Rectus Content Access for MCP lets authenticated MCP clients manage WordPress content, classic navigation menus, and media files.

For a Japanese overview and setup guide, visit the Rectus Content Access for MCP introduction page.

The plugin provides:

Listing, creation, and updating of posts, pages, and selected custom post types.
Targeted string edits with full-field SHA-256 conflict detection, so small corrections do not require resending an entire title, excerpt, or content field.
Confirmation-protected movement of posts to the WordPress trash with post type and modified-time conflict checks.
An optional publication date on creation and update, so back-dated entries such as a release history can be filed under the day they happened.
Reading of a single post’s stored title, content, excerpt, and assigned terms for editing workflows.
Listing of enabled post types with labels, supported fields, and taxonomies.
Listing of existing taxonomy terms so clients reuse the established vocabulary.
Paginated content lists with status, search, taxonomy term, and ordering filters.
Featured image assignment from uploaded media when creating or updating posts.
Classic navigation menu, menu item, hierarchy, order, and theme-location management with checksum conflict protection.
Media library listing, physical filename changes, and confirmation-protected permanent attachment deletion.
A settings screen where administrators choose which post types MCP clients may access.
Support for standard content fields, public custom fields, and taxonomies assigned to the selected post type.
Listing, reading, creation, update, and confirmation-protected deletion of managed fixed-page templates in the active theme.
Fixed-page template assignment through post creation and update operations.
Direct multipart image uploads for Codex and Claude Code using short-lived, one-time tickets.
Base64-encoded image uploads as a fallback for MCP clients that cannot perform direct uploads.
Browser-based OAuth 2.1 authorization with PKCE and automatic token refresh.
Copy-ready setup commands for Codex and Claude Code.
Site-specific MCP server names derived from the WordPress domain and path to prevent client configuration collisions.
Support for MCP protocol revisions 2025-11-25, 2025-06-18, and 2024-11-05, negotiated with the connecting client.
Server identity reported on connection, including the site title, description, website URL, and icons, so a client registered against several sites can tell them apart.
Translation-ready administration, OAuth, MCP ability, and error strings.

Posts and pages are enabled by default. Custom post types must be enabled by an administrator before MCP clients can use them.

Rectus Content Access for MCP checks the authorized WordPress user’s native capabilities for every operation, including each post type’s create, edit, publish, and taxonomy permissions.

Saved content is filtered by the same capability WordPress itself uses, so an edit made through an MCP client is stored exactly as the block or classic editor would have stored it. Markup that the editors keep, such as JSON-LD structured data and schema.org microdata, survives the round trip instead of being silently rewritten.

For targeted corrections, post-get returns SHA-256 checksums of the exact stored title, content, and excerpt. Post-edit requires the selected field checksum, re-reads the database immediately before saving, and returns a conflict without saving if the field changed. WordPress save filters still run normally, and the stored value is verified before success is reported.

OAuth access tokens, refresh tokens, authorization codes, and direct media upload tickets are stored only as SHA-256 hashes. Access tokens expire after one hour, refresh tokens are rotated automatically, and connections can be revoked from the settings screen. Uninstalling Rectus Content Access for MCP removes its settings and OAuth data.

A client that shares one credential between several processes can present a refresh token that another process already rotated away. For supported retry behavior, Rectus Content Access for MCP can replay the already-issued token pair instead of issuing a parallel credential, so the client converges on the single active credential. Replay material is encrypted with a key derived from the presented refresh token itself, so it is never recoverable from the database alone. Replay requests are bounded by the rotation history and a time safety limit; requests outside those bounds are treated as reuse of an invalid credential and revoke the connection family.

The official WordPress MCP Adapter library is bundled with Rectus Content Access for MCP. A separate MCP Adapter plugin or Node.js process is not required on the WordPress server.

Third-Party Libraries

Rectus Content Access for MCP includes the following GPL-compatible Composer packages:

WordPress MCP Adapter, copyright WordPress.org Contributors, GPL-2.0-or-later.
WordPress PHP MCP Schema, copyright WordPress.org Contributors, GPL-2.0-or-later.
Jetpack Autoloader, copyright Automattic, GPL-2.0-or-later.

License files are included with each package under the vendor directory.