Security update. Upgrade immediately to prevent authenticated Author-level users from reading and republishing server-local files through the media upload tool.<\/p>","3.0.18":"
Multisite site admins can keep style and script tags in MCP content when Trusted raw HTML is enabled. Enable it under Settings \u2192 WEBO MCP \u2192 Security.<\/p>","2.3.2":"
Recommended for Claude Desktop and other MCP SDK clients: SSE keepalive, standard tools\/call content format, and safer AI editing via content checkpoint tools.<\/p>","2.3.1":"
Recommended compatibility update for installs using SCF or plugins that register abilities during activation.<\/p>","2.2.1":"
Recommended compatibility update for sites relying on bundled MCP schema classes or layered ability execution through MCP clients.<\/p>","2.1.23":"
Opt-in fix for multisite Elementor\/custom HTML workflows that need trusted administrators to preserve raw HTML tags. Disabled by default.<\/p>","2.1.17":"
Adds post password updates to Recommended for multisite networks using child-site plugin activation through MCP; fixes WordPress capability checks after Adds core plugin mutation plus child-site plugin activation\/deactivation via Adds MCP audit logging, optional tool allowlists, and an administrator health\/status tool. Existing MCP access remains unchanged unless allowlist enforcement is enabled in Settings.<\/p>","2.1.11":" Recommended security hardening release: MCP tools now enforce object-level post\/media\/term capabilities and only list tools the current user can call.<\/p>","2.1.10":" Registers the missing Internal refactor (standalone tool bootstrap file only). No MCP tool renaming; safe routine update.<\/p>","2.1.8":" Critical for Recommended if MCP\/remote clients still hit Use this if MCP clients still fail JSON parse on If MCP clients still parse-fail on BOM: this release starts the BOM-stripping buffer before Further hardening for leading-BOM MCP JSON failures: earlier buffer bootstrap on MCP-like REST URLs.<\/p>","2.1.3":" Recommended if MCP clients show JSON parse errors (leading BOM) on Restores packaged agent Documentation-only refresh: use docs\/MCP_TOOL_MIGRATION.md when mapping old MCP tool names to dispatchers + Recommended update for MCP clients that batch process posts or rely on seo\/article-analysis; list-posts pagination and H1\/schema detection are more accurate.<\/p>","2.0.35":" Adds theme discovery and theme switching tools for MCP clients. This release also carries the shortened WordPress.org short description into the new tagged version.<\/p>","2.0.34":" Recommended update if you manage homepage reading settings via MCP; adds safe support for Documentation-only refresh on WordPress.org listings; recommended if you rely on the plugin directory description for onboarding.<\/p>","2.0.32":" Recommended update for WP 6.9+ sites using Abilities API and MCP adapter integration.<\/p>","2.0.31":" Maintenance update.<\/p>","2.0.30":" Maintenance update.<\/p>","2.0.29":" Maintenance update for runtime stability and cleaner CLI output. If you use WEBO MCP Pro, review\/update the Pro package compatibility notice before deploying this version to production.<\/p>","2.0.28":" WordPress.org compliance update: readme now documents Google Suggest external service usage with Terms\/Privacy links, and nav-menu API loading no longer relies on WPINC.<\/p>","2.0.27":" MCP clients must send WordPress Application Password (HTTP Basic) or use a logged-in session. API key\/HMAC alone are no longer sufficient when calling the router.<\/p>","2.0.26":" Adds seo\/article-analysis for post-level SEO diagnostics (optional outbound suggest API; set no_autocomplete to skip).<\/p>","2.0.7":" Readme and GitHub README now link webomcp.com and the n8n-nodes-webo-mcp npm package.<\/p>","2.0.6":" License declaration aligned between readme and main plugin file for WordPress.org review.<\/p>","2.0.5":" Plugin header updates for Plugin Check and WordPress.org tooling (@wordpress-plugin, GPLv2 license slug).<\/p>","2.0.4":" Plugin header formatting for WordPress.org Plugin Check (Description, Version, License).<\/p>","2.0.3":" Plugin Check and packaging fixes; upload the release zip from scripts\/build-release.ps1 for WordPress.org.