miniOrange

miniOrange Secure MCP Server helps WordPress administrators with AI governance and policy enforcement: understanding, and controlling, what AI assistants and MCP clients are allowed to do on their site.
The WordPress Abilities API (available in WordPress 6.9 and later) lets plugins and WordPress core expose discrete, machine-callable capabilities — for example: get site info, create a post, or generate a summary. This plugin turns those abilities into a remote Model Context Protocol (MCP) server so AI clients can discover and invoke them, protected by a self-hosted OAuth 2.1 authorization server.
What this version does
<ul>
<li>Abilities viewer. A read-only admin screen (in the Secure MCP Server menu) that lists every ability registered on your site, with its label, description, category, source namespace, and full input/output JSON schema.</li>
<li>Connection guide. A “Connect to AI” tab with step-by-step instructions and your site’s MCP URL for connecting clients such as ChatGPT and Claude.</li>
<li>Built-in content abilities. Create Post and Update Post abilities (exposed as MCP tools) so connected clients can draft and edit posts, gated by the user’s capabilities.</li>
<li>MCP server. A single Streamable HTTP endpoint that exposes every registered ability as an MCP tool. Tool calls run through the Abilities API, so each ability’s own permission check still applies.</li>
<li>Self-hosted dynamic OAuth. WordPress acts as its own OAuth 2.1 authorization server with OAuth 2.0 Dynamic Client Registration (RFC 7591), Protected Resource Metadata (RFC 9728), Authorization Server Metadata (RFC 8414), and Authorization Code flow with PKCE. Clients such as ChatGPT and Claude can register themselves and connect with no manual credential setup.</li>
</ul>
Every MCP request runs as the WordPress user who authorized it, so what an AI client can do is bounded by that user’s own capabilities.

miniOrange Secure MCP Server

AI governance for WordPress: expose your Abilities API as a secure, OAuth-protected MCP server for AI clients like ChatGPT and Claude.

pteglia

PillarShield integrates WordPress with the PillarShield SaaS governance API. It runs checks at the publish boundary, blocks non‑compliant content, allows optional overrides, and keeps a governance record per post for reporting. You must obtain a PillarShield API key from https://pillarshield.co for the plugin to function.
Key features:
<ul>
<li>Gate governance checks on publish/private statuses (configurable per post type).</li>
<li>Optional manual checks that never block saves.</li>
<li>Override workflow for privileged users.</li>
<li>Governance reporting under Tools → PillarShield (blocked-at-gate items only).</li>
<li>Safe storage of outcomes without raw content.</li>
</ul>
<h3>Configuration</h3>
Settings → PillarShield:
<ul>
<li>API Endpoint: The PillarShield governance endpoint.</li>
<li>API Key: Your tenant API key (<code>psk_...</code>).
<ul>
<li>Get a key at https://pillarshield.co. The plugin does not perform governance checks without a valid API key.</li>
<li>You can also define <code>PILLARSHIELD_API_KEY</code> in <code>wp-config.php</code> to override the stored option: 
define(‘PILLARSHIELD_API_KEY’, ‘psk_…’);</li>
</ul>
</li>
<li>Enable Governance: Turn checks on/off.</li>
<li>Allow Save Without API: Allow publishing if the API is unavailable.</li>
<li>Enabled Post Types: Which post types are governed.</li>
<li>Fields per Post Type: Comma‑separated fields to scan. Supports <code>meta:KEY</code>.</li>
<li>Gate Configuration:
<ul>
<li>Gated statuses (default: publish + private)</li>
<li>Fallback status (default: draft)</li>
</ul>
</li>
</ul>
Use the Test Connection button to validate API access.
<h3>Editor UX</h3>
On governed post types, a PillarShield meta box appears with:
<ul>
<li>Check PillarShield governance on this save (manual check)</li>
<li>Override PillarShield governance (save anyway)</li>
</ul>
These checkboxes do not persist — they only apply to the current save.
<h3>Permissions (Roles/Capabilities)</h3>
PillarShield adds these capabilities:
<ul>
<li><code>pillarshield_manage_settings</code> — manage settings page</li>
<li><code>pillarshield_view_reports</code> — view reports</li>
<li><code>pillarshield_manual_check</code> — run manual check</li>
<li><code>pillarshield_override_governance</code> — override violations</li>
</ul>
On activation, these are granted to Administrators only.
Override visibility requirement: 
The Override checkbox only appears for users who have the <code>pillarshield_override_governance</code> capability. Editors will not see it unless you explicitly grant that capability via a role editor plugin or custom code.
<h3>Reporting</h3>
Tools → PillarShield:
<ul>
<li>Overview of content currently blocked at the gate.</li>
<li>Details page per post with block reason and metadata.</li>
</ul>
<h3>External services</h3>
This plugin connects to the PillarShield governance API to evaluate post content for compliance before publishing.
Service: PillarShield SaaS governance API, operated by PillarShield. 
Endpoint: https://api.pillarshield.co/pillarshield-governance/governance
What is sent and when: 
When a user saves a post to a gated status (by default: publish or private) on a governed post type, or manually triggers a governance check, the plugin sends a POST request containing:
<ul>
<li>The post’s configured content fields (by default: title, body, and excerpt)</li>
<li>Post metadata: post type, post ID, post UUID, post URL, and target publish status</li>
<li>WordPress user context: user ID and roles (no email or username is transmitted)</li>
<li>The tenant API key</li>
</ul>
No data is sent during autosaves, revisions, or saves to non-gated statuses. The plugin requires a valid API key obtained from https://pillarshield.co to function.
<ul>
<li><a href="https://pillarshield.co/terms" rel="nofollow ugc">Terms of service</a></li>
<li><a href="https://pillarshield.co/privacy-policy" rel="nofollow ugc">Privacy policy</a></li>
</ul>
<h3>Support</h3>
Support and documentation: https://pillarshield.co.

PillarShield

Connect WordPress to the PillarShield SaaS API and enforce governance checks at publish time.

miniOrange Secure MCP Server vs PillarShield