{"id":367971,"date":"2026-11-06T16:34:02","date_gmt":"2026-11-06T16:34:02","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/llamly\/"},"modified":"2026-11-06T16:33:44","modified_gmt":"2026-11-06T16:33:44","slug":"llamly","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/llamly\/","author":14944768,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.3","stable_tag":"1.0.3","tested":"7.1.4","requires":"6.2","requires_php":"8.0","requires_plugins":null,"header_name":"Llamly MCP - AI Agent with ChatGPT & Claude","header_author":"Llamly","header_description":"Connect AI clients to WordPress through the Llamly MCP server.","assets_banners_color":"475055","last_updated":"2026-11-06 16:33:44","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":48,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.3":{"tag":"1.0.3","author":"dotrex","date":"2026-11-06 16:33:44","revision":3788333}},"upgrade_notice":{"1.0.3":"<p>The MCP endpoint authenticates in its REST permission callback. Translations now come from translate.wordpress.org.<\/p>","1.0.2":"<p>Agents now work with content permissions only, for every user role: no site settings, PHP error log or Site Health tools, and no unfiltered HTML.<\/p>","1.0.1":"<p>Users are read only, global styles no longer accept custom CSS, and database restore points were removed (existing ones are deleted on update).<\/p>","1.0.0":"<p>First public release. Writes no longer wait for approval by default; turn on the approval queue in Settings if you want that. Safe mode now asks the agent for <code>confirm: true<\/code> before deleting, undoing and irreversible actions.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3788333,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3788333,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3788333,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3788333,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3788333,"resolution":"1","location":"assets","locale":"","width":1280,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3788333,"resolution":"2","location":"assets","locale":"","width":1280,"height":1250},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3788333,"resolution":"3","location":"assets","locale":"","width":1280,"height":900},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3788333,"resolution":"4","location":"assets","locale":"","width":1280,"height":900},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3788333,"resolution":"5","location":"assets","locale":"","width":1280,"height":1100}},"screenshots":{"1":"Connections: pick an AI app and follow its step-by-step recipe. Key-based apps get a ready-to-paste command; the key is shown only once.","2":"Activity: a request waiting for approval, shown with a before and after of the change, and the history of every change made by an agent with undo and redo.","3":"Logs: audit trail of every MCP request, including refused ones, with filters by connection, result and date.","4":"Settings: server switch, safe mode, the optional approval queue, rate limit, OAuth rules and retention.","5":"About: what Llamly does, first steps and example requests to try with your agent."}},"plugin_section":[],"plugin_tags":[232494,216196,229563,242115,253991],"plugin_category":[],"plugin_contributors":[144447],"plugin_business_model":[],"class_list":["post-367971","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-agent","plugin_tags-chatgpt","plugin_tags-claude","plugin_tags-mcp","plugin_tags-model-context-protocol","plugin_contributors-dotrex","plugin_committers-dotrex"],"banners":{"banner":"https:\/\/ps.w.org\/llamly\/assets\/banner-772x250.png?rev=3788333","banner_2x":"https:\/\/ps.w.org\/llamly\/assets\/banner-1544x500.png?rev=3788333","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/llamly\/assets\/icon-128x128.png?rev=3788333","icon_2x":"https:\/\/ps.w.org\/llamly\/assets\/icon-256x256.png?rev=3788333","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/llamly\/assets\/screenshot-1.png?rev=3788333","caption":"Connections: pick an AI app and follow its step-by-step recipe. Key-based apps get a ready-to-paste command; the key is shown only once."},{"src":"https:\/\/ps.w.org\/llamly\/assets\/screenshot-2.png?rev=3788333","caption":"Activity: a request waiting for approval, shown with a before and after of the change, and the history of every change made by an agent with undo and redo."},{"src":"https:\/\/ps.w.org\/llamly\/assets\/screenshot-3.png?rev=3788333","caption":"Logs: audit trail of every MCP request, including refused ones, with filters by connection, result and date."},{"src":"https:\/\/ps.w.org\/llamly\/assets\/screenshot-4.png?rev=3788333","caption":"Settings: server switch, safe mode, the optional approval queue, rate limit, OAuth rules and retention."