miniOrange

miniOrange Secure MCP Server helps WordPress administrators with AI governance and policy enforcement: understanding, and controlling, what AI assistants and MCP clients are allowed to do on their site.
The WordPress Abilities API (available in WordPress 6.9 and later) lets plugins and WordPress core expose discrete, machine-callable capabilities — for example: get site info, create a post, or generate a summary. This plugin turns those abilities into a remote Model Context Protocol (MCP) server so AI clients can discover and invoke them, protected by a self-hosted OAuth 2.1 authorization server.
What this version does
<ul>
<li>Abilities viewer. A read-only admin screen (in the Secure MCP Server menu) that lists every ability registered on your site, with its label, description, category, source namespace, and full input/output JSON schema.</li>
<li>Connection guide. A “Connect to AI” tab with step-by-step instructions and your site’s MCP URL for connecting clients such as ChatGPT and Claude.</li>
<li>Built-in content abilities. Create Post and Update Post abilities (exposed as MCP tools) so connected clients can draft and edit posts, gated by the user’s capabilities.</li>
<li>MCP server. A single Streamable HTTP endpoint that exposes every registered ability as an MCP tool. Tool calls run through the Abilities API, so each ability’s own permission check still applies.</li>
<li>Self-hosted dynamic OAuth. WordPress acts as its own OAuth 2.1 authorization server with OAuth 2.0 Dynamic Client Registration (RFC 7591), Protected Resource Metadata (RFC 9728), Authorization Server Metadata (RFC 8414), and Authorization Code flow with PKCE. Clients such as ChatGPT and Claude can register themselves and connect with no manual credential setup.</li>
</ul>
Every MCP request runs as the WordPress user who authorized it, so what an AI client can do is bounded by that user’s own capabilities.

miniOrange Secure MCP Server

AI governance for WordPress: expose your Abilities API as a secure, OAuth-protected MCP server for AI clients like ChatGPT and Claude.

Npcink

Npcink AI Client Adapter gives OpenClaw-compatible and similar AI clients one WordPress REST namespace for reading Npcink Governance Core capability guidance, routing approved read abilities through the WordPress Abilities API, and forwarding governed write requests to Npcink Governance Core proposal and commit-preflight endpoints.
Adapter is intentionally thin. It does not define abilities, store approval truth, run workflow queues, or execute final write mutations without Core approval and commit-preflight.
Adapter can be distributed as the Npcink AI suite entry plugin while Core and Toolkit remain separate plugins. Adapter health reports missing dependencies and dependency-sensitive routes fail closed with a structured missing dependency error.
Adapter exposes a machine-readable <code>client_policy</code> on health, help, and the connection manifest so OpenClaw-compatible clients, Qclaw-style clients, WorkBuddy-style clients, or other local AI clients can consume explicit route, output, sensitive-read, and write-flow boundaries. The local CLI also redacts profile paths, key ids, signing headers, tokens, passwords, and secrets from output.
Current governed execution support covers individually approved proposal execution for explicit Adapter profiles, including <code>npcink-abilities-toolkit/trash-post</code>, <code>npcink-abilities-toolkit/create-draft</code>, <code>npcink-abilities-toolkit/update-post</code>, <code>npcink-abilities-toolkit/update-post-blocks</code>, <code>npcink-abilities-toolkit/update-template-blocks</code>, <code>npcink-abilities-toolkit/upsert-template-blocks</code>, <code>npcink-abilities-toolkit/update-template-part-blocks</code>, <code>npcink-abilities-toolkit/set-post-terms</code>, <code>npcink-abilities-toolkit/reply-comment</code>, and <code>npcink-abilities-toolkit/approve-comment</code>.

Npcink AI Client Adapter

Thin AI client channel plugin for Npcink Governance Core and WordPress Abilities execution.

miniOrange Secure MCP Server vs Npcink AI Client Adapter