014 last lines of the server-configured PHP error log (admins only)<\/li>\n<li><code>get_site_settings<\/code> \u2014 general, writing, reading, discussion, and permalink settings from a fixed allowlist<\/li>\n<\/ul>\n\n<p><strong>Content<\/strong><\/p>\n\n<ul>\n<li><code>list_posts<\/code>, <code>get_post<\/code>, <code>search_content<\/code> \u2014 content inspection<\/li>\n<li><code>create_post<\/code>, <code>update_post<\/code> \u2014 content writes (off by default, per token)<\/li>\n<\/ul>\n\n<p><strong>Media<\/strong><\/p>\n\n<ul>\n<li><code>list_media<\/code> \u2014 browse the media library<\/li>\n<li><code>upload_media<\/code> \u2014 add an image from base64 data (off by default, per token)<\/li>\n<li><code>set_featured_image<\/code> \u2014 set or clear a post's featured image (off by default, per token)<\/li>\n<\/ul>\n\n<p><strong>Taxonomies &amp; terms<\/strong><\/p>\n\n<ul>\n<li><code>list_taxonomies<\/code>, <code>list_terms<\/code> \u2014 taxonomy inspection<\/li>\n<li><code>create_term<\/code>, <code>assign_terms<\/code> \u2014 term writes (off by default, per token)<\/li>\n<\/ul>\n\n<p><strong>Comments<\/strong><\/p>\n\n<ul>\n<li><code>list_comments<\/code> \u2014 review the moderation queue<\/li>\n<li><code>moderate_comment<\/code> \u2014 approve, unapprove, spam, unspam, trash, untrash (off by default, per token)<\/li>\n<li><code>reply_to_comment<\/code> \u2014 reply as the connected user (off by default, per token)<\/li>\n<\/ul>\n\n<h4>Who it's for<\/h4>\n\n<ul>\n<li><strong>Developers and agencies<\/strong> debugging and maintaining sites with an AI coding assistant instead of a support ticket queue.<\/li>\n<li><strong>Site owners<\/strong> who want an AI assistant that can actually see the site it's advising them about.<\/li>\n<li><strong>Content teams<\/strong> letting an agent draft, update, illustrate, and categorise posts under editorial control.<\/li>\n<li><strong>Anyone<\/strong> who wants AI help with WordPress without shipping their content to another SaaS platform.<\/li>\n<\/ul>\n\n<h4>Built for developers<\/h4>\n\n<p>Register your own tools with a single filter, <code>sokket_register_tools<\/code>. Anything you add inherits the whole permission model, the audit log, and the transport for free, and shows up in the admin allowlist automatically. Filters are also provided for rate limits, upload restrictions, audit retention, the settings-read allowlist, and OAuth authorization rights.<\/p>\n\n<p>Full documentation: <a href=\"https:\/\/beautifulplugins.com\/docs\/sokket-site-connector-for-mcp\/\">beautifulplugins.com\/docs\/sokket-site-connector-for-mcp\/<\/a><\/p>\n\n<!--section=installation-->\n<h4>Install the plugin<\/h4>\n\n<ol>\n<li>Go to <strong>Plugins \u2192 Add New<\/strong>, search for <strong>\"Sokket\"<\/strong>, click <strong>Install Now<\/strong>, then <strong>Activate<\/strong>. (Or upload the ZIP under <strong>Plugins \u2192 Add New \u2192 Upload Plugin<\/strong>.)<\/li>\n<li>Nothing is exposed yet \u2014 the MCP server is disabled by default.<\/li>\n<\/ol>\n\n<h4>Turn on the server<\/h4>\n\n<ol>\n<li>Go to <strong>Sokket \u2192 Settings \u2192 General<\/strong>.<\/li>\n<li>Tick <strong>Enable MCP server<\/strong> and save.<\/li>\n<li>Copy the <strong>Endpoint URL<\/strong>, and click <strong>Test connection<\/strong> to confirm the endpoint is reachable and enforcing authentication.<\/li>\n<\/ol>\n\n<h4>Create a credential<\/h4>\n\n<ol>\n<li>Go to <strong>Sokket \u2192 Settings \u2192 Access<\/strong>.<\/li>\n<li>Give the token a label, pick the WordPress user it runs as, leave <strong>Read-only<\/strong> ticked to start with, and choose which tools it may call.<\/li>\n<li>Copy the token \u2014 it is shown exactly once.<\/li>\n<\/ol>\n\n<p>Prefer sign-in based connections? Tick <strong>Enable OAuth 2.1<\/strong> on the General tab instead, and clients configure themselves from the endpoint URL.<\/p>\n\n<h4>Connect your AI client<\/h4>\n\n<ol>\n<li>Go to <strong>Sokket \u2192 Connections \u2192 Connect your AI client<\/strong>.<\/li>\n<li>Choose your client and copy the generated command or config.<\/li>\n<\/ol>\n\n<p>For Claude Code, that is a single command:<\/p>\n\n<pre><code>claude mcp add --transport http sokket-site-connector-for-mcp https:\/\/example.com\/wp-json\/sokket\/v1\/mcp --header \"Authorization: Bearer YOUR_TOKEN\"\n<\/code><\/pre>\n\n<p>Then ask your agent what versions the site is running \u2014 and watch the call appear in the audit log.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"what%20is%20mcp%3F\"><h3>What is MCP?