},{"src":"https:\/\/ps.w.org\/llamly\/assets\/screenshot-5.png?rev=3788333","caption":"About: what Llamly does, first steps and example requests to try with your agent."}],"raw_content":"<!--section=description-->\n<p>Llamly MCP connects your WordPress site to the AI you already use: ChatGPT, Claude, Codex, Cursor and other AI agents. Ask in plain language and your agent writes, edits and organizes the site for you, with your WordPress content permissions, a full change history and undo. It is a free WordPress MCP server (Model Context Protocol) that runs inside your own site: no relay, no Llamly server in between, no Llamly account and no API key from an AI provider.<\/p>\n\n<p><strong>Use the AI subscription you already have. Keep every change reversible.<\/strong><\/p>\n\n<ul>\n<li><strong>Manage your site by chat<\/strong>: create, edit and publish posts and pages, edit Gutenberg blocks, upload media, organize categories, tags and menus, moderate comments and look up users.<\/li>\n<li><strong>Undo and redo<\/strong>: every change made by an agent is written to a journal first, so almost everything can be undone from the Activity screen or by asking your agent.<\/li>\n<li><strong>You stay in charge<\/strong>: safe mode makes the agent confirm before it deletes or undoes something. Turn on the approval queue and publishing waits for you in wp-admin, with a before and after of each change.<\/li>\n<li><strong>Content, never administration<\/strong>: the agent works with your content permissions only. Whatever your role, it never changes site settings, users, plugins, themes or code, and never writes unfiltered HTML.<\/li>\n<li><strong>Bring your own AI<\/strong>: works with ChatGPT, claude.ai, Claude Desktop, Claude Code, Codex, Cursor, OpenCode and Antigravity CLI. Llamly has no AI of its own and no usage meter: the agent you already pay for does the work.<\/li>\n<li><strong>Your data stays on your site<\/strong>: self-hosted, no account, no relay, no telemetry. Your AI app connects to your site, and Llamly never calls out.<\/li>\n<li><strong>Ready in a few minutes<\/strong>: a step-by-step recipe for each app with your site address already filled in, an \"Add to Claude\" button, and a Doctor that checks your server and tells you what to ask your host.<\/li>\n<\/ul>\n\n<p>Ask things like \"publish the three drafts about our new service\", \"find every image without alt text and fill it in\", \"add a FAQ section to the pricing page\", \"move Contact to the end of the main menu\" or \"undo the last change you made\", and your agent does it on your site.<\/p>\n\n<h4>What is a WordPress MCP server?<\/h4>\n\n<p>MCP (Model Context Protocol) is the open standard AI apps use to work with other software. A WordPress MCP server gives ChatGPT, Claude or any MCP-capable agent a set of typed, permission-checked actions on your site, such as publishing a post or updating a menu, instead of you copying and pasting between a chat window and wp-admin. Llamly MCP is that server, installed like any other plugin.<\/p>\n\n<h4>What your agent can do<\/h4>\n\n<ul>\n<li><strong>Content<\/strong>: posts, pages and public custom post types: list, read, create, update, trash, revisions and restore of a revision.<\/li>\n<li><strong>Gutenberg<\/strong>: read any page as a block tree and edit blocks in one atomic batch; patterns, templates and template parts, and global styles on block themes (custom CSS stays in the Site Editor and is never changed by Llamly).<\/li>\n<li><strong>Media<\/strong>: upload files, edit titles, captions and alt text, delete media.<\/li>\n<li><strong>Site structure<\/strong>: categories, tags and other taxonomies, menus and navigation, comments, and users (read only, within your role).<\/li>\n<li><strong>Site information<\/strong>: name, addresses, WordPress and PHP versions, theme, locale and limits.<\/li>\n<li><strong>Elementor<\/strong>: when Elementor is installed, read pages, templates, widgets and global styles (read only).<\/li>\n<li><strong>WordPress Abilities API<\/strong>: on WordPress versions with the Abilities API, Llamly tools can also be exposed as abilities (off by default), with the same permissions and approval rules.<\/li>\n<\/ul>\n\n<h4>Connect ChatGPT to WordPress<\/h4>\n\n<p>ChatGPT signs in with OAuth, so no key is needed. On chatgpt.com, turn on Developer mode in Settings &gt; Security and login, add a custom MCP server with your Llamly endpoint as the server URL and OAuth authentication, then approve access on your site. Needs a ChatGPT plan with developer mode (Plus, Pro, Business, Enterprise or Edu) and your site on a public HTTPS address.