Adds three diagnostic tools (site status, error-log tail, cron schedule), preserves HTML across several write tools, and adds admin notices for two common environment issues that block OAuth discovery.<\/p>","1.4.33":"
Adds scheduling and backdating to the post and page write tools, expands the create-status enum, and exposes a new action hook for ecosystem extensions.<\/p>","1.4.32":"
Adds snippet excerpts to Security hardening and ergonomic improvements for post-identifying tools. Recommended for all users.<\/p>","1.4.30":" Adds the first structural-write Elementor tool plus capability-order hardening across six integration wrappers. Recommended for all users.<\/p>","1.4.29":" Reliability fix for the runtime DB migration. Recommended for anyone on 1.4.27.<\/p>","1.4.28":" Adds Reliability patch: MCP session state moved onto a dedicated table. No customer action required.<\/p>","1.4.26":" Security patch: per-tool capability checks across the OAuth tool surface. Recommended for all users.<\/p>","1.4.25":" Recommended update. Settings page UX pass and new in-product setup guides for Claude.ai, ChatGPT, Claude Desktop, and Cursor.<\/p>","1.4.24":" Recommended update. Adds Advanced Custom Fields integration and enables variable-product creation in WooCommerce.<\/p>","1.4.23":" Strongly recommended update. AI Platforms model dropdowns refreshed across every provider.<\/p>","1.4.22":" Recommended update. Fixes Test Connection on Claude, restores clearing of manual OAuth credentials, and adds two new self-check admin notices.<\/p>","1.4.21":" Recommended update for WordPress 7.0: preserves escape sequences inside Gutenberg block content on the post and page write tools.<\/p>","1.4.17":" Critical fix for OAuth authorization codes. Also adds a Reset OAuth State button and Activity Log entries for MCP tool calls.<\/p>","1.4.16":" Recommended update: OAuth failures now write to Activity Logs with the exact error code, description, and HTTP status.<\/p>","1.4.15":" Critical update: four fixes to the API key flow, session TTL, and cache headers. Existing keys keep working.<\/p>","1.4.14":" Recommended update: unauthenticated GET on the MCP endpoint returns 401 with Recommended update: OAuth endpoint caching hardened plus 17 new WooCommerce tools (variable products, attributes, coupon CRUD).<\/p>","1.4.12":" Recommended update: fixes tool-list silent failure on Claude Desktop and adds a slug alias on Adds Adds 16 new tools spanning Royal Ledger, ForgeCache, and Royal Links integrations, SEO meta, permalink structure, and post revision history plus restore.<\/p>","1.4.9":" Adds 13 new tools across theme appearance, menu item CRUD, and comment moderation, with theme writes gated by an admin toggle and opt-in allowlist filter.<\/p>","1.4.8":" Fixes a setup failure on sites updated from an early build. Recommended for anyone unable to add Royal MCP as a Claude connector.<\/p>","1.4.7":" Adds plugin-settings read (sensitive keys redacted) and allowlisted options write. New "Allow AI to write WordPress options" toggle is OFF by default.<\/p>","1.3.0":" Major security and feature update. Recommended for all users.<\/p>","1.2.3":" Security: SSRF protection for outbound requests plus wp.org compliance fixes.<\/p>","1.2.0":" Security hardening and MCP spec compliance improvements. Recommended for all users.