miniOrange

miniOrange Secure MCP Server helps WordPress administrators with AI governance and policy enforcement: understanding, and controlling, what AI assistants and MCP clients are allowed to do on their site.
The WordPress Abilities API (available in WordPress 6.9 and later) lets plugins and WordPress core expose discrete, machine-callable capabilities — for example: get site info, create a post, or generate a summary. This plugin turns those abilities into a remote Model Context Protocol (MCP) server so AI clients can discover and invoke them, protected by a self-hosted OAuth 2.1 authorization server.
What this version does
<ul>
<li>Abilities viewer. A read-only admin screen (in the Secure MCP Server menu) that lists every ability registered on your site, with its label, description, category, source namespace, and full input/output JSON schema.</li>
<li>Connection guide. A “Connect to AI” tab with step-by-step instructions and your site’s MCP URL for connecting clients such as ChatGPT and Claude.</li>
<li>Built-in content abilities. Create Post and Update Post abilities (exposed as MCP tools) so connected clients can draft and edit posts, gated by the user’s capabilities.</li>
<li>MCP server. A single Streamable HTTP endpoint that exposes every registered ability as an MCP tool. Tool calls run through the Abilities API, so each ability’s own permission check still applies.</li>
<li>Self-hosted dynamic OAuth. WordPress acts as its own OAuth 2.1 authorization server with OAuth 2.0 Dynamic Client Registration (RFC 7591), Protected Resource Metadata (RFC 9728), Authorization Server Metadata (RFC 8414), and Authorization Code flow with PKCE. Clients such as ChatGPT and Claude can register themselves and connect with no manual credential setup.</li>
</ul>
Every MCP request runs as the WordPress user who authorized it, so what an AI client can do is bounded by that user’s own capabilities.

miniOrange Secure MCP Server

AI governance for WordPress: expose your Abilities API as a secure, OAuth-protected MCP server for AI clients like ChatGPT and Claude.

Malcolm Peralty

Governance Guardrails is a file-based WordPress governance plugin for site owners, agencies, and managed WordPress teams that want important operational rules to live in code instead of scattered database settings.
You define a policy in a PHP configuration file. Governance Guardrails reads that file on each request and applies the configured rules. This makes the policy easy to review, version-control, and deploy consistently across environments or multiple sites.
Governance Guardrails can help you manage:
<ul>
<li>Feature toggles such as XML-RPC, comments, feeds, the Customizer, widgets, application passwords, user registration, WP-Cron, and related admin features.</li>
<li>Admin UI cleanup, including admin bar nodes, dashboard widgets, menu pages, and admin footer text.</li>
<li>Runtime capability denials by role without changing stored role definitions in the database.</li>
<li>Upload governance, including allowed MIME types and per-file size limits.</li>
<li>Content behavior such as revisions, autosave intervals, oEmbed, and emoji loading.</li>
<li>Login behavior such as password reset restrictions, generic login errors, and post-logout redirects.</li>
<li>HTTP security headers and other hardening options such as pingback removal, author archive handling, file editing restrictions, and staging noindex headers.</li>
<li>Head cleanup for RSD, WLW manifest, shortlinks, feed links, and REST API discovery links.</li>
<li>Locked options so selected <code>wp_options</code> values are pinned from code.</li>
<li>Custom governance callbacks for site-specific rules.</li>
</ul>
This plugin does not claim to secure a site by itself. It is intended as a governance and consistency tool that helps keep selected WordPress settings and behaviors aligned with your site’s operational policy.
<h4>Must-use plugin support</h4>
Governance Guardrails was originally built for must-use plugin deployment. It can still be installed that way by copying <code>governance-guardrails.php</code> and the <code>governance-guardrails/</code> directory into <code>wp-content/mu-plugins/</code>.
For WordPress.org installation, it can also be installed and activated as a normal plugin. In that case, the included sample config is used from the plugin directory unless you define a custom config path.
To use a custom config file, add this to <code>wp-config.php</code>:
<pre><code>define( 'GOVGUARD_CONFIG', '/absolute/path/to/governance-guardrails-config.php' );
</code></pre>
The shipped sample config lives at <code>governance-guardrails/governance-guardrails-config.php</code>.
Config loading is fail-open. If the config file is missing, unreadable, has a syntax error, or does not return an array, Governance Guardrails does not enforce governance rules and logs a warning instead of crashing the site.
<h4>WP-CLI</h4>
When WP-CLI is available, Governance Guardrails registers the <code>wp governance</code> command set.
Examples:
<ul>
<li><code>wp governance status</code></li>
<li><code>wp governance check</code></li>
<li><code>wp governance audit</code></li>
<li><code>wp governance audit --severity=high</code></li>
<li><code>wp governance diff</code></li>
<li><code>wp governance get features --format=json</code></li>
<li><code>wp governance mimes</code></li>
</ul>

Governance Guardrails

Governance Guardrails provides file-based rules for managing admin behavior, capabilities, uploads, and operational hardening from code.

miniOrange Secure MCP Server vs Governance Guardrails