=== Easy Connect MCP ===
Contributors: geteasysoft
Tags: mcp, ai, seo, undo, abilities
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.6.3
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

MCP server for WordPress: Claude, ChatGPT or any MCP client works on your site, SEO plugin, Search Console and Cloudflare — with undo.

== Description ==

Easy Connect MCP turns your WordPress site into a secure **MCP (Model Context Protocol) server**. An AI assistant such as Claude (claude.ai, Claude Desktop, Claude Code), ChatGPT, Cursor or VS Code can then read and work on your site — but only within the permissions you grant, and every call is logged.

= Simple, secure connection =
* In Claude.ai add a custom connector with your site's MCP address (shown on the plugin's *AI connection* page). An "Authorize application" page opens on your site: you tick the permissions, each explained in plain language together with its risks, and approve.
* Standard OAuth 2.1 with PKCE, dynamic client registration and automatic token renewal. Connections can be narrowed or revoked at any time.
* Alternative for Claude Code, Claude Desktop and other clients: manual access tokens (stored only as hashes, with expiry and a read-only option).
* Main on/off switch, optional IP allow-list and a request limit per minute.

= What the AI can do (each item is a separate permission, off by default) =
* **Content:** read pages, posts and any content type (including custom post types and drafts), create and edit drafts, publish, schedule, trash; revisions (list, compare, restore); Gutenberg blocks (read the block tree, replace, insert, remove blocks); custom fields; categories, tags and custom taxonomy terms.
* **Find and replace across content** with a mandatory preview of every match, applied in one step and undone in one step.
* **Media:** upload files directly from the chat (base64, larger files in chunks up to your server's upload limit) or from a public URL, with alt text, caption and featured image; the file type is checked by content, SVG is refused unless you allow it. List, edit and delete media.
* **SEO plugins — Yoast SEO, Rank Math, All in One SEO, SEOPress:** read and write every per-post and per-category SEO field (title, description, focus keyphrases, canonical, noindex/nofollow, Open Graph and X/Twitter previews, breadcrumbs title, cornerstone, schema type), read SEO scores, audit pages with missing fields, manage redirects (Rank Math, Yoast SEO Premium, SEOPress) and change safe global settings (separator, title templates, XML sitemap, breadcrumbs). The active plugin is detected automatically.
* **Site editor:** templates and template parts (header, footer), patterns (synced and unsynced) and global styles.
* **Comments and users:** list, approve, mark as spam, reply, delete comments; read the list of users (never passwords).
* **Abilities of other plugins (WordPress 6.9+):** run the abilities of Yoast SEO, WooCommerce, Rank Math, Elementor and others — only those you allow one by one. Optionally, offer the Easy Connect MCP functions as WordPress abilities for the official MCP Adapter.
* **Menus and settings:** edit menus and menu locations; change a safe list of site settings (title, tagline, front page, time zone…). Critical settings (site address, admin email, user registration, search engine visibility) can never be changed by the AI.
* **Plugins and themes:** view installed plugins/themes and search the WordPress.org directory (read-only).
* **Google Search Console:** properties, search performance (clicks, impressions, CTR, position), URL inspection, sitemaps (read-only).
* **Google Analytics 4:** properties, reports and realtime reports (read-only).
* **PageSpeed Insights:** test any public page for Core Web Vitals, performance, accessibility, best practices and SEO. The AI receives a compact summary (scores, lab metrics, real-user field data, the top improvement opportunities) and a link to the full report. Works without an API key; a free Google API key is recommended for a reliable quota.
* **Cloudflare:** zones, settings, DNS records, firewall rules, Turnstile widgets and traffic analytics (read-only), plus purging the cache.

= Change history and undo =
* Every change made through Easy Connect MCP is recorded with the state before and after: content, SEO fields, settings, menus, media, terms, comments, templates and styles, redirects.
* The **History** page shows who changed what (per connection), a side-by-side diff and a one-click **Undo**. Undo restores only what that change modified and refuses to overwrite later edits unless you confirm. A whole request (for example a find and replace in 40 posts) can be undone in one step. The AI can list, inspect and undo changes too, if you allow it.
* Kept 30 days by default (configurable).

