=== HostCrafter MCP Server ===
Contributors: ashisbiswas
Tags: mcp, ai, claude, chatgpt, content
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Let Claude, ChatGPT, Cursor and other AI apps write and manage your content through MCP, with an editor's rights, approvals and a log on your site.

== Description ==

**HostCrafter MCP Server connects your WordPress content to the AI apps you already use.** Claude, ChatGPT, Claude Code, Cursor, VS Code, Gemini CLI and any other app that speaks the Model Context Protocol (MCP) can then work on your site when you ask in plain words: *"write a draft about our autumn menu"*, *"add alt text to every image in this post"*, *"put the winter coats on sale"*, *"move this page under Services in the menu"*.

You decide what each AI app may do. Every action is checked on your site and written to an activity log on your site.

= An editor's rights, never an administrator's =

An AI app connected through this plugin works with the rights of an **Editor** (and a WooCommerce **Shop Manager** for products and orders), whoever connected it. While its request runs, WordPress itself refuses anything an editor may not do. So an AI app:

* **can** write, change and trash posts, pages and products; add images; manage categories, tags, comments and menus; set SEO fields; clear caches; change the site title, tagline, timezone, date format and home page;
* **can never** install, activate, update or delete plugins or themes; create, change or delete users; edit theme or plugin code; add scripts or custom CSS; or change the site address, the admin email, who may register, or any other security setting.

Those stay with you, in wp-admin. This holds for the AI tools other plugins offer too (see below): each runs with an editor's rights only.

= What your AI can do =

* **Content:** list, read, write and update posts, pages and custom post types; duplicate; revisions and restore; preview links; find and replace (a dry run first; the real run waits for your approval).
* **SEO:** title, meta description, focus keyword, canonical and noindex in Yoast SEO, Rank Math or SEOPress; the HTML a page really serves.
* **Custom fields:** read and set post meta, including Advanced Custom Fields values (fields named like passwords, keys or contact details are never shown or changed).
* **Media:** add images from a web address, or **upload images from your computer straight from the chat** (up to 20 at a time); edit titles, alt text and captions.
* **Categories, tags, comments and menus.**
* **WooCommerce:** products and orders, through WooCommerce's own AI abilities on WooCommerce 10.9 and later (and built-in tools on older versions). Customer contact details are never shown.
* **Page builders:** Elementor (classic layouts through Elementor's own save; its new MCP tools when you switch them on) and GenerateBlocks 2. Every save keeps a revision.
* **Other plugins' AI tools:** many plugins now offer "abilities" to AI agents through the WordPress Abilities API (WordPress 6.9+). HostCrafter MCP Server finds them and lets your AI use them, each with an editor's rights; ones a plugin marks as destructive wait for your approval.
* **Read-only views:** installed plugins and themes, available updates, the main settings, site health, scheduled tasks and the error log, and any REST API route (secrets and contact details removed).

= Safe by default =

* New posts are drafts until you say publish. Deleting moves things to the trash, never further.
* Risky changes (a site-wide find and replace, an ability marked destructive) wait on the Approvals screen until an administrator approves them.
* No password, key, token, email address or phone number leaves your site in an answer: values like these read [removed].
* Scripts are removed from anything an AI saves, as for any editor. The HTML widget and custom code of page builders are never written.
* Up to five connections per site, each with its own name, permissions, sign-in and expiry, and its own log.

= Works with =

Claude (web, desktop and Claude Code), ChatGPT (developer mode connectors), Cursor, VS Code, Gemini CLI, Windsurf and any other MCP client that supports Streamable HTTP. The plugin shows the exact steps for each.

= Free, with a fair daily allowance =

The plugin and its MCP service are free. Each site gets 500 tool calls in 24 hours and 60 a minute; one call runs at a time on a site, so an AI app can never pile requests onto your server. An app that goes over a limit is told how long to wait.

= Trademarks =

Claude is a trademark of Anthropic. ChatGPT is a trademark of OpenAI. Cursor, Gemini, WooCommerce, Elementor, GenerateBlocks, Yoast SEO, Rank Math and SEOPress belong to their owners. HostCrafter MCP Server is made by HostCrafter and is not affiliated with or endorsed by any of them. The Model Context Protocol is an open standard.

== External services ==

This plugin connects your site to the **HostCrafter MCP service at mcp.hostcrafter.com**, run by HostCrafter, the plugin's author. It is the MCP server your AI app connects to: it forwards each tool call to your site and the answer back to the app. Without it the plugin does nothing.

