# WordPress Ops MCP

A small, confirmation-gated MCP server for the standard WordPress REST API. It is configured entirely through environment variables and stores no credentials, sites, or personal data.

## Features

- Read configured sites and inspect, search, or list posts.
- Create posts as drafts only.
- Update only approved post fields, with explicit write confirmation. Publishing additionally requires `confirm_publish=true`.
- Optionally use a post's `modified` value as an optimistic-concurrency check before updating it.
- Upload media only after explicit confirmation.

## Install

```bash
python -m venv .venv
.venv/bin/pip install -e .
```

On Windows, use `.venv\\Scripts\\pip install -e .`.

## Configuration

Use a single site:

```text
WORDPRESS_BASE_URL=https://example.com
WORDPRESS_USERNAME=api-user
WORDPRESS_APP_PASSWORD=xxxx xxxx xxxx xxxx
```

Or configure named sites:

```text
WORDPRESS_SITES_JSON={"site-a":{"base_url":"https://example.com","username":"api-user","app_password":"xxxx"}}
```

Run with `python server.py`. Do not commit `.env` files or application passwords.

## Safety model

Writes are never performed unless `confirm_write=true` is passed. New posts are drafts, and publishing an existing post requires a separate `confirm_publish=true`. The server has no delete endpoint.

## Development

```bash
python -m unittest -v
```

## License

MIT. See [LICENSE](LICENSE).