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":5},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3448287,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3448287,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3515644,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3515644,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{"blueprint.json":{"filename":"blueprint.json","revision":3616552,"resolution":false,"location":"assets","locale":"","contents":"{\"$schema\":\"https:\\\/\\\/playground.wordpress.net\\\/blueprint-schema.json\",\"meta\":{\"title\":\"Royal MCP \\u2014 Live Demo\",\"description\":\"Try the Royal MCP security-first Model Context Protocol server live in your browser. API key auth, rate limiting, activity log, and platform config all pre-seeded.\",\"author\":\"royalplugins\",\"categories\":[\"AI & Integration\"]},\"landingPage\":\"\\\/wp-admin\\\/admin.php?page=royal-mcp\",\"preferredVersions\":{\"php\":\"8.2\",\"wp\":\"latest\"},\"phpExtensionBundles\":[\"kitchen-sink\"],\"features\":{\"networking\":true},\"login\":{\"username\":\"admin\",\"password\":\"password\"},\"steps\":[{\"step\":\"setSiteOptions\",\"options\":{\"blogname\":\"Royal MCP Demo\",\"blogdescription\":\"Security-first MCP server for WordPress \\u2014 live preview.\"}},{\"step\":\"installPlugin\",\"pluginData\":{\"resource\":\"wordpress.org\\\/plugins\",\"slug\":\"royal-mcp\"},\"options\":{\"activate\":true}},{\"step\":\"runPHP\",\"code\":\" true,\\n 'api_key' => 'rmcp_demo_' . wp_generate_password( 24, false ),\\n 'platforms' => [\\n 'claude' => [ 'enabled' => true ],\\n 'chatgpt' => [ 'enabled' => true ],\\n 'gemini' => [ 'enabled' => false ],\\n ],\\n 'mcp_servers' => [],\\n] );\\n\\nglobal $wpdb;\\n$table = $wpdb->prefix . 'royal_mcp_logs';\\nif ( $wpdb->get_var( \\\"SHOW TABLES LIKE '{$table}'\\\" ) !== $table ) {\\n return;\\n}\\n\\n\\\/\\\/ Seed representative activity log entries so the Activity Log page isn't empty in the demo.\\n$samples = [\\n [ '-4 hours', 'claude', 'tools\\\/list', 'success', '{\\\"jsonrpc\\\":\\\"2.0\\\",\\\"method\\\":\\\"tools\\\/list\\\",\\\"id\\\":1}', '{\\\"tools\\\":[{\\\"name\\\":\\\"search_posts\\\"},{\\\"name\\\":\\\"get_post\\\"},{\\\"name\\\":\\\"list_products\\\"}]}' ],\\n [ '-3 hours', 'claude', 'tools\\\/call', 'success', '{\\\"method\\\":\\\"tools\\\/call\\\",\\\"params\\\":{\\\"name\\\":\\\"search_posts\\\",\\\"arguments\\\":{\\\"query\\\":\\\"backup\\\"}}}','{\\\"content\\\":[{\\\"type\\\":\\\"text\\\",\\\"text\\\":\\\"Found 12 posts\\\"}]}' ],\\n [ '-2 hours', 'chatgpt', 'resources\\\/list', 'success', '{\\\"method\\\":\\\"resources\\\/list\\\"}', '{\\\"resources\\\":[{\\\"uri\\\":\\\"wp:\\\/\\\/posts\\\"},{\\\"uri\\\":\\\"wp:\\\/\\\/pages\\\"}]}' ],\\n [ '-90 minutes','claude', 'tools\\\/call', 'rate_limited', '{\\\"method\\\":\\\"tools\\\/call\\\",\\\"params\\\":{\\\"name\\\":\\\"get_post\\\",\\\"arguments\\\":{\\\"id\\\":42}}}','{\\\"error\\\":\\\"rate_limit_exceeded\\\",\\\"retry_after\\\":60}' ],\\n [ '-45 minutes','unknown','tools\\\/list', 'unauthorized', '{\\\"method\\\":\\\"tools\\\/list\\\"}', '{\\\"error\\\":\\\"invalid_api_key\\\"}' ],\\n [ '-15 minutes','chatgpt','tools\\\/call', 'success', '{\\\"method\\\":\\\"tools\\\/call\\\",\\\"params\\\":{\\\"name\\\":\\\"list_products\\\"}}','{\\\"content\\\":[{\\\"type\\\":\\\"text\\\",\\\"text\\\":\\\"WooCommerce not installed in demo.\\\"}]}' ],\\n];\\n\\nforeach ( $samples as $row ) {\\n list( $ago, $server, $action, $status, $req, $res ) = $row;\\n $wpdb->insert( $table, [\\n 'timestamp' => gmdate( 'Y-m-d H:i:s', strtotime( $ago ) ),\\n 'mcp_server' => $server,\\n 'action' => $action,\\n 'request_data' => $req,\\n 'response_data' => $res,\\n 'status' => $status,\\n ] );\\n}\\n\"}]}"}},"all_blocks":[],"tagged_versions":["1.2.2","1.2.3","1.3.0","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.20","1.4.21","1.4.22","1.4.23","1.4.24","1.4.25","1.4.26","1.4.27","1.4.28","1.4.29","1.4.30","1.4.31","1.4.32","1.4.33","1.4.34","1.4.35","1.4.36","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"],"block_files":[],"assets_screenshots":{"screenshot-1.jpg":{"filename":"screenshot-1.jpg","revision":3439404,"resolution":"1","location":"assets","locale":"","width":1231,"height":1195},"screenshot-1.png":{"filename":"screenshot-1.png","revision":3515644,"resolution":"1","location":"assets","locale":"","width":1245,"height":858},"screenshot-2.jpg":{"filename":"screenshot-2.jpg","revision":3439404,"resolution":"2","location":"assets","locale":"","width":1240,"height":1115},"screenshot-3.jpg":{"filename":"screenshot-3.jpg","revision":3439404,"resolution":"3","location":"assets","locale":"","width":1263,"height":508},"screenshot-4.jpg":{"filename":"screenshot-4.jpg","revision":3439404,"resolution":"4","location":"assets","locale":"","width":1245,"height":1265},"screenshot-5.jpg":{"filename":"screenshot-5.jpg","revision":3439404,"resolution":"5","location":"assets","locale":"","width":1087,"height":266},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3497937,"resolution":"6","location":"assets","locale":"","width":645,"height":760}},"screenshots":{"1":"Main settings page with API key and platform overview","2":"AI platform configuration with connection testing","3":"Activity log showing authenticated MCP requests","4":"Claude Desktop MCP connector setup","5":"WooCommerce product management via Claude","6":"OAuth consent screen for Claude Desktop connector"}},"plugin_section":[],"plugin_tags":[2353,216196,229563,76538,242115],"plugin_category":[],"plugin_contributors":[253970],"plugin_business_model":[],"class_list":["post-274400","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-chatgpt","plugin_tags-claude","plugin_tags-elementor","plugin_tags-mcp","plugin_contributors-royalpluginsteam","plugin_committers-royalpluginsteam","plugin_support_reps-rpteam"],"banners":{"banner":"https:\/\/ps.w.org\/royal-mcp\/assets\/banner-772x250.png?rev=3515644","banner_2x":"https:\/\/ps.w.org\/royal-mcp\/assets\/banner-1544x500.png?rev=3515644","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/royal-mcp\/assets\/icon-128x128.png?rev=3448287","icon_2x":"https:\/\/ps.w.org\/royal-mcp\/assets\/icon-256x256.png?rev=3448287","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/royal-mcp\/assets\/screenshot-1.png?rev=3515644","caption":"Main settings page with API key and platform overview"},{"src":"https:\/\/ps.w.org\/royal-mcp\/assets\/screenshot-2.jpg?rev=3439404","caption":"AI platform configuration with connection testing"},{"src":"https:\/\/ps.w.org\/royal-mcp\/assets\/screenshot-3.jpg?rev=3439404","caption":"Activity log showing authenticated MCP requests"},{"src":"https:\/\/ps.w.org\/royal-mcp\/assets\/screenshot-4.jpg?rev=3439404","caption":"Claude Desktop MCP connector setup"},{"src":"https:\/\/ps.w.org\/royal-mcp\/assets\/screenshot-5.jpg?rev=3439404","caption":"WooCommerce product management via Claude"},{"src":"https:\/\/ps.w.org\/royal-mcp\/assets\/screenshot-6.png?rev=3497937","caption":"OAuth consent screen for Claude Desktop connector"}],"raw_content":"\n https:\/\/youtu.be\/pf-mdRnXezM<\/p>\n\n https:\/\/youtu.be\/6P7TU1Tva3k<\/p>\n\n Royal MCP is a security-first Model Context Protocol (MCP) server for WordPress. It gives AI platforms like Claude, ChatGPT, and Google Gemini structured access to your WordPress content \u2014 with authentication, rate limiting, and audit logging that most MCP implementations skip entirely.<\/p>\n\n First-time setup walkthrough (with videos):<\/strong> royalplugins.com\/support\/royal-mcp\/connecting-to-claude\/<\/a><\/p>\n\n According to recent security research<\/a>, 41% of public MCP servers have no authentication and respond to tool calls without any credentials. Royal MCP takes the opposite approach: every MCP session requires an API key, every request is rate-limited, and every interaction is logged.