@adsim/wordpress-mcp-server 5.3.1 → 5.4.0

package/companion/mcp-diagnostics.php

@@ -140,6 +140,34 @@ function mcp_diagnostics_register_routes() {
 		),
 	) );
 
+	// ── SEO meta direct write (bypasses Yoast REST API block) ──
+	register_rest_route( $namespace, '/seo-meta/(?P<post_id>\d+)', array(
+		array(
+			'methods'             => 'GET',
+			'callback'            => 'mcp_diagnostics_seo_meta_get',
+			'permission_callback' => 'mcp_diagnostics_schema_permission_check',
+			'args'                => array(
+				'post_id' => array(
+					'type'              => 'integer',
+					'required'          => true,
+					'sanitize_callback' => 'absint',
+				),
+			),
+		),
+		array(
+			'methods'             => 'POST',
+			'callback'            => 'mcp_diagnostics_seo_meta_set',
+			'permission_callback' => 'mcp_diagnostics_schema_permission_check',
+			'args'                => array(
+				'post_id' => array(
+					'type'              => 'integer',
+					'required'          => true,
+					'sanitize_callback' => 'absint',
+				),
+			),
+		),
+	) );
+
 	// ── Polylang Free REST fallback ──
 	register_rest_route( $namespace, '/polylang/languages', array(
 		'methods'             => 'GET',
@@ -791,6 +819,143 @@ function mcp_schema_output_jsonld() {
 	echo '<script type="application/ld+json">' . $schema . '</script>' . "\n";
 }
 
+// ============================================================
+// SEO Meta direct write — bypasses Yoast REST API block
+// ============================================================
+
+/**
+ * Allowed SEO meta keys grouped by plugin.
+ * Only these keys can be written via the direct endpoint.
+ */
+function mcp_diagnostics_seo_allowed_keys() {
+	return array(
+		// Yoast SEO
+		'_yoast_wpseo_focuskw',
+		'_yoast_wpseo_title',
+		'_yoast_wpseo_metadesc',
+		'_yoast_wpseo_canonical',
+		'_yoast_wpseo_meta-robots-noindex',
+		'_yoast_wpseo_meta-robots-nofollow',
+		// RankMath
+		'rank_math_title',
+		'rank_math_description',
+		'rank_math_focus_keyword',
+		'rank_math_canonical_url',
+		// SEOPress
+		'_seopress_titles_title',
+		'_seopress_titles_desc',
+		'_seopress_analysis_target_kw',
+		'_seopress_robots_canonical',
+		'_seopress_robots_index',
+		'_seopress_robots_follow',
+		// All in One SEO
+		'_aioseo_title',
+		'_aioseo_description',
+		'_aioseo_keywords',
+		'_aioseo_canonical_url',
+		'_aioseo_noindex',
+		'_aioseo_nofollow',
+	);
+}
+
+/**
+ * GET /mcp-diagnostics/v1/seo-meta/{post_id}
+ * Read SEO meta fields directly from post_meta.
+ */
+function mcp_diagnostics_seo_meta_get( $request ) {
+	$post_id = $request->get_param( 'post_id' );
+	$post    = get_post( $post_id );
+
+	if ( ! $post ) {
+		return new WP_Error( 'not_found', __( 'Post not found.' ), array( 'status' => 404 ) );
+	}
+
+	$allowed = mcp_diagnostics_seo_allowed_keys();