= Pause and approvals =
* **Pause all AI access** with one click from any Easy Connect MCP page: every request is refused with a clear message until you resume. Nothing else is changed.
* Optional **approval mode**: high-risk actions (or every change) wait in the **Approvals** page with the exact request and a preview; the AI is told to wait and gets the result after you approve.

= Easy connection =
* Copy-ready setup for Claude (claude.ai, Desktop, Claude Code), ChatGPT, Cursor, VS Code and OpenAI Codex, with sign-in through the authorization screen (no token to copy).
* **Test connection**: checks HTTPS, the MCP address, the OAuth information, another MCP plugin answering at the domain root, and whether your web server passes the Authorization header (with the fix for Apache, LiteSpeed and Nginx).

= Built for safety =
* Every permission is explained ("What it does" / "Risks") on the Permissions page and on the authorization screen. High-risk permissions require an explicit confirmation.
* Any single function can be switched off, even inside an allowed permission.
* Activity log of every call, including denied ones, plus the change history with undo.
* Secrets (Google refresh token, Cloudflare token, PageSpeed API key) are encrypted with AES-256-GCM using your site's own keys from wp-config.php. Access tokens are stored only as hashes.
* HTML written by the AI never gets the administrator's "unfiltered HTML" right: posts, pages, patterns, comments and terms are filtered like an author's content, and find & replace and template edits are refused if they would add a script, iframe, event handler or similar markup (markup already on the page is kept as it is).
* Media uploads by the AI accept only images, audio, video, PDF, office documents and plain text/CSV — never web pages, scripts, style sheets or XML; SVG only if you allow it.
* Protected DNS records: the site address, www, email (MX) and name servers (NS).

= Optional Premium add-on =
The separate, paid **Easy Connect MCP Premium** add-on (sold on geteasysoft.com, not required) adds Google Ads, Google Tag Manager, sitemap submission, plugin and theme management, and Cloudflare changes (speed, SSL, DNS records, security rules, Turnstile). This plugin is complete and fully functional on its own; it contains no locked features and no license checks.

= Languages =
English, German (Germany formal and informal, Switzerland), French, Italian, Spanish and Romanian are included. The plugin automatically follows the language set in WordPress — the site language or each user's profile language; other languages fall back to English.

== External services ==

This plugin connects to the third-party services below **only when you (the administrator) set them up and only when a feature that needs them is used**. Nothing is sent before that, and there is no tracking or analytics of any kind.

= Your AI client (MCP client) =
The plugin is an MCP server: it does not call any AI service itself. The AI application you connect (for example Claude by Anthropic, ChatGPT by OpenAI, Cursor) sends requests to your site's MCP endpoint and receives the data returned by the tools you allowed (for example page content, Search Console figures, PageSpeed results). That data is then processed by the AI provider under that provider's terms and privacy policy, e.g. Anthropic: https://www.anthropic.com/legal/consumer-terms and https://www.anthropic.com/legal/privacy ; OpenAI: https://openai.com/policies/terms-of-use and https://openai.com/policies/privacy-policy .

= Google APIs (Search Console, Analytics, account sign-in) =
Used when you connect a Google account on the *Google account* page and when the AI uses a Search Console or Analytics tool. The plugin sends authenticated requests to Google (accounts.google.com, oauth2.googleapis.com, openidconnect.googleapis.com, www.googleapis.com, searchconsole.googleapis.com, analyticsdata.googleapis.com, analyticsadmin.googleapis.com): the OAuth authorization, the refresh token to obtain access tokens, and the query parameters of each report (property, dates, dimensions, URL to inspect). When the plugin is deleted or you click Disconnect, the access is revoked at Google. Google Terms of Service: https://policies.google.com/terms — Privacy Policy: https://policies.google.com/privacy — Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