<\/h3><\/dt>\n<dd><p>The Model Context Protocol is the standard way for an AI client to work with an external system. The system exposes <em>tools<\/em> \u2014 named operations with typed arguments \u2014 and the AI decides which to call. Sokket makes your WordPress site one of those systems, so an AI agent can read and manage it directly instead of being told about it second-hand.<\/p><\/dd>\n<dt id=\"does%20this%20plugin%20send%20my%20content%20to%20an%20ai%20company%3F\"><h3>Does this plugin send my content to an AI company?<\/h3><\/dt>\n<dd><p>No. The plugin makes no outbound requests to AI providers or any other external service. AI clients that <em>you<\/em> configure connect <em>to your site<\/em>, authenticate with a credential you created, and can only use the tools that credential allows.<\/p><\/dd>\n<dt id=\"do%20i%20need%20an%20openai%20or%20anthropic%20api%20key%3F\"><h3>Do I need an OpenAI or Anthropic API key?<\/h3><\/dt>\n<dd><p>No. Sokket is provider-agnostic and stores no AI credentials at all. Your AI client brings its own subscription and authenticates to your site with a token or an OAuth connection you approve.<\/p><\/dd>\n<dt id=\"which%20ai%20clients%20work%20with%20it%3F\"><h3>Which AI clients work with it?<\/h3><\/dt>\n<dd><p>Any MCP-compatible client that supports remote servers over Streamable HTTP, including Claude Code, Claude Desktop, ChatGPT, Cursor, VS Code, and Windsurf. The \"Connect your AI client\" tab generates the exact command or configuration for your site.<\/p><\/dd>\n<dt id=\"how%20do%20i%20connect%20claude%20desktop%3F\"><h3>How do I connect Claude Desktop?<\/h3><\/dt>\n<dd><p>Claude Desktop's custom connectors have no field for a bearer token, so enable <strong>OAuth 2.1<\/strong> under Settings \u2192 General, then add your endpoint URL as a custom connector and leave Client ID and Client Secret blank \u2014 the connector registers itself and asks you to sign in and approve. If you would rather not enable OAuth, the plugin also generates an <code>mcp-remote<\/code> configuration that uses a bearer token instead.<\/p><\/dd>\n<dt id=\"is%20it%20free%3F\"><h3>Is it free?<\/h3><\/dt>\n<dd><p>Yes. This plugin is the complete MCP server: all 20 tools, OAuth 2.1, bearer tokens, per-connection permissions, and the audit log. There is no usage limit and no account to create.<\/p><\/dd>\n<dt id=\"is%20it%20safe%20to%20install%20on%20a%20production%20site%3F\"><h3>Is it safe to install on a production site?<\/h3><\/dt>\n<dd><p>The server is disabled by default and rejects every request until you enable it. When enabled, access requires a credential bound to a WordPress user, and each tool call is checked against that user's capabilities plus the connection's own allowlist. Every write tool is off until you enable it, and you can revoke any credential instantly.<\/p><\/dd>\n<dt id=\"can%20i%20control%20exactly%20which%20tools%20the%20ai%20can%20use%3F\"><h3>Can I control exactly which tools the AI can use?<\/h3><\/dt>\n<dd><p>Yes \u2014 that is the core of the plugin. Each bearer token has its own tool allowlist and an optional read-only ceiling that blocks every write tool regardless of what else is ticked. OAuth connections are scope-based instead: read-only or full access, still bounded by the WordPress user's capabilities.<\/p><\/dd>\n<dt id=\"can%20the%20ai%20modify%20files%20or%20run%20database%20queries%3F\"><h3>Can the AI modify files or run database queries?<\/h3><\/dt>\n<dd><p>No. The plugin deliberately ships no filesystem write, database query, or command execution tools. Every write tool is off by default and has to be enabled per connection. <code>get_php_error_log_tail<\/code> reads only the path the server itself configures in <code>error_log<\/code>, capped at the last 100 lines, and requires an administrator.<\/p><\/dd>\n<dt id=\"can%20the%20ai%20upload%20images%20to%20my%20media%20library%3F\"><h3>Can the AI upload images to my media library?<\/h3><\/dt>\n<dd><p>Only if you enable <code>upload_media<\/code> on a connection bound to a user who can already upload files, and even then the tool is deliberately narrow:<\/p>\n\n<ul>\n<li><strong>Images only<\/strong> \u2014 JPEG, PNG, GIF, WebP, and AVIF. SVG is refused outright, because SVG is XML that can carry script; this holds even on sites that have enabled SVG uploads elsewhere.<\/li>\n<li><strong>The file type comes from the bytes, not the file name.<\/strong> A payload named <code>photo.jpg<\/code> that is not really an image is rejected, and the stored extension is always rewritten to match the real image data.<\/li>\n<li><strong>The image arrives inside the request.