cosmincraciun97/stonewright-wp-mcp

Download the current plugin ZIP (1.0.0-beta.10 Public Beta) and install via Plugins -> Add New -> Upload Plugin (docs/installation.md).
Open Stonewright -> Setup, enable the site, and connect the client via guided OAuth or Application Password flow.
Fully restart the client and run the generated connection verification — a saved/parseable config alone is not runtime proof.
Direct mode (no plugin): create a WP Application Password and register with npx stonewright connect add --mode direct-only.

Usage

• •Confirm stonewright-task-start is visible and call it first with the real task; use the bounded 'essential' profile for normal work (bootstrap is startup diagnostics only).
• •Repair an Elementor page: read the live control schema, plan one surgical batch, snapshot the document, write once, verify, then complete the browser recipe.
• •Change custom code: discover the provider, dry-run the exact target, stop for human approval, apply approved bytes, read back, retain rollback evidence.
• •MCP surface modes (bootstrap / essential-static / essential / full) control how many abilities appear to clients; Elementor multi-step edits use a transaction envelope.

Key features

• ✓361 Plugin abilities (94 Elementor widget compat, 33 Elementor V3, 14 V4, design, Gutenberg/FSE, WP-CLI, WooCommerce, custom-code providers) and 101 Direct tools with a generated ability-truth matrix.
• ✓Gates selected by typed ability/mode/surface/risk: custom code stops for human approval, supported writes snapshot before mutation, destructive production-safe ops need a scoped confirmation token.
• ✓Durable audit, OAuth, write-receipt, and diagnostics contracts; incidents produce ranked actions and lessons.
• ✓Safety: staging + normal infrastructure backups recommended; plugin AGPL-3.0-or-later, companion MIT; PHP >=8.1, WordPress >=6.7.

Best for

Teams that need AI agents to edit WordPress/Elementor with an evidence trail — proof of change and a restore path — instead of an unguarded API bridge.

Caveats

• ⚠Current release is 1.0.0-beta.10 Public Beta; does not promise automation cannot fail, just concrete controls around supported changes.
• ⚠Direct mode does not write custom PHP/CSS/JS/HTML (no authenticated wp-admin grant boundary).
• ⚠Companion CLI is distributed via GitHub Releases (tgz), not the npm registry — commands reference vVERSION.
• ⚠Busy surface: enable only the tool profile you need; OAuth remote HTTP is a separate connection to /wp-json/mcp/stonewright-oauth.