Title: Rectus Content Access for MCP Author: Rectus Inc. Published: 24. julija 2026 Last modified: 6. awgusta 2026 --- Tykače pytać ![](https://ps.w.org/rectus-content-access-for-mcp/assets/banner-772x250.png?rev =3621986) ![](https://ps.w.org/rectus-content-access-for-mcp/assets/icon-256x256.png?rev=3621986) # Rectus Content Access for MCP Wot [Rectus Inc.](https://profiles.wordpress.org/rectuswp/) [Sćahnyć](https://downloads.wordpress.org/plugin/rectus-content-access-for-mcp.1.0.1.zip) * [Podrobnosće](https://hsb.wordpress.org/plugins/rectus-content-access-for-mcp/#description) * [Pohódnoćenja](https://hsb.wordpress.org/plugins/rectus-content-access-for-mcp/#reviews) * [Instalacija](https://hsb.wordpress.org/plugins/rectus-content-access-for-mcp/#installation) * [Wuwiće](https://hsb.wordpress.org/plugins/rectus-content-access-for-mcp/#developers) [Podpěra](https://wordpress.org/support/plugin/rectus-content-access-for-mcp/) ## Wopisanje Rectus Content Access for MCP lets authenticated MCP clients list, read, create, and update WordPress content and upload images. For a Japanese overview and setup guide, visit the [Rectus Content Access for MCP introduction page](https://www.rectus.co.jp/tool/rectuscontentaccessformcp.html). The plugin provides: * Listing, creation, and updating of posts, pages, and selected custom post types. * Targeted string edits with full-field SHA-256 conflict detection, so small corrections do not require resending an entire title, excerpt, or content field. * An optional publication date on creation and update, so back-dated entries such as a release history can be filed under the day they happened. * Reading of a single post’s stored title, content, excerpt, and assigned terms for editing workflows. * Listing of enabled post types with labels, supported fields, and taxonomies. * Listing of existing taxonomy terms so clients reuse the established vocabulary. * Paginated content lists with status, search, taxonomy term, and ordering filters. * Featured image assignment from uploaded media when creating or updating posts. * Media library listing and confirmation-protected permanent attachment deletion. * A settings screen where administrators choose which post types MCP clients may access. * Support for standard content fields, public custom fields, and taxonomies assigned to the selected post type. * Listing, reading, creation, update, and confirmation-protected deletion of managed fixed-page templates in the active theme. * Fixed-page template assignment through post creation and update operations. * Direct multipart image uploads for Codex and Claude Code using short-lived, one- time tickets. * Base64-encoded image uploads as a fallback for MCP clients that cannot perform direct uploads. * Browser-based OAuth 2.1 authorization with PKCE and automatic token refresh. * Copy-ready setup commands for Codex and Claude Code. * Site-specific MCP server names derived from the WordPress domain and path to prevent client configuration collisions. * Support for MCP protocol revisions 2025-11-25, 2025-06-18, and 2024-11-05, negotiated with the connecting client. * Server identity reported on connection, including the site title, description, website URL, and icons, so a client registered against several sites can tell them apart. * Translation-ready administration, OAuth, MCP ability, and error strings. Posts and pages are enabled by default. Custom post types must be enabled by an administrator before MCP clients can use them. Rectus Content Access for MCP checks the authorized WordPress user’s native capabilities for every operation, including each post type’s create, edit, publish, and taxonomy permissions. Saved content is filtered by the same capability WordPress itself uses, so an edit made through an MCP client is stored exactly as the block or classic editor would have stored it. Markup that the editors keep, such as JSON-LD structured data and schema.org microdata, survives the round trip instead of being silently rewritten. For targeted corrections, post-get returns SHA-256 checksums of the exact stored title, content, and excerpt. Post-edit requires the selected field checksum, re- reads the database immediately before saving, and returns a conflict without saving if the field changed. WordPress save filters still run normally, and the stored value is verified before success is reported. OAuth access tokens, refresh tokens, authorization codes, and direct media upload tickets are stored only as SHA-256 hashes. Access tokens expire after one hour, refresh tokens are rotated automatically, and connections can be revoked from the settings screen. Uninstalling Rectus