Token-optimized MCP gateway for WordPress: unified query/mutate tools cut context-window usage by up to 70% vs. per-operation APIs.

phuongwebo

WEBO MCP is a standalone MCP gateway for WordPress. It lets compatible clients call well-defined tools over REST using JSON-RPC, instead of scraping the admin or sharing broad credentials beyond what you intend.
What you get
<ul>
<li>Token-optimized unified tools: every domain exposes two abilities — <code>*-query</code> (all reads) and <code>*-mutate</code> (all writes) — with a single <code>action</code> discriminator. <code>tools/list</code> payload is up to 70% smaller than per-operation APIs, which means less of the model’s context window is consumed by tool schemas, lower cost per session, and fewer hallucinated tool names.</li>
<li>Primary router endpoint: <code>POST /wp-json/mcp/v1/router</code></li>
<li>Standard MCP-style flow: <code>initialize</code> → <code>tools/list</code> → <code>tools/call</code></li>
<li>Session lifecycle for clients (pass <code>session_id</code> or <code>Mcp-Session-Id</code> after <code>initialize</code>)</li>
<li>Built-in tool registry for common WordPress operations (posts, media, terms, menus, options, and more)</li>
<li>Bundled Abilities API + MCP Adapter integration, with automatic bridging from registered abilities to MCP tools (configurable)</li>
<li>WordPress 7.0/Core-aware bridge mode that uses Core Abilities/API surfaces when available and falls back only when needed</li>
<li>Public tool policy controls (category filters and optional allowlists) plus optional internal tool exposure for private environments</li>
<li>Bounded MCP audit log, optional per-user/role/client tool allowlists, and a read-only administrator health/status tool</li>
</ul>
Security model (high level)
<ul>
<li>MCP access requires a real WordPress user context: Application Password over HTTP Basic, or an existing logged-in session.</li>
<li>Optional site-wide or per-user API key and HMAC can be enabled in Settings as an additional gate (they do not replace WordPress authentication). Do not put the normal WEBO API key in URLs. For clients that cannot send headers, create a short-lived scoped <code>mcp_token</code> URL connector token in Settings -> WEBO MCP.</li>
<li>Default access expectations for the router and <code>GET /wp-json/webo-mcp/v1/tools</code>: users who are super admins, can <code>manage_options</code>, or can <code>edit_posts</code>, consistent with typical site operator and editor workflows (filterable).</li>
</ul>
Client guidance
Always discover tools before calling them: run <code>tools/list</code>, pick an exact tool name from the response, validate required arguments, then call <code>tools/call</code>. This reduces mistakes and keeps automation predictable in production.
Further documentation and optional integrations
<ul>
<li>Project documentation and ecosystem notes: https://webomcp.com</li>
<li>Optional n8n community node (separate package): https://www.npmjs.com/package/n8n-nodes-webo-mcp</li>
<li>Release notes and migration map: see docs/RELEASE_NOTES_2.1.0.md and docs/MIGRATION_GUIDE_2.1.0.md in the GitHub repository</li>
<li>Cross-addon dispatcher map (granular legacy names removed from discovery): docs/MCP_TOOL_MIGRATION.md</li>
</ul>
Compatibility note: any MCP-capable client can be used; which large language model runs inside the client is outside this plugin.
Standalone core tools included: 
– Site info 
– Content (posts/pages): <code>webo/content-query</code> (list, get, find-by-url, search-replace, list-revisions, get-revision) and <code>webo/content-mutate</code> (create, update, delete, bulk-update-status, restore-revision) 
– Users: list 
– Media: <code>webo/media-query</code> (list, get) and <code>webo/media-mutate</code> (upload, update, delete) 
– Comments: <code>webo/comment-query</code> (list, get) and <code>webo/comment-mutate</code> (update, delete) 
– Taxonomy/Terms: <code>webo/taxonomy-query</code> (discover, list, get) and <code>webo/taxonomy-mutate</code> (create, update, delete) 
– Nav menus: list menus, list menu items (menu_order, db_id), add menu link from post (explicit post_id + menu_order required) 
– Plugins: <code>webo/plugin-query</code> (installed, active, updates, …) and <code>webo/plugin-mutate</code> (install, activate, deactivate; supports child-site <code>site_id</code> / <code>blog_id</code> activation for network admins) 
– Health: <code>webo/health-status</code> (REST/router status, Application Password support, permalinks, cron, object cache, plugin update summary, WordPress/PHP versions, and redacted MCP config) 
– Abilities bridge: <code>webo/ability-query</code> and <code>webo/ability-execute</code> in default layered mode. Only abilities with <code>meta.mcp.public === true</code> are visible and executable through WEBO MCP. 
– Themes: <code>webo/theme-query</code> (installed themes) and <code>webo/theme-mutate</code> (install from WordPress.org by slug, switch installed theme) 
– Menus: <code>webo/menu-query</code>, <code>webo/menu-mutate</code> (navigation menu items; not post/CPT list order) 
– Post/CPT order (optional): <code>webo/reorder-query</code>, <code>webo/reorder-mutate</code> when <a href="https://github.com/mrphuong-webo/webo-reorder" rel="nofollow ugc">Webo Reorder</a> is active — see docs/abilities/reorder.md 
– Options: get/update (safe allowlist only), set site icon/favicon from media 
– SEO (WordPress post): seo/article-analysis — requires post_id; merges Rank Math meta when available (same data path as webo-rank-math/get-post-seo-meta); optional related-keyword suggestions via outbound request unless no_autocomplete is true
