Skip to main content
Glama
WordPress MCP Safe

WordPress MCP Safe

WordPress MCP Safe

Node.js TypeScript Tests Coverage MCP License

Server MCP locale per gestire WordPress in modo sicuro, controllato e orientato alla gestione editoriale.

Collega Cursor (o qualsiasi client MCP) al tuo WordPress staging per leggere contenuti, creare bozze, analizzare SEO e generare report — senza pubblicare, cancellare o eseguire operazioni amministrative.

Cursor/LLM  ──stdio──►  MCP Server (locale)  ──HTTPS──►  WordPress Staging
                              │                              ai_editor / Editor
                              ▼
                        logs/actions.log

Perché questo progetto

Problema

Soluzione

L'AI pubblica contenuti non revisionati

Solo bozze e proposte, mai publish

L'AI modifica il sito live

Staging obbligatorio, blocco all'avvio

L'AI cancella contenuti

Nessun tool delete/trash

L'AI installa plugin o modifica temi

Ruolo Editor, nessun endpoint admin

Nessuna tracciabilità

Log locale di ogni operazione

Related MCP server: seo-factory-mcp

Quick start

git clone <repository-url> mcp-wordpress
cd mcp-wordpress
npm install
cp .env.example .env
# Modifica .env con il tuo staging
npm run build
npm test

Configura Cursor

Aggiungi in ~/.cursor/mcp.json:

{
  "mcpServers": {
    "wordpress-staging": {
      "command": "node",
      "args": ["/percorso/assoluto/a/mcp-wordpress/dist/index.js"],
      "env": {
        "WORDPRESS_BASE_URL": "https://staging.example.com",
        "WORDPRESS_USERNAME": "ai_editor",
        "WORDPRESS_APPLICATION_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx",
        "WORDPRESS_ENVIRONMENT": "staging"
      }
    }
  }
}

Riavvia Cursor. Chiedi: "Usa wp_get_site_info per verificare la connessione".

Tool disponibili (22)

Categoria

Tool

Descrizione

Lettura

wp_get_site_info

Info sito

wp_list_posts, wp_list_pages

Elenco contenuti

wp_get_post, wp_get_page

Dettaglio per ID

wp_search_content

Ricerca keyword

wp_get_categories, wp_get_tags

Tassonomie

wp_get_media

Media library

Scrittura

wp_create_draft_post, wp_create_draft_page

Crea bozze

wp_update_draft_post, wp_update_draft_page

Aggiorna bozze

wp_upload_media

Upload file

wp_create_seo_proposal

Proposta SEO

wp_create_revision_note

Nota di revisione

Analisi

wp_analyze_page_seo, wp_analyze_post_seo

Audit SEO

wp_check_internal_links

Verifica link

wp_generate_content_report

Report contenuti

wp_find_old_content

Contenuti obsoleti

wp_suggest_content_improvements

Suggerimenti

Dettagli ed esempi: docs/tools.md

Esempio d'uso

"Analizza la pagina Affitto laboratorio smielatura e prepara una versione migliorata SEO"

  1. wp_analyze_page_seo → analisi headings, keywords, link

  2. wp_create_seo_proposal con create_draft: true → bozza su staging

  3. Restituisce edit_url e preview_url — nulla viene pubblicato

Documentazione

Guida

Contenuto

📖 Indice docs

Panoramica documentazione

🏗 Architettura

Design e layer di sicurezza

⚙️ Configurazione

Variabili .env

🔧 Setup WordPress

Utente, Application Password

🖥 Setup Cursor

Configurazione MCP

🔒 Sicurezza

Azioni consentite/vietate

📋 Workflow

Scenari operativi

🧪 Testing

Suite test e coverage

🔌 API Reference

Mapping REST API

🩺 Troubleshooting

Risoluzione problemi

Struttura progetto

mcp-wordpress/
├── src/
│   ├── index.ts                 # Entry point
│   ├── config.ts                # Validazione ambiente
│   ├── wordpress/               # Client REST (posts, pages, media)
│   ├── mcp/                     # Server e tool MCP
│   ├── safety/                  # Guardie e permessi
│   ├── seo/                     # Analisi SEO
│   ├── logging/                 # Audit log
│   └── utils/                   # Utility HTML/testo
├── tests/                       # 135 test, 100% coverage
├── docs/                        # Documentazione completa
├── logs/                        # actions.log (auto-generato)
└── .cursor/mcp.json.example     # Template configurazione

