[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_119":120},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":26,"_36":37,"_38":-5,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_57":49,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":49,"_84":-5,"_85":86,"_87":88,"_89":90,"_91":92,"_93":94,"_95":96},"apiUrl","https://odel.app/api","creator","royalplugins","moduleId","royal-mcp","@royalplugins/royal-mcp","displayName","royal mcp","tagline","Security-first WordPress MCP server. 129 tools for Claude, ChatGPT, Gemini. Free on wp.org.","iconKey","https://avatars.githubusercontent.com/u/267238367?v=4","category","remote","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","{\"url\":\"https://demo.royalplugins.com/wp-json/royal-mcp/v1/mcp\",\"transport\":\"streamable-http\",\"authType\":\"none\"}","pricingModel","free","creatorUserId","system:external-import","createdAt",1783657219000,"updatedAt",1788323306000,"sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=com.royalplugins%2Froyal-mcp","sourceVerified",false,"sourceMissingSince","importedAt","upstreamStars",9,"upstreamUpdatedAt",1788227876000,"detectedTransport","streamable-http","detectedAuthType","oauth","probeStatus","ok","lastProbedAt",1787632035000,"githubRepoUrl","https://github.com/royalplugins/royal-mcp","githubRepoFullName","royalplugins/royal-mcp","releaseId","ext-royalplugins-royal-mcp","version","1.4.34","descriptionMarkdown","

\r\n\r\n# Royal MCP\r\n\r\n**Security-first MCP server for WordPress.** Connect Claude, ChatGPT, and Gemini to your WordPress site with API key + OAuth 2.1 authentication, full activity logging, and capability-gated access.\r\n\r\n[![WordPress](https://img.shields.io/badge/WordPress-5.8+-21759B?style=flat-square&logo=wordpress)](https://wordpress.org/plugins/royal-mcp/)\r\n[![PHP](https://img.shields.io/badge/PHP-7.4+-777BB4?style=flat-square&logo=php)](https://www.php.net/)\r\n[![License](https://img.shields.io/badge/License-GPLv2-blue?style=flat-square)](https://www.gnu.org/licenses/gpl-2.0.html)\r\n[![Version](https://img.shields.io/badge/Version-1.4.45-C9A227?style=flat-square)](https://wordpress.org/plugins/royal-mcp/)\r\n\r\n[Download on WordPress.org](https://wordpress.org/plugins/royal-mcp/) · [Documentation](https://royalplugins.com/support/royal-mcp/) · [Royal Plugins](https://royalplugins.com)\r\n\r\n

\r\n\r\n---\r\n\r\nA WordPress plugin that exposes your site as a [Model Context Protocol](https://modelcontextprotocol.io/) server. AI agents — Claude.ai web, Claude Desktop, ChatGPT, custom clients — can read and write posts, pages, media, users, menus, WooCommerce orders, and Elementor pages, with every call going through capability gating, rate limiting, and an audit log. Distributed via the official WordPress.org plugin directory.\r\n\r\n## Quick facts\r\n\r\n| | |\r\n|---|---|\r\n| **Auth** | API key (`X-Royal-MCP-API-Key`) **or** OAuth 2.1 with PKCE + Dynamic Client Registration (RFC 7591) |\r\n| **Transport** | MCP 2025-11-25 Streamable HTTP (single `/mcp` endpoint, POST/GET/DELETE) |\r\n| **Tool count** | Up to 206 (85 WordPress core + 121 conditional plugin integrations) |\r\n| **Abilities API** | WP 6.9+ — every tool also registers as a WordPress ability, reachable via WP core REST at `/wp-json/wp-abilities/v1/abilities/{name}/run` and via the WordPress MCP Adapter's named `royal-mcp-server` |\r\n| **Rate limit** | 60 req/min per IP (configurable) |\r\n| **Session model** | Sliding 24h TTL with refresh-on-access |\r\n| **Activity log** | Every tool call logged (tool name + arg keys; argument values are never