Title: AlphaBridge MCP – Connect Claude and ChatGPT to WordPress
Author: cultureclub
Published: 30.7.2026
Last modified: 6.10.2026
---
Hae lisäosia
# AlphaBridge MCP – Connect Claude and ChatGPT to WordPress
[cultureclub](https://profiles.wordpress.org/cultureclub/)
[Lataa](https://downloads.wordpress.org/plugin/alphabridge-mcp.4.5.3.zip)
[Live Preview](https://fi.wordpress.org/plugins/alphabridge-mcp/?preview=1)
* [Tiedot](https://fi.wordpress.org/plugins/alphabridge-mcp/#description)
* [Arvostelut](https://fi.wordpress.org/plugins/alphabridge-mcp/#reviews)
* [Asennus](https://fi.wordpress.org/plugins/alphabridge-mcp/#installation)
* [Kehitys](https://fi.wordpress.org/plugins/alphabridge-mcp/#developers)
[Tuki](https://wordpress.org/support/plugin/alphabridge-mcp/)
## Kuvaus
**Claude and ChatGPT on your WordPress site. Read-only until you flip one switch,
then full power. Free.**
AlphaBridge MCP turns your WordPress site into a native **MCP server** (Model Context
Protocol). An AI assistant such as Claude — on Claude.ai, in Claude Desktop, Claude
Code or Cursor — connects over one authenticated HTTPS endpoint. ChatGPT connects
the same way, as an MCP app on the Plus, Pro, Business, Enterprise and Edu plans.
The assistant writes and edits posts, pages, media, categories and tags, and replies
to and moderates comments. It reads widgets, site settings and the outline of pages
built with blocks or a common page builder. Every tool checks WordPress permissions
on every single call.
Tell Claude what you want done — ”draft a post from these notes, add last week’s
photos, file it under the right categories and schedule it for Friday” — and it
happens on your site, not through screen-clicking or raw admin access.
**One switch, full power**
Out of the box AlphaBridge MCP only reads: write access for AI assistants is off.
Assistants can read content, media, terms, comments, settings and the structure
of the site. Every tool that creates, changes or deletes is refused, and so is every
reading tool noted «only with write access» under Fine-tuning: in this plugin that
is the reader of user profile fields. The answer says why, what the person can do
and links straight to the switch.
The main switch «Write access for AI assistants» at the top of Settings AlphaBridge
MCP holds for every connection — Claude, ChatGPT, Cursor and all others. Switching
write access on switches every tool on; each connection keeps its access level (
Full, Content or Read only). Switching it off takes one click.
Before switching on, an administrator ticks a box: changes take effect immediately,
it is at the site owner’s own risk, and a current backup exists. The account, the
time, the version of that notice and its wording are recorded.
* Every connection acts as a real WordPress user, and every tool checks the matching
WordPress capability. What that user may not do, the AI cannot do.
* Scoped connections: hand out a read-only or content-only key with an optional
expiry instead of full access. Rotate a connection’s secret in one click.
* Fine-tuning: every tool is on, and switching write access on switches every tool
on again. Switch single tools or whole groups off, and they vanish from the MCP
surface until write access is switched on the next time. Each tool says whether
it reads or writes.
* Every refusal leads somewhere: when write access is off, the connection’s access
level or the account’s role does not reach, or a tool is switched off, the answer
names the reason, the steps and a direct link, for the assistant to pass on.
A tool that belongs to the separate AlphaBridge MCP Pro is named as such, with
the page that describes the editions.
* An audit log keeps the latest 200 tool calls, and a rate limit of 120 requests
a minute stops abusive request bursts.
**Connected in two minutes**
In Claude, connect «AlphaBridge MCP for WordPress» from the connector directory.
Enter your site’s address and approve on your own site’s login-protected consent
screen. There is no endpoint or token to copy: it is standard OAuth 2.1 with PKCE,
the login is your WordPress login, and you need no account with us. This entry runs
through the AlphaBridge Connect hub described below. To connect directly, paste
your endpoint URL into Claude as a custom connector instead.
ChatGPT connects the same way: add the endpoint as an MCP app (Plugins Add Create
MCP app, authentication OAuth) and approve on your site. This was checked on 26
September 2026 with ChatGPT Pro, directly and through the hub. For clients without
a Connect button, create a token manually and paste one ready-made config.
The whole way in one minute — install, connect from Claude’s directory, approve
on your site, give Claude a first task:
In German: [Claude mit WordPress verbinden](https://www.youtube.com/watch?v=M262gCOc7gM)
**AlphaBridge Connect: up to 10 sites in one chat, free**
The entry «AlphaBridge MCP for WordPress» in Claude’s connector directory is the
hosted hub at connect.alphabridge-mcp.com. You enter your site’s address instead
of copying the endpoint, and you approve the site on its own login screen. Through
the hub, up to 10 sites work from one chat, in every edition including this free
plugin: add a site from the chat and keep working in the same conversation. Each
site keeps its own rights and its own audit log.
The hub is optional and free, and this plugin never contacts it on its own. The
hub connects to your site for authorization, connection setup and management, and
to forward the tool calls you make through it. It stores the site’s access key encrypted
and passes content through without storing it. The details are in its privacy notice(
https://connect.alphabridge-mcp.com/legal/privacy) and its data processing agreement(
https://connect.alphabridge-mcp.com/legal/dpa).
**Nothing extra to host**
Unlike bridge-based solutions, AlphaBridge speaks MCP directly in PHP inside WordPress.
With a direct connection there is no Node middleware, no external service and nothing
else to run or pay for — it works on ordinary WordPress hosting. The hub above is
the one optional exception, and you choose whether to use it.
**Free means free**
Everything in this plugin is fully functional: no license keys, no registration,
no plan-based, cumulative or time-based usage limits, no locked features.