<\/p>\n\n<h4>Connect Claude to WordPress (claude.ai and Claude Desktop)<\/h4>\n\n<p>Click \"Add to Claude\" in the Llamly recipe, review the request on your site, choose read only or read and write, and click Approve access. The same connector shows up in Claude Desktop on the same account. Needs a public HTTPS address; for a site on your computer, Claude Desktop uses the local bridge shown in the recipe.<\/p>\n\n<h4>Connect Claude Code, Codex, Cursor, OpenCode and Antigravity CLI<\/h4>\n\n<p>Create an access key in the Llamly recipe and paste the ready-made command. For Claude Code:<\/p>\n\n<pre><code>claude mcp add --transport http my-site https:\/\/your-site.example\/wp-json\/llamly\/v1\/endpoint --header \"Authorization: Bearer YOUR_KEY\"\n<\/code><\/pre>\n\n<p>The Connections tab shows the exact command or config for each app, with your endpoint filled in. These apps also work with a local WordPress site, with no public address needed.<\/p>\n\n<h4>Safe by design<\/h4>\n\n<p>You are handing an AI real access to your site, so Llamly is built to keep you in charge:<\/p>\n\n<ul>\n<li><strong>Change journal with undo and redo<\/strong>: before-state snapshots of every change, undo from Activity or by the agent (<code>wp_undo_change<\/code> \/ <code>wp_redo_change<\/code>), newest first in batches, and conflicts with later human edits are reported instead of overwritten.<\/li>\n<li><strong>Safe mode<\/strong> (on by default): the agent must show you what it will do and repeat the call with <code>confirm: true<\/code> before it deletes or trashes something, undoes a change, makes a destructive redo or takes an irreversible action. The agent controls that flag, so it is a brake and not a security boundary.<\/li>\n<li><strong>Content permissions only<\/strong>: every agent request runs under a capability ceiling. The key or OAuth grant acts as its WordPress user for content, but never with administrator capabilities (site settings, users, plugins, themes, code files, import and export, unfiltered HTML), whatever that user's role. All markup the agent writes goes through the WordPress content filter: scripts, styles, iframes, inline event handlers, <code>javascript:<\/code> links and Custom HTML blocks are refused or removed.<\/li>\n<li><strong>Approval queue<\/strong> (optional): holds publishing or changing anything visitors see until a human approves it in wp-admin. Requests expire after 7 days, and the agent cannot approve its own request.<\/li>\n<li><strong>Access control<\/strong>: each key can have full access, read only access or chosen tool categories; OAuth connections are read only or read and write. Keys and tokens are stored hashed and can be revoked at any time.<\/li>\n<li><strong>Audit log and limits<\/strong>: every MCP request is logged, with rate limiting per connection (120 requests per minute by default) and an origin allowlist.<\/li>\n<li><strong>One gate for every write<\/strong>: input schema, your WordPress capabilities, the scope of the connection, the policy above, a durable snapshot and a revision check before anything changes.<\/li>\n<\/ul>\n\n<p>Undo brings content back, but it cannot take back effects outside your database such as caches and CDNs. See Limitations below.<\/p>\n\n<h4>What Llamly does not do<\/h4>\n\n<p>No arbitrary SQL, shell, WP-CLI or file editing; no site settings, user changes or server logs; no installing, updating or switching plugins and themes; no fetching of remote URLs; no writing to Elementor. Llamly has no internal AI chat and does not send your content to any AI provider: the AI app you connect calls your site, not the other way around.<\/p>\n\n<h4>Requirements<\/h4>\n\n<ul>\n<li>WordPress 6.2 or newer and PHP 8.0 or newer (tested up to WordPress 7.1).<\/li>\n<li>MySQL 5.7.8 or newer, or MariaDB 10.3 or newer, with InnoDB tables. Not supported for writes: Galera clusters (<code>wsrep_on=ON<\/code>) and a custom <code>wp-content\/db.php<\/code> drop-in.<\/li>\n<li>The database user must be allowed to use <code>GET_LOCK()<\/code> and to run <code>SET SESSION TRANSACTION ISOLATION LEVEL<\/code>. Llamly sets REPEATABLE READ for each write and restores the previous level, so the host default does not need to change.<\/li>\n<li><code>innodb_flush_log_at_trx_commit<\/code> must be 1 or 2. Value 1 is fully durable; with 2 an operating system crash or power loss can lose about one second of committed changes, including journal entries. Value 0 is refused.<\/li>\n<li><code>max_allowed_packet<\/code> of 16 MB or more is recommended; large changes can be refused below that.<\/li>\n<li>A persistent object cache such as Redis is supported.<\/li>\n<li>OAuth apps (claude.ai, ChatGPT, Claude Desktop remote) need your site on a public HTTPS address.