<\/p>\n\n MCP gives AI agents the ability to read, create, update, and delete your WordPress content. Without proper authentication, anyone who discovers your MCP endpoint can:<\/p>\n\n Royal MCP prevents all of this with API key authentication on session initialization, timing-safe key comparison, per-IP rate limiting (60 requests\/minute), and a full activity log of every MCP interaction.<\/p>\n\n Royal MCP is fully featured in its free, GPL-licensed release. There is no Pro version — all tools ship in the wp.org plugin, and updates go through the standard WordPress plugin updater.<\/p>\n\n Your credentials stay on your server. Royal MCP runs entirely inside WordPress: API keys, OAuth tokens, and session state all live in your own database. Royal MCP makes no outbound connections to Royal Plugins’ own servers — no license check, no telemetry, no traffic beacon. If you prefer to keep AI inference local too, Ollama and LM Studio are first-class platforms alongside Claude, ChatGPT, and Gemini.<\/p>\n\n WordPress Core (69 tools):<\/strong><\/p>\n\n Royal MCP automatically detects compatible plugins and adds specialized MCP tools. No configuration needed \u2014 if the plugin is active, the tools appear.<\/p>\n\n WooCommerce Integration (26 tools):<\/strong>\nWhen WooCommerce is active, AI agents can manage your store end-to-end:<\/p>\n\n Elementor Integration (7 tools):<\/strong>\nWhen Elementor (free or Pro) is active, AI agents can clone and customize existing Elementor pages without trying to generate page-builder JSON from scratch:<\/p>\n\n Advanced Custom Fields Integration (4 tools):<\/strong>\nWhen ACF (free or Pro) is active, AI agents can read and write ACF fields with the field-type-aware formatting the ACF UI uses \u2014 instead of the raw serialized values WordPress meta returns:<\/p>\n\n GuardPress Integration (7 tools):<\/strong>\nWhen GuardPress is active, AI agents can monitor your site security:<\/p>\n\n SiteVault Integration (6 tools):<\/strong>\nWhen SiteVault is active, AI agents can manage your backups:<\/p>\n\n ForgeCache Integration (3 tools):<\/strong>\nWhen ForgeCache is active, AI agents can manage your page cache:<\/p>\n\n Royal Ledger Integration (4 tools):<\/strong>\nWhen Royal Ledger is active, AI agents can review your software costs and license data:<\/p>\n\n Royal Links Integration (3 tools):<\/strong>\nWhen Royal Links is active, AI agents can manage your branded short links:<\/p>\n\n WordPress 6.9 shipped the Abilities API in November 2025 \u2014 a primitive that lets plugins register typed capabilities AI agents can call. Core ships three default abilities (site info, user info, environment info) and the Royal MCP is a complete, production-ready MCP server that predates the official adapter. It runs the full Streamable HTTP transport, enforces API key authentication on every request, ships OAuth 2.0 for Claude Desktop's native connector flow, rate-limits per-IP, redacts sensitive data, and logs every interaction. Out of the box it includes 67 tools for WordPress core operations plus 60 integration tools that auto-load when WooCommerce, GuardPress, SiteVault, ForgeCache, Royal Ledger, Royal Links, Elementor, or Advanced Custom Fields (ACF) is active.<\/p>\n\n \nRoyal MCP works with any MCP-compliant client, IDE, or AI agent framework \u2014 no per-tool configuration required. Each entry below describes the specific integration path Royal MCP provides for that target, so customers can answer \"will this work with the tool I already use?