Excluded by default in standalone-safe mode: 
– Bulk/mass execution tools 
– Plugin/theme write-management abilities 
– Multisite-specific abilities
<h3>Privacy</h3>
This plugin does not phone home or send telemetry. MCP traffic is initiated by clients you configure. Some tools may perform outbound HTTP requests only when a client invokes them (for example seo/article-analysis may request keyword suggestions from a third-party suggest API unless you pass no_autocomplete).
The plugin stores the following options in the WordPress database when configured: 
– <code>webo_mcp_api_key</code>: API key used to authenticate MCP requests. 
– <code>webo_mcp_hmac_secret</code>: HMAC secret used to sign and validate MCP requests. 
– <code>webo_mcp_url_connector_tokens</code>: hashed, expirable, revocable URL connector tokens for clients that cannot send headers. Raw tokens are shown once and are not stored. 
– <code>webo_mcp_tool_allowlist_enabled</code> and <code>webo_mcp_tool_allowlist_rules</code>: optional administrator-configured MCP tool allowlist policy. 
– <code>webo_mcp_audit_log_enabled</code>, <code>webo_mcp_audit_log_max_entries</code>, and <code>webo_mcp_audit_log</code>: bounded MCP tool-call audit log settings and compact audit events. Audit entries include user/tool/action/status data, anonymized IPs, and hashed session IDs; they do not store request payloads, API keys, HMAC secrets, or Application Passwords.
These options are removed when the plugin is uninstalled via the WordPress Plugins screen.
<h3>External services</h3>
This plugin can connect to Google Suggest (Autocomplete) when a client calls the <code>seo/article-analysis</code> tool and does not set <code>no_autocomplete</code> to true. This external request is used to return related keyword suggestions for SEO analysis.
Service provider: Google LLC (Google Suggest / Autocomplete API endpoint).
Data sent and when: 
– Sent only when <code>seo/article-analysis</code> is called with autocomplete enabled. 
– Sends the analysis query text to <code>https://suggestqueries.google.com/complete/search</code> as the <code>q</code> parameter. 
– Sends standard HTTP request metadata such as IP address and User-Agent as part of the web request.
Terms of Service: https://policies.google.com/terms 
Privacy Policy: https://policies.google.com/privacy
<h3>Developer Hooks</h3>
The plugin exposes the following actions and filters for developers:
<h3>Actions</h3>
<ul>
<li><code>webo_mcp_register_tools</code> 
Fired during plugin bootstrap after standalone tools are registered. Use this to register custom MCP tools from other plugins.</li>
</ul>
<h3>Filters</h3>
<ul>
<li>
<code>webo_mcp_current_user_can_use_mcp</code> (bool $allowed, int $user_id) 
Gate for all MCP REST access. Default: super admin OR <code>manage_options</code> OR <code>edit_posts</code>. Override to tighten (e.g. super-admin only) in hardened installs.
</li>
<li>
<code>webo_mcp_allow_internal_tools</code> (bool $allow_internal, WP_REST_Request $request) 
Controls whether internal tools are included in tools/list responses. Defaults to false for public environments.
</li>
<li>
<code>webo_mcp_public_categories</code> (array $categories, WP_REST_Request $request, array $tool) 
Filters which tool categories are exposed as public. Defaults to array( ‘wordpress’ ).
</li>
<li>
<code>webo_mcp_public_tool_allowlist</code> (array $names, WP_REST_Request $request, array $tool) 
Optional allowlist of specific tool names that are always considered public.
</li>
<li>
<code>webo_mcp_bridge_deny_patterns</code> (array $patterns) 
Controls which abilities are excluded when auto-bridging abilities into MCP tools (e.g. bulk, plugins/, themes/, multisite/).
</li>
<li>
<code>webo_mcp_auto_bridge_abilities</code> (bool $enabled) 
Enables or disables automatic bridging of registered abilities into MCP tools. Defaults to true; bridge mode still controls whether the bridge is off, layered, or full.
</li>
<li>
<code>webo_mcp_bridge_mode</code> (string $mode) 
Controls Abilities bridge mode after the <code>WEBO_MCP_BRIDGE_MODE</code> constant and before the stored option. Values: <code>off</code>, <code>layered</code>, <code>full</code>. Default: <code>layered</code>.
</li>
<li>
<code>webo_mcp_enable_adapter</code> (bool $enabled) 
Enables or disables the bundled WordPress MCP Adapter runtime. Defaults to true.
</li>
<li>
<code>webo_mcp_validate_media_fetch_url</code> (true|\WP_Error $ok, string $url, array $parsed) 
Reject unsafe URLs for webo/media-mutate upload action (return WP_Error to block).
</li>
<li>
<code>webo_mcp_tool_allowlist_allowed</code> (bool $allowed, string $tool_name, WP_REST_Request $request, array $params, array $allowed_tools) 
Filters the optional per-user/role/client allowlist decision.
</li>
</ul>
<h3>Credits</h3>
Special thanks to the authors and open source projects that contributed to this plugin: 
– WordPress (https://wordpress.org) 
– Abilities API (https://github.com/WordPress/abilities-api) 
 Reference: https://make.wordpress.org/ai/2025/07/17/abilities-api/ 
– MCP Adapter (https://github.com/WordPress/mcp-adapter) 
 Reference: https://make.wordpress.org/ai/2025/07/17/mcp-adapter/ 
– Composer (https://getcomposer.org) 
– Other PHP and JS libraries from the community
If you use this plugin, please give credit to the authors of these libraries.
<h3>License</h3>
This plugin is licensed under the GPLv2 or later. 
See https://www.gnu.org/licenses/gpl-2.0.html for details.

Alternatives to WEBO MCP

Top alternatives