=== MCPKit ===
Contributors: abdulwahabtaqi
Tags: mcp, ai agents, claude, elementor, automation
Requires at least: 6.9
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 0.9.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect Claude, Codex and other MCP clients to WordPress and Elementor with scoped OAuth access, rate limits, and audit logs.

== Description ==

MCPKit helps site owners connect trusted AI clients to WordPress through authenticated, scoped endpoints.

Version 1 focuses on a safe foundation for local and administrator-controlled AI workflows. The free plugin is useful without payment, license validation, time limits, or feature expiry.

== Features available free ==

* Site information.
* Theme diagnostics.
* Plugin diagnostics.
* Site health summary.
* Post and page inspection.
* Scoped WordPress Application Password connections.
* OAuth browser authorization with PKCE for compatible MCP clients.
* MCP JSON-RPC endpoint with tool discovery and tool calls.
* Codex, Claude Code, and Claude-compatible JSON configuration snippets.
* Built-in external-client simulation test for OAuth and MCP tool calls.
* Per-ability rate limits.
* Connection revocation.
* Audit logging.
* Draft-post proposals stored for human review.
* Privacy exporter and eraser support for user-linked audit data.

== WooCommerce store management (0.2.0) ==

With WooCommerce active and the shop.read / shop.manage scopes an approved AI client can build and run a store: create simple, variable, grouped and external products with images, galleries, attributes and variations; manage categories, tags and attributes; handle orders, refunds and customers; create coupons; set up taxes, payment methods and shipping; change any WooCommerce setting; read sales reports; and create the Shop, Cart, Checkout and My Account pages with shortcodes, blocks or Elementor Pro widgets. A store check tests the whole customer journey and says which tool fixes each problem.

== Site building with Claude and Elementor (0.1.7) ==

With the content.write, media.write, elementor.manage and site.manage scopes an approved AI client can:

* Create, edit, publish and delete pages, posts and custom post types, including terms, featured images, templates and post meta.
* Upload images from a URL or base64 data and edit alt text.
* Discover every registered Elementor widget, including Elementor Pro and add-ons such as CotKit Addons for Elementor, and read each widget's exact control schema.
* Build complete Elementor layouts (containers, sections, widgets, responsive settings) and make targeted edits by element ID.
* Set global colors and fonts in the Elementor Kit, save templates, and with Elementor Pro build headers, footers and other theme parts with display conditions.
* Create navigation menus, set the homepage, activate themes and update site settings.

All Elementor saves use Elementor's own Document API, so revisions, CSS regeneration and add-on hooks run exactly as they do when you click Update in the editor.

== What MCPKit does not allow ==

MCPKit does not execute arbitrary PHP, JavaScript, shell commands, SQL, WP-CLI commands, or file-manager actions, and it does not edit plugin or theme files.

A small set of options that could lock you out of your site (siteurl, home, active plugins, admin email, user roles, MCPKit security options) cannot be changed through MCP.

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/mcpkit`, or install MCPKit from the WordPress Plugins screen.
2. Activate MCPKit.
3. Open MCPKit > Connect.
4. Enable MCPKit abilities.
5. Create a scoped connection for a supported AI client.
6. Copy the generated WordPress Application Password into your trusted AI client.

Additional setup notes are included in `docs/client-setup.md`.

== Connection setup ==

MCPKit supports two V1 authentication paths: WordPress Application Passwords and OAuth bearer tokens for compatible MCP clients.

Each AI client connection should use its own Application Password. MCPKit stores connection metadata such as the connection UUID, user ID, client label, scopes, status, and Application Password identifier. It does not store the raw Application Password.

OAuth clients can use the metadata, registration, authorization, and token endpoints exposed by MCPKit. OAuth authorization uses a browser approval screen and PKCE S256. Access tokens are stored only as hashes and expire after one hour. Refresh tokens are rotated and expire after one week.