\":<\/p>\n\n Royal MCP implements the MCP 2025-11-25 Streamable HTTP transport specification<\/a>:<\/p>\n\n This plugin connects to third-party AI services to enable AI platforms to interact with your WordPress content. No data is transmitted until you explicitly configure and enable a platform connection.<\/strong><\/p>\n\n What data is sent:<\/strong> Your WordPress content (posts, pages, media metadata) as requested by the connected AI platform through authenticated MCP tool calls.<\/p>\n\n When data is sent:<\/strong> Only when you have configured a platform with API credentials AND enabled that platform connection AND the AI platform makes an authenticated request.<\/p>\n\n Supported services and their policies:<\/strong><\/p>\n\n Anthropic Claude<\/strong> \u2014 Used for Claude AI integration\nTerms of Service<\/a> | Privacy Policy<\/a><\/p><\/li>\n OpenAI<\/strong> \u2014 Used for ChatGPT\/GPT-4 integration\nTerms of Use<\/a> | Privacy Policy<\/a><\/p><\/li>\n Google Gemini<\/strong> \u2014 Used for Gemini AI integration\nTerms of Service<\/a> | Privacy Policy<\/a><\/p><\/li>\n Groq<\/strong> \u2014 Used for Groq LPU inference\nTerms of Service<\/a> | Privacy Policy<\/a><\/p><\/li>\n Microsoft Azure OpenAI<\/strong> \u2014 Used for Azure-hosted OpenAI models\nTerms of Service<\/a> | Privacy Policy<\/a><\/p><\/li>\n AWS Bedrock<\/strong> \u2014 Used for AWS-hosted AI models\nTerms of Service<\/a> | Privacy Policy<\/a><\/p><\/li>\n Ollama \/ LM Studio<\/strong> \u2014 Local self-hosted models (no external data transmission)<\/p><\/li>\n Custom MCP Servers<\/strong> \u2014 User-configured servers (data sent to user-specified endpoints only)<\/p><\/li>\n<\/ul>\n\n\n Full setup guides for each platform are available at royalplugins.com\/support\/royal-mcp\/<\/a>.<\/p>\n\n\n Model Context Protocol (MCP) is an open standard created by Anthropic that lets AI assistants interact with external data sources. Without MCP, AI tools like Claude or ChatGPT can only work with content you copy and paste into them. With Royal MCP installed, these AI platforms can directly read your WordPress posts, create new content, manage your WooCommerce products, check your security status, and trigger backups \u2014 all through a structured, authenticated protocol.<\/p><\/dd>\n Security. Most MCP plugins \u2014 and 41% of all public MCP servers \u2014 have no authentication at all. Royal MCP requires an API key for every session, rate-limits requests to prevent abuse, logs every interaction for audit purposes, and filters sensitive data (emails, PHP version, admin credentials) from responses. We built this plugin with the same security standards we apply to GuardPress, our WordPress security plugin used on thousands of sites.<\/p><\/dd>\n No. WordPress 6.9 added the Abilities API \u2014 a primitive for registering AI-callable functions \u2014 and the Yes. When WooCommerce is active, Royal MCP automatically adds 26 MCP tools spanning product management (simple and variable, including variation CRUD and global attribute management), full coupon management (list\/get\/create\/update\/delete + bulk trash purge), order management (view, update status), customer data, and store statistics. No additional configuration is needed \u2014 the tools appear automatically in the MCP tools list.