<\/li>\n<\/ul>\n\n<p>The <strong>Doctor<\/strong> in the Connections tab (Run checks) tests these requirements on your server and tells you what to ask your host for.<\/p>\n\n<h4>Tested apps<\/h4>\n\n<p>Tested end to end with Claude Code, Codex, OpenCode, claude.ai, ChatGPT, Claude Desktop (cloud connector), Cursor (access key) and Antigravity CLI. Recipes are included, and testing is under way, for Cursor sign-in and the Claude Desktop local bridge. If a recipe does not work for you, please tell us in the support forum.<\/p>\n\n<h4>Admin screens<\/h4>\n\n<p>One Llamly menu with five tabs: Connections (connected apps, recipes and the Doctor), Activity (change history with undo and redo and approval requests), Logs (filterable audit log with CSV export), Settings and About (getting started and example requests). The interface is in English and can be translated on translate.wordpress.org; wp-admin and the OAuth sign-in page follow each user's language.<\/p>\n\n<h4>Credits and licenses<\/h4>\n\n<p>Llamly is GPLv2 or later. Its connection recipes, OAuth flow and transport were modelled on Cowboy MCP (GPL-2.0-or-later); interface icons come from Lucide (ISC) and client marks from Simple Icons (CC0) and OpenCode (MIT). Details are in THIRD-PARTY-NOTICES.txt inside the plugin.<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>Llamly stores, in your WordPress database:<\/p>\n\n<ul>\n<li><strong>Connections<\/strong>: name, scope, owner user, creation and last-use time of each key and OAuth client. Keys and tokens are stored only as hashes.<\/li>\n<li><strong>Audit log<\/strong>: one row per MCP request with time, connection, user, tool, result and the request IP address. Kept for 30 days by default (configurable from 1 to 365 days); you can clear or export it from Logs.<\/li>\n<li><strong>Change journal<\/strong>: before and after snapshots of each object an agent changed, used for undo and redo. Snapshots contain the fields of the changed object, which can include personal data such as a comment author's name, email, IP address and user agent; passwords, sessions and application passwords are never stored. Kept for 7 days by default (configurable from 1 to 90 days). Snapshots of deleted media files are kept in <code>wp-content\/uploads\/llamly-mcp\/<\/code> for the same period.<\/li>\n<\/ul>\n\n<p>There is no Llamly server: the AI app you connect sends its requests straight to your site, and each request acts with the content permissions of the user who created the key or approved the OAuth sign-in, never administrator ones.<\/p>\n\n<p>Expired rows are removed by a daily WordPress cron event. Llamly sets no cookies on the public site, adds no tracking, and makes no external requests at runtime. Links in the admin that open claude.ai or chatgpt.com only open those sites in your browser when you click them.<\/p>\n\n<h3>Source code<\/h3>\n\n<p>Every JavaScript and CSS file in this plugin is its own human-readable source, not minified and not generated: there is no build step. <code>assets\/free\/js\/admin.js<\/code> (the admin screens), <code>assets\/free\/js\/editor-guard.js<\/code> (block editor guard) and <code>assets\/free\/js\/icons.js<\/code> (the SVG markup of the icons, from Lucide and Simple Icons, see THIRD-PARTY-NOTICES.txt) are loaded as they are, and the CSS in <code>assets\/free\/css\/<\/code> likewise. The PHP code is in <code>src\/Free\/<\/code>.<\/p>\n\n<h3>Limitations<\/h3>\n\n<ul>\n<li><strong>One undo and redo cycle.<\/strong> A change can be undone once and redone once. A repeated undo returns <code>already_undone<\/code>.<\/li>\n<li>Undo works while the snapshot of a change is retained (7 days by default). After that the Activity screen shows why a change can no longer be undone.<\/li>\n<li>Private meta fields of other plugins and meta derived from other data (for example values a plugin recalculates on save) are left as they are; undo does not rewrite them.<\/li>\n<li><strong>Editors and other REST clients.<\/strong> After the agent has edited a post, page, custom post type, navigation menu, template or template part, a save over the REST API is refused with 409 until the client reads the item with <code>context=edit<\/code> and sends its <code>llamly_edit_token<\/code> in the <code>X-Llamly-Edit-Token<\/code> header. The block editor does this for you. The mobile app and other REST clients that send no token get the error until they reload the item. Items the agent never changed need no token. Not guarded: XML-RPC, the quick edit and bulk edit of the posts list, and plugin-specific REST APIs that write the same post (for example WooCommerce products). You can disable XML-RPC.