What is sent, and when:

* **When you open the plugin's screen:** it asks the service whether it is up (`/healthz`) and what the free allowance is (`/v1/server`). Nothing about your site is sent with these two requests.
* **When you press "Connect this site":** your site's address and REST API address, the plugin, WordPress and PHP versions, the page where you approve sign-ins, the permissions you chose, the names of the tools this plugin offers, how many AI abilities each of your plugins offers, and a one-time check code. The service then calls your site back once to confirm the address is yours. The IP address the request came from is stored with your site.
* **When you create, remove or test a connection, or approve a sign-in:** your site's id and that connection's name, permissions, sign-in type and expiry.
* **Once a week, and a minute after a plugin is switched on or off:** a check-in with your site's id, the versions, the permissions, the tool names and the ability counts.
* **When your AI app uses a connection:** the tool call and its answer pass through the service in memory, encrypted between the service and your site. They are not stored or logged there. The service counts calls per site address for the daily allowance; the count is kept for 24 hours, also after a site is removed, so removing and adding a site does not reset it.
* **When you upload images in your AI app:** the images are held by the service for up to 5 minutes (deleted as soon as they are added to your media library), then fetched by your site from a one-time address.

What the service stores, how long it keeps it, and your rights: [privacy policy](https://hostcrafter.com/mcp-server/privacy). Terms of use: [terms](https://hostcrafter.com/mcp-server/terms).

The AI app you connect (for example Claude or ChatGPT) is run by its own company under its own terms and privacy policy.

== Installation ==

1. Install HostCrafter MCP Server from **Plugins → Add New** and activate it. Your site must use HTTPS.
2. Open **HostCrafter MCP** in the admin menu and press **Connect this site**.
3. Press **Add New Connection**: give it a name, choose what AI may do, how it authenticates and how long it lasts.
4. Copy the address into your AI app, following the steps shown for it.
5. Paste the test prompt into your AI app. The page turns green when the first call arrives.

== Frequently Asked Questions ==

= Is it free? =

Yes. The plugin is free (GPLv2 or later), and the MCP service it connects to, run by HostCrafter, is free within the daily allowance above.

= Which AI apps can connect? =

Any MCP client: Claude, ChatGPT, Claude Code, Cursor, VS Code, Gemini CLI, Windsurf and more.

= Can an AI install plugins, change users or take over my site? =

No. AI apps get an editor's rights only, enforced by WordPress's own permission checks while each request runs. Installing, switching on, updating and deleting plugins and themes, managing users, editing code and changing security settings are not possible through this plugin, whichever tool or plugin ability is asked to do it.

= Can an AI add code or scripts to my site? =

No. There is no tool that writes or runs PHP, JavaScript, CSS or SQL. While an AI app's request runs, scripts are removed from anything saved, exactly as for an editor. Code-snippet, header-and-footer and file-manager plugins cannot be reached at all.

= Can the AI delete my content or break my site? =

Deleting moves things to the trash, never further; new content is a draft until you say publish; a site-wide find and replace waits for your approval; every page save keeps a revision you can restore.

= Does the MCP server see or keep my content? =

Requests pass through it between your AI app and your site and are not stored or logged there. Your site keeps its own log, which you can read and clear under HostCrafter MCP → Logs.

= How do I add an image from my computer? =

Ask your AI to add an image. In Claude and ChatGPT an upload panel appears in the chat; in other apps the AI gives you a link to an upload page. Drop up to 20 images (10 MB each); the AI then adds them to your media library with titles and alt text. Uploads are deleted from the service within 5 minutes.

= What are "abilities", and which plugins have them? =

The WordPress Abilities API (WordPress 6.9+) lets a plugin describe actions AI agents may take. WooCommerce (10.9+) offers products and orders this way, Elementor (4.3+) offers its page building once you switch on Elementor → MCP, and many other plugins follow. GenerateBlocks has no abilities of its own; HostCrafter MCP Server has GenerateBlocks tools built in.

= How many connections can a site have? =

Up to five, each with its own name, permissions and log. To add another, remove one first.

= What happens when I deactivate or delete the plugin? =

Deactivating asks first: pause (keep your connections; they stop answering until you activate the plugin again) or revoke everything. Deleting the plugin always takes your site and every connection off the MCP server and removes the plugin's data.

= Does it work on multisite? =

Activate it on single sites. On multisite, the editor-only rule also holds for a Super Admin's account.

== Screenshots ==

1. Connections: every AI app with its sign-in type, permissions and when it was last used.
2. Add New: name, what AI may do, how it authenticates and how long it lasts.
3. Ready: the address, the steps for your AI app, and a test prompt that turns green on the first call.
4. Approving an AI app's sign-in on your own site.
5. Logs: every tool call, sign-in and connection change, per connection.

== Changelog ==

= 2.0.0 =
* First release on WordPress.org.

== Upgrade Notice ==

= 2.0.0 =
First release.