OAuth metadata discovery is available at:

`/.well-known/oauth-authorization-server/`

Revoking a connection in MCPKit immediately blocks MCPKit abilities for that connection.

== MCP endpoint ==

The MCP endpoint is:

`/wp-json/mcpkit/v1/mcp`

It accepts JSON-RPC 2.0 POST messages and supports:

* `initialize`
* `ping`
* `tools/list`
* `tools/call`
* `prompts/list`
* `resources/list`

Unauthenticated requests receive a 401 response with an OAuth `WWW-Authenticate` challenge so MCP clients such as Claude Code, Claude Desktop and Claude custom connectors start the browser login automatically. Tool calls require a linked active connection, an allowed scope, rate limiting, and audit logging.

== Client configuration ==

Open MCPKit > Client Config to copy generated configuration for:

* Codex Streamable HTTP MCP `config.toml`
* Codex MCP add and OAuth login commands
* Claude Code `claude mcp add` and `claude mcp login` commands
* Claude Desktop `claude_desktop_config.json` using the mcp-remote bridge, with certificate settings for local HTTPS sites

The Codex configuration includes the MCP endpoint URL, OAuth mode, explicit scopes, enabled tool names, timeout settings, and approval prompts for write tools. The same screen runs an external-client simulation covering metadata discovery, dynamic registration, PKCE token exchange, MCP initialize, tools/list, and tools/call.

== Supported/tested AI clients ==

The V1 setup screen includes connection labels for:

* Codex
* Claude Code
* Claude Desktop

Other clients may work if they can call authenticated WordPress REST endpoints with a WordPress Application Password.

== Security model ==

MCPKit abilities require:

* MCPKit enabled by an administrator.
* An authenticated WordPress user with the required capability.
* A linked, active MCPKit connection.
* A WordPress Application Password captured by WordPress authentication.
* The required MCPKit connection scope.
* The per-user, per-ability rate limit.

MCPKit validates and sanitizes inputs, escapes output in admin screens, and uses prepared SQL values for dynamic query values. Custom database table names are limited to MCPKit-owned tables.

More detail is included in `docs/security-model.md`.

== Data handling and privacy ==

MCPKit stores the minimum data needed for connection control, audit review, and proposal review.

Audit events may include event type, WordPress user ID, connection UUID, client label, ability name, a short redacted message, a hashed IP value, and timestamps.

MCPKit does not store raw AI prompts, raw MCP requests, WordPress login passwords, raw Application Passwords, raw OAuth bearer tokens, AI provider keys, cookies, or secrets.

Admins can set audit retention days in MCPKit settings. MCPKit registers WordPress personal-data exporter and eraser callbacks for user-linked audit data.

Suggested privacy policy text:

MCPKit records limited audit events when administrator-approved AI client connections use MCPKit abilities. These events may include a WordPress user ID, connection label, ability name, redacted event summary, hashed IP value, and timestamp. MCPKit does not store raw Application Passwords, AI provider keys, or raw prompts by default.

== External services ==

MCPKit does not contact external services by itself in V1.

The site administrator chooses whether to configure an AI client outside WordPress. Any data sent by that client is controlled by the administrator's client configuration, not by MCPKit telemetry.

== Frequently Asked Questions ==

= Can Claude publish content and build Elementor pages? =

Yes, when the connection was approved with the content.write and elementor.manage scopes. The approval screen lists every scope before you authorize a client, and you can revoke a connection at any time.

= Does MCPKit store my generated Application Password? =

No. WordPress shows the raw Application Password once. MCPKit stores only connection metadata and an Application Password identifier/name for matching future authenticated requests.

= Does MCPKit require an external service? =

No. MCPKit exposes authenticated local WordPress endpoints for compatible AI clients.

= Can I use MCPKit Pro? =

MCPKit Free does not require MCPKit Pro. A separate paid add-on may exist later, but the free plugin remains useful by itself.

