hamidxazad

Botailor ModelContext Integrator for AI is a powerful WordPress plugin that exposes selected posts and pages as AI-readable endpoints via the Model Context Protocol (MCP). This plugin provides a clean, secure way to make your WordPress content available to AI systems, external applications, and other services that need structured access to your content.
The plugin features granular permission control, allowing you to set specific permissions (Read, Write, Update, Delete) for each piece of content, ensuring your data remains secure while providing flexible access for authorized applications.
<h4>Features</h4>
<ul>
<li>Selective Content Exposure: Choose which posts and pages to expose via the API</li>
<li>Granular Permission Control: Set individual permissions (Read, Write, Update, Delete) for each content item</li>
<li>Full CRUD Operations: Create, Read, Update, and Delete posts and pages via API</li>
<li>REST API Endpoints: Clean, standardized endpoints under <code>/wp-json/mcia/v1/</code></li>
<li>Master Endpoint: List all available endpoints with <code>/wp-json/mcia/v1/endpoints</code></li>
<li>Manifest Endpoint: Auto-generated manifest at <code>/wp-json/mcia/v1/manifest</code> and <code>/.well-known/mcp-manifest.json</code></li>
<li>Admin Interface: Easy-to-use settings page with search, pagination, and bulk actions</li>
<li>Security: Built-in authentication, nonces, and capability checks</li>
<li>WooCommerce Filtering: Automatically excludes WooCommerce products and pages</li>
<li>Real-time Updates: Changes take effect immediately</li>
</ul>
<h4>API Endpoints</h4>
Read Operations: 
* <code>GET /wp-json/mcia/v1/manifest</code> – Get manifest (all exposed content) 
* <code>GET /wp-json/mcia/v1/endpoints</code> – List all available endpoints 
* <code>GET /wp-json/mcia/v1/{slug}</code> – Get individual content by slug
CRUD Operations (Require Authentication): 
* <code>POST /wp-json/mcia/v1/posts</code> – Create new post 
* <code>PUT /wp-json/mcia/v1/posts/{id}</code> – Update existing post 
* <code>DELETE /wp-json/mcia/v1/posts/{id}</code> – Delete post 
* <code>POST /wp-json/mcia/v1/pages</code> – Create new page 
* <code>PUT /wp-json/mcia/v1/pages/{id}</code> – Update existing page 
* <code>DELETE /wp-json/mcia/v1/pages/{id}</code> – Delete page
Well-known Endpoint: 
* <code>GET /.well-known/mcp-manifest.json</code> – Public manifest (no authentication required)
<h4>Response Format</h4>
Each content endpoint returns:
<pre><code>`json
</code></pre>
{ 
 “title”: “Page/Post title”, 
 “content”: “Page/Post content”, 
 “content_html”: “HTML formatted content”, 
 “description”: “Short description”, 
 “slug”: “content-slug”, 
 “type”: “post|page”, 
 “status”: “publish”, 
 “date”: “2024-01-01 00:00:00”, 
 “modified”: “2024-01-01 00:00:00”, 
 “author”: “Author Name”, 
 “featured_image”: “image-url”, 
 “meta”: {}, 
 “url”: “permalink” 
} 
 `
<h3>Testing the Plugin</h3>
<h3>Quick Test Setup</h3>
<ol>
<li>
Configure Authentication:
<ul>
<li>Go to Settings > Botailor ModelContext Integrator for AI</li>
<li>Set a username and password for API access</li>
<li>Save the credentials</li>
</ul>
</li>
<li>
Enable Content:
<ul>
<li>Select which posts/pages to expose</li>
<li>Set permissions (Read, Write, Update, Delete) for each item</li>
<li>Use bulk actions to enable multiple items at once</li>
</ul>
</li>
<li>
Test Read Operations: 
 `bash
Test manifest (no auth required)
curl “http://yoursite.com/.well-known/mcp-manifest.json”
Test authenticated manifest
curl -u “username:password” “http://yoursite.com/wp-json/mcia/v1/manifest”
Test individual content
curl -u “username:password” “http://yoursite.com/wp-json/mcia/v1/your-post-slug” 
 `
</li>
<li>
Test CRUD Operations: 
 `bash
Create a new post
curl -u “username:password” -X POST “http://yoursite.com/wp-json/mcia/v1/posts” \ 
 -H “Content-Type: application/json” \ 
 -d ‘{“title”: “Test Post”, “content”: “Test content”, “status”: “publish”}’
Update a post (replace {id} with actual post ID)
curl -u “username:password” -X PUT “http://yoursite.com/wp-json/mcia/v1/posts/{id}” \ 
 -H “Content-Type: application/json” \ 
 -d ‘{“title”: “Updated Title”, “content”: “Updated content”}’
Delete a post (replace {id} with actual post ID)
curl -u “username:password” -X DELETE “http://yoursite.com/wp-json/mcia/v1/posts/{id}” 
 `
</li>
<li>
Test Permission System:
<ul>
<li>Try to update/delete content that only has “Read” permission</li>
<li>Verify that operations are blocked with proper error messages</li>
<li>Test that content with appropriate permissions works correctly</li>
</ul>
</li>
</ol>
<h3>Expected Results</h3>
<ul>
<li>Manifest: Should list all exposed content with metadata</li>
<li>Individual Content: Should return full post/page data with permissions</li>
<li>CRUD Operations: Should respect permission settings and authentication</li>
<li>Error Handling: Should return clear error messages for unauthorized operations</li>
</ul>
<h3>Development</h3>
This plugin follows WordPress coding standards and best practices:
<ul>
<li>Proper sanitization and validation</li>
<li>Nonce verification for security</li>
<li>Capability checks for admin functions</li>
<li>Modular code structure with 4-letter prefix naming convention</li>
<li>Comprehensive error handling</li>
<li>Responsive admin interface</li>
<li>Granular permission system</li>
<li>Full CRUD operations with authentication</li>
</ul>
<h3>Support</h3>
Author: Hamid Azad 
GitHub: <a href="https://github.com/hamidhosenazad" rel="nofollow ugc">https://github.com/hamidhosenazad</a> 
Email: hamidxazad@gmail.com
For support, feature requests, or bug reports, please visit the plugin’s GitHub repository or contact the author directly.