<\/strong> Bytes are sent base64-encoded over the connection your client already opened. The plugin does not fetch URLs, so enabling uploads still results in zero outbound requests from your site.<\/li>\n<li><strong>Rate limited.<\/strong> Uploads are capped per user per hour (20 files \/ 25 MB by default, filterable) so an agent stuck in a loop cannot fill your uploads directory.<\/li>\n<li><strong>Logged.<\/strong> The audit log records the resulting attachment id alongside the tool call.<\/li>\n<\/ul><\/dd>\n<dt id=\"does%20the%20ai%20client%20see%20personal%20data%3F\"><h3>Does the AI client see personal data?<\/h3><\/dt>\n<dd><p>It sees whatever the WordPress user it is bound to can see through the tools you enabled. Notably, <code>list_comments<\/code> includes commenter email addresses, and <code>get_site_settings<\/code> includes the site's admin email \u2014 the same data that user sees in wp-admin. Leave those tools off if you would rather not share them.<\/p><\/dd>\n<dt id=\"what%20does%20the%20audit%20log%20record%3F\"><h3>What does the audit log record?<\/h3><\/dt>\n<dd><p>The time, the user, the tool, the outcome, and the id of the post, attachment, term, or comment the call acted on. Tool arguments are never stored, so the log tells you what happened without becoming a second copy of your content.<\/p><\/dd>\n<dt id=\"can%20i%20add%20my%20own%20tools%3F\"><h3>Can I add my own tools?<\/h3><\/dt>\n<dd><p>Yes. Register them through the <code>sokket_register_tools<\/code> filter and they appear in the admin allowlist automatically, passing exactly the same permission gates as the built-in tools. See the developer documentation.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20wordpress%20multisite%3F\"><h3>Does it work with WordPress Multisite?<\/h3><\/dt>\n<dd><p>Yes. Sokket runs per site \u2014 each site in a network has its own settings, credentials, endpoint, and audit log, and is enabled independently. Connect your AI client to each site separately.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20the%20wordpress%20rest%20api%20disabled%3F\"><h3>Does it work with the WordPress REST API disabled?<\/h3><\/dt>\n<dd><p>No. The MCP endpoint is a REST route (<code>\/wp-json\/sokket\/v1\/mcp<\/code>), so the REST API must be reachable. A security plugin that blocks REST requests or strips the <code>Authorization<\/code> header will also block Sokket.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20i%20delete%20the%20plugin%3F\"><h3>What happens if I delete the plugin?<\/h3><\/dt>\n<dd><p>The plugin cleans up after itself: the token, audit log, and OAuth tables are dropped, the options are deleted, and the plugin's transients are cleared. Every credential stops working immediately.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>New media tools: <code>list_media<\/code>, <code>upload_media<\/code> (base64 images only), and <code>set_featured_image<\/code>.<\/li>\n<li>New taxonomy tools: <code>list_taxonomies<\/code>, <code>list_terms<\/code>, <code>create_term<\/code>, and <code>assign_terms<\/code>.<\/li>\n<li>New comment moderation tools: <code>list_comments<\/code>, <code>moderate_comment<\/code>, and <code>reply_to_comment<\/code>.<\/li>\n<li>New <code>get_site_settings<\/code> tool reading a fixed allowlist of WordPress options.<\/li>\n<li>Uploads are restricted to JPEG, PNG, GIF, WebP, and AVIF, typed from the file contents rather than the file name, and rate limited per user per hour.<\/li>\n<li>The audit log now records the post, attachment, term, or comment id a call acted on. Tool arguments are still never stored.<\/li>\n<li>The token screen groups the tool allowlist by area.<\/li>\n<li>All new write tools are off by default; existing tokens keep exactly the tools they were granted.<\/li>\n<li>Updated the plugin banner and icon.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"Self-hosted MCP server for WordPress. Connect Claude, ChatGPT, Cursor &amp; any AI agent to your site \u2014 with the tools and permissions you control.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/357699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=357699"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/beautifulplugins"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=357699"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=357699"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=357699"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=357699"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=357699"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=357699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}