**What’s inside**
* Native MCP endpoint (JSON-RPC 2.0 over HTTP POST; protocol versions 2024-11-05,
2025-03-26, 2025-06-18 and the stateless 2026-07-28, side by side on the same
endpoint; the newest one can be switched off) — no external server required.
* 40 structured tools across content, media, taxonomies, comments, widgets, site
settings, site info, SEO reads and search.
* Bearer-token authentication mapped to a real WordPress user, with per-tool capability
checks.
* Unlimited connections — create one deliberately limited key per client.
**How it compares**
A dated comparison with other WordPress MCP plugins, every cell checked against
the vendors’ own pages: https://alphabridge-mcp.com/compare.html
**Need more? AlphaBridge MCP Pro and Agency**
A separate commercial add-on, AlphaBridge MCP Pro, lets the assistant do more:
* change texts, links and images on pages of many page builders;
* run the abilities other plugins offer, and say so when such a run reports success
on a post but nothing was saved;
* edit plugin and theme files and the PHP snippets of Code Snippets or WPCode;
* check the site with test requests after saving active PHP code, and put the previous
version back automatically when one of them ends with a fatal error;
* use tool groups for the database, users, menus, WooCommerce and migration;
* undo many of the changes made through it (undo points expire after 7 days by
default, adjustable from 1 to 30 days).
The Agency plan adds Site Deploy for agencies and developers: files, themes and
whole builds published over SFTP onto the server this site runs on. ZIP deploys
can run atomically, with rollback when the swap fails.
Pro can be tried free for 7 days, no card needed. Both are entirely optional — this
free plugin is complete on its own and stays fully functional without them. Details
are on the plugin website.
AlphaBridge is our own product brand for this project. MCP (Model Context Protocol)
is an open protocol standard; this plugin is an independent implementation and is
not affiliated with or endorsed by the protocol’s authors or by any other vendor.
### External services
This plugin makes no automatic outbound requests and sends no telemetry. Two things
can contact an external address, each only on a deliberate step:
* One tool, on your explicit instruction: when you call `wp_upload_media_from_url`
with a URL, the plugin downloads that file from the address you provide (and
up to a few safely re-validated redirects; SSRF-guarded, type- and size-checked).
* Connecting an app through OAuth: an app may identify itself not by registering
with your site but by the HTTPS address of its client metadata document (OAuth
Client ID Metadata Documents, the registration the MCP specification prefers
since 2026-07-28). When such an app sends you to your site’s consent screen,
and only once you are logged in there with the right to approve connections,
the site fetches that one document from the address the app named — a small JSON
file with the app’s name and return addresses — to check where the approval may
be sent (and once more when the app collects its access, if the copy has expired
by then). The request comes from your server’s address and names only the plugin
and its version as user agent; it carries no cookies, no tokens and nothing else
about your site or you. The address must be https and resolve only to public
network addresses; redirects are not followed; the document may be at most 5
KB, the request waits at most 5 seconds, and the document is kept for at most
a day (five minutes unless its server says otherwise). Which apps use this is
up to the app makers; the consent screen names the host the document comes from.
You can switch it off under Settings AlphaBridge MCP Your connections «Connect
from Claude (OAuth, advanced)» «Accept apps with a metadata document» (a developer
also with the `ab_mcp_oauth_cimd` filter), and it is off while WordPress blocks
outgoing requests (`WP_HTTP_BLOCK_EXTERNAL`); registration then remains the only
way to connect.
The plugin itself initiates no other outbound requests.
## Kuvankaappaukset
[⌊At the top, the main switch for write access, off until you turn it on. Below
it, pick your assistant — Claude, ChatGPT, Cursor or another client — and follow
its steps: for Claude a direct link into its connector directory, this site's address
to copy, the video and the guide. A token is created only where one is needed.⌉⌊
At the top, the main switch for write access, off until you turn it on. Below it,
pick your assistant — Claude, ChatGPT, Cursor or another client — and follow its
steps: for Claude a direct link into its connector directory, this site's address
to copy, the video and the guide. A token is created only where one is needed.⌉[
At the top, the main switch for write access, off until you turn it on. Below it,
pick your assistant — Claude, ChatGPT, Cursor or another client — and follow its
steps: for Claude a direct link into its connector directory, this site’s address
to copy, the video and the guide. A token is created only where one is needed.
[⌊The moment you create a connection, the plugin shows what you need once — the
Bearer token and a copy-paste config for Cursor / Claude Code, and the connector
URL if connector-URL authentication is switched on — with a reminder to save it,
because the token is shown in full only once.⌉⌊The moment you create a connection,
the plugin shows what you need once — the Bearer token and a copy-paste config for
Cursor / Claude Code, and the connector URL if connector-URL authentication is switched
on — with a reminder to save it, because the token is shown in full only once.⌉[
The moment you create a connection, the plugin shows what you need once — the Bearer
token and a copy-paste config for Cursor / Claude Code, and the connector URL if
connector-URL authentication is switched on — with a reminder to save it, because
the token is shown in full only once.
[⌊Optional advanced settings for a connection: a label, the WordPress user it acts
as, full, content-only or read-only access, and an optional expiry in days.⌉⌊Optional
advanced settings for a connection: a label, the WordPress user it acts as, full,
content-only or read-only access, and an optional expiry in days.⌉[
Optional advanced settings for a connection: a label, the WordPress user it acts
as, full, content-only or read-only access, and an optional expiry in days.
[⌊Switch all tools, a group or a single tool; open a group to see its tool groups
and what each tool does, whether it reads or writes, or search for one. These switches
sit under «Fine-tuning», below the main switch for write access at the top of the
page.⌉⌊Switch all tools, a group or a single tool; open a group to see its tool
groups and what each tool does, whether it reads or writes, or search for one. These
switches sit under «Fine-tuning», below the main switch for write access at the
top of the page.⌉[
Switch all tools, a group or a single tool; open a group to see its tool groups
and what each tool does, whether it reads or writes, or search for one. These switches
sit under «Fine-tuning», below the main switch for write access at the top of the
page.
