Ability results and saved post content are no longer altered, stdio and HTTP follow the MCP spec more strictly, and plugins can be installed from WordPress.org by slug.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3681819,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3681819,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.2","1.1.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[2353,569,229563,242115,253991],"plugin_category":[],"plugin_contributors":[279250],"plugin_business_model":[],"class_list":["post-362342","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-automation","plugin_tags-claude","plugin_tags-mcp","plugin_tags-model-context-protocol","plugin_contributors-justadityaraj","plugin_committers-justadityaraj"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/shim-mcp\/assets\/icon-128x128.png?rev=3681819","icon_2x":"https:\/\/ps.w.org\/shim-mcp\/assets\/icon-256x256.png?rev=3681819","generated":false},"screenshots":[],"raw_content":"\n
Shim MCP is a self-contained MCP (Model Context Protocol) server plugin for WordPress. It provides 57 abilities that let any MCP-compatible AI client manage your WordPress site -- posts, pages, media, users, plugins, menus, widgets, comments, options, and system settings. The MCP server and every ability ship in the one plugin, so no companion plugins are required.<\/p>\n\n
The MCP protocol layer is derived from the WordPress project's own MCP Adapter (GPL-2.0), and abilities are registered through WordPress's Abilities API, which core ships from 6.9. See the Credits section below.<\/p>\n\n
Key features:<\/p>\n\n
wp shim-mcp serve<\/code>)<\/li>\n- Admin dashboard with API key generation<\/li>\n
- Config export for Claude Code, Claude Desktop, and Cursor<\/li>\n
- Conflict detection for legacy MCP plugins<\/li>\n<\/ul>\n\n
Credits<\/h3>\n\n
Shim MCP builds on three GPL projects:<\/p>\n\n
\nWP MCP Ultimate<\/a> by Daniel Agrici (GPL-2.0-or-later) - the first version of Shim MCP was built by an autonomous fleet of coding agents that took a good part of their code from it: the plugin bootstrap, the admin dashboard, the WP-CLI command and the layout of the ability classes.<\/p><\/li>\nWordPress MCP Adapter<\/a> (GPL-2.0) - everything under includes\/Server\/<\/code> (transport, JSON-RPC routing, session management, tools\/resources\/prompts handlers, schema transformation, error and observability infrastructure) is derived from it.<\/p><\/li>\n- WordPress Abilities API<\/a> (GPL-2.0) - every ability is registered through this core API, which WordPress ships from 6.9.<\/li>\n<\/ul>\n\n
Most of the ability code, the tests and the 1.1.0 changes were written for this plugin. Full breakdown in CREDITS.md.<\/p>\n\n\n
\n- Upload the plugin zip file via Plugins > Add New > Upload Plugin, or clone the repository into
wp-content\/plugins\/shim-mcp\/<\/code>.<\/li>\n- Activate the plugin through the Plugins menu.<\/li>\n
- Go to Tools > Shim MCP, generate an API key, and copy the config snippet into your AI client.<\/li>\n<\/ol>\n\n\n
\nWhat is MCP?<\/h3><\/dt>\nMCP (Model Context Protocol) is an open standard that allows AI clients like Claude to interact with external systems through a structured protocol. It defines how AI tools discover and use capabilities (called \"abilities\" in WordPress) provided by a server.<\/p><\/dd>\n
Do I need MCP Adapter or the Abilities API installed alongside this?<\/h3><\/dt>\nNo. Shim MCP is self-contained: it bundles its own MCP server, and the Abilities API it registers against is part of WordPress from 6.9 onwards. Nothing else is required.<\/p><\/dd>\n
Can it edit wp-config.php?<\/h3><\/dt>\nOnly if you let it. The ability that rewrites the WP_DEBUG constants is switched off until you add define( 'SHIM_MCP_ALLOW_CONFIG_WRITES', true );<\/code> to wp-config.php yourself. Without that line the ability refuses, and it is refused again if DISALLOW_FILE_EDIT or DISALLOW_FILE_MODS is set, if the file is not writable, or if the rewritten contents fail a sanity check.<\/p><\/dd>\nIt warns me about another MCP plugin. Why?<\/h3><\/dt>\nTwo MCP server plugins running at once can register competing abilities and endpoints, which produces confusing results for the connected AI client. If Shim MCP detects another MCP server or a standalone Abilities API plugin, it shows a notice suggesting you run only one. This is a compatibility warning, not a judgement about the other plugin.<\/p><\/dd>\n
Can I connect without an application password?<\/h3><\/dt>\nYes, on a site you have locally. wp shim-mcp serve --user=admin --path=\/path\/to\/wordpress<\/code> runs the MCP server over WP-CLI and stdio, with no URL, port or password. The setup guide in docs\/SETUP.md has tested configurations for Claude Code, Claude Desktop and Cursor.<\/p><\/dd>\nWhat AI clients are supported?<\/h3><\/dt>\nAny MCP-compatible client works. The admin dashboard provides ready-made config snippets for Claude Code, Claude Desktop, and Cursor.<\/p><\/dd>\n