= GetEasySoft Google sign-in relay (license.easysoftapp.eu) =
Optional "quick connect" so you do not need your own Google Cloud project. Used only if you click **Connect with Google** (you can instead use your own Google Cloud project under *Advanced*, and the relay is never contacted). What is sent and when:
* When you click Connect with Google, the plugin first checks that quick connect is available (`GET https://license.easysoftapp.eu/api/google/status`, no data about your site is sent; the answer is cached for one hour).
* Your browser is then sent to the relay with your site address, the return address in your wp-admin, the Google permissions (scopes) requested and a one-time PKCE challenge. You then sign in on Google's own page.
* After you sign in, your site collects the Google tokens from the relay once (one-time handoff protected by PKCE). The relay does not keep your tokens.
* Every time a new Google access token is needed (about once an hour while the AI uses Google tools), your site sends the stored refresh token to the relay, which adds the application secret and forwards the request to Google.
Provider: GetEasySoft. Terms: https://geteasysoft.com/terms-and-conditions/ — Privacy policy: https://geteasysoft.com/privacy-policy/

= Google PageSpeed Insights API =
Used only when the AI calls the PageSpeed tool (permission "Run PageSpeed Insights tests"). The plugin sends the tested URL, the strategy (mobile/desktop), the requested categories and, if you saved one, your own API key to https://www.googleapis.com/pagespeedonline/v5/runPagespeed. Google then loads that public page like a visitor. Results are cached on your site for 10 minutes. Terms: https://developers.google.com/terms and https://policies.google.com/terms — Privacy Policy: https://policies.google.com/privacy

= Cloudflare API =
Used only if you save a Cloudflare API token (or Global API Key) on the *Cloudflare* page, when you test the connection and when the AI calls a Cloudflare tool. The plugin sends authenticated requests to https://api.cloudflare.com/client/v4/ (zones, settings, DNS records, firewall rules, Turnstile widgets, GraphQL analytics, cache purge with the URLs to purge). The "Create the API token in Cloudflare" button only opens the Cloudflare dashboard in your browser. Cloudflare Terms: https://www.cloudflare.com/website-terms/ — Privacy Policy: https://www.cloudflare.com/privacypolicy/

= WordPress.org =
The read-only tools that search the plugin and theme directory use WordPress core functions (api.wordpress.org), exactly like the Plugins → Add New screen.

== Installation ==

1. Install the plugin from Plugins → Add New (search for "Easy Connect MCP") or upload the ZIP, then activate it.
2. Open **Easy Connect MCP → Permissions** and enable what the AI may do (everything is off by default). You can also choose the permissions later on the authorization screen.
3. In Claude.ai: *Settings → Connectors → Add custom connector*, name it and paste the MCP address shown on **Easy Connect MCP → AI connection** (it looks like `https://your-site.com/wp-json/esys-connect/v1/mcp`). Leave the OAuth fields empty and click Connect, then approve on your site.
4. Optional: connect Google (Search Console, Analytics), add a PageSpeed Insights API key and connect Cloudflare on their pages.

For Claude Code, Claude Desktop and other clients, create an access token under *AI connection → Alternative method* and follow the instructions shown there.

== Frequently Asked Questions ==

= Which AI clients work with it? =
Any client that supports remote MCP servers over Streamable HTTP: Claude.ai (web, desktop and mobile), Claude Desktop, Claude Code, ChatGPT (where custom connectors are available), Cursor, VS Code and others. Claude.ai and other OAuth-capable clients connect with the built-in authorization screen; other clients use a manual token.

= Does the plugin send my content to an AI company? =
The plugin itself never contacts an AI provider. Data only leaves your site when the AI client you connected calls a tool you allowed; the result is returned to that client and processed by its provider. Choose the permissions accordingly — each one explains what the AI will see.

= Can the AI break my site? =
Only if you allow it. All permissions are off by default, risky ones need an explicit confirmation, drafts are preferred, published pages keep their revisions, critical settings are never exposed and every call is logged. Start with the read-only permissions.

= Do I need a Google Cloud project? =
No. "Connect with Google" uses the GetEasySoft quick-connect relay (see External services). If you prefer, you can use your own Google Cloud project under *Advanced*.

