Ostheimer Cockpit for WebMCP turns your WordPress site into a set of structured tools for
AI agents that run through your browser. It implements the experimental
WebMCP Draft Community Group Report,
which is not a W3C Standard. Compatible browser agents can discover what your
site can do and act on it. The plugin requires no separate MCP server and no
plugin API key.

The agent drafts; the human approves.

How it works

Install and activate the plugin, then open the normal WordPress dashboard
or the Cockpit for WebMCP page — both register the agent tools in your
browser. A native dashboard box shows the live status and quick links.
Enable experimental WebMCP support. Chrome 149+ offers an origin trial and
a local testing flag; the cockpit links to the current Chrome instructions.
Tell your browser’s AI agent what to do, for example:
“Write a draft post about pumpkin recipes and submit it for review.”
The agent drafts the content and submits it with the status
Zur Prüfung (pending review) — it never publishes on its own.
You review the draft in the review queue and approve it with one click.

Tool registration and WordPress requests run in your browser tab and your own
WordPress installation. The plugin itself does not send content to the plugin
developer or another third-party service. Your chosen browser, AI agent, or
extension may process prompts, page content, tool inputs, or tool results on
external systems under its provider’s terms and privacy policy.

Agent tools included

create_post / update_post — common core post fields: title, content,
excerpt, slug, author, scheduling date (planned posts), comment and ping
status, password protection, sticky, post format, page attributes
(parent, template, order).
Featured images in one step — the agent passes an image URL or uploads
self-generated images as Base64 (PNG, JPEG, WebP, GIF), the plugin puts
them into the media library and sets the featured image.
Taxonomies by name — categories_names / tags_names resolve names to
terms; missing tags are created automatically.
SEO fields are written to Yoast SEO or Rank Math automatically when
active, so agents can set meta titles and descriptions where your SEO
plugin actually reads them.
list_posts, get_post, get_post_markdown — search and read content in
agent-friendly formats.
list_comments, moderate_comment — triage the comment queue: the agent
sorts pending comments and spam, you decide what gets approved. Author
email and IP address are never handed to the agent.
list_revisions, compare_revisions, restore_revision — read a post’s
revision history and roll back to an earlier one. Restoring follows the
same review boundary as update_post (published or scheduled content
cannot be touched) and is itself reversible, because WordPress saves the
pre-restore state as a new revision before restoring.
list_terms, get_site_info, get_activity — context and audit trail.
upload_media, upload_media_base64 — media library uploads.
Developers can register their own agent tools with the
webmcp_cockpit_tools filter — anything a PHP callback can do becomes an
agent tool.

Safe by design

Agent content lands in a dedicated review status, invisible to visitors.
Publishing is only possible from the review queue, and only for users with
the publish capability.
Successful and failed agent tool calls plus workflow actions are written to
a controllable activity log with timestamp and user. Read entries contain
metadata only, never post content, search terms, tool inputs or tool results.
Session-bound authentication with a dedicated workflow nonce; per-user rate
limiting on write operations.
Works with caching plugins (Autoptimize, WP Rocket, LiteSpeed Cache,
W3 Total Cache, SG Optimizer) and with the Classic Editor and Gutenberg.

For developers

The cockpit is extensible: register custom tools via
apply_filters( ‘webmcp_cockpit_tools’, $tools ) with a name, description,
JSON schema and PHP callback. Custom tools appear alongside the built-in ones
in the browser agent’s tool list.