<\/p><\/dd>\n Yes, with safety controls. Royal MCP exposes two tools for plugin configuration:<\/p>\n\n Plugin authors can opt in their settings with one line: Install Royal MCP, go to Royal MCP \u2192 Settings, and copy your API key and MCP server URL. In Claude Desktop, add a new MCP server configuration with the URL and include the About 90% of \"can't connect\" \/ \"OAuth failed\" \/ \"tools missing\" issues resolve in a basic 4-step pass before any host-specific fix is needed. In order: (1) update Royal MCP to the latest version (every recent release fixes meaningful OAuth edge cases), (2) run a conflict test \u2014 deactivate all other plugins, switch to a default theme like Twenty Twenty-Five, and purge every cache layer (any cache plugin, your host's server-level cache, Cloudflare\/CDN, and browser cache), (3) wipe stale OAuth state \u2014 use the Reset OAuth State button in Royal MCP \u2192 Settings if you're on 1.4.17 or newer, or run the four When you restore from backup, the OAuth client credentials Claude was holding no longer match anything on the WordPress side, so Claude's connector ends up with a stale token that no Royal MCP installation will accept. The fix in Royal MCP 1.4.17+ is one click: go to Royal MCP \u2192 Settings<\/strong> and click the Reset OAuth State<\/strong> button. This wipes all stale OAuth clients, issued access\/refresh tokens, and pending authorization codes. Then in Claude, delete the existing connector entirely, wait 30 seconds, and re-add it from scratch \u2014 the full OAuth flow runs fresh against the cleaned-up state and the connection works. On 1.4.16 or older the same effect can be achieved by running four Both messages (plus \"no tools available\" in Claude.ai after connecting) usually mean one of Royal MCP's OAuth or sessions database tables is physically missing. The fix is to update Royal MCP to 1.4.29 or newer \u2014 the new runtime healer detects missing tables and recreates them automatically on the next pageload, with no deactivate\/reactivate required. After updating, delete the existing Royal MCP connector in Claude, wait 30 seconds, then re-add it fresh. If you can't update yet and need to recover immediately, the manual workaround is By design, Royal MCP's OAuth endpoints ( Royal MCP is designed with defense in depth. API key authentication is required for all MCP sessions. Rate limiting prevents abuse (60 requests per minute per IP). Activity logging records every tool call. Sensitive data is filtered \u2014 user emails, usernames, admin email, PHP version, and stored credentials inside plugin settings (api keys, secrets, tokens, passwords) are never exposed through MCP. Comment creation respects your WordPress moderation settings. Post meta values are sanitized before storage. Option writes are disabled by default and gated by three independent checks (admin toggle, allowlist, hard denylist) when enabled. The plugin itself starts disabled by default \u2014 nothing is accessible until you explicitly enable it.<\/p><\/dd>\n Yes. Royal MCP supports Ollama and LM Studio for fully local AI inference. When using local models, no data leaves your server \u2014 the AI model runs on your own hardware and communicates with WordPress through the MCP protocol on localhost.<\/p><\/dd>\n Royal MCP performs a clean uninstall. All plugin options, database tables (activity logs), transients, and user meta are removed. No orphaned data is left behind.<\/p><\/dd>\n Yes. Any MCP-compliant client can connect to Royal MCP. Configure your IDE or client with the MCP server URL ( Yes. Royal MCP exposes WordPress's standard No. The MCP endpoint is a REST route that runs only when an authenticated AI client makes a request \u2014 it does not run on visitor-facing pages, frontend templates, or admin screens (except its own settings page). The activity log uses a single indexed database table and writes asynchronously after the response is sent. Rate limiting (60 requests\/minute per IP) prevents accidental overload.<\/p><\/dd>\nwp_search<\/code> and pagination to wc_get_orders<\/code>. Note: wc_get_orders<\/code> response shape changes from a bare array to {orders, page, per_page, total, total_pages}<\/code>.