= Do I need an API key for PageSpeed Insights? =
It works without one, but Google's shared quota for requests without a key is very small and often exhausted, in which case the AI receives a clear "quota exceeded" message. A free key takes about three minutes to create (the steps are shown on the Google account page) and gives 25,000 tests per day.

= Is it free? =
Yes. This plugin is free and complete. An optional, separately sold add-on (Easy Connect MCP Premium) adds Google Ads, Tag Manager and management features for agencies and advanced users.

= I used version 2.4 with a Premium license. What happens after updating to 2.5? =
Premium features moved to the separate Easy Connect MCP Premium add-on. Your license key and settings stay saved; the plugin shows a notice with the steps to install the add-on, which picks them up automatically.

= Can I undo what the AI changed? =
Yes. Every change made through the plugin is recorded with its before and after state. Open *Easy Connect MCP → History*, look at the diff and click *Undo*. Undo is refused when the same fields were edited again later (so your newer work is not overwritten), unless you confirm. Permanently deleted media files cannot be restored.

= Which SEO plugins are supported? =
Yoast SEO, Rank Math, All in One SEO and SEOPress (free and premium editions). The plugin uses each one's own API or its documented fields. Redirects are available with Rank Math (Redirections module), Yoast SEO Premium and SEOPress; category SEO with Yoast SEO, Rank Math and SEOPress.

= Can I stop the AI immediately? =
Yes: "Pause all AI access" at the top of every Easy Connect MCP page refuses all requests until you resume. You can also require your approval for risky actions on the *Approvals* page.

= Where are the settings stored? What happens when I delete the plugin? =
In your WordPress database (options, a log table and a change history table). Deleting the plugin removes all its data, revokes the Google access and drops both tables.

== Screenshots ==

1. AI connection: MCP address, authorized connections and connection security.
2. Permissions: every permission explained with what it does and its risks, grouped by service.
3. The "Authorize application" screen shown when Claude.ai connects to your site.
4. Google account: Search Console and Analytics connection and the PageSpeed Insights API key.
5. Cloudflare: API token, zone, access scope and DNS protection.
6. Activity log of every AI call, including denied ones.
7. A PageSpeed Insights test as returned to the AI client (scores, Core Web Vitals, top opportunities).
8. Change history: every AI change with who made it, a side-by-side diff and one-click undo.
9. Approvals: risky actions wait for your decision, with the exact request and a preview.
10. Setup snippets for Claude, ChatGPT, Cursor, VS Code and Codex, and the connection test.

== Credits ==

Bundled fonts: Bricolage Grotesque and Instrument Sans, SIL Open Font License 1.1 (see `assets/fonts/OFL.txt`). Icons: WordPress Dashicons.

== Changelog ==

= 2.6.3 =
* Copies installed from geteasysoft.com: the "Need more?" box on the Permissions page now has a license key field. Enter the key you received after buying Easy Connect MCP Premium and click Install Premium: the key is checked and activated for your site, the add-on is downloaded, installed and activated, and its License page opens already licensed (no second entry). If the add-on is already installed, the same button activates it. Clear messages for an invalid, expired or disabled key, a full site limit or an unreachable license server; at most 5 attempts per 10 minutes. On sites where WordPress cannot install plugins itself (file changes disabled or FTP credentials needed) the box links to the download in your account instead. The key is stored encrypted and never shown again or written to the Activity log. The WordPress.org copy is unchanged and shows only the link to the product page.
* No settings are changed by this update.

= 2.6.2 =
* Plugin details ("View details") now show the full plugin page like on WordPress.org: description, installation, FAQ, screenshots and changelog tabs, banner, author and plugin homepage (when the update server provides them). No settings are changed.