<\/li>\n<li><strong>Upload size.<\/strong> One <code>wp_upload_media<\/code> call carries a file of up to about 693 KB, because the whole request is limited to 1 MiB. Over the limit the agent gets a clear error and a request larger than 1 MiB is refused with HTTP 413.<\/li>\n<li>Elementor support is read only.<\/li>\n<li>Llamly coordinates with the block editor, but a person saving the same post at the same moment as an agent may get a conflict that must be resolved by reloading.<\/li>\n<li>The agent can delete to the trash only; permanent deletion of posts is not offered.<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Install Llamly MCP from Plugins &gt; Add New, or upload the ZIP in Plugins &gt; Add New &gt; Upload Plugin.<\/li>\n<li>Activate it. Llamly creates its own database tables on activation.<\/li>\n<li>Open <strong>Llamly<\/strong> in the admin menu. The Connections tab lists the supported apps and shows the recipe for each one with your site address already filled in.<\/li>\n<\/ol>\n\n<p>Your MCP endpoint is <code>https:\/\/your-site.example\/wp-json\/llamly\/v1\/endpoint<\/code>. OAuth discovery is published at <code>\/.well-known\/oauth-protected-resource<\/code> and <code>\/.well-known\/oauth-authorization-server<\/code> on your site root.<\/p>\n\n<p><strong>Apps that sign in with OAuth (claude.ai, Claude Desktop, ChatGPT, Cursor)<\/strong><\/p>\n\n<p>OAuth needs your site on a public HTTPS address. New OAuth clients can only register while the registration window is open: the recipe opens it for 30 minutes when you start. Closing the window never disconnects existing apps, and an app that is already registered can reconnect at any time when an administrator approves the sign-in on your site. Other users can approve a sign-in only while the window is open.<\/p>\n\n<ul>\n<li><strong>claude.ai<\/strong>: click \"Add to Claude\" in the recipe (or, in claude.ai, go to Customize &gt; Connectors &gt; + Add &gt; Add custom connector and paste the endpoint). Claude opens a login page on your site; review the request, choose the access level and click Approve access. On Team and Enterprise plans an organization owner adds the connector first.<\/li>\n<li><strong>Claude Desktop (remote)<\/strong>: same connector as claude.ai; it shows up in the Desktop app on the same account.<\/li>\n<li><strong>ChatGPT<\/strong>: on chatgpt.com, enable Developer mode in Settings &gt; Security and login, then add a custom MCP server with the endpoint as server URL and OAuth authentication, and approve access on your site. Requires a ChatGPT plan with developer mode (Plus, Pro, Business, Enterprise or Edu); on Business and Enterprise an administrator enables it first.<\/li>\n<li><strong>Cursor (OAuth)<\/strong>: add <code>{ \"mcpServers\": { \"my-site\": { \"url\": \"&lt;endpoint&gt;\" } } }<\/code> to <code>~\/.cursor\/mcp.json<\/code> and approve access on your site when Cursor asks.<\/li>\n<\/ul>\n\n<p><strong>Apps that use an access key (Claude Code, Codex, Cursor, Antigravity CLI, OpenCode, Claude Desktop local bridge)<\/strong><\/p>\n\n<p>In the recipe, create a key: give it a name and choose full access, read only or chosen tool categories. The key acts as the WordPress user who created it, with that user's content permissions and never administrator ones. It is shown once.<\/p>\n\n<ul>\n<li><strong>Claude Code<\/strong>: <code>claude mcp add --transport http my-site &lt;endpoint&gt; --header \"Authorization: Bearer &lt;key&gt;\"<\/code>, then run <code>\/mcp<\/code> in a new session.<\/li>\n<li><strong>Codex<\/strong>: <code>export LLAMLY_API_KEY=\"&lt;key&gt;\"<\/code> (also in your shell profile), then <code>codex mcp add my-site --url &lt;endpoint&gt; --bearer-token-env-var LLAMLY_API_KEY<\/code>, then <code>\/mcp<\/code>.<\/li>\n<li><strong>Antigravity CLI<\/strong>: <code>agy mcp add --header \"Authorization: Bearer &lt;key&gt;\" my-site &lt;endpoint&gt;<\/code>. To remove it: <code>agy mcp remove my-site<\/code>.<\/li>\n<li><strong>OpenCode<\/strong>: add a remote server with <code>\"type\": \"remote\"<\/code>, <code>\"url\": \"&lt;endpoint&gt;\"<\/code>, <code>\"oauth\": false<\/code> and an <code>Authorization: Bearer &lt;key&gt;<\/code> header to <code>~\/.config\/opencode\/opencode.json<\/code> (or <code>opencode.json<\/code> in a project), then <code>opencode mcp list<\/code>.<\/li>\n<li><strong>Cursor (key)<\/strong>: add the server with <code>\"url\"<\/code> and an <code>Authorization: Bearer &lt;key&gt;<\/code> header to <code>~\/.cursor\/mcp.json<\/code> and restart Cursor.