Content Access for MCP removes its settings and OAuth data. The official WordPress MCP Adapter library is bundled with Rectus Content Access for MCP. A separate MCP Adapter plugin or Node.js process is not required on the WordPress server. ### Third-Party Libraries Rectus Content Access for MCP includes the following GPL-compatible Composer packages: * WordPress MCP Adapter, copyright WordPress.org Contributors, GPL-2.0-or-later. * WordPress PHP MCP Schema, copyright WordPress.org Contributors, GPL-2.0-or-later. * Jetpack Autoloader, copyright Automattic, GPL-2.0-or-later. License files are included with each package under the `vendor` directory. ## Fota wobrazowki [⌊Configure connection readiness, allowed post types, and MCP client setup commands.⌉⌊ Configure connection readiness, allowed post types, and MCP client setup commands .⌉[ Configure connection readiness, allowed post types, and MCP client setup commands. ## Instalacija 1. Install and activate Rectus Content Access for MCP. 2. Open Settings, Rectus Content Access for MCP. 3. Select the post types that MCP clients may list, create, or update. 4. Copy and run the setup command for your client. 5. Follow the client-specific authentication instructions shown on the settings screen. HTTPS is required for OAuth connections. The connection has the same effective permissions as the WordPress user who approved it. ## HSP ### Does Rectus Content Access for MCP require an external service? No service operated by the plugin author is required. MCP requests are handled by WordPress through the bundled official MCP Adapter library. When an OAuth client uses an HTTPS URL as its client ID, Rectus Content Access for MCP retrieves public client metadata from that client-provided URL as described below. ### What data is sent when URL-based OAuth client metadata is retrieved? During OAuth authorization, a connecting client may provide an HTTPS metadata URL as its client ID. Rectus Content Access for MCP then sends a server-side GET request to that exact URL with an `Accept: application/json` header. The response is limited to 64 KB and valid metadata is cached for one hour. No WordPress content, passwords, OAuth codes, or tokens are sent. The destination is selected and operated by the connecting MCP client, not by the plugin author, so the destination operator’s terms and privacy policy apply. ### Does the WordPress server need Node.js? No. The server-side plugin runs in PHP. An MCP client may have its own local runtime requirements, depending on the client. ### Does Rectus Content Access for MCP send my WordPress password to the MCP client? No. The user signs in on the WordPress site and approves the connection in the browser. The MCP client receives short-lived OAuth tokens instead of the WordPress password. ### How do I revoke a connection? Open Settings, Rectus Content Access for MCP and revoke the connection in the OAuth connections table. MCP clients may also clear or revoke their saved authorization. ### How are local images uploaded without Base64? Codex and Claude Code should call the media upload ticket tool with the local image filename, byte size, MIME type, and attachment metadata. The tool returns a plugin REST endpoint and a short-lived, one-time token. The client then sends the image bytes directly as multipart form data. The image does not enter the model context, and no Application Password or second WordPress login is required. The ticket is valid for five minutes, is bound to the authorized WordPress user and expected file metadata, and is stored only as a SHA-256 hash. Repeating a completed request with the same ticket returns the existing attachment instead of creating a duplicate. MCP clients that cannot perform the direct HTTP upload may continue to use the Base64 media upload tool. Files already present in the WordPress uploads/mcp-inbox directory may use the media import tool without transferring image bytes through MCP. ### How do I select and delete media? Use the media list tool to search the WordPress media library and obtain the exact attachment ID and filename. Then call the media delete tool with that ID, the matching filename, and `confirm` set to true. WordPress checks the authorized user’s delete permission for the selected attachment. Deletion is permanent and removes the attachment and its generated files. Existing links to that media in post content are not rewritten, so clients should show the selected ID and filename to the user before confirming. ### How is the MCP server name chosen? Rectus Content Access for MCP derives the client configuration name from the site’s domain and subdirectory path. For