Botailor ModelContext Integrator for AI

Expose selected posts & pages as AI-readable endpoints via the Model Context Protocol (MCP) with granular permission control and full CRUD operations.

Royal Plugins

Royal MCP is a security-first Model Context Protocol (MCP) server for WordPress. It gives AI platforms like Claude, ChatGPT, and Google Gemini structured access to your WordPress content — with authentication, rate limiting, and audit logging that most MCP implementations skip entirely.
According to <a href="https://mcpplaygroundonline.com/blog/mcp-server-security-complete-guide-2026" rel="nofollow ugc">recent security research</a>, 41% of public MCP servers have no authentication and respond to tool calls without any credentials. Royal MCP takes the opposite approach: every MCP session requires an API key, every request is rate-limited, and every interaction is logged.
<h4>Why Security Matters for MCP</h4>
MCP gives AI agents the ability to read, create, update, and delete your WordPress content. Without proper authentication, anyone who discovers your MCP endpoint can:
<ul>
<li>Read all your posts, pages, and media</li>
<li>Create or delete content</li>
<li>Access user data and plugin information</li>
<li>Overwhelm your server with rapid-fire requests</li>
</ul>
Royal MCP prevents all of this with API key authentication on session initialization, timing-safe key comparison, per-IP rate limiting (60 requests/minute), and a full activity log of every MCP interaction.
<h4>37+ MCP Tools Built In</h4>
WordPress Core (37 tools):
<ul>
<li>Posts — create, read, update, delete, search, count</li>
<li>Pages — full CRUD with parent page support</li>
<li>Media — library browsing, metadata, deletion</li>
<li>Comments — create (respects moderation settings), read, delete</li>
<li>Users — display names and roles (emails and usernames are not exposed)</li>
<li>Categories & Tags — create, assign, delete, count</li>
<li>Menus — list menus and menu items</li>
<li>Post Meta — read, update, delete custom fields</li>
<li>Site Info — site name, description, WordPress version, timezone</li>
<li>Plugins & Themes — list installed plugins and themes with active status</li>
<li>Search — full-text content search across post types</li>
<li>Options — read allowlisted safe options only</li>
</ul>
<h4>Plugin Integrations (Conditional)</h4>
Royal MCP automatically detects compatible plugins and adds specialized MCP tools. No configuration needed — if the plugin is active, the tools appear.
WooCommerce Integration (9 tools): 
When WooCommerce is active, AI agents can manage your store:
<ul>
<li>Browse and search products by category, status, or type</li>
<li>Create and update products with prices, SKUs, stock levels</li>
<li>View orders, order details, and update order status</li>
<li>List customers with order count and total spent</li>
<li>Get store statistics — revenue, order count, average order value by period</li>
</ul>
GuardPress Integration (7 tools): 
When GuardPress is active, AI agents can monitor your site security:
<ul>
<li>Get current security score and grade with factor breakdown</li>
<li>View security statistics — failed logins, blocked IPs, alerts</li>
<li>Run vulnerability scans and review results</li>
<li>List blocked IP addresses and failed login attempts</li>
<li>Browse the security audit log filtered by severity</li>
</ul>
SiteVault Integration (6 tools): 
When SiteVault is active, AI agents can manage your backups:
<ul>
<li>List available backups filtered by status or type</li>
<li>Trigger new backups (full, database, files, plugins, themes)</li>
<li>Check backup progress in real time</li>
<li>View backup statistics — total size, last backup, counts</li>
<li>List and review backup schedules</li>
</ul>
<h4>Works Alongside WordPress Core MCP</h4>