<\/li>\n<li><strong>Claude Desktop with a local site<\/strong>: cloud connectors cannot reach a site that runs on your computer. The recipe gives a <code>claude_desktop_config.json<\/code> entry that starts the open source <code>mcp-remote<\/code> bridge through <code>npx<\/code> (Node.js required) with your key. The key is stored in plain text in that file, so prefer a read-only key if you do not need edits.<\/li>\n<\/ul>\n\n<p>After the first request, the Connections tab marks the app as connected and the request appears in Logs.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"what%20is%20a%20wordpress%20mcp%20server%3F\"><h3>What is a WordPress MCP server?<\/h3><\/dt>\n<dd><p>A plugin that lets AI apps act on your site through the Model Context Protocol (MCP), the open standard that ChatGPT, Claude, Cursor and other agents use to call external tools. Llamly MCP turns your WordPress site into one of those tools, so your agent can publish, edit and organize things directly instead of telling you what to click.<\/p><\/dd>\n<dt id=\"how%20do%20i%20connect%20chatgpt%20to%20my%20wordpress%20site%3F\"><h3>How do I connect ChatGPT to my WordPress site?<\/h3><\/dt>\n<dd><p>Install Llamly MCP, open Llamly &gt; Connections and pick ChatGPT. On chatgpt.com, turn on Developer mode in Settings &gt; Security and login, add a custom MCP server with your Llamly endpoint and OAuth authentication, and approve access on your site. It needs a Plus, Pro, Business, Enterprise or Edu plan and a public HTTPS site.<\/p><\/dd>\n<dt id=\"how%20do%20i%20connect%20claude%20to%20my%20wordpress%20site%3F\"><h3>How do I connect Claude to my WordPress site?<\/h3><\/dt>\n<dd><p>For claude.ai and Claude Desktop, click \"Add to Claude\" in the Llamly recipe and approve the sign-in on your site, with no terminal and no key. For Claude Code, create a key in the recipe and run the one-line command shown there.<\/p><\/dd>\n<dt id=\"do%20i%20need%20an%20api%20key%20from%20openai%20or%20anthropic%3F\"><h3>Do I need an API key from OpenAI or Anthropic?<\/h3><\/dt>\n<dd><p>No. Llamly does not call any AI model. You use the AI app you already have, on its own plan, and that app connects to your site. Llamly only needs its own access key or an OAuth approval, both created inside your site.<\/p><\/dd>\n<dt id=\"is%20it%20free%3F\"><h3>Is it free?<\/h3><\/dt>\n<dd><p>Yes. This plugin is free and licensed GPLv2 or later. Llamly does not meter requests; the only limit is the rate limit per connection you set in Settings.<\/p><\/dd>\n<dt id=\"do%20i%20need%20a%20llamly%20account%3F\"><h3>Do I need a Llamly account?<\/h3><\/dt>\n<dd><p>No. There is no account and no sign-up. Everything runs inside your WordPress site.<\/p><\/dd>\n<dt id=\"do%20i%20need%20to%20be%20a%20developer%3F\"><h3>Do I need to be a developer?<\/h3><\/dt>\n<dd><p>No. Apps like ChatGPT and claude.ai connect with a click and an approval on your site, and from then on you just ask in plain language. Terminal apps such as Claude Code and Codex get a ready-to-paste command.<\/p><\/dd>\n<dt id=\"which%20ai%20apps%20work%20with%20it%3F\"><h3>Which AI apps work with it?<\/h3><\/dt>\n<dd><p>Any MCP client over Streamable HTTP. Recipes are included for ChatGPT, claude.ai, Claude Desktop, Claude Code, Codex, Cursor, OpenCode and Antigravity CLI.<\/p><\/dd>\n<dt id=\"is%20it%20safe%3F%20can%20the%20ai%20break%20my%20site%3F\"><h3>Is it safe? Can the AI break my site?<\/h3><\/dt>\n<dd><p>Almost every change is journaled and can be undone, safe mode makes the agent confirm before deleting or undoing, and the optional approval queue holds publishing for you. The agent works with content permissions only, never administrator ones. Keys can be read only, and every request is logged. See \"Safe by design\" above.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20elementor%3F\"><h3>Does it work with Elementor?<\/h3><\/dt>\n<dd><p>Yes, read only: the agent can read Elementor pages, templates, widgets and global styles, but Llamly never writes Elementor data.<\/p><\/dd>\n<dt id=\"does%20an%20outside%20service%20administer%20my%20site%3F\"><h3>Does an outside service administer my site?<\/h3><\/dt>\n<dd><p>No. There is no Llamly server or relay. The AI app you connect (ChatGPT, Claude, Codex, Cursor and others) sends requests straight to your site with an access key or an OAuth grant that a user of your site created, and you can revoke it at any time in Connections. Each request runs as that user with content permissions only: an administrator's key cannot change site settings, users, plugins, themes or code, and cannot write unfiltered HTML.<\/p><\/dd>\n<dt id=\"does%20llamly%20send%20my%20content%20anywhere%3F\"><h3>Does Llamly send my content anywhere?