Deepak Gupta

<p>MCP Manager uses the standard <code>@automattic/mcp-wordpress-remote@latest</code> package with WordPress Application Passwords for the default remote flow. It also includes an optional experimental direct Claude Connectors mode backed by a WordPress-hosted OAuth approval flow.</p>
<p>MCP Manager is a WordPress plugin that enables seamless integration with Model Context Protocol (MCP) servers, allowing AI assistants and code editors to safely access your WordPress instance through secure application passwords.</p>
<h4>Key Features</h4>
<ul>
<li>
<p><strong>Multi-Client Support</strong>: Configure MCP for:</p>
<ul>
<li>VS Code with Copilot</li>
<li>Claude Desktop App</li>
<li>GitHub Copilot & Codex</li>
<li>OpenAI ChatGPT Codex</li>
<li>Custom MCP Clients</li>
</ul>
</li>
<li>
<p><strong>Secure Authentication</strong>: Uses WordPress native Application Passwords system</p>
<ul>
<li>One-click password generation</li>
<li>Secure credential management</li>
<li>Password revocation support</li>
<li>Per-server Access Control still enforced after authentication</li>
</ul>
</li>
<li>
<p><strong>Easy Configuration</strong>:</p>
<ul>
<li>Copy-paste ready JSON configurations</li>
<li>Per-provider configuration file paths</li>
<li>Automatic top-level key detection</li>
</ul>
</li>
<li>
<p><strong>Format #1 Standard</strong>: Uses the Automattic-recommended MCP configuration format</p>
<ul>
<li>npx command execution</li>
<li>@automattic/mcp-wordpress-remote@latest package</li>
<li>Full environment variable support</li>
</ul>
</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Navigate to Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> MCP Manager</li>
<li>Select your MCP client (VS Code, Claude, GitHub Copilot, ChatGPT, or Custom)</li>
<li>Click “Generate New Application Password”</li>
<li>Copy the ready-to-use JSON configuration</li>
<li>Paste into your client’s configuration file</li>
<li>Restart your MCP client</li>
</ol>
<p>All application passwords are managed through WordPress’s native Application Passwords system and appear in your profile under Account Management.</p>
<h4>CLI Connection and Authorization Flow</h4>
<p>MCP Manager also supports a browser-assisted CLI connection flow for local MCP clients.</p>
<p>Typical command:</p>
<pre><code>npx -y @acrossai/mcp-manager --siteurl=https://example.com --server=default-mcp-server
</code></pre>
<p>Flow summary:</p>
<ol>
<li>The CLI checks <code>/wp-json/acrossai-mcp-manager/v1/health</code></li>
<li>The CLI starts auth with <code>/wp-json/acrossai-mcp-manager/v1/auth/start</code></li>
<li>WordPress returns an <code>auth_code</code> and frontend <code>auth_url</code></li>
<li>The CLI opens the frontend approval page at <code>/acrossai-mcp-manager/</code></li>
<li>If needed, the user signs in through normal WordPress login</li>
<li>The signed-in user approves access in the browser</li>
<li>The CLI polls <code>/auth/status</code> until the request is approved</li>
<li>The CLI fetches the approved user’s accessible servers from <code>/servers</code></li>
<li>The CLI exchanges the approved code at <code>/auth/exchange</code></li>
<li>WordPress creates a one-time Application Password and the CLI writes the MCP client config</li>
</ol>
<p>Terminology:</p>
<ul>
<li><strong>Sign in / Log in</strong> = WordPress account authentication</li>
<li><strong>Connect</strong> = starting the CLI-to-site linking flow</li>
<li><strong>Authorize / Approve access</strong> = granting the CLI permission in the browser</li>
</ul>
<p>Important notes:</p>
<ul>
<li>The frontend authorization page must never be cached</li>
<li>Auth codes are single-use</li>
<li><code>/servers</code> and <code>/auth/exchange</code> respect per-server access control</li>
<li>User-facing copy should say <strong>CLI Connections</strong> rather than <strong>npm Login</strong></li>
<li>Generated remote MCP configs use Application Passwords and explicitly disable OAuth discovery in <code>@automattic/mcp-wordpress-remote</code></li>
</ul>
<h4>Experimental Direct Claude Connectors</h4>
<p>An optional <strong>Claude Connectors Screen (Experimental)</strong> setting can enable a direct OAuth flow for Claude’s hosted connectors.</p>
<p>When the global feature toggle is enabled and a specific server is configured in its <strong>Claude Connector</strong> tab, the plugin exposes:</p>
<ul>
<li><code>/.well-known/oauth-authorization-server</code></li>
<li><code>/.well-known/oauth-protected-resource?resource=<mcp-url></code></li>
<li><code>/acrossai-mcp-connectors/oauth/authorize/</code></li>
<li><code>/wp-json/acrossai-mcp-manager/v1/connector/oauth/token</code></li>
</ul>
<p>Important notes:</p>
<ul>
<li>Disabled by default</li>
<li>The Application Password flow remains available and supported</li>
<li>The master experimental toggle is global, but OAuth client settings are stored per server</li>
<li>Direct connector approval signs Claude in as a WordPress user</li>
<li>Per-server Access Control still applies to every MCP request after OAuth</li>
<li>Public HTTPS is recommended for hosted connector usage</li>
</ul>
<h4>Provider Configuration Paths</h4>
<ul>
<li><strong>VS Code</strong>: ~/.config/Code/User/globalStorage/Copilot.copilot-chat/mcp.json (top-level key: “servers”)</li>
<li><strong>Claude</strong>: ~/Library/Application Support/Claude/claude_desktop_config.json (top-level key: “mcpServers”)</li>
<li><strong>GitHub Copilot</strong>: ~/.gh-copilot/config.json (top-level key: “servers”)</li>
<li><strong>OpenAI ChatGPT</strong>: ~/.config/chatgpt/config.json (top-level key: “servers”)</li>
<li><strong>Custom</strong>: ./your-project/.mcp/config.json (top-level key: configurable)</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 5.9 or higher</li>
<li>PHP 7.4 or higher</li>
<li>WordPress Application Passwords support (built-in since WP 5.6)</li>
</ul>
<h3>Support & Contribution</h3>
<p>For issues, feature requests, or contributions, visit the plugin repository.</p>
<p>Questions? Check the FAQ section or look for documentation in the plugin settings page.</p>
<h3>Development</h3>
<p>This plugin follows WordPress coding standards and best practices:<br />
– PHP 7.4+ compatible<br />
– Full object-oriented architecture<br />
– Secure nonce verification<br />
– Proper capability checks<br />
– Sanitized input validation<br />
– Escaped output</p>
<h3>License</h3>
<p>This plugin is licensed under the GPL-2.0-or-later license. See LICENSE file for details.</p>
<h3>Credits</h3>
<p>MCP Manager is built with:<br />
– WordPress native APIs<br />
– Automattic’s MCP WordPress Remote package<br />
– WordPress Application Passwords system</p>
<p>Developed with ❤️ for the WordPress community.</p>


AcrossAI MCP Manager

Connect WordPress to MCP clients like VS Code, Claude, and Copilot using secure application passwords.

AI Engine – The Chatbot, AI Framework & MCP for WordPress vs AcrossAI MCP Manager