+	$meta    = array();
+
+	foreach ( $allowed as $key ) {
+		$val = get_post_meta( $post_id, $key, true );
+		if ( $val !== '' && $val !== false ) {
+			$meta[ $key ] = $val;
+		}
+	}
+
+	return new WP_REST_Response( array(
+		'post_id' => $post_id,
+		'meta'    => $meta,
+		'source'  => 'direct_post_meta',
+	), 200 );
+}
+
+/**
+ * POST /mcp-diagnostics/v1/seo-meta/{post_id}
+ * Write SEO meta fields directly via update_post_meta().
+ * Bypasses Yoast's REST API write block.
+ *
+ * Accepts JSON body: { "meta": { "_yoast_wpseo_focuskw": "value", ... } }
+ */
+function mcp_diagnostics_seo_meta_set( $request ) {
+	if ( mcp_diagnostics_is_read_only() ) {
+		return new WP_Error( 'read_only', __( 'Site is in read-only mode.' ), array( 'status' => 403 ) );
+	}
+
+	$post_id = $request->get_param( 'post_id' );
+	$post    = get_post( $post_id );
+
+	if ( ! $post ) {
+		return new WP_Error( 'not_found', __( 'Post not found.' ), array( 'status' => 404 ) );
+	}
+
+	$body = $request->get_json_params();
+	$meta = isset( $body['meta'] ) ? $body['meta'] : array();
+
+	if ( empty( $meta ) || ! is_array( $meta ) ) {
+		return new WP_Error( 'invalid_body', __( 'Request body must contain a "meta" object with key-value pairs.' ), array( 'status' => 400 ) );
+	}
+
+	$allowed = mcp_diagnostics_seo_allowed_keys();
+	$written = array();
+	$rejected = array();
+
+	foreach ( $meta as $key => $value ) {
+		if ( ! in_array( $key, $allowed, true ) ) {
+			$rejected[] = $key;
+			continue;
+		}
+
+		// Sanitize: URLs get esc_url_raw, everything else gets sanitize_text_field
+		if ( strpos( $key, 'canonical' ) !== false ) {
+			$value = esc_url_raw( $value );
+		} else {
+			$value = sanitize_text_field( $value );
+		}
+
+		update_post_meta( $post_id, $key, $value );
+		$written[] = $key;
+	}
+
+	// Verify the writes
+	$verified = array();
+	foreach ( $written as $key ) {
+		$actual = get_post_meta( $post_id, $key, true );
+		$verified[ $key ] = $actual;
+	}
+
+	$response = array(
+		'post_id'  => $post_id,
+		'written'  => $written,
+		'verified' => $verified,
+		'source'   => 'direct_update_post_meta',
+	);
+
+	if ( ! empty( $rejected ) ) {
+		$response['rejected'] = $rejected;
+		$response['warning']  = 'Some keys were rejected (not in allowed SEO meta keys list).';
+	}
+
+	return new WP_REST_Response( $response, 200 );
+}
+
 // ============================================================
 // Polylang Free REST fallback endpoints
 // ============================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adsim/wordpress-mcp-server",
-  "version": "5.3.1",
+  "version": "5.4.0",
   "description": "Enterprise WordPress MCP Server — 180 tools, modular architecture, governance, audit trail, WooCommerce, Schema.org, multilingual.",
   "type": "module",
   "main": "index.js",