== Screenshots ==

1. Dashboard with status, active connections, pending approvals, and site information.
2. Connection setup with OAuth and Application Password options.
3. V1 abilities list with scopes, methods, and REST routes.
4. Client Config page with MCP endpoint, OAuth metadata, and Codex setup.
5. Approvals workflow for reviewing AI-proposed draft posts.
6. Activity Log showing recent ability calls and approval events.

== Changelog ==

= 0.9.1 =
* New: mcpkit_media_upload_link — a one-time upload link (30 minutes by default, max 120) for zips, videos, PDFs and other files too big to send in one tool call. Send the file with curl or a browser file field; it is added to the media library as the user who created the link, with the normal file-type and size rules. Check the result with {"check": token}.
* New: mcpkit_media_upload_chunk — upload a file in base64 pieces over several calls (up to 64 MB); unfinished uploads are cleaned up after two hours.
* New: mcpkit_elementor_replace_text — find and replace text (or a regular expression) inside any Elementor settings, including HTML widget code, links and repeater items, without resending the page. Supports element_id / setting filters, an expected match count and a dry run.
* New: mcpkit_install_plugin_zip accepts media_id — install or update a plugin from a ZIP uploaded with the new upload tools (the ZIP is removed from the media library afterwards unless keep_media is true).

= 0.9.0 =
* New: full FormsKit Lite and FormsKit Pro support: mcpkit_formskit_guide, _status, _field_types (read live from FormsKit, including Pro / Elite fields and which licence unlocks them), _forms_list, _form_get, _form_save (create from scratch or a template, replace / add / update / remove fields, choices with images and icons, conditional logic, layouts, multi-step, notifications, confirmations, spam protection, styles, Pro integrations — all checked before saving), _form_delete, _form_embed (block, shortcode or Elementor widget, on an existing or new page), _entries, _entry_update and _settings (email defaults, reCAPTCHA / Turnstile / hCaptcha keys, Pro integration keys; secrets are never shown).
* New: FormsKit is suggested and installed for any form request that does not name another form plugin.
* Improved: WPKits suggestions match whole words, so "form" no longer matches "platform" or "information".

= 0.8.0 =
* New: Advanced Custom Fields (free and Pro) support: mcpkit_acf_status, mcpkit_acf_field_group_get / _save / _delete (all field types incl. repeater, group and flexible content, location rules or a simple {post_type: "book"} shorthand), mcpkit_acf_fields_get / _update (values on posts, terms, users, comments and options pages, saved with ACF's update_field), mcpkit_acf_post_type_save and mcpkit_acf_taxonomy_save (custom post types and taxonomies through ACF 6.1+).
* New: custom post types and taxonomies everywhere. mcpkit_content_create / _update take terms of any taxonomy, acf values, author and comment status, and accept custom post statuses; mcpkit_content_list filters by taxonomy terms, meta / ACF value, author, parent and IDs, with sorting; mcpkit_content_get returns every taxonomy (IDs, slugs) and ACF values; mcpkit_content_list_types adds supports, taxonomies, page templates, archive and REST details and the registered statuses.
* New: mcpkit_user_update can set user meta (login and capability keys are protected) and ACF user fields.
* Checked: no site-specific values are built in; everything is read from the connected site.

= 0.7.1 =
* Fix: mcpkit_wishlist_lists no longer shows the product stock count in place of the item quantity (stock count is now stock_quantity).
* Fix: mcpkit_quotefold_frontend_check explains when the My Account page exists but is not published.