<\/p>","1.4.31":"Authorization: Bearer<\/code> header support for API keys and covers the post URL slug in the SEO meta tools. Both changes are strictly additive.<\/p>","1.4.27":"WWW-Authenticate<\/code> so web-based MCP clients trigger OAuth discovery correctly.<\/p>","1.4.13":"wp_get_taxonomies<\/code>.<\/p>","1.4.11":"wp_update_term<\/code>, the term-meta tools, and wp_get_taxonomies<\/code>, with existing term tools accepting any registered taxonomy.<\/p>","1.4.10":"Why Security Matters for MCP<\/h4>\n\n
\n
Free, Self-Hosted, Fully Featured<\/h4>\n\n
69 Core Tools + 60 Integration Tools<\/h4>\n\n
\n
Plugin Integrations (Conditional)<\/h4>\n\n
\n
pa_*<\/code> taxonomies) \u2014 list registered attributes, list attribute terms, register new attributes, assign attributes to a product as variation axes<\/li>\n\n
\n
\n
\n
\n
\n
\n
Royal MCP and the WordPress Core Abilities API<\/h4>\n\n
wordpress\/mcp-adapter<\/code> package bridges abilities to the MCP protocol.<\/p>\n\nSupported AI Platforms<\/h4>\n\n
\n
Compatible Clients & Frameworks<\/h4>\n\n
\n
X-Royal-MCP-API-Key<\/code> header).<\/li>\nacf_*<\/code> tools that return values formatted per each field's Return Format setting (the same way the ACF UI shows them). MetaBox, JetEngine, Pods, CPT UI, and Custom Field Suite are supported through the wp_get_post_meta<\/code> \/ wp_update_post_meta<\/code> tools, so AI agents can populate custom fields just like a human editor.<\/li>\nMCP Spec Compliance<\/h4>\n\n
\n
\/mcp<\/code> endpoint for all JSON-RPC communication<\/li>\nExternal Services<\/h3>\n\n
\n
\n
royal-mcp<\/code> folder to \/wp-content\/plugins\/<\/code><\/li>\n\n
What is MCP and why does my WordPress site need it?<\/h3><\/dt>\n
How is Royal MCP different from other WordPress MCP plugins?<\/h3><\/dt>\n
Does Royal MCP duplicate what WordPress core now does?<\/h3><\/dt>\n
wordpress\/mcp-adapter<\/code> package bridges abilities to the MCP protocol. Royal MCP is a full MCP server with the security layer, connector flows, and plugin integrations that the bare primitive does not include: enforced API key auth, OAuth 2.0 for Claude Desktop, per-IP rate limiting, audit logging, sensitive-data redaction, 67 ready-to-use WordPress core tools, and 60 integration tools that auto-load for WooCommerce, GuardPress, SiteVault, ForgeCache, Royal Ledger, Royal Links, Elementor, and Advanced Custom Fields.<\/p><\/dd>\nDoes Royal MCP work with WooCommerce?<\/h3><\/dt>\n
Can AI assistants configure my plugins for me?<\/h3><\/dt>\n
\n
wp_get_plugin_settings<\/code> lets AI read any plugin's stored settings by slug. Sensitive values (API keys, secrets, tokens, passwords, license keys, OAuth credentials) are automatically replaced with [REDACTED]<\/code> before they leave your server, so AI assistants can understand a plugin's configuration without ever seeing stored credentials.<\/p><\/li>\nwp_update_option<\/code> lets AI write to WordPress options, but only after passing three security gates:<\/p>\n\n\n
blogname<\/code>, blogdescription<\/code>, posts_per_page<\/code>, date_format<\/code>, time_format<\/code>. Plugin authors opt their own settings in via the royal_mcp_writable_options<\/code> filter.<\/li>\nadd_filter('royal_mcp_writable_options', fn($opts) => array_merge($opts, ['my_plugin_settings']));<\/code><\/p><\/dd>\nHow do I connect Claude Desktop to WordPress?<\/h3><\/dt>\n
X-Royal-MCP-API-Key<\/code> header with your API key. Full step-by-step guide at royalplugins.com\/support\/royal-mcp\/<\/a>. If the connection fails, see the next FAQ.<\/p><\/dd>\nThe connector won't connect \u2014 where do I start?<\/h3><\/dt>\n