package/src/tools/content.js

@@ -7,7 +7,7 @@ import { rt } from '../shared/context.js';
 
 export const definitions = [
   { name: 'wp_list_posts', _category: 'content', description: 'Use to browse/filter posts by status, category, tag, author, or search. Read-only. Hint: use mode=\'summary\' for listings, \'ids_only\' for batch ops.', inputSchema: { type: 'object', properties: { per_page: { type: 'number', default: 10 }, page: { type: 'number', default: 1 }, status: { type: 'string', default: 'publish' }, orderby: { type: 'string', default: 'date' }, order: { type: 'string', default: 'desc' }, categories: { type: 'string' }, tags: { type: 'string' }, search: { type: 'string' }, author: { type: 'number' }, mode: { type: 'string', default: 'full', description: 'full=all fields, summary=id/title/slug/date/status/link only, ids_only=flat ID array' } }}},
-  { name: 'wp_get_post', _category: 'content', description: 'Use to read a single post with full content and meta. Read-only. Hint: use content_format=\'links_only\' for link audits (~800 chars vs 187k), \'text\' for rewrites, fields=[\'id\',\'title\',\'meta\'] for SEO-only.', inputSchema: { type: 'object', properties: { id: { type: 'number' }, fields: { type: 'array', items: { type: 'string' }, description: 'Return only specified fields (id,title,content,excerpt,slug,status,date,modified,categories,tags,author,featured_media,meta,link). Omit for all.' }, content_format: { type: 'string', default: 'html', description: 'html=raw HTML (truncated at WP_MAX_CONTENT_CHARS), text=plain text, links_only=extract internal links only' } }, required: ['id'] }},
+  { name: 'wp_get_post', _category: 'content', description: 'Use to read a single post with full content and meta. Read-only. Hint: use content_format=\'links_only\' for link audits (~800 chars vs 187k), \'text\' for rewrites, fields=[\'id\',\'title\',\'meta\'] for SEO-only.', inputSchema: { type: 'object', properties: { id: { type: 'number' }, fields: { type: 'array', items: { type: 'string' }, description: 'Return only specified fields (id,title,content,excerpt,slug,status,date,modified,categories,tags,author,featured_media,meta,link). Omit for all.' }, content_format: { type: 'string', enum: ['html', 'text', 'links_only', 'raw'], default: 'html', description: 'html=rendered HTML (truncated at WP_MAX_CONTENT_CHARS), text=plain text, links_only=extract internal links only, raw=Gutenberg source with block comments via ?context=edit (NEVER truncated — required before any read-modify-write of content)' } }, required: ['id'] }},
   { name: 'wp_create_post', _category: 'content', description: 'Use to create a post (defaults to draft). Accepts title, HTML content, categories, tags, featured_media, meta. Write — blocked by WP_READ_ONLY.', inputSchema: { type: 'object', properties: { title: { type: 'string' }, content: { type: 'string' }, status: { type: 'string', default: 'draft' }, excerpt: { type: 'string' }, categories: { type: 'array', items: { type: 'number' } }, tags: { type: 'array', items: { type: 'number' } }, slug: { type: 'string' }, featured_media: { type: 'number' }, meta: { type: 'object' }, author: { type: 'number' } }, required: ['title', 'content'] }},
   { name: 'wp_update_post', _category: 'content', description: 'Use to modify any post field — only provided fields change. Write — blocked by WP_READ_ONLY.', inputSchema: { type: 'object', properties: { id: { type: 'number' }, title: { type: 'string' }, content: { type: 'string' }, status: { type: 'string' }, excerpt: { type: 'string' }, categories: { type: 'array', items: { type: 'number' } }, tags: { type: 'array', items: { type: 'number' } }, slug: { type: 'string' }, featured_media: { type: 'number' }, meta: { type: 'object' }, author: { type: 'number' } }, required: ['id'] }},
   { name: 'wp_delete_post', _category: 'content', description: 'Use to trash or permanently delete a post. Write — blocked by WP_READ_ONLY, WP_DISABLE_DELETE.', inputSchema: { type: 'object', properties: { id: { type: 'number' }, force: { type: 'boolean', default: false }, confirmation_token: { type: 'string', description: 'Confirmation token returned by the first call when WP_CONFIRM_DESTRUCTIVE=true' } }, required: ['id'] }},
@@ -53,12 +53,19 @@ handlers['wp_get_post'] = async (args) => {
   const t0 = Date.now();
   let result;
   const { wpApiCall, getActiveAuth, auditLog, name, summarizePost, applyContentFormat } = rt;
-  validateInput(args, { id: { type: 'number', required: true, min: 1 }, fields: { type: 'array' }, content_format: { type: 'string', enum: ['html', 'text', 'links_only'] } });
+  validateInput(args, { id: { type: 'number', required: true, min: 1 }, fields: { type: 'array' }, content_format: { type: 'string', enum: ['html', 'text', 'links_only', 'raw'] } });
   const { content_format = 'html', fields: requestedFields } = args;
-  const p = await wpApiCall(`/posts/${args.id}`);
+  // raw = source Gutenberg (block comments) : REST ?context=edit expose
+  // content.raw / title.raw (droits d'édition requis — déjà le cas ici).
+  const p = await wpApiCall(`/posts/${args.id}${content_format === 'raw' ? '?context=edit' : ''}`);
   let postData = { id: p.id, title: p.title.rendered, content: p.content.rendered, excerpt: p.excerpt.rendered, status: p.status, date: p.date, modified: p.modified, link: p.link, slug: p.slug, categories: p.categories, tags: p.tags, author: p.author, featured_media: p.featured_media, comment_status: p.comment_status, meta: p.meta || {} };
   if (p.acf && Object.keys(p.acf).length > 0) { postData.acf_fields = p.acf; }
   else { postData.acf_fields = {}; postData.acf_hint = 'ACF returned empty. Verify Show in REST API is enabled in each Field Group settings in WordPress Admin.'; }
+  if (content_format === 'raw') {
+    postData.content = p.content.raw ?? p.content.rendered;
+    postData.title = p.title.raw ?? p.title.rendered;
+    postData.excerpt = p.excerpt.raw ?? p.excerpt.rendered;
+  }
   const { url: siteUrl } = getActiveAuth();
   postData = applyContentFormat(postData, content_format, siteUrl);
   if (requestedFields && requestedFields.length > 0) postData = summarizePost(postData, requestedFields);

