@automattic/mcp-wordpress-remote 0.2.5 → 0.2.6

package/dist/proxy.js

@@ -34,6 +34,10 @@ var CONFIG = {
   // Resource Indicators (RFC 8707)
   OAUTH_RESOURCE_INDICATOR: process.env.OAUTH_RESOURCE_INDICATOR !== "false",
   // Resource parameter support
+  // OAuth Scopes Configuration
+  // OAUTH_SCOPES: Comma-separated list of OAuth scopes (e.g., "read,write" or "global")
+  // If empty, uses defaults: "global" for WordPress.com, "read,write" for self-hosted
+  OAUTH_SCOPES: process.env.OAUTH_SCOPES || "",
   // Timeout Configuration (in milliseconds)
   OAUTH_TIMEOUT: 3e4,
   // 30 seconds
@@ -52,6 +56,12 @@ var CONFIG = {
   // Environment
   NODE_ENV: process.env.NODE_ENV || "development"
 };
+function parseOAuthScopes(envScopes, defaultScopes) {
+  if (!envScopes || envScopes.trim() === "") {
+    return defaultScopes;
+  }
+  return envScopes.split(",").map((scope) => scope.trim()).filter((scope) => scope.length > 0);
+}
 function isWordPressComSite(url) {
   try {
     const siteUrl = new URL(url);
@@ -64,15 +74,18 @@ function isWordPressComSite(url) {
 }
 function getRecommendedOAuthConfig(siteUrl) {
   if (isWordPressComSite(siteUrl)) {
+    const defaultScopes = ["global"];
     return {
       flowType: "implicit",
       usePKCE: false,
       useResourceIndicator: false,
       authorizationEndpoint: "https://public-api.wordpress.com/oauth2/authorize",
       tokenEndpoint: "https://public-api.wordpress.com/oauth2/token",
+      scopes: parseOAuthScopes(CONFIG.OAUTH_SCOPES, defaultScopes),
       description: "WordPress.com OAuth2 (compatible mode)"
     };
   } else {
+    const defaultScopes = ["read", "write"];
     return {
       flowType: "authorization_code",
       usePKCE: true,
@@ -81,6 +94,7 @@ function getRecommendedOAuthConfig(siteUrl) {
       // Will be discovered
       tokenEndpoint: void 0,
       // Will be discovered
+      scopes: parseOAuthScopes(CONFIG.OAUTH_SCOPES, defaultScopes),
       description: "MCP-compliant OAuth 2.1"
     };
   }
@@ -889,15 +903,17 @@ var MCPOAuthProvider = class {
     // Discovered metadata
     this.authServerMetadata = null;
     this.resourceMetadata = null;
+    const serverUrl = options.serverUrl || CONFIG.WP_API_URL;
+    const recommendedConfig = getRecommendedOAuthConfig(serverUrl);
     this.config = {
-      serverUrl: options.serverUrl || CONFIG.WP_API_URL,
-      resource: generateCanonicalResourceURI(options.serverUrl || CONFIG.WP_API_URL),
+      serverUrl,
+      resource: generateCanonicalResourceURI(serverUrl),
       responseType: "code",
       // OAuth 2.1 uses authorization code flow
       usePKCE: true,
       // PKCE is required for OAuth 2.1
       redirectUri: `http://${CONFIG.OAUTH_HOST}:${CONFIG.OAUTH_CALLBACK_PORT}/oauth/callback`,
-      scopes: options.scopes || ["read", "write"],
+      scopes: options.scopes || recommendedConfig.scopes,
       clientId: options.clientId || CONFIG.WP_OAUTH_CLIENT_ID,
       callbackPort: CONFIG.OAUTH_CALLBACK_PORT,
       host: CONFIG.OAUTH_HOST,
@@ -1260,6 +1276,7 @@ import { EventEmitter as EventEmitter2 } from "node:events";
 var WP_PERSISTENT_CONFIG = {
   authorizeEndpoint: "/wp-admin/admin.php?page=mcp-oauth-authorize",
   scopes: ["read", "write"],
+  // Default for self-hosted, will be overridden for WordPress.com
   callbackPort: CONFIG.OAUTH_CALLBACK_PORT,
   host: CONFIG.OAUTH_HOST
 };
@@ -1270,7 +1287,9 @@ var PersistentWPOAuthClientProvider = class {
     const recommendedConfig = getRecommendedOAuthConfig(options.serverUrl || "");
     this.options = {
       ...WP_PERSISTENT_CONFIG,
-      ...options
+      ...options,
+      // Use recommended scopes for the site type
+      scopes: options.scopes || recommendedConfig.scopes
     };
     if (isWpCom && recommendedConfig.authorizationEndpoint) {
       this.options.authorizeEndpoint = recommendedConfig.authorizationEndpoint;
@@ -1911,10 +1930,11 @@ async function getOAuthTokens() {
     const shouldUseMCPFlow = !isWPCom && CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && CONFIG.OAUTH_USE_PKCE;
     if (shouldUseMCPFlow) {
       if (!mcpOAuthProvider) {
+        const recommendedConfig2 = getRecommendedOAuthConfig(serverUrl);
         mcpOAuthProvider = new MCPOAuthProvider({
           serverUrl,
           clientId: CONFIG.WP_OAUTH_CLIENT_ID,
-          scopes: ["read", "write"]
+          scopes: recommendedConfig2.scopes
         });
       }
       logger.auth("Using MCP-compliant OAuth 2.1 authorization code flow with PKCE");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/mcp-wordpress-remote",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "MCP WordPress Remote proxy server",
   "engines": {
     "node": ">=22.0.0"