= 0.7.0 =
* New: full Wishlist Kit Lite and Wishlist Kit Pro support.
* New: mcpkit_wishlist_guide explains the whole plugin to AI apps: the visitor flow (heart button, Choose a list, My Wishlist page, layouts, bulk actions, sharing, email alerts), every setting on the General, Placement, Theme and Social Sharing tabs with options, defaults and ranges, the Pro emails and placeholders, shortcodes, blocks and Elementor widgets.
* New: mcpkit_wishlist_page_setup (check, create or choose the wishlist page), mcpkit_wishlist_frontend_check (why the heart shows or not, placements, sharing, email sender), mcpkit_wishlist_list_manage (create, rename, set default, delete lists; add, remove, move items; choose a variation; Pro sharing links and notes) and mcpkit_wishlist_emails (Pro: overview, preview, test, reset to default, subscribers, unsubscribe).
* Improved: mcpkit_wishlist_settings_update checks every key before saving (unknown keys, wrong options, colours, sizes, platforms and email events are reported) and tells you when a setting needs Pro.
* Fix: saved WooCommerce products now show their price and stock in mcpkit_wishlist_lists and mcpkit_wishlist_report.
* Improved: Wishlist Kit suggestions also match "add to favorite", "add to list" and similar requests; installing it also creates the wishlist page.

= 0.6.0 =
* New: WPKits plugin suggestions. When you ask your AI app for a feature such as "request a quote", "wishlist" or "login link in the menu", MCPKit suggests the free WPKits plugin for it (made by the makers of MCPKit, with full MCPKit support): mcpkit_wpkits_recommend.
* New: mcpkit_wpkits_install installs, activates and sets up a WPKits plugin in one step (QuoteFold also gets its Request a Quote page).
* New: mcpkit_plugin_search lists a matching WPKits plugin first, clearly labelled.
* Suggestions are always labelled as WPKits plugins, only plugins published on WordPress.org by WPKits are installed (checked live), and they can be turned off in MCPKit → Settings.

= 0.5.0 =
* New: full QuoteFold support for the free version (QuoteFold Pro still adds its extras).
* New: mcpkit_quotefold_guide explains the whole plugin to AI apps: customer flow, admin screens, every setting on each tab with options and defaults, statuses, shortcodes, pages, emails and placeholders, and which tool does each job.
* New: mcpkit_quotefold_quote_create (create a quote for a customer through the same hooks as the front-end form), mcpkit_quotefold_quote_items (add, change or remove products), mcpkit_quotefold_quote_delete (with confirm) and mcpkit_quotefold_email_customer (reply to the customer by email; saved in the quote history).
* New: mcpkit_quotefold_page_setup (check, repair or choose the Request a Quote page), mcpkit_quotefold_frontend_check (why the Add to Quote button shows or not, page, settings and Pro checks) and mcpkit_quotefold_report (requests by status, most-requested products, top customers; Pro offers, acceptance and order revenue).
* Improved: mcpkit_quotefold_quote_get adds the Pro PDF link, timeline and chat images; settings tools list all email placeholders and no longer risk the settings screen sanitiser resetting another tab.

= 0.4.1 =
* Fix: Codex setup now adds the site and starts OAuth login in one command, so login cannot run before registration succeeds.
* Fix: the optional Codex installer skips its launch prompt. Setup instructions explain when to wait and how to recover from "No MCP server named".
* Fix: generated Codex commands quote their arguments for safe copying into Terminal.

= 0.4.0 =
* New: QuoteFold – Request a Quote for WooCommerce and QuoteFold Pro tools: mcpkit_quotefold_status, mcpkit_quotefold_quotes_list, mcpkit_quotefold_quote_get (products, customer and seller prices, conversation, admin notes, secure customer link, linked order), mcpkit_quotefold_quote_update (status, customer details, conversation messages, private notes), mcpkit_quotefold_offer_send (Pro: send, draft or accept the customer's prices, with expiry date) and mcpkit_quotefold_settings_get / _update (including Pro email templates; licence keys are never exposed).
* New: Wishlist Kit Lite and Wishlist Kit Pro tools: mcpkit_wishlist_status, mcpkit_wishlist_settings_get / _update (placement, content types, page, My Account tab, appearance and Pro theme, button label, social sharing, email notifications), mcpkit_wishlist_lists and mcpkit_wishlist_report (most-saved items with price and stock).
* New: Rowerr Frontend Translation Editor for MemberPress tools: mcpkit_mptranslate_status, mcpkit_mptranslate_languages (add, delete, switch language, fallback), mcpkit_mptranslate_strings and mcpkit_mptranslate_save (placeholders are validated; a broken batch saves nothing).
* Fix: mcpkit_debug_log_read no longer fails with "fread(): Argument #2 ($length) must be greater than 0" when a log file is empty.
* All new tools use the plugins' own classes and sanitisers, follow the same rules as their admin screens, are always listed, and explain how to activate the plugin when it is inactive. AI apps are told about them on connect when the plugins are active.