example, `rectus.co.jp` becomes `wordpress-rectus- co-jp`, while `example.com/site-a` becomes `wordpress-example-com-site-a`. This prevents different WordPress sites from overwriting each other’s MCP client configuration. ### Why should I run the Codex login command only when needed? Codex App and Codex CLI share MCP configuration. After the add command saves the server, Codex App may open the authorization screen automatically. Approve that screen once. Run `codex mcp login` only when authorization does not start; running both flows at the same time can create a duplicate OAuth connection. ### How do I authenticate Claude Code? Run the displayed `claude mcp add` command, then run `claude mcp login`. The login command opens the browser authorization screen directly, so there is no need to start Claude Code and run `/mcp` manually. ### Why do new MCP clients fail to connect while existing clients keep working? The OAuth discovery URLs under `/.well-known/` are served through WordPress. Server rules that handle `/.well-known/` before WordPress break new authorizations while issued tokens keep refreshing. Rectus Content Access for MCP reports this state in Site Health and in the Discovery metadata row on the settings screen. ### Does OAuth support random localhost callback ports? Yes. Native MCP clients may select an available loopback port when authorization starts. Rectus Content Access for MCP follows RFC 8252 by allowing the port to differ for `localhost`, `127.0.0.1`, and `::1` redirect URIs while still requiring the scheme, host, path, and query to match. All other redirect URIs require an exact match. ### Is post content sanitized before it is saved? Yes, by the same rule WordPress applies to the block and classic editors. Content from a user who holds the unfiltered_html capability, which on a single site means an administrator, is stored as written and left to the content_save_pre filters that wp_insert_post() applies, so nothing is removed that the editors would have kept. Content from every other user is filtered with wp_kses_post(), which strips script elements, event handler attributes, and anything else outside the allowed list. Rectus Content Access for MCP additionally allows schema.org microdata attributes there, because WordPress core omits them and structured data lives in the post content. An MCP connection therefore never grants more reach than the approving WordPress user already had in the editor. ### Which custom post types are available? Rectus Content Access for MCP lists non-built-in post types that have a WordPress editing screen and support a title, editor, or excerpt. Administrators must explicitly enable each post type. ### Are ACF and other custom fields supported? Yes. The post-get, post-create, and post-update tools expose public custom fields through the custom_fields object. Values may be strings, numbers, booleans, arrays, or objects; pass null during create or update to delete a field. When post-get returns a stored custom field, custom_field_definitions returns its label, type, description, required setting, available choices, and whether the definition came from registered WordPress meta, ACF, or unregistered post meta. Fields without a stored value are omitted. For safety, WordPress-protected meta keys, including keys beginning with an underscore, are not exposed or writable. Existing public ACF value rows are therefore available, but hidden ACF field-reference metadata is not created or changed. Plugin-specific validation, new field-reference setup, or side effects that only run through a plugin’s own form or API are not emulated. ### Can MCP manage fixed-page templates? Yes. The page-template-list, page-template-get, page-template-create, page-template- update, and page-template-delete tools manage only root-level `page-*.php` files with a `Template Name` header in the active theme. They cannot read or modify arbitrary theme PHP files such as functions.php. Only users with WordPress theme-editing permission can use these tools. Updates and deletions require the SHA-256 returned by a prior read or list, so a changed template is never overwritten or deleted silently. Deletion also requires `confirm: true` and is refused while the template remains assigned to a non-trashed page. The post-get result includes `page_template`. Pass a managed template filename to the page_template field of post-create or post-update to assign it to a page, or pass `default` to clear the assignment. ### Which languages are supported? English source strings are included. After publication on WordPress.org, community translations are provided through translate.wordpress.org and