recorded) |\r\n| **Distribution** | [wp.org plugin directory](https://wordpress.org/plugins/royal-mcp/) + GitHub releases + auto-update via WP admin |\r\n| **Tested** | PHP 7.4 → 8.3, WordPress 5.8 → 7.0 |\r\n| **License** | GPLv2+ |\r\n\r\n## Capabilities\r\n\r\n### WordPress core (85 tools, always available)\r\n\r\n- **Content** — Posts, pages, custom post types (full CRUD + revisions + featured images)\r\n- **Taxonomies** — Categories, tags, custom taxonomies, term meta, post-term linking\r\n- **Media** — Browse, upload (URL or base64), update metadata, delete\r\n- **Comments** — Create, moderate (approve / spam / trash)\r\n- **Users** — Read display names + roles (emails and usernames are not exposed)\r\n- **Menus** — Read, create items, reorder, update with destructive-write guardrails\r\n- **Theme** — Custom CSS, theme mods, active theme detection\r\n- **Site** — Permalink structure, options (allowlisted), site info\r\n- **Search** — Cross-content search by query\r\n- **SEO** — Yoast / Rank Math / AIOSEO meta read/write where the plugin is active\r\n- **Diagnostics** — Site status (WP/PHP/MySQL/plugins/themes/cron in one call), PHP error-log tail, WP cron schedule, and MCP `royal_mcp_connection_health` (returns route, auth method, session ID, plugin version, and active page-builder versions for Divi + Elementor + Gutenberg)\r\n\r\n### Plugin integrations (121 tools, conditional)\r\n\r\nAuto-register only when the integrated plugin is active.\r\n\r\n| Plugin | Tools | What's covered |\r\n|---|---|---|\r\n| WooCommerce | 29 | Products, variations, attributes, coupons, orders (create/update/notes), customers, store stats |\r\n| Elementor | 11 | Clone pages, replace text, swap images, get outline, read single element, list templates, import templates, add widget, rebuild post_content |\r\n| Divi | 9 | Format detection (D4 shortcode vs D5 block), page outline, layout validation, library list + get, find/replace with builder-format awareness, clone, image swap, library apply |\r\n| GuardPress | 7 | Security score, failed logins, blocked IPs, vulnerability scans, audit log |\r\n| SiteVault | 6 | Trigger backups, monitor progress, list schedules |\r\n| Royal AI Firewall | 6 | Dashboard stats, recent bot hits, per-bot policies (allow / block / challenge), daily rollups |\r\n| Yoast SEO | 5 | Read/write Yoast meta (raw + resolved), capture JSON-LD schema graph, list indexed internal links, list Premium redirects |\r\n| Redirection | 4 | List redirects with group + URL-substring filters, create + update redirects (301 / 302 / 307 / regex / groups), list redirect groups |\r\n| Royal Ledger | 4 | Software costs, renewal dates, license keys (values never exposed) |\r\n| Advanced Custom Fields | 4 | Read/write ACF fields with each field's Return Format respected (hydrated post objects, parsed repeater rows, image arrays); enumerate field groups |\r\n| UpdraftPlus | 4 | List backup history, read per-backup status, trigger async backups with entity filtering, read schedule |\r\n| WPForms | 4 | List forms, read a single form's parsed field schema, (Pro) list submissions, (Pro) read single submission |\r\n| Solid Security | 4 | Read security status, list currently locked-out IPs, read the security event log, add an IP to the ban list |\r\n| MonsterInsights | 4 | Read the analytics overview, top pages, traffic sources, and top Google Search Console queries |\r\n| BuddyPress | 4 | List community members, read a single member profile, list groups, read the activity feed (same detection covers BuddyBoss Platform) |\r\n| Contact Form 7 | 3 | List forms, read