<\/h3><\/dt>\n<dd><p>No. Llamly makes no outbound calls to Llamly or to any third-party service at runtime. The AI app you connect sends requests to your site and receives the answers; what that app does with them is governed by its own terms. The connection diagnostics in Connections (Run checks) only call your own site (loopback) to check that the REST API, the MCP endpoint and the OAuth discovery URLs answer.<\/p><\/dd>\n<dt id=\"can%20the%20agent%20publish%20or%20delete%20things%20without%20me%3F\"><h3>Can the agent publish or delete things without me?<\/h3><\/dt>\n<dd><p>By default the agent can create, edit and publish without waiting for you, and every change is journaled, so almost everything can be undone in Activity. With safe mode on (the default) the agent must first show you what it will do and send <code>confirm: true<\/code> before it deletes or trashes something, before it undoes a change, before a redo that is destructive or irreversible, and before changes that cannot be undone. Llamly cannot create, change or delete users. Llamly cannot change site settings either. If you want to approve things yourself, turn on \"Require my approval to publish\" in Settings: those requests then wait for you in wp-admin.<\/p><\/dd>\n<dt id=\"why%20doesn%27t%20the%20history%20show%20%22changed%20outside%20llamly%22%3F\"><h3>Why doesn't the history show \"changed outside Llamly\"?<\/h3><\/dt>\n<dd><p>The Activity tab does not read the current state of every item, so it stays fast with a large history. If you edited an item in WordPress after the agent changed it, Llamly checks the real state when you click Undo and, if the item changed, warns you instead of overwriting your edit.<\/p><\/dd>\n<dt id=\"how%20long%20do%20approval%20requests%20last%3F\"><h3>How long do approval requests last?<\/h3><\/dt>\n<dd><p>Approval requests expire after 7 days. The agent must send a new request after that.<\/p><\/dd>\n<dt id=\"how%20do%20i%20disconnect%20an%20app%3F\"><h3>How do I disconnect an app?<\/h3><\/dt>\n<dd><p>In Connections, open the app's menu under Connected apps and click Revoke access. The next request with that token or key is rejected. Deactivating the plugin also stops every connection: the endpoint no longer exists while Llamly is inactive.<\/p><\/dd>\n<dt id=\"the%20doctor%20says%20the%20server%20can%27t%20reach%20its%20own%20address.\"><h3>The Doctor says the server can't reach its own address.<\/h3><\/dt>\n<dd><p>If the browser checks pass, this is shown as a warning, not a failure: AI apps connect from outside. Security and cache plugins (Wordfence, Solid Security, All In One WP Security, Sucuri, WP Rocket, W3 Total Cache, LiteSpeed Cache and others) are listed as a heads-up, since they sometimes restrict or cache REST requests.<\/p><\/dd>\n<dt id=\"which%20upload%20size%20can%20the%20agent%20send%3F\"><h3>Which upload size can the agent send?<\/h3><\/dt>\n<dd><p>Media uploads go through MCP as base64 in a single request that is limited to 1 MiB, so one <code>wp_upload_media<\/code> call carries a file of up to about 693 KB (or less if your PHP upload limit is lower). Text fields such as the caption travel in the same request; for long texts upload the file first and then call <code>wp_update_media<\/code>. Larger files are refused with a clear message.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20a%20local%20wordpress%20site%3F\"><h3>Does it work with a local WordPress site?<\/h3><\/dt>\n<dd><p>Yes for apps that run on your computer and use a key (Claude Code, Codex, Cursor, Antigravity CLI, OpenCode) and for Claude Desktop through the local bridge. claude.ai, ChatGPT and the Claude cloud connector need a public HTTPS address.<\/p><\/dd>\n<dt id=\"does%20it%20work%20on%20multisite%3F\"><h3>Does it work on multisite?<\/h3><\/dt>\n<dd><p>Connections, history and settings are kept per site.<\/p><\/dd>\n<dt id=\"what%20happens%20to%20my%20data%20when%20i%20delete%20the%20plugin%3F\"><h3>What happens to my data when I delete the plugin?<\/h3><\/dt>\n<dd><p>By default nothing is removed, so you can reinstall without losing connections, history and settings. If you turn on \"Delete data when deleting the plugin\" in Settings (it asks for confirmation), deleting the plugin removes Llamly's own tables, options, transients, user meta and the <code>uploads\/llamly-mcp<\/code> folder. Posts, pages, media, users and any other WordPress content are never removed by uninstall.<\/p>\n\n<p>Before an update that rewrites or removes existing data or columns in Llamly's tables, the previous tables are first copied to backup tables named <code>&lt;table&gt;_bak_v&lt;N&gt;<\/code>. Purely additive updates (new columns or tables) make no copy. The latest backups stay in the database as a safety net, and older ones are removed after a later verified update; deleting the plugin with \"Delete data when deleting the plugin\" turned on also removes them.