delivered as WordPress language packs. ## Pohódnoćenja Za tutón tykač pohódnoćenja njejsu. ## Sobuskutkowarjo a wuwiwarjo „Rectus Content Access for MCP“ je softwara wotewrjeneho žórła. Slědowacy ludźo su k tutomu tykačej přinošowali. Sobuskutkowarjo * [ Rectus Inc. ](https://profiles.wordpress.org/rectuswp/) „Rectus Content Access for MCP“ je so do 1 rěče přełožił. Dźakujemy so [přełožowarjam](https://translate.wordpress.org/projects/wp-plugins/rectus-content-access-for-mcp/contributors) za jich přinoški. [Přełožće „Rectus Content Access for MCP“ do swojeje rěče.](https://translate.wordpress.org/projects/wp-plugins/rectus-content-access-for-mcp) ### Na wuwiću zajimowany? [Přehladajće kod](https://plugins.trac.wordpress.org/browser/rectus-content-access-for-mcp/), hladajće do [SVN-repozitorija](https://plugins.svn.wordpress.org/rectus-content-access-for-mcp/) abo abonujće [wuwiwanski protokol](https://plugins.trac.wordpress.org/log/rectus-content-access-for-mcp/) přez [RSS](https://plugins.trac.wordpress.org/log/rectus-content-access-for-mcp/?limit=100&mode=stop_on_copy&format=rss). ## Protokol změnow #### 1.0.1 * Added an optional date to post-create and post-update, read in the site time zone, so an entry can carry a past date instead of the time of the request. * Scheduled the post when that date is in the future, reporting the resulting future status instead of the requested publish. * Verified the stored date after saving, like the other post fields. #### 1.0.0 * Reported the plugin and site identity to MCP clients instead of the bundled adapter’s default server name, version, and instructions. * Added the server title, description, website URL, and icons defined by MCP 2025- 11-25, sent only to clients that negotiated a protocol version which defines them. * Added openWorldHint to every ability annotation, stating that operations stay within this WordPress site. * Fixed the OAuth discovery metadata check reporting a failure with the message„ 1“ on sites without a persistent object cache, which made the settings screen and Site Health report broken discovery while authorization worked normally. * Brought the plugin source to a clean WordPress Coding Standards run. * Removed unused parameters from the internal taxonomy helpers. #### 0.6.0 * Added post-edit, which replaces exact strings inside a stored post title, excerpt, or content instead of resending the whole field. * Added field_sha256 checksums to post-get and required the selected checksum as expected_field_sha256 when calling post-edit. * Required each edit to match exactly once unless replace_all is set, and rejected the whole request without saving when an edit does not match or is ambiguous. * Re-read the database immediately before saving, rejected stale field checksums, refreshed the post cache, and verified the stored value before reporting success. * Kept WordPress save filters active and returned an explicit re-read error when a filter stored a different value. #### 0.5.5 * Added permission-checked fixed-page template listing, reading, creation, update, and deletion for active-theme root-level page-*.php files with Template Name headers. * Added SHA-256 concurrency checks, explicit deletion confirmation, and an assigned- page safeguard for template deletion. * Added fixed-page template reporting and assignment through post-get, post-create, and post-update. #### 0.5.4 * Made post updates determine the post type from the post ID; an optional post_type input now acts only as a checked assertion. * Verified submitted post fields directly against the database and refreshed the post cache before reporting success. * Added permission-checked reading, writing, and deletion of public custom fields for posts, pages, and enabled custom post types. * Added per-field definitions to post reads for stored custom fields, including registered WordPress meta and ACF metadata when available. * Rejected protected custom field keys and returned explicit errors for mismatched post types, empty updates, or values that were not preserved. #### 0.5.3 * Fixed MCP sessions being rejected as invalid on sites with a persistent object cache, which stopped Claude Code and other clients from loading the tool list right after connecting. #### 0.5.2 * Verified post content after create and update operations so silently changed content is no longer reported as a successful save. * Preserved backslashes and escaped JSON values when creating posts, pages, and custom post type entries. * Allowed a short refresh-token rotation overlap for concurrent processes using the same MCP client credentials without revoking the active connection family. * Stored MCP HTTP