<\/p>","2.0.2":" Packaging and readme updates for WordPress.org review. Always upload the zip from scripts\/build-release.ps1, not the raw git folder.<\/p>","2.0.0":" Major rename: reinstall from folder webo-mcp (or deploy to new path), then activate WEBO MCP. Settings are preserved via migration.<\/p>","1.1.1":" Recommended update to fix tools\/call validation for core tools with no input.<\/p>","1.0.2":" Recommended update to support active plugin verification via MCP tool.<\/p>","1.0.1":" Recommended update to refresh plugin metadata and improve tools\/list compatibility.<\/p>","1.0.0":" Initial public release of WEBO MCP (formerly WEBO WordPress MCP).<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":3},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3514777,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3514777,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.0.28","2.0.29","2.0.34","2.0.35","2.0.40","2.0.45","2.1.0","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.17","2.1.19","2.1.3","2.1.4","2.1.9","2.2.0","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.4.0","2.4.1","2.4.2","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.3","2.6.4","2.6.8","2.6.9","3.0.0","3.0.18","3.0.2","3.0.22","3.0.3","3.0.32","3.0.5","3.0.6","3.0.7"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"MCP endpoint working in a REST client (initialize)","2":"tools\/list response with public tools","3":"tools\/call response for a WordPress tool"}},"plugin_section":[],"plugin_tags":[232494,569,69473,242115,253991],"plugin_category":[],"plugin_contributors":[261006],"plugin_business_model":[],"class_list":["post-293340","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-agent","plugin_tags-automation","plugin_tags-json-rpc","plugin_tags-mcp","plugin_tags-model-context-protocol","plugin_contributors-phuongwebo","plugin_committers-phuongwebo"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/webo-mcp\/assets\/icon-128x128.png?rev=3514777","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"\n WEBO MCP securely connects authenticated AI agents and MCP-compatible clients to WordPress through JSON-RPC tools over REST. It provides bounded access to content, media, users, settings, site health, and extensible WordPress abilities while preserving native capability checks.<\/p>\n\n Use Application Passwords or an authenticated WordPress session, discover tools with This plugin does not send telemetry. MCP traffic is initiated by clients you configure. An administrator may explicitly activate or deactivate a separately installed paid add-on license from the WEBO MCP settings page; that action contacts webomcp.com. Some tools may perform outbound HTTP requests only when a client invokes them (for example seo\/article-analysis may request keyword suggestions from a third-party suggest API unless you pass no_autocomplete). Separately installed paid add-ons manage their own update checks; Core does not download or install their packages.<\/p>\n\n The plugin stores the following options in the WordPress database when configured:\n- These Core options are removed when the plugin is uninstalled via the WordPress Plugins screen. If an administrator enters a paid add-on license, the license key and status are stored locally in that add-on's When an administrator explicitly activates or deactivates a paid add-on license in WEBO MCP settings, Core sends an HTTPS POST to webomcp.com (WEBO MCP \/ \u0110inh WP) for Easy Digital Downloads license validation. The request includes the entered license key, add-on product ID, WordPress site URL, requested activation\/deactivation action, and a user-agent containing the Core version and site URL. Standard request metadata such as the server IP address is also sent. This is not triggered merely by activating Core. Separately installed paid add-ons may contact the same service for their own update checks and downloads; see their documentation. Service information: https:\/\/webomcp.com<\/p>\n\n This plugin can connect to Google Suggest (Autocomplete) when a client calls the Service provider: Google LLC (Google Suggest \/ Autocomplete API endpoint).