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.3<\/h4>\n\n<ul>\n<li>The MCP endpoint checks the request origin and the caller's credential (Llamly API key or OAuth access token) in its REST permission callback, before the request reaches the MCP handler. Responses to clients are unchanged.<\/li>\n<li>Translations are no longer bundled: they come from translate.wordpress.org language packs.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Agent requests run under a capability ceiling: whatever the role of the connected user, MCP and Abilities requests never use administrator capabilities (site settings, users, plugins, themes, code files, import and export, network administration, unfiltered HTML).<\/li>\n<li>The content policy applies to every user, administrators included: scripts, styles, iframes, inline event handlers, <code>javascript:<\/code> links and Custom HTML blocks are refused or removed in posts, patterns, block edits and templates.<\/li>\n<li>Removed the tools that changed site options, read the PHP error log and ran Site Health. Option changes made with 1.0.1 can still be undone in Activity.<\/li>\n<li>The key creation step and the OAuth sign-in page say what the agent can and cannot do.<\/li>\n<li>The admin JavaScript, CSS and icons are formatted as readable source; new \"Source code\" section in this readme.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Users are read only: the tools that created, changed or deleted users were removed.<\/li>\n<li>Global styles: custom CSS is no longer accepted. Edit it in the Site Editor; Llamly keeps the CSS saved there as it is.<\/li>\n<li>Database restore points were removed. Existing restore points and their tables are deleted on update; use your host's backups to take the whole site back to an earlier moment.<\/li>\n<li>Plugin paths, request input and database queries follow the WordPress.org guidelines (plugin directory functions, sanitized input, prepared queries).<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<p>First public release on WordPress.org. It summarizes the changes since the 0.1.0 preview, which was never published here.<\/p>\n\n<ul>\n<li>New approval policy. By default nothing waits for approval and every change is journaled, almost all of it with undo. With safe mode on, the agent needs <code>confirm: true<\/code> to delete, trash, delete a restore point, undo, redo destructive or irreversible changes and for irreversible actions. An optional approval queue in Settings holds publishing or changing anything visitors see (content, comments, menus, templates, styles, media in use), users and settings for a human. A restore requested by an agent always needs a human.<\/li>\n<li>Hosting checks. Llamly verifies InnoDB, transaction isolation, durable commits, Galera and <code>db.php<\/code> drop-ins, <code>GET_LOCK<\/code> and PHP time limits before it writes, and the Doctor reports each one with what to ask your host.<\/li>\n<li>Restore points. Size limit of about 200 MB, a clearer confirmation (size, time estimate, what is kept), options and tables with secrets of other plugins are kept as they are now, and an automatic \"Before restoring\" point.<\/li>\n<li>Activity. The history is paginated in the database and approval requests show a before and after diff.<\/li>\n<li>Safer editing. The block editor and REST clients are protected from overwriting a change made by an agent.<\/li>\n<li>MCP. The server now sends usage instructions to the agent, tool annotations (a hint that only pure creations are non-destructive), English-only responses and a documented upload size limit.<\/li>\n<li>Admin. English tab URLs (old Portuguese links still redirect), a Doctor with security and cache plugin hints, and a Brazilian Portuguese translation.<\/li>\n<li>Keys can have full access, read only access or chosen tool categories; OAuth grants are read only or read and write.<\/li>\n<\/ul>","raw_excerpt":"Manage your site with ChatGPT, Claude or any AI subscription you already have. Free WordPress MCP server with undo and approvals.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/367971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=367971"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/dotrex"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=367971"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=367971"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=367971"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=367971"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=367971"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=367971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}