= 2.6.1 =
Security release — please update. All issues were found in our own audit; no settings are changed by this update.
* Security: AI uploads (`wp_upload_media`, chunked uploads, `wp_upload_media_from_url`) use their own list of file types (images, audio, video, PDF, office documents, text/CSV). HTML, JavaScript, CSS and XML files are always refused, also when renamed, even though WordPress allows HTML uploads for administrators. Downloads from a URL are limited to the site's upload size.
* Security: find & replace and template edits can no longer add scripts, iframes, event handlers or `javascript:` links (also not by rebuilding them with regular-expression back-references). AI connections never get the "unfiltered HTML" right of the linked administrator. Global style values are checked too.
* Security: undo and redo through the AI need the permission the change was made with (for example undoing a settings change needs "Change site settings"), and changes to published content need "Publish and edit live content". Older history entries without a recorded permission can be undone only by an administrator on the History page. Change details also follow the permission.
* Security: every message of a JSON-RPC batch now counts against the per-minute limit, and a batch can contain at most 20 messages.
* Security: the "drafts only" rule is now an allowlist: the generic content tools work only on viewable content types (posts, pages, products, public custom types) and only on drafts/pending items without the publish permission. Orders, coupons, form entries and other records are never reachable through them.
* Security: an approved request runs with the connection's current permissions; requests of a revoked or expired connection are not run.
* Security: abilities that run other abilities (such as the MCP Adapter's "execute ability") cannot be run through `wp_ability_run`, and Easy Connect MCP tools cannot be called as abilities from inside an AI connection.
* Security: open OAuth client registration is limited per IP address and redirect addresses are limited in length.
* WordPress.org copy: the Permissions page shows only a short note about the optional Premium add-on instead of greyed-out Premium permissions.

= 2.6.0 =
* New: **Change history and undo** — every change made through the plugin (content, SEO, settings, menus, media, terms, comments, templates, styles, redirects) is recorded with the state before and after, per connection. New *History* page with a side-by-side diff and one-click undo (also for a whole request); tools `wp_history_list`, `wp_history_get`, `wp_history_undo`. Kept 30 days (configurable).
* New: **Pause all AI access** switch on every plugin page, and an optional **approval mode** (high-risk actions or every change wait on the new *Approvals* page; the AI checks the result with `wp_approval_status`).
* New: **SEO plugins** — Yoast SEO, Rank Math, All in One SEO and SEOPress: all per-post and per-category SEO fields, scores, audit of missing fields, redirects and safe global settings (`seo_*` tools, four new permissions).
* New: **upload files directly from the chat** (`wp_upload_media`, chunked uploads for larger files up to the server limit), with alt text, caption and featured image; file type checked by content; SVG only if you allow it. `wp_upload_media_from_url` can now also set caption and featured image.
* New: **find and replace** across content with preview and one-step undo; **revisions** (list, compare, restore); **Gutenberg blocks** (read and edit individual blocks); **custom fields**; **content types, taxonomies and terms**; **comments** (moderate, reply, delete); **users** (read only); **site editor** templates, template parts, patterns and global styles.
* New: **WordPress Abilities API** bridge (WordPress 6.9+): run the abilities of other plugins you allow one by one, and optionally offer the Easy Connect MCP functions as abilities for the official MCP Adapter.
* New: copy-ready setup for ChatGPT, Cursor, VS Code, Codex and Claude Code with OAuth, and a **Test connection** diagnostic (HTTPS, MCP address, OAuth metadata, Authorization header stripping with the fix).
* The Permissions page previews the new Premium groups (Elementor, WooCommerce, ACF, forms, translations, users) when the related plugin is active.
* For developers: a public change history API (`History::track()`, `record()`, `mark_undone()`, type registration) and new tool keys, see `docs/extending.md`.
* Works on PHP without the ctype and sodium extensions.
* No existing settings, tokens, connections or permissions are changed by this update; all new permissions are off until you enable them.

= 2.5.6 =
* Permissions page: every section now has a "Select all / Deselect all" switch (it also shows when only some permissions are on). When a section contains medium, high or critical risk permissions, you confirm them once, in a single message that lists them, instead of one question per permission. Functions you turned off individually stay off.
* The "Authorize application" screen has the same "Select all" switch per section.
* No settings are changed by this update; only what you select and save is stored.

= 2.5.5 =
* Our brand is now GetEasySoft (geteasysoft.com). Names and links updated; no settings are changed.