a single form's parsed field schema, list submissions (via Flamingo add-on) |\r\n| W3 Total Cache | 3 | Read cache configuration across every module, purge cache (all / by URL / by post), read usage statistics |\r\n| Duplicator | 3 | List migration packages, read per-package status, get the installer URL for a completed package |\r\n| Royal Links | 3 | Branded short links, click stats |\r\n| ForgeCache | 3 | Cache stats, clear cache, purge URL |\r\n| Google Site Kit | 1 | Read authenticated Site Kit report data |\r\n\r\n## WordPress Abilities API bridge (WP 6.9+)\r\n\r\nWordPress 6.9 shipped the [Abilities API](https://developer.wordpress.org/plugins/abilities-api/) — a primitive that lets plugins register typed capabilities AI agents can call. As of 1.4.38, every Royal MCP tool also registers as a WordPress ability, giving you three ways to reach the same handlers:\r\n\r\n1. **Native** — Royal MCP's `/wp-json/royal-mcp/v1/mcp` Streamable HTTP endpoint (unchanged, always available).\r\n2. **WP MCP Adapter** — if the [`wordpress/mcp-adapter`](https://github.com/WordPress/mcp-adapter) package is installed, Royal MCP registers a named `royal-mcp-server` on the `mcp_adapter_init` hook alongside adapter's default server.\r\n3. **WP core REST** — direct ability invocation at `/wp-json/wp-abilities/v1/abilities/{name}/run` for callers that prefer the core WP endpoint.\r\n\r\nSame handlers, three transports, one set of per-tool capability gates. Bridge can be disabled with the `royal_mcp_abilities_registration_enabled` option (default: on).\r\n\r\n## What we don't do\r\n\r\nExplicit scope boundaries — the integration model is \"narrow tools that work reliably,\" not \"expose every API surface.\"\r\n\r\n- **No widget-level Elementor generation from scratch.** Atomic widgets (Editor V4) pass through opaque; we never decode atomic schemas because Elementor itself may shift them.\r\n- **No Beaver Builder / Bricks page-builder JSON writes.** Standard post content is readable and writable; page-builder-specific JSON storage is opaque unless covered by a dedicated tool. (Elementor and Divi have dedicated tools — see the integration table above.)\r\n- **No theme builder template creation** (Elementor or otherwise).\r\n- **No core file modifications** — Royal MCP never writes to `wp-content/themes`, `wp-includes`, or `wp-admin`.\r\n- **No plugin installation or upgrades via MCP.** Discovery yes; install/activate/deactivate no.\r\n- **No raw SQL.** Queries go through `WP_Query` and `$wpdb->prepare()` only.\r\n\r\n## Royal MCP Pro (paid)\r\n\r\nThe Free plugin is fully featured for individual site owners. Royal MCP Pro extends it for agencies and multi-site operators:\r\n\r\n- **Divi Pro suite** — page clone, image swap, template import, full library CRUD, D4→D5 Migrator, global preset bulk-apply (8 tools)\r\n- **Elementor Pro depth** — additional Elementor tools beyond the Free integration\r\n- **Universal audit log** — every AI operation logged with attribution + export\r\n- **72-hour undo on every write** — every destructive Pro tool returns an undo token; reverse any operation within the window\r\n- **License-gated updates** through the standard WordPress updater — no runtime dependencies on external license servers\r\n\r\n[Learn more at royalplugins.com/royal-mcp-pro](https://royalplugins.com/royal-mcp-pro/)\r\n\r\n## Connect\r\n\r\n### Install\r\n\r\n1. Install from [WordPress.org](https://wordpress.org/plugins/royal-mcp/) (recommended — auto-updates via WP admin) or upload the GitHub release zip.\r\n2. **Royal MCP → Settings** → click *Generate API Key*.