= 0.3.0 =
* Fix: Elementor and WooCommerce tools are always listed. Before, AI apps that loaded the tool list before those plugins were activated never saw them. If the plugin is inactive, the tool explains how to activate it; no reconnect needed.
* Fix: the Codex config no longer freezes the tool list and asks for every scope, with a 300-second tool timeout.
* Fix: Theme Builder display conditions ("include/general", "include/product") no longer crash Elementor Pro ("Cannot unset string offsets").
* Fix: Theme Builder widgets saved through MCPKit get their dynamic defaults (product title, archive title, post title, site logo...) instead of placeholder text.
* New: unknown Elementor setting names are reported as warnings instead of being silently ignored.
* New: heavy tools get up to 5 minutes; the activity log records each call's duration and flags slow calls.
* New tools: mcpkit_batch (up to 25 calls in one request), mcpkit_plugin_search (find exact slugs; "plugin not found" now suggests close matches), mcpkit_term_list / mcpkit_term_save (any taxonomy, with image and order), mcpkit_widgets_list / mcpkit_widget_save (widget areas and block widgets), mcpkit_media_import (up to 20 images with alt text, credits, resize and WebP), mcpkit_site_check_page (load a page as a visitor and catch PHP errors) and mcpkit_debug_log_read (debug.log and PHP error log).
* Tidy: HTML entities decoded in site and plugin names; mcpkit_theme_mods_update refuses WordPress options such as blogname and says which tool to use.

= 0.2.1 =
* Fix: creating a WooCommerce customer no longer fails when the store does not generate usernames; one is made from the email.
* Fix: order links open the right edit screen with HPOS order storage.
* Fix: the Terms page gets starter text when store pages are built with Elementor; a note explains when WordPress adds "-2" to a new page address.
* Fix: CartFlows global checkout now points to the flow's checkout step.
* Tidy: readable settings labels and clearer store-check messages.

= 0.2.0 =
* New: WooCommerce tools (31). Products of every type with images, gallery, categories, tags, attributes, downloads, sale prices and stock; variations with their own prices, images and stock, or generate every combination; categories, tags, global attributes and terms, shipping classes.
* New: orders (list, view, create, change status, cancel, notes, refunds), customers (name, email, password, billing and shipping address), coupons, taxes (settings, classes, rates), payment methods (enable, titles, settings; secrets masked), shipping zones, every WooCommerce setting, and sales reports (sales per day, top products and customers, coupons, stock).
* New: store pages. Create or repair Shop, Cart, Checkout, My Account and Terms with shortcodes, blocks or Elementor Pro widgets, and a store check that tests the whole Shop > Cart > Checkout > My Account journey, including CartFlows checkout overrides.
* New: WooCommerce guide for AI apps (all shortcodes and where they go, My Account tabs, Elementor Pro WooCommerce widgets and templates, CartFlows) and full WooCommerce REST access for anything else.
* New: shop.read and shop.manage permissions. Connections that already had full access get them automatically.
* Fix: a disconnected site no longer crashes Claude Desktop's connection on every start ("Server disconnected" / "Couldn't start ... Connection closed"). MCPKit now answers with a single "connection status" tool that explains how to remove the site.
* New: Disconnect also removes the site from Claude Desktop on local sites, with a backup of the config. The Connect page has a "Remove from Claude Desktop" button and a Terminal command for other computers.