package/src/tools/seo.js

@@ -191,11 +191,63 @@ handlers['wp_update_seo_meta'] = async (args) => {
 
   if (updated.length === 0) throw new Error('No SEO fields provided. Specify at least one of: title, description, focus_keyword, canonical_url, robots_noindex, robots_nofollow.');
 
-  const writeEp = post_type === 'page' ? `/pages/${id}` : `/posts/${id}`;
-  await wpApiCall(writeEp, { method: 'POST', body: JSON.stringify({ meta: metaUpdate }) });
+  // ── Strategy 1: Try MCP Companion direct write (uses update_post_meta, bypasses Yoast block) ──
+  let writeMethod = 'rest_api';
+  let verified = true;
+  const failedFields = [];
 
-  result = json({ success: true, message: `SEO meta updated for ${post_type} ${id}`, plugin, fields_updated: updated, meta_written: metaUpdate });
-  auditLog({ tool: name, target: id, target_type: post_type, action: 'update_seo', status: 'success', latency_ms: Date.now() - t0, params: { plugin, fields: updated } });
+  try {
+    const companionResult = await wpApiCall(`/${id}`, {
+      method: 'POST',
+      basePath: '/wp-json/mcp-diagnostics/v1/seo-meta',
+      body: JSON.stringify({ meta: metaUpdate }),
+    });
+    // Companion returns { written: [...], verified: { key: value } }
+    if (companionResult?.written?.length > 0) {
+      writeMethod = 'companion_direct';
+      // Verify from companion response
+      for (const [metaKey, expectedVal] of Object.entries(metaUpdate)) {
+        const actual = companionResult.verified?.[metaKey];
+        if (actual === undefined || actual === null || String(actual) !== String(expectedVal)) {
+          failedFields.push({ key: metaKey, expected: expectedVal, actual: actual ?? null });
+        }
+      }
+      if (failedFields.length > 0) verified = false;
+    }
+  } catch {
+    // Companion not installed — fall back to REST API
+    writeMethod = 'rest_api';
+  }
+
+  // ── Strategy 2: Standard REST API (fallback when companion not available) ──
+  if (writeMethod === 'rest_api') {
+    const writeEp = post_type === 'page' ? `/pages/${id}` : `/posts/${id}`;
+    await wpApiCall(writeEp, { method: 'POST', body: JSON.stringify({ meta: metaUpdate }) });
+
+    // Verify write: read back meta to detect silent failures (Yoast issue)
+    try {
+      const verify = await wpApiCall(readEp);
+      const verifyMeta = verify.meta || {};
+      for (const [metaKey, expectedVal] of Object.entries(metaUpdate)) {
+        const actual = verifyMeta[metaKey];
+        if (actual === undefined || actual === null || String(actual) !== String(expectedVal)) {
+          failedFields.push({ key: metaKey, expected: expectedVal, actual: actual ?? null });
+        }
+      }
+      if (failedFields.length > 0) verified = false;
+    } catch { verified = false; }
+  }
+
+  const response = { success: verified, message: `SEO meta updated for ${post_type} ${id}`, plugin, fields_updated: updated, meta_written: metaUpdate, verified, write_method: writeMethod };
+  if (!verified && failedFields.length > 0) {
+    response.failed_fields = failedFields;
+    response.warning = `Silent write failure detected: ${failedFields.length} field(s) were not saved by WordPress. This is a known issue with Yoast SEO which blocks REST API writes to its proprietary meta fields.`;
+    response.fix = 'Install the MCP Companion plugin (companion/mcp-diagnostics.php) as a must-use plugin to enable direct update_post_meta() writes that bypass Yoast restrictions. Copy it to wp-content/mu-plugins/mcp-diagnostics.php and retry.';
+    auditLog({ tool: name, target: id, target_type: post_type, action: 'update_seo', status: 'silent_failure', latency_ms: Date.now() - t0, params: { plugin, fields: updated, failed: failedFields.map(f => f.key), write_method: writeMethod } });
+  } else {
+    auditLog({ tool: name, target: id, target_type: post_type, action: 'update_seo', status: 'success', latency_ms: Date.now() - t0, params: { plugin, fields: updated, write_method: writeMethod } });
+  }
+  result = json(response);
   return result;
 };
 handlers['wp_audit_seo'] = async (args) => {