[⌊Connect from Claude is on by default: Claude discovers the site, you approve on
a login-protected consent screen, and the approved connection appears in the list,
revocable any time. Switching it off removes the OAuth endpoints. A second box lets
apps identify themselves with a metadata document instead of registering.⌉⌊Connect
from Claude is on by default: Claude discovers the site, you approve on a login-
protected consent screen, and the approved connection appears in the list, revocable
any time. Switching it off removes the OAuth endpoints. A second box lets apps identify
themselves with a metadata document instead of registering.⌉[
Connect from Claude is on by default: Claude discovers the site, you approve on
a login-protected consent screen, and the approved connection appears in the list,
revocable any time. Switching it off removes the OAuth endpoints. A second box lets
apps identify themselves with a metadata document instead of registering.
[⌊Connector-URL authentication is off by default, because a token in a URL leaks
more easily than one in a header; the setting explains the trade-off before you
switch it on.⌉⌊Connector-URL authentication is off by default, because a token in
a URL leaks more easily than one in a header; the setting explains the trade-off
before you switch it on.⌉[
Connector-URL authentication is off by default, because a token in a URL leaks more
easily than one in a header; the setting explains the trade-off before you switch
it on.
## Asennus
1. Upload the `alphabridge-mcp` folder to `/wp-content/plugins/` (or install the ZIP
via Plugins Add New Upload).
2. Activate the plugin.
3. In Claude, open Connectors, find «AlphaBridge MCP for WordPress» in the directory
and connect: enter your site’s address and approve on your own site’s login-protected
consent screen. Done. To connect directly, without the AlphaBridge Connect hub
in between, add a custom connector with the endpoint `https://your-site.tld/wp-
json/alphabridge/v1/mcp` instead. In ChatGPT: Plugins Add Create MCP app with
the endpoint and OAuth.
4. For clients without a Connect button (Cursor, Claude Code, scripts): open **Settings
AlphaBridge MCP**, create a connection manually and copy its token.
5. The plugin starts with write access off: assistants can read content, media, terms,
comments, settings and the structure of the site. To let them create, change and
delete, and read user profile fields, switch on «Write access for AI assistants»
at the top of **Settings AlphaBridge MCP**. Changes then take effect immediately
and not everything can be undone; you switch it on at your own risk, so make sure
you have a current backup.
## UKK
### Is it secure?
Every request needs a token bound to a WordPress user; each tool enforces the matching
WordPress capability, including object-level checks for the specific post, attachment
or taxonomy (non-public taxonomies additionally require that taxonomy’s own capability).
Out of the box the plugin only reads: every tool that creates, changes or deletes,
and every reading tool noted «only with write access» (in this plugin the reader
of user profile fields), is refused until an administrator switches on write access
at the top of Settings AlphaBridge MCP, at the site owner’s own risk; single tools
and whole groups can then be switched off again under «Fine-tuning». The latest
200 calls are logged. Arbitrary option or transient values cannot be read through
this plugin at all — only a fixed list of common site settings is exposed, and the
settings of registered widgets through wp_get_widgets, without the values whose
key the credential guard below refuses. Post, term and user meta is layered-protected:
protected (”_”-prefixed) keys, keys flagged by is\_protected\_meta(), and two kinds
of credential-shaped key are refused: keys whose whole name is a credential word,
singular or plural (token, secret, password, passphrase, passcode, pwd, otp, credential),
and keys containing one of a fixed list of compound credential patterns (api\_key,
access\_token, client\_secret, license\_key, oauth, \_token, \_secret, \_password,
passwd, …). Case and surrounding whitespace are ignored. The list is matched literally,
which makes this guard deliberately conservative rather than exhaustive: token\_count,
password\_hint, credential\_type, api\_version, counters such as maxTokens and camelCase
spellings such as accessToken all pass it, and the layers around it do the real
work — and every generic post, term and user meta read or write additionally passes
WordPress’s own per-key meta capability (edit\_post\_meta / edit\_term\_meta / edit\
_user\_meta), which honours auth\_callback rules that other plugins register via
register\_meta() (the media and SEO tools read only their own fixed keys). A key
you may not edit is not exposed over MCP either. Page-builder data that ends up
in the page as markup or code, also where a builder keeps it under a key without”_”(
such as panels_data, dslc_code, pagelayer-data, brizy, mfn-page-items or tve_updated_post),
is written through the meta argument of wp_create_post and wp_update_post only for
accounts with the unfiltered_html capability; for any other account the call is
refused before anything is written, and the answer names the ways that remain. One
read-only tool reaches further, by design: wp_get_builder_layout, for an account
that may edit the post, reads the page builder’s own stored data of that post, protected(”_”-
prefixed) keys included, to recognise the builder and outline the page — and returns
only the visible text, link and image fields of its elements, never the raw meta,
code, styling or attributes; separate keys that hold a page’s own scripts or CSS
are not read at all. wp_duplicate_post copies protected keys too, into the new draft
only and only for an account that may edit the original: WordPress’ own page template,
featured image and list of removed hooked blocks, and — for accounts with the unfiltered_html
capability, because it holds markup — the post meta of page builders (Elementor,
Beaver Builder, SiteOrigin, Themify, Zion, Live Composer, Brizy, Visual Composer,
SeedProd, Pagelayer), each builder’s keys together or not at all. Credential-shaped
keys, the original’s editing state (edit lock, former slugs, trash data), the meta
of a revision, builder caches and other plugins’ protected keys are not copied.
Tokens are accepted via the Authorization or X-Api-Key header — header authentication
is the default. An admin can optionally enable a connector URL that carries the
token in its path (served with Referrer-Policy: no-referrer and Cache-Control: no-
store); this is off by default, because a token in a URL leaks more easily. Query-
string tokens are never accepted. If you turn the connector URL on, treat it like
a password: it contains the token — rotate the connection if the URL is shared,
logged or pasted anywhere.