sessions independently so Codex, Claude Code, and other clients can connect concurrently as the same WordPress user without overwriting one another. * Added media listing and permission-checked permanent deletion with exact ID, filename, and confirmation safeguards. #### 0.5.1 * Stopped running post content through wp_kses_post() for users who hold unfiltered_html, so an edit made through MCP keeps the markup that the block and classic editors would have stored. * Fixed JSON-LD structured data being dropped, and its raw JSON left behind as visible body text, when those users saved content through the create and update tools. #### 0.5.0 * Added a preferred direct multipart image upload flow for Codex and Claude Code. * Added short-lived, one-time media upload tickets exposed through an MCP ability. * Added a plugin REST endpoint that validates the ticket, WordPress user permissions, filename, byte size, MIME type, and image contents. * Added idempotent retry behavior that returns an existing attachment instead of creating a duplicate. * Kept Base64 media upload and server-side inbox import as compatible fallbacks. * Renamed PHP symbols, internal hooks, settings, OAuth storage, and credential prefixes to match Rectus Content Access for MCP. #### 0.4.1 * Preserved schema.org microdata attributes in post content saved through the create and update tools. #### 0.4.0 * Renamed the plugin to Rectus Content Access for MCP and updated its pre-approval slug. * Internationalized MCP ability names, descriptions, and error messages. * Standardized English source strings for WordPress.org translation workflows. * Removed bundled translation files in favor of WordPress.org language packs. * Generated site-specific MCP client server names from the WordPress domain and path. * Documented URL-based OAuth client metadata retrieval and the data it sends. * Separated Codex server setup from the fallback login command to prevent duplicate OAuth authorization flows. * Updated Claude Code setup to open browser authorization directly via `claude mcp login`. * Added a Site Health test and a settings screen check for OAuth discovery metadata reachability. * Added a post read tool that returns the stored content and terms for AI editing workflows. * Added a taxonomy term listing tool so clients assign existing terms instead of creating variants. * Added featured image support to the post create, update, and read tools. * Added taxonomy term filtering to the post list tool. * Allowed RFC 8252 ephemeral ports for native client loopback OAuth redirects. #### 0.3.0 * Added read-only paginated listing for posts, pages, and enabled custom post types. * Added read-only discovery of enabled post types, supported fields, and taxonomies. #### 0.2.0 * Added MCP OAuth 2.1 authorization with PKCE, resource indicators, and discovery metadata. * Added automatic access token refresh, refresh token rotation, and connection revocation. * Replaced Application Password setup with one-copy Codex and Claude Code commands. * Added an OAuth connection management table to the settings screen. #### 0.1.0 * Initial release. * Added configurable post, page, and custom post type access. * Added standard content, taxonomy, and media abilities. * Bundled the official WordPress MCP Adapter with conflict-safe autoloading. * Added initial Application Password and MCP client setup tools. ## Meta * Version **1.0.1** * Last updated **2 dnjej** * Active installations **Mjenje hač 10** * WordPress version ** 6.9 abo nowši ** * Tested up to **7.0.3** * PHP version ** 7.4 abo nowši ** * Languages * [English (US)](https://wordpress.org/plugins/rectus-content-access-for-mcp/) a [Japanese](https://ja.wordpress.org/plugins/rectus-content-access-for-mcp/). * [Přełožće do swojeje rěče](https://translate.wordpress.org/projects/wp-plugins/rectus-content-access-for-mcp) * Tags * [AI](https://hsb.wordpress.org/plugins/tags/ai/)[content](https://hsb.wordpress.org/plugins/tags/content/) [custom post types](https://hsb.wordpress.org/plugins/tags/custom-post-types/) [mcp](https://hsb.wordpress.org/plugins/tags/mcp/)[media](https://hsb.wordpress.org/plugins/tags/media/) * [Rozšěrjeny napohlad](https://hsb.wordpress.org/plugins/rectus-content-access-for-mcp/advanced/) ## Pohódnoćenja No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/rectus-content-access-for-mcp/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/rectus-content-access-for-mcp/reviews/) ## Sobuskutkowarjo * [ Rectus Inc. ](https://profiles.wordpress.org/rectuswp/) ## Podpěra Chceće něšto prajić? Trjebaće pomoc? [Forum pomocy pokazać](https://wordpress.org/support/plugin/rectus-content-access-for-mcp/)