<\/p>\n\n Data sent and when:\n- Sent only when Terms of Service: https:\/\/policies.google.com\/terms\nPrivacy Policy: https:\/\/policies.google.com\/privacy<\/p>\n\n The plugin exposes the following actions and filters for developers:<\/p>\n\n For release packaging, use scripts\/build-release.ps1 to create a clean zip with .distignore exclusions.<\/p>\n\n Special thanks to the authors and open source projects that contributed to this plugin:\n- WordPress (https:\/\/wordpress.org)\n- Abilities API (https:\/\/github.com\/WordPress\/abilities-api)\n Reference: https:\/\/make.wordpress.org\/ai\/2025\/07\/17\/abilities-api\/\n- MCP Adapter (https:\/\/github.com\/WordPress\/mcp-adapter)\n Reference: https:\/\/make.wordpress.org\/ai\/2025\/07\/17\/mcp-adapter\/\n- Composer (https:\/\/getcomposer.org)\n- Other PHP and JS libraries from the community<\/p>\n\n If you use this plugin, please give credit to the authors of these libraries.<\/p>\n\n This plugin is licensed under the GPLv2 or later.\nSee https:\/\/www.gnu.org\/licenses\/gpl-2.0.html for details.<\/p>\n\n\n WEBO MCP<\/strong> is a WordPress MCP server \u2014 a complete Model Context Protocol<\/strong> gateway for WordPress. It lets AI agents and MCP-compatible clients (Claude Desktop, Cursor, Windsurf, n8n, and more) call well-defined tools over REST using JSON-RPC, instead of scraping the admin or sharing broad credentials.<\/p>\n\n Official WEBO MCP website, documentation, and ecosystem hub: https:\/\/webomcp.com<\/p>\n\n Why use WEBO MCP as your WordPress MCP server?<\/strong><\/p>\n\n Security model (high level)<\/strong><\/p>\n\n Client guidance<\/strong><\/p>\n\n Always discover tools before calling them: run Further documentation and optional integrations<\/strong><\/p>\n\n Compatibility note: any MCP-capable client can be used; which large language model runs inside the client is outside this plugin.<\/p>\n\n Standalone core tools included:\n- Site info\n- Content (posts\/pages): Excluded by default in standalone-safe mode:\n- Bulk\/mass execution tools\n- Plugin\/theme write-management abilities\n- Multisite-specific abilities<\/p>\n\n\n POST \/wp-json\/mcp\/v1\/router<\/p><\/dd>\n The project hub is https:\/\/webomcp.com. For n8n, install the community node from npm: https:\/\/www.npmjs.com\/package\/n8n-nodes-webo-mcp<\/p><\/dd>\n Yes. The official WEBO MCP website, documentation hub, and ecosystem landing page is https:\/\/webomcp.com.<\/p><\/dd>\n Yes. On WordPress versions where Core provides the Abilities API, WEBO MCP uses Core and does not load a duplicate bundled Abilities API. On older WordPress versions it falls back to the bundled Composer package. The default bridge mode is Only abilities that explicitly set Use Yes, via filter webo_mcp_allow_internal_tools in private environments.<\/p><\/dd>\n Yes, via filter webo_mcp_public_categories.<\/p><\/dd>\n Yes. Default bridge rules exclude patterns for bulk, themes, and multisite abilities.<\/p><\/dd>\n Yes, when used with proper authentication, TLS, and a limited tool exposure policy.<\/p><\/dd>\n Use a WordPress Application Password<\/strong> (Users \u2192 Profile \u2192 Application Passwords) and send it with HTTP Basic Auth (username = WordPress username, password = the application password). Optional API Key<\/strong> (webo\/content-mutate<\/code> for protected content workflows.<\/p>","2.1.14":"switch_to_blog()<\/code>.<\/p>","2.1.13":"site_id<\/code> or blog_id<\/code> for multisite network admins.<\/p>","2.1.12":"webo\/plugin-query<\/code><\/strong> tool (plugin inventory and updates via MCP). Recommended for automation that lists pending plugin updates.<\/p>","2.1.9":"webo.vn<\/code> \/ multi-BOM REST bodies: fixes BOM sanitizer regex so repeated UTF-8 BOM prefixes are actually removed.<\/p>","2.1.7":"Unexpected token<\/code> \/ invalid JSON \u2014 BOM strip now defaults on for all<\/strong> REST API responses.<\/p>","2.1.6":"discover-abilities<\/code> \/ ability tools \u2014 BOM strip now covers wp-abilities<\/code> REST routes.<\/p>","2.1.5":"rest_api_init<\/code> for MCP-like URLs.<\/p>","2.1.4":"tools\/list<\/code> or tools\/call<\/code> \u2014 response body is sanitized for MCP REST routes.<\/p>","2.1.2":"skills\/<\/code><\/strong> in the upstream repo clone; upgrade if you rely on Cursor\/Codex skills from GitHub.<\/p>","2.1.1":"action<\/code>. No behavioral change vs 2.1.0 expected.<\/p>","2.0.40":"show_on_front<\/code> and page_on_front<\/code> updates.<\/p>","2.0.33":"tools\/list<\/code>, and invoke exact tools through tools\/call<\/code>. Optional API-key, HMAC, scoped connector-token, allowlist, and audit controls are available for administrators. Documentation and ecosystem details: https:\/\/webomcp.com<\/p>\n\nPrivacy<\/h3>\n\n