WordPress is building MCP support into core via the Abilities API. Royal MCP complements this by providing security controls that the core implementation does not include — API key authentication, rate limiting, activity logging, and sensitive data filtering. When the Abilities API ships, Royal MCP will continue to provide the security layer, plugin integrations, and WooCommerce tools that core does not cover.
<h4>Supported AI Platforms</h4>
<ul>
<li>Claude (Anthropic) — Full MCP support via Claude Desktop, Claude Code, and VS Code</li>
<li>OpenAI / ChatGPT — GPT-4o, GPT-4 Turbo, GPT-3.5 Turbo</li>
<li>Google Gemini — Gemini 1.5 Pro, 1.5 Flash</li>
<li>Groq — Llama 3.3, Mixtral, Gemma 2</li>
<li>Azure OpenAI — Azure-hosted OpenAI deployments</li>
<li>AWS Bedrock — Claude, Llama, Titan models</li>
<li>Ollama / LM Studio — Local self-hosted models (no external data transmission)</li>
<li>Custom MCP Servers — Connect to any MCP-compatible endpoint</li>
</ul>
<h4>MCP Spec Compliance</h4>
Royal MCP implements the <a href="https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http" rel="nofollow ugc">MCP 2025-03-26 Streamable HTTP transport specification</a>:
<ul>
<li>Single <code>/mcp</code> endpoint for all JSON-RPC communication</li>
<li>POST for client messages, GET for server-sent events, DELETE for session termination</li>
<li>Cryptographically secure session IDs with transient-based storage</li>
<li>Origin header validation to prevent DNS rebinding attacks</li>
<li>Proper CORS handling for browser-based MCP clients</li>
</ul>
<h3>External Services</h3>
This plugin connects to third-party AI services to enable AI platforms to interact with your WordPress content. No data is transmitted until you explicitly configure and enable a platform connection.
What data is sent: Your WordPress content (posts, pages, media metadata) as requested by the connected AI platform through authenticated MCP tool calls.
When data is sent: Only when you have configured a platform with API credentials AND enabled that platform connection AND the AI platform makes an authenticated request.
Supported services and their policies:
<ul>
<li>
Anthropic Claude — Used for Claude AI integration 
<a href="https://www.anthropic.com/legal/consumer-terms" rel="nofollow ugc">Terms of Service</a> | <a href="https://www.anthropic.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
OpenAI — Used for ChatGPT/GPT-4 integration 
<a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms of Use</a> | <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
Google Gemini — Used for Gemini AI integration 
<a href="https://ai.google.dev/terms" rel="nofollow ugc">Terms of Service</a> | <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
Groq — Used for Groq LPU inference 
<a href="https://groq.com/terms-of-use/" rel="nofollow ugc">Terms of Service</a> | <a href="https://groq.com/privacy-policy/" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
Microsoft Azure OpenAI — Used for Azure-hosted OpenAI models 
<a href="https://azure.microsoft.com/en-us/support/legal/" rel="nofollow ugc">Terms of Service</a> | <a href="https://privacy.microsoft.com/en-us/privacystatement" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
AWS Bedrock — Used for AWS-hosted AI models 
<a href="https://aws.amazon.com/service-terms/" rel="nofollow ugc">Terms of Service</a> | <a href="https://aws.amazon.com/privacy/" rel="nofollow ugc">Privacy Policy</a>
</li>
<li>
Ollama / LM Studio — Local self-hosted models (no external data transmission)
</li>
<li>
Custom MCP Servers — User-configured servers (data sent to user-specified endpoints only)
</li>
</ul>

Royal MCP

The security-first MCP server for WordPress. Connect Claude, ChatGPT, and Gemini with API key auth, rate limiting, and activity logging.

Botailor ModelContext Integrator for AI vs Royal MCP