### Does it work on shared hosting?
Yes. It is pure PHP and uses the WordPress REST API. PHP 8.0+ and HTTPS are recommended.
### Which page builders does it read?
wp_get_builder_layout reads a page as an outline: its elements in page order, with
their visible text, link and image fields. Elements that cannot be read safely,
such as code, forms or unknown elements, are listed as locked, with the reason and
without their content. `wp_get_post` says which builder a page was made with. As
of 1 October 2026:
* Read: WordPress blocks, Elementor, Beaver Builder, SiteOrigin Page Builder, SeedProd,
GenerateBlocks, Kadence Blocks, Spectra, Stackable, Pagelayer, Otter Blocks and
CoBlocks (both as plain blocks), WPBakery Page Builder, Divi 4, Avada (Fusion
Builder), Flatsome (UX Builder) and Enfold (Avia Layout Builder).
* Read from the vendors’ documentation and code, not yet checked on a live installation(
the answer says so): WPBakery Page Builder, Divi 4, Avada, Flatsome and Enfold.
* Recognised, not read: Brizy, Themify Builder, Zion Builder, Live Composer, Cornerstone,
Thrive Architect, Bricks, Breakdance, Oxygen 6, Oxygen Classic, BeTheme (BeBuilder),
Visual Composer Website Builder, Divi 5 and Etch.
Where a builder shows its own data and post_content is only a copy — Elementor,
Beaver Builder, SiteOrigin Page Builder and Enfold — `wp_update_post` refuses a
change to the content while the builder is active, because it would not show, and
says how to change the page instead. Called without content, it still changes the
title, status, excerpt and the other fields.
### Is the free plugin limited?
No. Every feature in this plugin works without payment, registration or license
keys, and there are no plan-based, cumulative or time-based usage limits. A uniform
security throttle (120 requests/minute, identical for every user) protects your
server from abusive request bursts.
### Does the plugin send data anywhere?
No. It contacts no external service on its own. Outbound requests happen only when
you explicitly ask a tool to fetch a file from a URL you provide, and when an app
you are connecting identifies itself with the address of its client metadata document
and you, logged in, open its consent screen (see External services).
## Arvostelut
There are no reviews for this plugin.
## Avustajat & Kehittäjät
“AlphaBridge MCP – Connect Claude and ChatGPT to WordPress” perustuu avoimeen lähdekoodiin.
Seuraavat henkilöt ovat osallistuneet tämän lisäosan kehittämiseen.
Avustajat
* [ cultureclub ](https://profiles.wordpress.org/cultureclub/)
[Käännä “AlphaBridge MCP – Connect Claude and ChatGPT to WordPress” omalle kielellesi.](https://translate.wordpress.org/projects/wp-plugins/alphabridge-mcp)
### Oletko kiinnostunut kehitystyöstä?
[Browse the code](https://plugins.trac.wordpress.org/browser/alphabridge-mcp/),
check out the [SVN repository](https://plugins.svn.wordpress.org/alphabridge-mcp/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/alphabridge-mcp/)
by [RSS](https://plugins.trac.wordpress.org/log/alphabridge-mcp/?limit=100&mode=stop_on_copy&format=rss).
## Muutosloki
#### 4.5.3
* **All visible texts of the plugin come in German on a German site** (de_DE, de_DE_formal,
de_AT, de_CH, de_CH_informal): the settings page with its cards, notices, tables,
buttons, tooltips and the texts of its script; the consent screen with its access
levels and its error pages; the description in the plugin list; the log, whose
status and time now follow the language; and the refusals and error messages
of the tools that an assistant passes on. The plugin brings these files itself;
a language pack from translate.wordpress.org still takes precedence for every
text it has.
* Stays English on purpose: what is written for the assistant — the descriptions
of the tools and their parameters (shown behind the «i» in the fine-tuning),
the server instructions and the notes on single elements in the outline that `
wp_get_builder_layout` hands over — and the protocol’s own errors (JSON-RPC,
and the error codes the OAuth standard sends to an app). The names and descriptions
of abilities come from the plugins that offer them.
* The reasons why an app’s metadata document is refused, the note of `wp_seo_detect`
about AIOSEO and the status and time in the log are translatable now. The plugin
header names `/languages` as its Domain Path, so the plugin list shows the description
in German also while the plugin is inactive.
* **A command for Claude Code.** After a connection is created, the settings page
shows a ready-made `claude mcp add --transport http …` command with the endpoint
and the token, as the guide on alphabridge-mcp.com does. The config with `mcp-
remote` is now labelled for Cursor only: in Claude Code, `${AUTH}` in that config
stayed empty and `/mcp` reported it missing.
* The note under the fine-tuning names the rate limit without «(fixed)».
* The readme says what the audit log keeps: the latest 200 tool calls.
#### 4.5.2
* **The request for a review is a short strip at the foot of the coloured header**
of Settings AlphaBridge MCP instead of a WordPress notice. As before it appears
only there, once the site has used the plugin for at least 14 days and made at
least 50 successful tool calls, names exactly these figures and asks everyone
the same way. «Write a review» now counts as an answer: the strip does not come
back afterwards, as after «Don’t show again». Its texts, and «(opens in a new
tab)» for screen readers, come in German with the plugin, and so do the texts
of the header around it that were still English on German sites («Connect your
AI assistant», the question below it and the hints on the assistant buttons).
* **A «Settings» link in the plugin list.** The plugin’s row under Plugins now
starts with «Settings», which opens Settings AlphaBridge MCP, as WordPress plugins
usually do. It shows only to users who may open that page, and it comes in German
with the plugin (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal).