= 0.1.9 =
* New: Local site key. Sites running on your computer (Local, MAMP, Docker) connect Claude Desktop and Claude Code with one command and no sign-in page.
* Fix: after you revoke a connection, AI apps get a clear "access revoked" message instead of reopening the authorize page again and again.
* Fix: the MCP stream endpoint (GET) now accepts Application Password logins, so Claude no longer opens the authorize page in a loop when using a key.
* New tools: users and roles (list, create, update, delete), plugins (list, install from WordPress.org, update, delete), theme install, Customizer settings (theme mods) and Additional CSS, permalinks, option search and cache flush.
* New: Blocksy support (status, extensions on/off, Customizer settings for header, footer, colors and typography).
* New: Elementor and Elementor Pro settings, features/experiments and Replace URL.
* New: CotKit Addons for Elementor module list and enable/disable.
* New media tools: get details, delete, crop/resize/rotate/flip images, regenerate thumbnails.

= 0.1.8 =
* Fixed Claude Desktop sign-in on local sites with an http address (for example http://mysite.com in Local): Claude's bridge refuses to send logins to non-https addresses, so Claude now connects through the site's https address and trusts Local's certificate automatically.
* Fixed the repeated "Authorize client" loop in Claude Desktop: Easy setup now closes stuck connections and signs in once from Terminal before Claude starts, so Claude Desktop reuses the login and never times out waiting for the browser.
* Token endpoint now returns standard OAuth errors and records the exact reason (and every token request) in the Activity Log.
* Tool titles and descriptions now include the site name so Claude can tell several connected MCPKit sites apart.

= 0.1.7 =
* Fixed Claude Code and Claude Desktop connections: the MCP endpoint now answers unauthenticated requests with a 401 OAuth challenge, so Claude starts the browser login instead of connecting without a token.
* Expired or revoked tokens now return 401 invalid_token so clients refresh or sign in again.
* OAuth requests without a scope now receive all scopes the administrator approves on the consent screen.
* Claude Desktop setup now uses the mcp-remote bridge (claude_desktop_config.json does not support HTTP servers directly) and detects Local site certificates.
* Added Claude Code login command and settings for local HTTPS certificates.
* Added an Easy setup tab for Claude Desktop: numbered copy-paste commands for Mac and Windows that install Node.js when missing, connect Claude Desktop (with a backup of the old config), and restart Claude. The previous steps remain under Manual setup.
* Added content tools: list/get/create/update/delete for any post type, media upload and update, menus, homepage, themes and site settings.
* Added Elementor tools: status, build guide, widget list (Elementor, Pro and add-ons such as CotKit), widget control schemas, save page, targeted element edits, render, global kit styles, templates and theme-builder conditions, CSS cache clear.
* MCP: protocol version negotiation, server instructions, structuredContent always an object, tool annotations, larger result limits for Elementor data.
* Discovery metadata is served before canonical redirects; Authorization header is read from REDIRECT_HTTP_AUTHORIZATION on Apache/CGI hosts.

= 0.1.5 =
* Added OAuth protected resource metadata and MCP authorization challenge responses for Codex OAuth login.

= 0.1.4 =
* Enabled MCPKit abilities by default on new plugin activation.

= 0.1.3 =
* Improved Codex setup guidance with an install step, copyable terminal commands, and clearer OAuth login instructions.

= 0.1.1 =
* Added exact Codex, Claude Code, and Claude Desktop client configuration generation.
* Added OAuth and MCP compatibility hardening for V1 client workflows.
* Verified auth, scopes, revocation, kill switch, rate limits, proposals, audit logs, and redaction with automated local tests.

= 0.1.0 =
* Initial V1 foundation with read-only abilities, scoped connections, approval proposals, rate limits, privacy tools, and audit logs.