\r\n3. Pick a client below.\r\n\r\n### Claude.ai web (OAuth — recommended)\r\n\r\nEasiest path — no config file edits, no API key in your client.\r\n\r\n1. In Claude.ai → **Settings → Connectors → Add Custom Connector**.\r\n2. URL: `https://yoursite.com/wp-json/royal-mcp/v1/mcp`\r\n3. Approve the OAuth consent screen when prompted. Claude.ai handles dynamic client registration + PKCE flow against your site.\r\n\r\n### Claude Desktop (.mcpb one-click bundle — new in 1.4.38)\r\n\r\nEasiest Claude Desktop path — no `mcp-remote`, no npx, no config-file editing.\r\n\r\n1. Download `royal-mcp-1.4.38.mcpb` from the [latest GitHub release](https://github.com/royalplugins/royal-mcp/releases/latest).\r\n2. Double-click the `.mcpb` file — Claude Desktop opens the install prompt.\r\n3. Enter your site URL + API key when prompted. Connection is live.\r\n\r\nThe bundle ships a zero-dependency stdio-to-HTTPS bridge in Node ≥18, which Claude Desktop already includes. See [Claude Desktop MCP Bundles](https://modelcontextprotocol.io/) for the .mcpb spec.\r\n\r\n### Claude Desktop (OAuth via mcp-remote)\r\n\r\n```json\r\n{\r\n \"mcpServers\": {\r\n \"my-wordpress\": {\r\n \"command\": \"npx\",\r\n \"args\": [\"-y\", \"mcp-remote\", \"https://yoursite.com/wp-json/royal-mcp/v1/mcp\"]\r\n }\r\n }\r\n}\r\n```\r\n\r\nConfig path: `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows).\r\n\r\n### Claude Desktop (API key)\r\n\r\nSkip OAuth and authenticate via header:\r\n\r\n```json\r\n{\r\n \"mcpServers\": {\r\n \"my-wordpress\": {\r\n \"command\": \"npx\",\r\n \"args\": [\r\n \"-y\", \"mcp-remote\",\r\n \"https://yoursite.com/wp-json/royal-mcp/v1/mcp\",\r\n \"--header\", \"X-Royal-MCP-API-Key:YOUR_API_KEY\"\r\n ]\r\n }\r\n }\r\n}\r\n```\r\n\r\n### ChatGPT\r\n\r\nChatGPT's custom MCP connector takes the same URL as Claude.ai web. Follow ChatGPT's connector flow and paste `https://yoursite.com/wp-json/royal-mcp/v1/mcp`.\r\n\r\n### Raw HTTP (custom clients)\r\n\r\n```bash\r\n# 1. Initialize a session. -i prints headers so you can grab Mcp-Session-Id.\r\ncurl -i -X POST https://yoursite.com/wp-json/royal-mcp/v1/mcp \\\r\n -H \"X-Royal-MCP-API-Key: YOUR_KEY\" \\\r\n -H \"Content-Type: application/json\" \\\r\n -H \"Accept: application/json, text/event-stream\" \\\r\n -d '{\r\n \"jsonrpc\": \"2.0\",\r\n \"method\": \"initialize\",\r\n \"id\": 1,\r\n \"params\": {\r\n \"protocolVersion\": \"2025-11-25\",\r\n \"capabilities\": {},\r\n \"clientInfo\": {\"name\": \"my-app\", \"version\": \"1.0\"}\r\n }\r\n }'\r\n\r\n# 2. List available tools using the session id from the response header.\r\ncurl -X POST https://yoursite.com/wp-json/royal-mcp/v1/mcp \\\r\n -H \"X-Royal-MCP-API-Key: YOUR_KEY\" \\\r\n -H \"Mcp-Session-Id: \" \\\r\n -H \"Content-Type: application/json\" \\\r\n -d '{\"jsonrpc\": \"2.0\", \"method\": \"tools/list\", \"id\": 2}'\r\n```\r\n\r\n## Security model\r\n\r\n| Layer | What it does |\r\n|---|---|\r\n| **API key** | 32-char hex, timing-safe comparison. Sent via `X-Royal-MCP-API-Key` header. Regenerate from admin without server restart. |\r\n| **OAuth 2.1** | RFC 7591 Dynamic Client Registration, RFC 8414 metadata, PKCE S256 required, refresh tokens supported. No implicit grant. No client_credentials grant. |\r\n| **Capability gating** | Every tool checks WordPress capabilities. `edit_posts` for create/update, `manage_options` for site settings, `edit_post` per-post for individual operations. |\r\n| **Rate limiting** | 60 requests/minute per IP, sliding window. |\r\n| **Session model** | Sliding 24h TTL with refresh-on-access. Cryptographically secure 32-byte