webo_mcp_api_key<\/code>: API key used to authenticate MCP requests.\n- webo_mcp_hmac_secret<\/code>: HMAC secret used to sign and validate MCP requests.\n- webo_mcp_require_secondary_credentials<\/code>: when enabled, also require API key\/HMAC for Application Password and Bearer clients (off by default so standard connectors are not blocked).\n- webo_mcp_url_connector_tokens<\/code>: hashed, expirable, revocable URL connector tokens for clients that cannot send headers. Raw tokens are shown once and are not stored.\n- webo_mcp_tool_allowlist_enabled<\/code> and webo_mcp_tool_allowlist_rules<\/code>: optional administrator-configured MCP tool allowlist policy.\n- webo_mcp_audit_log_enabled<\/code>, webo_mcp_audit_log_max_entries<\/code>, and webo_mcp_audit_log<\/code>: bounded MCP tool-call audit log settings and compact audit events. Audit entries include user\/tool\/action\/status data, anonymized IPs, and hashed session IDs; they do not store request payloads, API keys, HMAC secrets, or Application Passwords.\n- webo_mcp_installed_at<\/code> and webo_mcp_review_notice<\/code>: local timestamps\/state for an optional WordPress.org review request notice (not sent off-site; dismissible).<\/p>\n\nwebo_mcp_*_license_key<\/code> and webo_mcp_*_license_status<\/code> options. Those shared add-on options are not deleted when Core is uninstalled, so separately installed add-ons retain their license state.<\/p>\n\nExternal services<\/h3>\n\n
seo\/article-analysis<\/code> tool and does not set no_autocomplete<\/code> to true. This external request is used to return related keyword suggestions for SEO analysis.<\/p>\n\nseo\/article-analysis<\/code> is called with autocomplete enabled.\n- Sends the analysis query text to https:\/\/suggestqueries.google.com\/complete\/search<\/code> as the q<\/code> parameter.\n- Sends standard HTTP request metadata such as IP address and User-Agent as part of the web request.<\/p>\n\nDeveloper Hooks<\/h3>\n\n
Actions<\/h3>\n\n
\n
webo_mcp_register_tools<\/code>\nFired during plugin bootstrap after standalone tools are registered. Use this to register custom MCP tools from other plugins.<\/li>\n<\/ul>\n\nFilters<\/h3>\n\n
\n
webo_mcp_current_user_can_use_mcp<\/code> (bool $allowed, int $user_id)\nGate for all MCP REST access. Default: super admin OR manage_options<\/code> OR edit_posts<\/code>. Override to tighten (e.g. super-admin only) in hardened installs.<\/p><\/li>\nwebo_mcp_secondary_credentials_exempt<\/code> (bool $exempt, WP_REST_Request $request)\nWhen true, skip optional API key \/ HMAC after WordPress auth. Default true for Application Password (Basic) and Bearer sessions unless Settings \u2192 Security \u2192 \u201cRequire for App Password \/ Bearer\u201d is enabled. Return false to always enforce X-WEBO-*<\/code> headers.<\/p><\/li>\nwebo_mcp_allow_internal_tools<\/code> (bool $allow_internal, WP_REST_Request $request)\nControls whether internal tools are included in tools\/list responses. Defaults to false for public environments.<\/p><\/li>\nwebo_mcp_public_categories<\/code> (array $categories, WP_REST_Request $request, array $tool)\nFilters which tool categories are exposed as public. Defaults to array( 'wordpress' ).<\/p><\/li>\nwebo_mcp_rate_limit_per_hour<\/code> (int $limit, string $client, array|null $profile)\nAdjust effective hourly limit (fallback for both buckets).<\/p><\/li>\nwebo_mcp_rate_limit_read_per_hour<\/code> \/ webo_mcp_rate_limit_mutate_per_hour<\/code> (int $limit, string $client, array|null $profile)\nPer-bucket limits after admin\/profile resolution.