Piyush Asthana

<p>ActivityPilot is an activity log and audit-trail plugin for developers, agencies, and security-conscious site owners. Meaningful changes on your site — logins, content edits, plugin and theme operations, role changes, high-impact options, integrations, and more — are stored in a dedicated database table and shown in a modern admin timeline.</p>
<h4>Privacy defaults</h4>
<ul>
<li>External-service features are <strong>opt-in</strong>.</li>
<li>Geolocation (<code>ip-api.com</code>) is <strong>disabled by default</strong> (<code>enable_geo = 0</code>).</li>
<li>Outbound webhooks (Slack/Discord/Teams/custom URL) are <strong>disabled by default</strong> until you enable them and provide destination URLs.</li>
<li>The plugin does not send data to third-party services unless you explicitly enable and configure those features.</li>
</ul>
<h4>Why use this plugin?</h4>
<ul>
<li><strong>Custom tables</strong> — logs live in <code>{prefix}apwpm_activity_logs</code> (not post meta) with indexes for fast queries.</li>
<li><strong>Modern admin UI</strong> — dashboard, timeline, filters, search, pagination, exports, dark mode, and keyboard shortcuts.</li>
<li><strong>Security-first</strong> — capability checks, REST nonces, prepared SQL, output escaping, and optional sudo mode for destructive actions.</li>
<li><strong>Break detection</strong> — spots error spikes and surfaces recent risky changes.</li>
<li><strong>Extensible</strong> — REST API (<code>activitypilot/v1</code>), hooks, custom event registry, and PSR-3 adapter.</li>
</ul>
<h4>Core features</h4>
<ul>
<li>Activity logging for logins, posts, plugins, themes, users, roles, and important site options</li>
<li>Timeline view with avatars, severity colors, and structured context</li>
<li>Filters by user, action, object type, severity, date range, status, assignee, and search</li>
<li>CSV and JSON exports; daily retention pruning via cron</li>
<li>Email alerts when break detection finds unusual error activity</li>
<li>Workflow: acknowledge, resolve, snooze, assign, and comment on events</li>
<li>Smart insights: bursts, off-hours access, role escalation, and statistical spikes</li>
<li>Optional rollback for supported change types (sudo-gated)</li>
<li>Analytics heatmap, hour-of-day chart, and top users</li>
<li>Scheduled HTML digest reports (daily, weekly, monthly)</li>
<li>Multisite support with per-site tagging and network overview</li>
<li>Hash-chain integrity verification (optional)</li>
<li>File integrity monitoring, IP throttle, PII redaction, GDPR export/erase helpers</li>
<li>Integrations: WooCommerce, ACF, popular form builders, SEO plugins, page builders</li>
<li>Optional outbound webhooks (Slack, Discord, Microsoft Teams, generic URL)</li>
<li>WP-CLI: <code>wp apwpm list|count|verify|prune|purge|export|digest|scan-files</code></li>
</ul>
<h4>For developers</h4>
<p>Log custom events from your code:</p>
<pre><code>APWPM_Logger::log( array( 'action_type' => 'my_event', 'description' => 'Something happened' ) );
</code></pre>
<p>Filter hooks include <code>apwpm_skip_log</code>, <code>apwpm_pre_insert_row</code>, and <code>apwpm_register_event_types</code>. The shorter <code>ap_*</code> hook names from earlier builds are still fired for backward compatibility.</p>
<h3>External services</h3>
<p>This plugin can connect to third-party services <strong>only when you enable the related feature</strong> and, for webhooks, when you provide URLs.</p>
<h4>IP geolocation (optional)</h4>
<p>When <strong>Enable geolocation</strong> is on, the plugin may send the visitor IP address to <a href="http://ip-api.com/" rel="nofollow ugc">ip-api.com</a> to resolve country and city. No API key is required. Results are cached in WordPress transients (about 24 hours). See the <a href="https://ip-api.com/docs/legal" rel="nofollow ugc">ip-api privacy policy</a> for their terms.</p>
<ul>
<li>Data sent: IP address (in the request URL).</li>
<li>When: On log insert for events that include an IP, if geo is enabled and not already set.</li>
<li>Purpose: Display country/city on timeline rows and detect logins from new countries.</li>
</ul>
<h4>Outbound webhooks (optional)</h4>
<p>When webhooks are enabled and URLs are saved in settings, the plugin sends HTTP POST requests to <strong>your</strong> endpoints (for example Slack, Discord, Microsoft Teams, or a custom URL) when qualifying events occur.</p>
<ul>
<li>Data sent: Event title, description, severity, site name, and related metadata you configure to receive.</li>
<li>When: After an event is logged that meets your minimum severity threshold.</li>
<li>Purpose: Notify external chat or monitoring systems.</li>
<li>Services/endpoints: Slack, Discord, Microsoft Teams, or any custom HTTPS endpoint that you explicitly configure.</li>
<li>Terms/privacy (when using those services):<br />
Slack: https://slack.com/terms-of-service , https://slack.com/privacy-policy<br />
Discord: https://discord.com/terms , https://discord.com/privacy<br />
Microsoft Teams (Microsoft): https://www.microsoft.com/servicesagreement , https://privacy.microsoft.com/privacystatement</li>
</ul>
<p>Webhook delivery is fully optional and disabled by default. No webhook requests are sent until you enable webhooks and provide at least one destination URL.</p>
<p>The plugin does not include bundled third-party API keys. Geolocation and webhooks are optional and disabled by default until configured by a site administrator.</p>


ActivityPilot

Track, visualize, and analyze admin and user activity in a timeline UI with break detection, workflows, REST API, and exportable audit logs.