#### 4.5.1
* **The answer to a tool of AlphaBridge MCP Pro, and the paragraph about Pro in
the server instructions, state facts only.** A call of a tool that belongs to
the separate AlphaBridge MCP Pro or its Agency plan is answered with the edition
it belongs to and the page that describes the editions and their tools (https://
alphabridge-mcp.com/docs). The steps to install Pro, the request to the assistant
to point the person to Pro and the link to the prices are gone: ChatGPT’s app
directory allows saying that a feature is missing, not promoting an upgrade.
The server instructions of a site without Pro list what is not on the site and
name the same page. No tool, permission or setting changed.
* **The description says which reading tool waits for write access.** It said that
with write access off assistants could not read code, files, the database, logs
or credentials; this plugin has no tool for any of these. Its only reading tool
that waits for write access reads user profile fields (`wp_get_user_meta`). The
description, the installation steps and the FAQ now say so. The description also
says that each connection keeps its access level (Full, Content or Read only)
when write access is on.
* The directory page is shorter: a shorter name and short description, the description
in short paragraphs, the AlphaBridge Connect hub under its own heading (up to
10 sites in one chat, free, in every edition) and AlphaBridge MCP Pro as a list.«
fast, stable» and «faster and more stable» are gone from the plugin’s description
and the readme; nothing measured backs them. The captions of screenshots 1 and
5 match the current settings page.
* The new sentence of the answer to a Pro tool comes in German with the plugin (
de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal); the two sentences with the
steps to install Pro are gone.
* **A token in the query string or in the request body is never accepted, also
with the connector URL switched on.** With the connector URL on, `/mcp?token=…`
and a `token` field in the body were taken as the token too; only the path `/
mcp/` was meant. Now only the path counts, as the FAQ says. Header authentication
is unchanged.
* The server instructions of a site without Pro name changing the texts, links
and images of page-builder elements as not on this site, instead of the texts
of page-builder pages: reading them with `wp_get_builder_layout` works on every
site. The list of what AlphaBridge MCP Pro adds says that its test requests run
after PHP code is saved and catch the fatal errors they hit, not every error.
#### 4.5.0
* **The main switch «Write access for AI assistants» replaces the box with the
modes Read and Full.** It sits where the box was, the first thing on Settings
AlphaBridge MCP, and holds for every connection — Claude, ChatGPT, Cursor and
all others. Off (as every site starts) assistants only read; on, they read and
write with full power. The page calls the states «write access off (read only)»
and «write access on (full power)»; the internal names (`read`, `full`), the
option and the PHP interface stay as they were. Switching on opens a small window
at the switch with the notice and a box to tick (without JavaScript the same
fields stand in the page); switching off takes one click. The notice is new (
version 2): changes take effect immediately, they can create, change and also
delete, not everything can be undone, at your own risk, a current backup. A confirmation
of the notice of 4.4.0 stays valid; nobody has to confirm again.
* **Switching on write access switches everything on.** Every tool is on afterwards,
also one that was switched off before or kept off from a version before 4.4.0.
Single tools can be switched off under Fine-tuning; that holds until write access
is switched on the next time. Only a switch from off to on does this: a second
click from an old tab while write access is on changes nothing. An update alone
resets nothing.
* **The fine-tuning, compact and open.** Four main groups, seven at most with the
Pro add-on (Content; Site & users; Plugins, themes & code; Database & operations;
Shop; Undo; Abilities of other plugins), each with its switch, its tool groups
and how many of its tools are on; every tool group opens its tools. Every tool
shows a short name in your language next to its name in code, and its description
for the assistant behind an «i»; the search finds a tool by either and by the
names of its groups. The only badges left are «Reads» and «Writes», each with
a symbol; readers that wait for write access say «only with write access». One
button saves everything.
* **Refusals of the switch, the access level, the role and the fine-tuning lead
to the place where they are changed.** When write access is off, the connection’s
access level does not include a tool, the account lacks the capability, or a
tool is switched off under Fine-tuning, the answer says why in one sentence,
what the person can do, gives a direct link (to the switch, the fine-tuning,
the connections or the users) and asks the assistant to pass it on kindly and
try again afterwards. The same holds where a tool itself refuses because the
account’s role does not allow it — this post, this user’s meta, publishing: the
answer adds that an administrator can change the account’s role under Users,
with the link.
* **Tools of AlphaBridge MCP Pro are named as such.** A call of a tool that belongs
to the separate AlphaBridge MCP Pro or its Agency plan is answered with what
it is and where it comes from instead of «Unknown tool», and the server instructions
of a site without Pro say in a short paragraph what Pro adds. Nothing in this
plugin is locked or limited by it.
* **New connections start with the full access level.** The consent screen preselects«
Full», and says that the switch for write access on the site decides whether
assistants may write; an approval without a choice gets the full level too. Connections
made before keep their level.
* The texts of the switch and the fine-tuning, the short names of the tools and
the refusals for the account’s role come in German with the plugin (de_DE, de_DE_formal,
de_AT, de_CH, de_CH_informal); dates on the settings page follow the language.
* For add-ons: the action `ab_mcp_reset_switches` (write access switched on), the
filters `ab_mcp_unavailable_tool_message` and `ab_mcp_tool_label` (a tool’s short
name), the action `ab_mcp_fine_save` (one save for the fine-tuning), the helpers`
AB_MCP_Admin::fine_row_html()`, `fine_sub_html()`, `count_badges()` and `addon_text()`,
and the class `AB_MCP_Guidance` with `role_refusal()`.