Do I need HTTPS?<\/h3><\/dt>\nHTTPS is strongly recommended for production use since API credentials are transmitted with each request. The plugin will work over HTTP for local development.<\/p><\/dd>\n
What WordPress capabilities are required?<\/h3><\/dt>\nDifferent abilities require different WordPress capabilities. For example, content abilities require edit_posts<\/code>, user abilities require list_users<\/code> or edit_users<\/code>, and system abilities require manage_options<\/code>. See the full abilities reference in docs\/ABILITIES.md.<\/p><\/dd>\n\n<\/dl>\n\n\n1.1.0<\/h4>\n\n
New<\/p>\n\n
\n- Install plugins from the WordPress.org Plugin Directory by slug with
shim-mcp\/plugins-install<\/code>. URLs, file paths and uploaded archives are still refused, and the plugin is left inactive until you activate it.<\/li>\n- Every ability label, description and message, the dashboard and the WP-CLI command can now be translated.<\/li>\n
- A complete stdio setup guide for Claude Code, Claude Desktop and Cursor on macOS, Linux and Windows.<\/li>\n<\/ul>\n\n
Fixed<\/p>\n\n
\n- Ability results return values exactly as WordPress stores them. They were HTML-escaped, so
Rock & Roll<\/code> came back as Rock & Roll<\/code>.<\/li>\n- Posts keep iframes, embeds, scripts and block markup for users allowed to post unfiltered HTML, and search-and-replace no longer re-filters the whole post. Backslashes in post, page and media content are no longer stripped, so block attributes survive.<\/li>\n
- The stdio transport keeps STDOUT for JSON-RPC only: no
Using server<\/code> line, and output from an ability is moved to STDERR. It also no longer exits after an idle socket timeout.<\/li>\n- String JSON-RPC request ids work over both transports.<\/li>\n
- Both transports validate JSON-RPC messages the same way, and malformed requests get
-32600<\/code> or -32602<\/code> instead of a server error.<\/li>\n- Streamable HTTP answers notifications with 202 and an unknown or expired session with 404, so clients reconnect on their own.<\/li>\n
- HTTP sessions are no longer lost when requests arrive at the same moment, are kept separate per site on multisite, and refuse oversized initialization data.<\/li>\n
initialize<\/code> only advertises capabilities the server implements, and resources\/templates\/list<\/code> is answered.<\/li>\ntools\/list<\/code> descriptors match the MCP Tool schema. Contributed by @mikemikimike.<\/li>\n- The dashboard never exports a revoked or placeholder credential, and an active key can be replaced with Generate New Key.<\/li>\n
- No more \"already registered\" notices for the site and user ability categories.<\/li>\n<\/ul>\n\n
Development<\/p>\n\n
\n- Smoke tests and GitHub Actions CI on WordPress 6.9 with PHP 8.0, the latest WordPress with PHP 8.5, and a multisite network.<\/li>\n
- The release build fails instead of skipping a file it cannot archive.<\/li>\n<\/ul>\n\n
1.0.2<\/h4>\n\n\n- The dashboard's endpoint probe is labelled and reported honestly: it confirms the REST route is reachable and protected, not that an exported client configuration can authenticate. A 401 or 403 response is never shown as \"Connected\".<\/li>\n<\/ul>\n\n
1.0.1<\/h4>\n\n\n- Option abilities refuse to read or write options whose names look like stored credentials, and the option-name search no longer returns values at all<\/li>\n
- Core admin files are loaded only where a function from them is used<\/li>\n
- Removed the redirect to the settings page after activation<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Initial release with 56 WordPress abilities<\/li>\n
- Admin dashboard with API key generation<\/li>\n
- Config export for Claude Code, Claude Desktop, Cursor<\/li>\n
- Conflict detection for legacy MCP plugins<\/li>\n
- MCP protocol 2025-06-18 over Streamable HTTP and WP-CLI stdio<\/li>\n<\/ul>","raw_excerpt":"Connect WordPress to AI in one click. Full MCP server with 57 abilities.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/362342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=362342"}],"author":[{"embeddable":true,"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/justadityaraj"}],"wp:attachment":[{"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=362342"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=362342"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=362342"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=362342"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=362342"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ory.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=362342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}