Riaan K.

<p>AI agents are starting to talk to WordPress sites directly. Claude Desktop, ChatGPT custom GPTs, and a growing list of MCP clients can connect to your site, browse content, place orders, edit posts, or call any custom tool you expose. The Model Context Protocol (MCP) is the open standard that makes this possible.</p>
<p>The problem: by default, you can’t see any of it. Requests come in, things change, and there’s no record of what an agent actually did, when it did it, or which user it acted as.</p>
<p>Activity Log for MCP records every MCP request the moment it hits your site. You see the route, the ability that was called, the user it acted as, the request body, the response, and whether it succeeded. Everything is browsable in a clean React admin page that feels like the rest of WordPress.</p>
<p>If you’re running an AI integration, debugging a custom MCP server, or just want a paper trail before letting agents touch your data — this is the visibility layer.</p>
<h4>What you get</h4>
<p>A real-time log of every MCP request, with filters for date range, ability name, and user. Click any row to inspect the full request and response, copy bodies to your clipboard, or trace a single agent session end-to-end. Sortable columns, configurable per-page counts (10 to 500), and full-text search across request and response bodies. Export to CSV when you need to share findings or feed them into another tool.</p>
<p>The whole interface is built with <code>@wordpress/components</code> so it inherits the WordPress design language — no jarring custom UI to learn.</p>
<h4>Built for both halves of the audience</h4>
<p>If you’re a site owner: install, activate, and click into Tools <span aria-hidden="true" class="wp-exclude-emoji">→</span> MCP Logs. There’s no setup screen and no configuration — the plugin starts logging the moment an MCP client makes a request.</p>
<p>If you’re a developer: there’s a full REST API for every admin feature, authenticated via WordPress Application Passwords or WooCommerce API keys. The plugin is also itself MCP-aware — it registers an MCP server with seven abilities, so an AI agent can introspect its own activity log programmatically. Source ships under <code>src/</code> and builds with <code>npm run build</code>.</p>
<h4>Why you’d want this</h4>
<ul>
<li>Debug a custom MCP integration without tailing server logs</li>
<li>Audit AI agent activity on production sites before something goes wrong</li>
<li>Review per-tool error rates to spot which abilities are flaky</li>
<li>Trace a single agent session end-to-end when something breaks</li>
<li>Export logs for compliance reviews or external analysis</li>
<li>Let an AI agent monitor its own activity through the MCP server</li>
</ul>
<h4>REST API</h4>
<p>Every admin feature is exposed under <code>/wp-json/activity-log-for-mcp/v1/</code>:</p>
<ul>
<li><code>GET /requests</code> — list with filters, sort, and pagination</li>
<li><code>GET /stats</code> — totals, success rate, and calls per ability</li>
<li><code>GET /sessions/{id}</code> — every request in a session, in order</li>
<li><code>GET /search</code> — full-text across routes, abilities, and bodies</li>
<li><code>GET /errors</code> — recent failed executions and HTTP errors</li>
<li><code>GET /tool-performance</code> — per-ability call count, error rate, and unique users</li>
<li><code>GET /filters</code> — distinct ability names and users for dropdowns</li>
<li><code>GET /export-csv</code> — server-side streamed CSV download</li>
<li><code>DELETE /requests</code> — clear all logs</li>
<li><code>DELETE /retention</code> — delete logs older than a given date</li>
</ul>
<h4>MCP abilities</h4>
<p>The plugin registers itself as an MCP server (<code>activity-log-for-mcp-server</code>) with seven abilities agents can call directly:</p>
<ul>
<li><code>get-activity</code> — paginated log retrieval with filters</li>
<li><code>get-stats</code> — summary metrics with optional date range</li>
<li><code>get-activity-by-session</code> — full session trace, with optional body exclusion for lighter payloads</li>
<li><code>search-activity</code> — full-text search across stored requests and responses</li>
<li><code>analyze-errors</code> — recent errors with full details</li>
<li><code>get-tool-performance</code> — per-ability performance metrics</li>
<li><code>clear-old-logs</code> — date-based retention cleanup</li>
</ul>
<h4>Privacy and data handling</h4>
<p>All data stays in your WordPress database — nothing is sent anywhere. Logs live in a custom table named <code>{prefix}alfmcp_requests</code>. You control retention and can clear everything from the admin UI or via REST. There’s no telemetry, no third-party calls, no external dependencies at runtime.</p>
<h4>Disclaimer</h4>
<p>Activity Log for MCP is not affiliated with, endorsed by, or sponsored any AI provider or the Model Context Protocol project. “MCP” and “Model Context Protocol” are referenced solely to describe the open protocol that this plugin observes.</p>
<h3>Privacy Policy</h3>
<p>Activity Log for MCP records REST API requests that contain the <code>Mcp-Session-Id</code> header. Logged data includes request routes, methods, headers, bodies, response data, user IDs, and timestamps. All data is stored in your WordPress database and is never transmitted to external services.</p>


Activity Log for MCP

See exactly what AI agents do on your WordPress site. A complete activity log for every Model Context Protocol (MCP) request.

ActivityPilot vs Activity Log for MCP