#### 4.4.0
* **Page builders: `wp_get_builder_layout` recognises the builder a page was made
with and reads the page as an outline.** For an account that may edit the post,
it lists the page’s elements in page order, each with its id, type and parent,
and with its visible text, heading, HTML, link and image fields. Code, forms,
global parts and elements it does not know are listed as locked, with the reason
and without their content; the raw builder data, styling, attributes and scripts
are never handed out. The answer also names the builder, whether it is active,
what the site shows (`storage`), where copies of the page are kept, a hash of
the layout to compare before and after a change, and the tools that change the
page with a visible effect (`write_via`). Read, as of 1 October 2026: WordPress
blocks, Elementor (classic and atomic elements), Beaver Builder, SiteOrigin Page
Builder, SeedProd, GenerateBlocks, Kadence Blocks, Spectra, Stackable, Pagelayer,
Otter Blocks and CoBlocks (both as plain blocks), WPBakery Page Builder, Divi
4, Avada, Flatsome and Enfold — the last five from the vendors’ documentation
and code, not yet checked on a live installation, which the answer says. Further
builders, among them Bricks, Breakdance, Oxygen and Divi 5, are recognised but
not read; the dated list is in the FAQ. An Elementor element that Elementor has
not registered is listed as locked with the way: the plugin that provides it;
for a container while Elementor’s Container feature is off, the switch under
Elementor › Settings › Features; for an atomic element while Elementor’s Atomic
Editor is off, the switch under Elementor › Settings › Atomic Editor. A guided
prompt, `edit_builder_page`, takes an assistant through recognising, reading,
previewing, applying and checking a change.
* **`wp_get_post` says which page builder a post was made with.** The new field`
built_with` names the builder, whether it is active, its version, what the site
shows and the tools that change the page with a visible effect, with a note where
post_content is not simply the page.
* **`wp_list_posts` filters by page builder.** `built_with` takes a builder id
as `wp_get_post` names it, `any` for every known builder or `none` for posts
without one. The totals count only matching posts, and each listed post names
the builder found on it.
* **`wp_update_post` refuses a change to the content only where the builder shows
its own data.** Where an active builder renders a page from its own data — Elementor,
Beaver Builder, SiteOrigin Page Builder or Enfold, and only on a page that has
such data — post_content is a copy the site does not show, so a change to it
would not appear. Such a call is refused before anything is written, and the
answer says how to change the page instead; title, status, excerpt and the other
fields still change when the call leaves the content out. Where the builder is
inactive, restores its own copy on its next save, or may or may not show its
own data, the change is saved and the answer says what to expect.
* **`wp_duplicate_post` copies a page with its custom fields and page builder data.**
A copy used to carry only title, content, excerpt, parent, order and terms, so
a builder page came out as a text page. For an account that may edit the original,
the copy now also gets the custom fields, the page template, the featured image
and WordPress’ list of removed hooked blocks. Page builder data — Elementor,
Beaver Builder, SiteOrigin, Themify, Zion, Live Composer, Brizy, Visual Composer,
SeedProd and Pagelayer — holds markup, so it is copied only for an account with
the unfiltered_html capability, and each builder’s keys together or not at all.
Elementor elements get new ids where the layout can be read; otherwise it is
copied unchanged, and the answer says so. Other builders’ data is copied byte
for byte, and the answer says so. Builder caches, credential-shaped keys, the
original’s editing state and other plugins’ protected keys are not copied; the
answer lists what stayed behind and why.
* **Hardening: page builder data in the `meta` argument needs the unfiltered_html
capability.** `wp_create_post` and `wp_update_post` wrote keys without ”_” in
which a page builder keeps markup or code — `panels_data`, `dslc_code`, `pagelayer-
data`, `brizy`, `mfn-page-items`, `tve_updated_post` and others — for any account
that may edit posts. For an account without unfiltered_html such a call is now
refused before anything is written; the answer names who has the capability,
the builder’s own editor, the tools that change the page’s texts, and the call
without the key for the other fields. Other keys behave as before. Site owners
can change the list with the `ab_mcp_builder_markup_meta_keys` filter.
* **MCP 2026-07-28 alongside the older revisions.** The endpoint also speaks the
stateless revision 2026-07-28: a request that names it in `_meta` is answered
in it, with `server/discover`, result types, cache hints and the checks of the`
MCP-Protocol-Version`, `Mcp-Method` and `Mcp-Name` headers, and without a session.`
initialize` and the requests of the revisions 2024-11-05, 2025-03-26 and 2025-
06-18 are answered as before, apart from one new field in the site’s self-description(`
protocol_versions`). The newer revision can be switched off under Settings AlphaBridge
MCP Your connections «MCP protocol 2026-07-28 (advanced)», or with the `ab_mcp_modern_protocol`
filter; the site then answers in the older revisions only.
* **Apps can identify themselves with a client metadata document (CIMD).** Besides
registering with the site (RFC 7591, unchanged), an app may give the HTTPS address
of its client metadata document as its client id, the registration MCP 2026-07-
28 prefers. The site fetches that document only once a logged-in user who may
approve connections opens the consent screen: from public addresses only, without
redirects, at most 5 KB within 5 seconds, kept for at most a day. The consent
screen names the host it came from. It can be switched off under Settings AlphaBridge
MCP Your connections «Connect from Claude (OAuth, advanced)» «Accept apps
with a metadata document», or with the `ab_mcp_oauth_cimd` filter, and it is
off while WordPress blocks outgoing requests. Details under External services.
* **Read out of the box: the modes Read and Full.** AlphaBridge MCP now starts
in Read, on new sites and on every site after this update: assistants can read
content, media, terms, comments, settings and the structure of the site; every
tool that creates, changes or deletes is refused, `wp_undo` included, and so
is every tool marked Mighty that reads code, files, the database, logs or credentials,
with an answer saying why and that an administrator can switch to Full at the
top of Settings AlphaBridge MCP. That switch is the first thing on the page.