package/src/utils/contentCompressor.js

@@ -88,7 +88,7 @@ export function summarizePost(post, fields) {
 /**
  * Apply content_format transformation to a post object.
  * @param {object} post  Post with .content field
- * @param {string} contentFormat  'html' | 'text' | 'links_only'
+ * @param {string} contentFormat  'html' | 'text' | 'links_only' | 'raw'
  * @param {string} siteUrl  Site base URL
  * @param {number} maxChars  Truncation limit (0 = unlimited)
  * @returns {object}
@@ -106,6 +106,11 @@ export function applyContentFormat(post, contentFormat, siteUrl, maxChars = DEFA
       processed.internal_links = extractLinksOnly(post.content, siteUrl);
       processed._content_format = 'links_only';
       break;
+    case 'raw':
+      // Source Gutenberg destinée à être réécrite telle quelle :
+      // AUCUNE troncature (un raw tronqué corromprait le post à l'update).
+      processed._content_format = 'raw';
+      break;
     case 'html':
     default:
       processed.content = truncateContent(post.content, maxChars);

package/tests/unit/tools/contentCompressor.test.js

@@ -143,6 +143,13 @@ describe('contentCompressor — summarizePost', () => {
 });
 
 describe('contentCompressor — applyContentFormat', () => {
+  it('raw : passthrough intégral, jamais tronqué', () => {
+    const long = '<!-- wp:paragraph -->' + 'x'.repeat(50000) + '<!-- /wp:paragraph -->';
+    const result = applyContentFormat({ content: long }, 'raw', 'https://s.tld', 100);
+    expect(result.content).toBe(long);
+    expect(result._content_format).toBe('raw');
+  });
+
   const siteUrl = 'https://mysite.example.com';
 
   it('html mode — truncates long content', () => {

package/tests/unit/tools/posts.test.js

@@ -52,6 +52,41 @@ describe('wp_list_posts', () => {
 // ────────────────────────────────────────────────────────────
 
 describe('wp_get_post', () => {
+  describe('content_format=raw', () => {
+    const RAW = '<!-- wp:paragraph --><p>Source brute</p><!-- /wp:paragraph -->';
+    const rawPost = {
+      id: 1,
+      title: { rendered: 'Rendu', raw: 'Brut' },
+      content: { rendered: '<p>Source brute</p>', raw: RAW },
+      excerpt: { rendered: 'ex', raw: 'ex brut' },
+      status: 'publish', date: '2024-01-01', modified: '2024-01-01',
+      link: 'https://test.example.com/post-1', slug: 'post-1',
+      categories: [], tags: [], author: 1, featured_media: 0,
+      comment_status: 'open', meta: {},
+    };
+
+    it('appelle la REST API avec ?context=edit', async () => {
+      fetch.mockResolvedValue(mockSuccess(rawPost));
+      await call('wp_get_post', { id: 1, content_format: 'raw' });
+      expect(String(fetch.mock.calls[0][0])).toContain('/posts/1?context=edit');
+    });
+
+    it('retourne content.raw et title.raw sans troncature', async () => {
+      fetch.mockResolvedValue(mockSuccess(rawPost));
+      const data = parseResult(await call('wp_get_post', { id: 1, content_format: 'raw' }));
+      expect(data.content).toBe(RAW);
+      expect(data.title).toBe('Brut');
+      expect(data._content_format).toBe('raw');
+    });
+
+    it('sans raw, pas de context=edit et contenu rendu', async () => {
+      fetch.mockResolvedValue(mockSuccess(rawPost));
+      const data = parseResult(await call('wp_get_post', { id: 1 }));
+      expect(String(fetch.mock.calls[0][0])).not.toContain('context=edit');
+      expect(data.content).toBe('<p>Source brute</p>');
+    });
+  });
+
   let consoleSpy;
   beforeEach(() => { fetch.mockReset(); consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {}); });
   afterEach(() => { consoleSpy.mockRestore(); });