= 2.5.4 =
* Links now point to our new website geteasysoft.com (the old address keeps redirecting). No settings are changed.

= 2.5.3 =
* The Premium preview on the Permissions page now also lists the new Google Ads permissions of Easy Connect MCP Premium 1.2 (create campaigns, edit ads, ad groups and assets, edit and remove keywords). No settings are changed by this update.

= 2.5.2 =
* Updates from your WordPress dashboard work again for copies installed from geteasysoft.com (the WordPress.org copy is updated by WordPress.org). No settings are changed.

= 2.5.1 =
* The Permissions page now previews the Premium add-on permissions (Google Ads, Tag Manager, sitemaps, plugin and theme management, GitHub and ZIP packages, Cloudflare changes) greyed out and not selectable, so you can see what Premium adds. No settings are changed by this update.

= 2.5.0 =
* Premium features (Google Ads, Tag Manager, sitemap submission, plugin and theme management, Cloudflare changes) are now the separate Easy Connect MCP Premium add-on; after updating, sites with a license get a one-click install and keep their license and settings.
* New: PageSpeed Insights tool (`pagespeed_run`) — the AI can test any public page (this site by default) on mobile or desktop and receives scores, lab metrics (LCP, FCP, CLS, TBT, Speed Index, TTI), real-user Core Web Vitals, the top improvement opportunities and a link to the full report. Optional API key (stored encrypted) on the Google account page.
* The plugin is now fully free and ready for WordPress.org: no license checks and no self-updater; updates come through WordPress.
* New extension points (filters and actions) for add-ons: permissions, tools, settings, admin pages and Google services.
* The "Authorize application" page loads its style and script as files; clearer message when a function is allowed on the site but was not granted to a connection.
* Security: activity-log queries use identifier placeholders; uninstall also removes cached data.
* Requires WordPress 6.2 or newer.

= 2.4.0 =
* New Cloudflare integration: connect with an API token (one click opens Cloudflare with the permissions pre-filled), choose the zone and whether the AI may work only on it or on all zones.
* The AI can read Cloudflare zones, settings, DNS, firewall and traffic statistics and purge the cache.
* DNS protection: the site address, www, email (MX) and name servers (NS) cannot be changed or deleted by the AI.
* Optional Global API Key connection, hidden under "Alternative", with a clear warning.

= 2.3.2 =
* Tidier connection security settings.

= 2.3.1 =
* Fixed a broken image in front of the status icons: the plugin uses built-in WordPress icons instead of emoji images.

= 2.3.0 =
* The plugin is in English by default, with a full Romanian translation.
* Descriptions of the AI functions are in English for every site, so any AI assistant understands them precisely.

= 2.1.0 =
* The plugin is now called Easy Connect MCP.
* Quick Google connection, no Google Cloud project needed. Your own project is still available under "Advanced".
* Pick the Search Console and GA4 properties from lists after connecting.

= 2.0.0 =
* Redesigned authorization page, per-connection permission editing, switching off single functions, automatic import from MPS Connect.

== Upgrade Notice ==

= 2.6.3 =
Copies from geteasysoft.com: install and activate Easy Connect MCP Premium by entering your license key on the Permissions page. No settings are changed.

= 2.6.2 =
Richer "View details" window (installation, FAQ, screenshots, banner). No settings are changed.

= 2.6.1 =
Security release: safer AI uploads (no HTML/JS files), no scripts through find & replace or templates, undo limited to the connection's permissions, batch requests rate-limited. Please update. Your settings are not changed.

= 2.5.6 =
Adds "Select all" per section on the Permissions page, with one risk confirmation per section. Your settings are not changed.

= 2.5.1 =
Shows a read-only preview of the Premium permissions on the Permissions page. Your settings are not changed.

= 2.5.0 =
Adds a PageSpeed Insights tool. Premium features (Google Ads, Tag Manager, plugin/theme management, Cloudflare changes) moved to the separate Premium add-on — if you had a license, follow the notice after updating; your license and settings are kept. Requires WordPress 6.2+.