Switching to Full takes a ticked box under a notice that it can be destructive
and is at the site owner’s own risk; the account, the time, the version and the
wording of the notice and the plugin version are recorded in the plugin’s settings
and in its log, the last 20 switches also in a history that clearing the log
leaves alone, and the page shows since when and by whom — or that code set Full
and nobody confirmed it there. In Full every tool is on, the powerful ones marked
Mighty included, unless an administrator switches it off under «Fine-tuning (
for advanced users)». Back to Read takes one click. The server instructions and
the consent screen say when a site is in Read; the tools it refuses stay listed
there, as writing tools did under the former read-only mode, and are refused
when called. After the update, administrators see a notice that explains the
change until one of them dismisses it or switches the mode. The global read-only
switch is gone, Read replaces it; switches saved before no longer hold writing
Mighty tools off, while a Mighty tool that only reads and was switched off stays
off in Full until an administrator switches it on under Fine-tuning. The texts
of the modes come in German with the plugin (de_DE, de_DE_formal, de_AT, de_CH,
de_CH_informal); a language pack from translate.wordpress.org takes precedence.
The access levels per connection (Read only, Content, Full) are unchanged.
* **The access levels on the consent screen are described.** When an app connects,
the consent screen offers Read only, Content and Full as a choice, each with
one sentence on what the connection may then do and what not. Content stays preselected.
* **Refusals from AlphaBridge’s own checks name the way.** Where AlphaBridge itself
refuses a call or reports a failure, the answer now says, beyond what did not
work and why, what does: the tool that finds an id, the right it takes and who
has it, the switch under Settings AlphaBridge MCP Fine-tuning, a wider access
level when connecting, the values a parameter accepts, the filter a site owner
can use — and, where WordPress gives no reason, how to check the result. Errors
WordPress itself reports are passed on as WordPress words them. The rate limit
names its figure. No limit, permission or behaviour changed.
* **The texts about the Pro add-on’s undo give its current window:** undo points
expire after 7 days by default, adjustable from 1 to 30 days, in the description
and in the box about AlphaBridge MCP Pro on the settings page.
* For add-ons: the builder interface is versioned by the constant `AB_MCP_BUILDER_API`(
1), with the filters `ab_mcp_builder_adapters`, `ab_mcp_builder_signatures`, `
ab_mcp_builder_block_profiles`, `ab_mcp_builder_write_via` and `ab_mcp_builder_content_update_guard`.`
AB_MCP_Site_Mode` says which mode a site is in (`get()`, `is_full()`, `allows()`),
and the action `ab_mcp_site_mode_changed` fires when an administrator switches.
A connection with Content access may run an add-on’s `wp_update_builder_element`.
#### 4.3.11
* **An invitation to the affiliate programme, on the settings page.** One line
in the side column, below the box about AlphaBridge MCP Pro: the commission —
60% of every Pro and Agency sale you refer, renewals included — and a link to
the programme’s page on alphabridge-mcp.com, which has the full terms and says
how to apply. The link opens in a new tab and carries no tracking. The commission
comes from sales of the separately sold Pro and Agency editions; this free plugin
itself earns none. Where the Pro add-on shows your own affiliate figures, it
takes the line’s place. No tool or setting changed.
* For add-ons: the filter `ab_mcp_affiliate_invite` decides whether the line shows.
#### 4.3.10
* **A new settings page: pick your assistant first, then follow its steps.** The
page opens with the plugin’s logo, this site’s state (connections, tools switched
on, read-only mode) and a choice of assistant — Claude, ChatGPT, Cursor or another
client. Each gets its own steps with direct links: for Claude into its connector
directory, with this site’s address ready to copy, the setup video and the step-
by-step guide; for ChatGPT to its plugins page, with this site’s endpoint. Creating
a token is offered where one is needed — for Cursor and other clients — and no
longer next to the ways that never use one. The page remembers the assistant
you picked in your browser.
* **Capabilities with switches.** One switch turns all tools on or off, one read-
only mode, and every group has a switch of its own. Open a group to see each
tool with what it does — the first sentence, the whole description behind the«
i» — and switch it on its own. A search finds a tool by name or description.
A group that is partly on shows it; the bar at the bottom tells you when switches
have changed and are not saved yet. What the form saves is unchanged.
* The connections now follow the capabilities, above the log. «1 tool» instead
of «1 tools».
* For add-ons: the side column has a place for their boxes (`ab_mcp_admin_side_boxes`),
between the box about AlphaBridge MCP Pro and the guides.
#### 4.3.9
* **The box about AlphaBridge MCP Pro on the settings page says what Pro adds,
how to try it and what it costs.** It now stands at the top of the side column:
what the separately sold plugin adds on this site, a button that starts the 7-
day trial without a card, and the monthly and the yearly price. Each link opens
the Freemius checkout, which sells AlphaBridge MCP Pro, for exactly what it names—
trial, monthly or yearly — and carries no tracking. On a site where AlphaBridge
MCP Pro runs with a valid Pro or Agency licence the box no longer shows; it offered
what the site already had. Its look comes from a small stylesheet that ships
with the plugin and loads only on this settings page; nothing is loaded from
outside. No tool or setting changed: this free plugin remains complete and fully
functional on its own.
#### 4.3.8
* **`wp_update_post` saves a page whose page template is gone like any other.**
WordPress saves a post’s page template along on every save; where that template
no longer exists — after a theme switch, say — the tool reported «Invalid page
template» although the change was already saved, and the hooks after the save
did not run: a scheduled post got no schedule, caches were not cleared. Now WordPress
falls back to the default template, as the classic editor does, and finishes
the save; the page already looked that way.