<\/p><\/li>\nwebo_mcp_tool_is_mutating<\/code> (bool $is_mutating, string $tool_name, array|null $tool_definition, array $arguments)\nOverride mutating classification for rate limits and read-only profiles.<\/p><\/li>\nwebo_mcp_tool_arguments_allow_extra<\/code> (bool $allow, string $tool_name, array $schema, array $arguments)\nWhen true, unknown tool argument keys are passed through (default false).<\/p><\/li>\nwebo_mcp_disallow_url_token_query<\/code> (bool $disallowed)\nBlock URL connector tokens in query strings (admin setting is the default source).<\/p><\/li>\nwebo_mcp_rest_bom_guard_json_api_requests<\/code> (bool $activate, string $uri_raw)\nOpt-in BOM sanitizer for all \/wp-json\/<\/code> responses (default false; MCP routes only).<\/p><\/li>\nwebo_mcp_bridge_deny_patterns<\/code> (array $patterns)\nControls which abilities are excluded when auto-bridging abilities into MCP tools (e.g. bulk, themes\/, multisite\/).<\/p><\/li>\nwebo_mcp_auto_bridge_abilities<\/code> (bool $enabled)\nEnables or disables automatic bridging of registered abilities into MCP tools. Defaults to true; bridge mode still controls whether the bridge is off, layered, or full.<\/p><\/li>\nwebo_mcp_bridge_mode<\/code> (string $mode)\nControls Abilities bridge mode after the WEBO_MCP_BRIDGE_MODE<\/code> constant and before the stored option. Values: off<\/code>, layered<\/code>, full<\/code>. Default: layered<\/code>.<\/p><\/li>\nwebo_mcp_enable_adapter<\/code> (bool $enabled)\nEnables or disables the bundled WordPress MCP Adapter runtime. Defaults to true.<\/p><\/li>\nwebo_mcp_validate_media_fetch_url<\/code> (true|\\WP_Error $ok, string $url, array $parsed)\nReject unsafe URLs for webo\/media-mutate upload action (return WP_Error to block).<\/p><\/li>\nwebo_mcp_tool_allowlist_allowed<\/code> (bool $allowed, string $tool_name, WP_REST_Request $request, array $params, array $allowed_tools)\nFilters the optional per-user\/role\/client allowlist decision.<\/p><\/li>\n<\/ul>\n\nQuick start<\/h4>\n\n
\n
Credits<\/h3>\n\n
License<\/h3>\n\n
\n
*-query<\/code> (all reads) and *-mutate<\/code> (all writes) \u2014 with a single action<\/code> discriminator. tools\/list<\/code> payload is up to 70% smaller than per-operation APIs, which means less of the model's context window is consumed by tool schemas, lower cost per session, and fewer hallucinated tool names.<\/li>\nPOST \/wp-json\/mcp\/v1\/router<\/code><\/li>\ninitialize<\/code> \u2192 tools\/list<\/code> \u2192 tools\/call<\/code><\/li>\nsession_id<\/code> or Mcp-Session-Id<\/code> after initialize<\/code>)<\/li>\n\n
mcp_token<\/code> URL connector token in Settings -> WEBO MCP.<\/li>\nGET \/wp-json\/webo-mcp\/v1\/tools<\/code>: users who are super admins, can manage_options<\/code>, or can edit_posts<\/code>, consistent with typical site operator and editor workflows (filterable).<\/li>\n<\/ul>\n\ntools\/list<\/code>, pick an exact tool name from the response, validate required arguments, then call tools\/call<\/code>. This reduces mistakes and keeps automation predictable in production.<\/p>\n\n\n
webo\/content-query<\/code> (list, get, find-by-url, search-replace, list-revisions, get-revision; with author\/date\/taxonomy filters) and webo\/content-mutate<\/code> (create, update, delete, bulk-update-status, restore-revision, change-author)\n- Users: webo\/list-users<\/code> and webo\/user-mutate<\/code> (add-to-blog, set-role)\n- Media: webo\/media-query<\/code> (list with search\/MIME\/post_id filters, get) and webo\/media-mutate<\/code> (upload, update, delete)\n- Comments: webo\/comment-query<\/code> (list, get) and webo\/comment-mutate<\/code> (create, update, delete)\n- Taxonomy\/Terms: webo\/taxonomy-query<\/code> (discover, list, get) and webo\/taxonomy-mutate<\/code> (create, update, delete)\n- Nav menus: list menus, list menu items (menu_order, db_id), add menu link from post (explicit post_id + menu_order required)\n- Plugins: webo\/plugin-query<\/code> (installed, active, updates, \u2026) and webo\/plugin-mutate<\/code> (install, activate, deactivate; supports child-site site_id<\/code> \/ blog_id<\/code> activation for network admins)\n- Health: webo\/health-status<\/code> (REST\/router status, Application Password support, permalinks, cron, object cache, plugin update summary, WordPress\/PHP versions, and redacted MCP config)\n- Client health: webo\/client-health-report<\/code> (score 0\u2013100, grade A\u2013D, Markdown scoreboard for agency clients; hybrid foundation for Pro collectors later)\n- 404 logs: webo\/get-404-logs<\/code> (read-only Rank Math \/ Redirection 404 monitor: url, hits, accessed, referrer)\n- Abilities bridge: webo\/ability-query<\/code> and webo\/ability-execute<\/code> in default layered mode. Only abilities with meta.mcp.public === true<\/code> are visible and executable through WEBO MCP.