package/tests/unit/tools/seo.test.js

@@ -105,21 +105,70 @@ describe('wp_get_seo_meta', () => {
 // =========================================================================
 
 describe('wp_update_seo_meta', () => {
-  it('SUCCESS — detects Yoast and updates title + description', async () => {
+  it('SUCCESS via companion — uses direct update_post_meta', async () => {
     // First fetch: read current post to detect plugin
     mockSuccess(yoastPost);
-    // Second fetch: write the meta update
-    mockSuccess({});
+    // Second fetch: companion endpoint succeeds with verified values
+    mockSuccess({
+      written: ['_yoast_wpseo_title', '_yoast_wpseo_metadesc'],
+      verified: { _yoast_wpseo_title: 'New SEO Title', _yoast_wpseo_metadesc: 'New desc' },
+      source: 'direct_update_post_meta',
+    });
 
     const res = await call('wp_update_seo_meta', { id: 1, title: 'New SEO Title', description: 'New desc' });
     const data = parseResult(res);
 
     expect(data.success).toBe(true);
+    expect(data.verified).toBe(true);
+    expect(data.write_method).toBe('companion_direct');
     expect(data.plugin).toBe('yoast');
     expect(data.fields_updated).toContain('title');
     expect(data.fields_updated).toContain('description');
   });
 
+  it('SUCCESS via REST fallback — companion not installed', async () => {
+    // First fetch: read current post to detect plugin
+    mockSuccess(yoastPost);
+    // Second fetch: companion endpoint → 404 (not installed)
+    mockError(404, '{"code":"rest_no_route"}');
+    // Third fetch: standard REST write
+    mockSuccess({});
+    // Fourth fetch: verification read — meta reflects the written values
+    mockSuccess({ ...yoastPost, meta: { ...yoastPost.meta, _yoast_wpseo_title: 'New SEO Title', _yoast_wpseo_metadesc: 'New desc' } });
+
+    const res = await call('wp_update_seo_meta', { id: 1, title: 'New SEO Title', description: 'New desc' });
+    const data = parseResult(res);
+
+    expect(data.success).toBe(true);
+    expect(data.verified).toBe(true);
+    expect(data.write_method).toBe('rest_api');
+    expect(data.plugin).toBe('yoast');
+  });
+
+  it('SILENT FAILURE — companion unavailable and REST write blocked by Yoast', async () => {
+    // First fetch: read current post to detect plugin
+    mockSuccess(yoastPost);
+    // Second fetch: companion → 404
+    mockError(404, '{"code":"rest_no_route"}');
+    // Third fetch: REST write — WordPress returns success but does not save
+    mockSuccess({});
+    // Fourth fetch: verification read — meta unchanged (silent failure)
+    mockSuccess(yoastPost);
+
+    const res = await call('wp_update_seo_meta', { id: 1, focus_keyword: 'new keyword' });
+    const data = parseResult(res);
+
+    expect(data.success).toBe(false);
+    expect(data.verified).toBe(false);
+    expect(data.write_method).toBe('rest_api');
+    expect(data.failed_fields).toBeDefined();
+    expect(data.failed_fields.length).toBeGreaterThan(0);
+    expect(data.failed_fields[0].key).toBe('_yoast_wpseo_focuskw');
+    expect(data.failed_fields[0].expected).toBe('new keyword');
+    expect(data.warning).toContain('Silent write failure');
+    expect(data.fix).toContain('mcp-diagnostics.php');
+  });
+
   it('GOVERNANCE — blocked by WP_READ_ONLY', async () => {
     const original = process.env.WP_READ_ONLY;
     process.env.WP_READ_ONLY = 'true';
@@ -152,7 +201,11 @@ describe('wp_update_seo_meta', () => {
 
   it('AUDIT — logs update_seo action on success', async () => {
     mockSuccess(yoastPost);
-    mockSuccess({});
+    // Companion succeeds
+    mockSuccess({
+      written: ['_yoast_wpseo_title'],
+      verified: { _yoast_wpseo_title: 'Audit Test' },
+    });
 
     await call('wp_update_seo_meta', { id: 1, title: 'Audit Test' });