DELETE<\/code> SQL queries documented in our support article, (4) check Royal MCP \u2192 Activity Logs for the most recent oauth:<\/code> row, which records exactly which validation rule fired. Full walk-through with copy-pasteable commands at royalplugins.com\/support\/royal-mcp\/troubleshooting-start-here.html<\/a>. Only proceed to host-specific fixes (Cloudflare AI Bots toggle, SiteGround \/.well-known\/<\/code> static files, edge-cache exclusions) after the four basics are ruled out \u2014 most \"advanced infrastructure\" tickets we receive actually resolve in those four steps.<\/p><\/dd>\nI restored my WordPress database from backup and Claude can't reconnect. How do I fix this?<\/h3><\/dt>\n
DELETE<\/code> SQL queries documented at royalplugins.com\/support\/royal-mcp\/troubleshooting-start-here.html<\/a>. The plugin's settings, API key, and Activity Log are not affected by Reset OAuth State \u2014 only the OAuth handshake state.<\/p><\/dd>\nClaude says \"Couldn't register with sign-in service\" or \"Session not found\" \u2014 what's wrong?<\/h3><\/dt>\n
wp option delete royal_mcp_db_version<\/code> followed by loading any wp-admin page. Full symptom diagnostic (phpMyAdmin \/ WP-CLI), the auto-heal explanation, and the manual recovery walkthrough are at royalplugins.com\/support\/royal-mcp\/oauth-tables-missing.html<\/a>.<\/p><\/dd>\nI'm auditing my install and can't find the OAuth endpoints under `\/wp-json\/royal-mcp\/v1\/`. Where are they?<\/h3><\/dt>\n
\/register<\/code>, \/token<\/code>, \/authorize<\/code>) are registered as top-level WordPress rewrite rules at the site root<\/strong>, not as REST API routes under \/wp-json\/royal-mcp\/v1\/<\/code>. This is required by the OAuth 2.0 specification (RFC 6749) and the MCP discovery specs (RFC 8414 and RFC 9728), which mandate predictable site-root paths so OAuth-discovery-aware clients can find them without per-plugin configuration. If you're auditing rewrite rules instead of REST routes, you can see ours via wp rewrite list | grep royal_mcp_oauth<\/code> from WP-CLI. The \/wp-json\/royal-mcp\/v1\/<\/code> namespace contains the JSON-RPC tool endpoint at \/mcp<\/code> plus supporting REST routes (\/posts<\/code>, \/pages<\/code>, \/site<\/code>, etc.) \u2014 but not the OAuth handshake endpoints themselves. Both routing layers are normal and both need to be reachable for the connector to work end-to-end.<\/p><\/dd>\nIs my content safe?<\/h3><\/dt>\n
Can I use local AI models instead of cloud services?<\/h3><\/dt>\n
What happens if I uninstall Royal MCP?<\/h3><\/dt>\n
Does Royal MCP work with Claude Code, VS Code, Cursor, Windsurf, or other AI IDEs?<\/h3><\/dt>\n
https:\/\/yoursite.com\/wp-json\/royal-mcp\/v1\/mcp<\/code>) and the API key (sent in the X-Royal-MCP-API-Key<\/code> header). Claude Desktop additionally supports the native \"Add Connector\" OAuth 2.0 flow, which Royal MCP handles via Dynamic Client Registration (RFC 7591) \u2014 no manual API key management required on that path. The same OAuth flow works in any client that follows the MCP 2025-11-25 spec.<\/p><\/dd>\nDoes Royal MCP work with custom fields, ACF, MetaBox, JetEngine, Pods, or CPT UI?<\/h3><\/dt>\n
wp_get_post_meta<\/code>, wp_update_post_meta<\/code>, and wp_delete_post_meta<\/code> tools, which read and write any custom field \u2014 including Advanced Custom Fields (ACF), MetaBox, JetEngine, Pods, CPT UI, and Custom Field Suite. AI agents can populate ACF fields, set repeater rows, update flexible content blocks, and read computed fields just like a human editor working in the WordPress admin.<\/p><\/dd>\nWill Royal MCP slow down my WordPress site?<\/h3><\/dt>\n
Does Royal MCP work on WordPress multisite networks?<\/h3><\/dt>\n