Script npm

Comando

Descrizione

npm run build

Compila TypeScript → dist/

npm run dev

Sviluppo con hot reload

npm start

Avvia server MCP

npm test

Esegue test

npm run test:coverage

Test con coverage 100%

npm run lint

Verifica tipi TypeScript

Sicurezza in sintesi

  • ✅ Solo ambiente staging (blocco all'avvio)

  • ✅ Solo utente Editor (non admin)

  • ✅ Solo bozze e proposte

  • ✅ Contenuti pubblicati protetti (nuova bozza, no overwrite)

  • ✅ Log locale senza credenziali

  • ❌ Nessun publish, delete, plugin, temi, utenti

Dettagli: docs/security.md

Requisiti

  • Node.js >= 18

  • WordPress self-hosted 5.6+ con REST API

  • Ambiente staging dedicato

  • Application Password per utente Editor

Licenza

MIT

Available Tools

22 tools
wp_analyze_page_seoA

Analyze a page for SEO issues: headings, keywords, meta, internal links, readability.

Inputs: id, search.

wp_analyze_post_seoC

Analyze a post for SEO issues.

Inputs: id, search.

wp_create_draft_pageB

Create a new page as DRAFT only. Never publishes. Staging only.

Inputs: title (required), slug, parent, content, +1 more.

wp_create_draft_postB

Create a new post as DRAFT only. Never publishes. Staging only.

Inputs: title (required), slug, tags, content, +2 more.

wp_create_revision_noteC

Create a revision draft with an editorial note. Original content is not modified.

Inputs: id (required), note (required), type (required).

wp_create_seo_proposalC

Generate SEO improvement proposal for a post or page. Optionally save as draft.

Inputs: id (required), type (required), create_draft, improved_content.

wp_find_old_contentC

Find published content not updated within a given number of days.

Inputs: days, type.

wp_generate_content_reportB

Generate a summary report of all posts and pages on the site.

Inputs: no named parameters.

wp_get_categoriesA

List all post categories. Read-only.

Inputs: no named parameters.

wp_get_mediaB

Get media item by ID or list recent media. Read-only.

Inputs: id, per_page.

wp_get_pageA

Get a single WordPress page by ID with full content. Read-only.

Inputs: id (required).

wp_get_postA

Get a single WordPress post by ID with full content. Read-only.

Inputs: id (required).

wp_get_site_infoA

Get WordPress site information (name, URL, description). Read-only.

Inputs: no named parameters.

wp_get_tagsA

List all post tags. Read-only.

Inputs: no named parameters.

wp_list_pagesA

List WordPress pages. Supports pagination, status filter, and search. Read-only.

Inputs: page, search, status, per_page.

wp_list_postsB

List WordPress posts. Supports pagination, status filter, and search. Read-only.

Inputs: page, search, status, per_page.

wp_search_contentB

Search posts and pages by keyword. Read-only.

Inputs: query (required), type, per_page.

wp_suggest_content_improvementsC

Get editorial and SEO improvement suggestions for a post or page.

Inputs: id (required), type (required).

wp_update_draft_pageA

Update an existing DRAFT page. If page is published, creates a new draft instead. Never publishes.

Inputs: id (required), slug, title, parent, +2 more.

wp_update_draft_postA

Update an existing DRAFT post. If post is published, creates a new draft instead. Never publishes.

Inputs: id (required), slug, tags, title, +3 more.

wp_upload_mediaC

Upload media to WordPress staging. Staging only.

Inputs: alt_text, filename, file_path, mime_type, +1 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    B3.4/5.0

    Scored across 22 tools

    Disambiguation5/5

    Each tool targets a distinct resource-action combination. Tools are differentiated by content type (post/page) or operation (analyze, create, update, list, etc.), with clear descriptions preventing overlap.

    Naming Consistency5/5

    All tools follow the consistent pattern `wp_verb_noun` (or `wp_verb_prep_noun`) with snake_case, e.g., `wp_create_draft_post`, `wp_find_old_content`. No mixing of conventions.

    Tool Count5/5

    22 tools is well-scoped for a WordPress management server focusing on safe content operations and SEO. Each tool serves a clear purpose without being overwhelming or too sparse.

    Completeness4/5

    The server covers core content workflows: create drafts, read, update drafts, search, analyze SEO, and manage media. Missing delete operations, but this aligns with the 'safe' design. Minor gap for publishing.

    Related MCP Connectors

    Related MCP Servers