session IDs. |\r\n| **Activity log** | Every tool call writes a row to a database log. Records: tool name, argument keys, IP, User-Agent, errors. **Never** records argument values (they may contain customer data). |\r\n| **OAuth state recovery** | One-click *Reset OAuth State* admin button wipes all clients + tokens + auth codes, without affecting your API key or settings. |\r\n| **Discovery** | `.well-known/oauth-authorization-server` and `.well-known/oauth-protected-resource` served at site root per RFC 8414 + RFC 9728. |\r\n\r\nFull security architecture: [royalplugins.com/support/royal-mcp/](https://royalplugins.com/support/royal-mcp/)\r\n\r\n## Project status\r\n\r\n- **Active maintenance** — releases roughly weekly. See [releases](https://github.com/royalplugins/royal-mcp/releases) for changelog.\r\n- **MCP spec compliance** — implements the [Streamable HTTP transport (2025-11-25)](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#streamable-http).\r\n- **Issues** — [github.com/royalplugins/royal-mcp/issues](https://github.com/royalplugins/royal-mcp/issues). Customer-impact issues are typically acknowledged within 24h and triaged with version targets.\r\n- **Source access** — This repo mirrors the plugin's wp.org SVN trunk for transparency. Report bugs and feature requests in [Issues](https://github.com/royalplugins/royal-mcp/issues). Releases ship through the wp.org review pipeline.\r\n\r\n## Further reading\r\n\r\n- **[Editing Elementor with Claude: The Four Workflows That Work Today](https://royalplugins.com/blog/editing-elementor-with-claude-four-workflows/)** — the four real architectures for AI-editing Elementor pages and when to reach for which. User-facing version with prompts, examples, and a video demo of the clone-and-customize flow.\r\n- **[Editing Elementor with Claude: 4 MCP Architectures](https://royalplugins.hashnode.dev/editing-elementor-with-claude-mcp-architectures)** — engineer's cut on Hashnode. The PHP under the hood of `elementor_clone_page`, the six tool signatures, and the HTTP-Basic-vs-OAuth-2.1 auth-model tradeoff.\r\n\r\n## Related projects\r\n\r\n- [GuardPress](https://royalplugins.com/guardpress/) — WordPress security hardening\r\n- [SiteVault](https://royalplugins.com/sitevault/) — WordPress backups and migration\r\n- [ForgeCache](https://royalplugins.com/forgecache/) — Caching and performance\r\n- [FormForge](https://royalplugins.com/formforge/) — Form builder with PDF generation\r\n- [SEObolt](https://royalplugins.com/seobolt/) — SEO toolkit for WordPress\r\n\r\n## License\r\n\r\nGPLv2 or later — see [LICENSE](https://github.com/royalplugins/royal-mcp/blob/main/LICENSE) or the [GNU site](https://www.gnu.org/licenses/gpl-2.0.html).\r\n\r\nRoyal MCP is provided as-is. API keys protect your endpoints; guard them like any other credential. You are responsible for the content, commands, and actions any AI platform is allowed to perform on your WordPress site.\r\n\r\n---\r\n\r\n

\r\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"upstream",{"_105":106,"_107":108,"_109":110,"_111":112,"_113":114,"_115":116},"requiredSecrets",[],"tags",[99,100,101,102,103,104],"assets",[],"stats",{"_97":86,"_98":86},"ratingAvg","reviewCount","ai","claude","elementor","oauth2","wordpress","wordpress-plugin","topics",[99,100,101,117,118,102,103,104],"license","NOASSERTION","language","PHP","registryName","com.royalplugins/royal-mcp","homepage","https://royalplugins.com/royal-mcp/","packages",[],"mcp","model-context-protocol","ENV",{"_121":122,"_123":124,"_125":126},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]