#### 4.3.7
* **In `wp_update_post`, a file that would take its visibility from its parent
needs the right to publish — also through «draft» or another parent.** WordPress
stores a file with any status but «private», «trash» or «auto-draft» as «inherit»,
and a file with «inherit» is as visible as its parent: public without one, and
public the moment the parent is published. `wp_update_post` asked for the right
to publish only when the status asked for would publish, so an account without
that right could make a private file public by asking for «draft» or «pending»,
or make a file that a draft kept hidden public by giving it another parent. Now
a save that makes a file «inherit», or leaves a file «inherit» or in the trash(
from where it comes back as «inherit») under another parent, needs the right
to publish — whatever the parent’s status is now, since a draft that is published
later shows the file too. The parent that counts is the one WordPress stores:
none where a loop would run through the file, which any save can cause, a title
alone included. A save that leaves status and parent as they are needs no such
right. This is stricter than it would have to be in some cases, on purpose: an
account without the right to publish can no longer move a file from one published
post to another. «Visible» means the attachment page, the file’s entry in the
REST API and its title, caption and description: WordPress never protects the
uploaded file itself, whose address stays reachable.
* **`wp_create_post` and `wp_duplicate_post` make no files.** A file created or
copied there had no file behind it: an attachment page with whatever text was
given, stored as «inherit» — public without a parent — and a copy of a private
file showed its title, caption and description. Files are added with `wp_upload_media`
or `wp_upload_media_from_url`. A copy WordPress could not save is now reported
as an error; it came back as a copy with the id 0.
* **A parent must be a post id.** `wp_update_post` took a parent given as null
or a list as none — a file came off its post, a page moved to the top level —
and `wp_create_post` took a list as post 1. Both are refused now. A file goes
under another post only where the account may edit that post, as with the upload
tools, and never under a revision or another file.
* **A post in the trash that `wp_update_post` gives a status comes out the way
WordPress takes one out:** its comments get their states back, the notes the
trash keeps are removed, and the hooks other plugins listen to run; a plugin
may also keep it in the trash. It is still one save, with the status, date and
fields asked for.
* **`wp_update_media` reports a save that failed** instead of «updated», and follows
the rule of `wp_update_post` for files.
* **`wp_delete_post` puts every kind of post into the trash unless `force` is set.**
It promised the trash, but WordPress moves only posts and pages there: a product,
an event or a post of any other type was deleted for good, and a file together
with the file on the server. Without `force` any post now goes to the trash.
A file is deleted with `wp_delete_media` or with `force`, since the media library
has no trash unless a site turns it on. A post already in the trash, or on a
site without a trash, needs `force` to be deleted for good.
#### 4.3.6
* In the connections list, the time a connection was last used and an expiry still
ahead are shown as the site’s date and time in digits, to the minute, for example«
2026-09-27 12:52» — the form of the log below, which adds the seconds. They were
phrases such as «2 weeks ago» and «in 3 days»: WordPress translates the time
span, the words around it come from this plugin, and a site whose language this
plugin has no translation for yet mixed the two — a German site read «2 Wochen
ago». «never», «expired» and the dash for a connection not used yet stay as they
were. Found while recording a setup video on 27 September 2026.
* The steps for Claude start with the simplest way: «AlphaBridge MCP for WordPress»
in Claude’s connector directory, where you enter your site’s address instead
of copying the endpoint; it connects through the AlphaBridge Connect hub. The
settings screen shows that way first, with this site’s address, while connecting
from Claude (OAuth) is switched on — the hub signs in through it. The direct
way, a custom connector with the endpoint, follows as the way without the hub.
* The steps for Claude no longer spell out its menus. Claude has rearranged them—
Connectors now sit under «Customize», and a custom connector is added through
an «Add» menu — so the settings screen, the notice after saving the tool selection
and the installation steps, which pointed to «Settings Connectors», no longer
matched what Claude shows. The settings screen and the installation steps now
say to open Connectors in Claude and add a custom connector there. The notice
after saving says where in Claude to make a change visible: in Connectors, refresh
the connector’s tool list — new in the notice — or disconnect and connect again.
* `wp_list_posts` keeps a steady order when several posts share the same date to
the second, as posts created by an import or a script often do. Such posts came
back in whatever order the database chose, which could change from one call to
the next, so paging through a list could show one of them twice and leave another
out. Posts that tie on the field being sorted by — date, title, modified or menu
order — are now also sorted by their id, in the same direction, so a tie no longer
shifts posts between pages. Sorting by id is unchanged. Found while recording
a setup video on 27 September 2026, on a demo site where several posts carry
the same date.
* `wp_update_post` takes a date, in the forms `wp_create_post` takes: site time,
or RFC 3339 with an offset. Neither tool publishes a post, or takes one off the
site, unless the call asks for it. WordPress decides between «publish» and «future»
by the date: a post saved as «future» whose date is not at least a minute ahead
is published at once. Until now «future» without a date did exactly that to a
draft, which takes the time of the save. Such a save is now refused before anything
is written, with the date it would have had and what to pass instead — a later
date to schedule, status «publish» to publish, status «future» to schedule a
published post. An edit to …
## Metatiedot
* Version **4.5.3**
* Last updated **17 tuntia sitten**
* Active installations **20+**
* WordPress version ** 6.5 or higher **
* Tested up to **7.1.3**
* PHP version ** 8.0 or higher **
* Language
* [English (US)](https://wordpress.org/plugins/alphabridge-mcp/)
* Tags
* [AI](https://fi.wordpress.org/plugins/tags/ai/)[ChatGPT](https://fi.wordpress.org/plugins/tags/chatgpt/)
[Claude](https://fi.wordpress.org/plugins/tags/claude/)[mcp](https://fi.wordpress.org/plugins/tags/mcp/)
[mcp-server](https://fi.wordpress.org/plugins/tags/mcp-server/)
* [Edistynyt näkymä](https://fi.wordpress.org/plugins/alphabridge-mcp/advanced/)
## Arvosanat
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/alphabridge-mcp/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/alphabridge-mcp/reviews/)
## Avustajat
* [ cultureclub ](https://profiles.wordpress.org/cultureclub/)
## Tuki
Viimeisen kahden kuukauden aikana ratkaistut ongelmat:
0 / 1
[Tukifoorumi](https://wordpress.org/support/plugin/alphabridge-mcp/)