\n- Themes: webo\/theme-query<\/code> (installed themes) and webo\/theme-mutate<\/code> (install from WordPress.org by slug, switch installed theme)\n- Theme context: webo\/theme-context<\/code> (active theme info, block editor settings, style presets, registered blocks)\n- Block patterns: webo\/block-patterns<\/code> (list\/get patterns, list\/get synced patterns)\n- Site stats: webo\/site-stats<\/code> (overview, post counts, comment counts, user counts, media stats, activity summary)\n- Activity log: webo\/activity-log<\/code> (list events, summary, clear)\n- User profile: webo\/user-profile<\/code> (get own profile, update display name \/ bio \/ preferences)\n- Site settings: webo\/site-settings<\/code> (get and update the 20 most common WordPress options via MCP)\n- Content search: webo\/content-search<\/code> (full-text cross-post-type search with grouped results)\n- Menus: webo\/menu-query<\/code>, webo\/menu-mutate<\/code> (navigation menu items; not post\/CPT list order)\n- Post\/CPT order (optional): webo\/reorder-query<\/code>, webo\/reorder-mutate<\/code> when Webo Reorder<\/a> is active \u2014 see docs\/abilities\/reorder.md\n- Options: get\/update (safe allowlist only), set site icon\/favicon from media\n- SEO (WordPress post): seo\/article-analysis \u2014 requires post_id; merges Rank Math meta when available (same data path as webo-rank-math\/get-post-seo-meta); optional related-keyword suggestions via outbound request unless no_autocomplete is true<\/p>\n\n\n
Which endpoint should MCP clients use?<\/h3><\/dt>\n
Where is the official website and the n8n package?<\/h3><\/dt>\n
Is webomcp.com the official WEBO MCP website?<\/h3><\/dt>\n
Can this run WordPress abilities by itself?<\/h3><\/dt>\n
layered<\/code>, which exposes compact webo\/ability-query<\/code> and webo\/ability-execute<\/code> tools instead of one tool per ability. You can set bridge mode to off<\/code>, layered<\/code>, or full<\/code> with WEBO_MCP_BRIDGE_MODE<\/code>, the webo_mcp_bridge_mode<\/code> filter, or the webo_mcp_bridge_mode<\/code> option.<\/p><\/dd>\nWhich abilities are exposed through WEBO MCP?<\/h3><\/dt>\n
meta.mcp.public<\/code> to true are exposed. Execution also checks the ability permission callback, WEBO allowlist\/policy, and scope\/risk metadata such as meta.webo_mcp.scope<\/code> and meta.webo_mcp.risk<\/code>.<\/p><\/dd>\nHow do I migrate from legacy one-operation tool names?<\/h3><\/dt>\n
tools\/list<\/code> to discover the dispatcher tool names on your site, then pass the correct action<\/code> (or query\/mutate discriminant) for each operation. Use docs\/MIGRATION_GUIDE_2.1.0.md for the 2.1.0 rollout narrative and docs\/MCP_TOOL_MIGRATION.md for a consolidated addon-by-addon map (Rank Math, Rocket, WooCommerce groups, etc.).<\/p><\/dd>\nCan I expose internal tools?<\/h3><\/dt>\n
Can I limit public tools by category?<\/h3><\/dt>\n
Can I keep only WordPress.org-safe features?<\/h3><\/dt>\n
Is this plugin suitable for production?<\/h3><\/dt>\n
How do I authenticate MCP clients?<\/h3><\/dt>\n
X-WEBO-API-KEY<\/code>) and HMAC<\/strong> (X-WEBO-TIMESTAMP<\/code> + X-WEBO-SIGNATURE<\/code>) are managed under Settings \u2192 WEBO MCP \u2192 Security (generate\/rotate; secrets are shown once). By default those optional headers are not<\/strong> required for Application Password or Bearer clients; enable \u201cRequire for App Password \/ Bearer\u201d if your client can send X-WEBO-*<\/code> headers. HMAC signature: sha256=<\/code> + HMAC-SHA256( timestamp + \".\" + raw_body<\/code>, secret ), skew \u2264 300s. If a client cannot send headers, create a short-lived scoped URL connector token and pass it as