@wpgaurav/wp-mcp 0.1.0

package/README.md

@@ -0,0 +1,215 @@
+# wp-mcp
+
+A TypeScript MCP server that exposes any WordPress site's REST API as MCP tools. Hand-crafted tools for core endpoints plus **auto-discovery of custom plugin endpoints** (WooCommerce, ACF, Yoast, any plugin).
+
+## Features
+
+- **37 core tools** for posts, pages, media, categories, tags, comments, plugins, themes, users, settings, menus, search, and site health
+- **Auto-discovery engine** that scans `/wp-json/` and generates tools for any plugin's REST API endpoints
+- **Both transports**: stdio (default for Claude Code/Desktop) and HTTP (StreamableHTTP)
+- **Re-scan on demand** via `wp_discover_routes` after installing new plugins
+- Single site, Basic Auth via Application Passwords
+
+## Prerequisites
+
+- Node.js 18+
+- A WordPress site with REST API enabled
+- An [Application Password](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/) for authentication
+
+## Installation
+
+```bash
+# Run directly with npx
+npx wp-mcp
+
+# Or install globally
+npm install -g wp-mcp
+```
+
+## Configuration
+
+Set environment variables:
+
+| Variable | Required | Default | Description |
+|----------|----------|---------|-------------|
+| `WP_URL` | Yes | — | WordPress site URL (no trailing slash) |
+| `WP_USERNAME` | Yes | — | WordPress username |
+| `WP_APP_PASSWORD` | Yes | — | Application Password |
+| `WP_MCP_TRANSPORT` | No | `stdio` | `stdio` or `http` |
+| `WP_MCP_PORT` | No | `3000` | HTTP transport port |
+| `WP_MCP_HOST` | No | `127.0.0.1` | HTTP transport bind address |
+| `WP_MCP_DISCOVER` | No | `true` | Auto-discover custom endpoints |
+
+### Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "wordpress": {
+      "command": "npx",
+      "args": ["wp-mcp"],
+      "env": {
+        "WP_URL": "https://example.com",
+        "WP_USERNAME": "admin",
+        "WP_APP_PASSWORD": "xxxx xxxx xxxx xxxx"
+      }
+    }
+  }
+}
+```
+
+### Claude Code
+
+```json
+{
+  "mcpServers": {
+    "wordpress": {
+      "command": "npx",
+      "args": ["wp-mcp"],
+      "env": {
+        "WP_URL": "https://example.com",
+        "WP_USERNAME": "admin",
+        "WP_APP_PASSWORD": "xxxx xxxx xxxx xxxx"
+      }
+    }
+  }
+}
+```
+
+### HTTP Transport
+
+```bash
+WP_URL=https://example.com \
+WP_USERNAME=admin \
+WP_APP_PASSWORD="xxxx xxxx xxxx xxxx" \
+WP_MCP_TRANSPORT=http \
+npx wp-mcp
+```
+
+The server listens on `http://127.0.0.1:3000/mcp` with StreamableHTTP.
+
+## Core Tools
+
+### Content (Tier 1)
+
+| Tool | Description |
+|------|-------------|
+| `wp_posts_list` | List posts with filtering and pagination |
+| `wp_posts_get` | Get a single post by ID |
+| `wp_posts_create` | Create a new post |
+| `wp_posts_update` | Update an existing post |
+| `wp_posts_delete` | Delete a post |
+| `wp_pages_list` | List pages |
+| `wp_pages_get` | Get a single page by ID |
+| `wp_pages_create` | Create a new page |
+| `wp_pages_update` | Update an existing page |
+| `wp_pages_delete` | Delete a page |
+| `wp_media_list` | List media library items |
+| `wp_media_get` | Get a media item by ID |
+| `wp_media_upload` | Upload media from a URL |
+| `wp_media_delete` | Delete a media item |
+| `wp_categories_list` | List categories |
+| `wp_categories_create` | Create a category |
+| `wp_tags_list` | List tags |
+| `wp_tags_create` | Create a tag |
+| `wp_comments_list` | List comments |
+| `wp_comments_create` | Create a comment |
+
+### Management (Tier 2)
+
+| Tool | Description |
+|------|-------------|
+| `wp_plugins_list` | List installed plugins |
+| `wp_plugins_get` | Get plugin details |
+| `wp_plugins_activate` | Activate a plugin |
+| `wp_plugins_deactivate` | Deactivate a plugin |
+| `wp_themes_list` | List installed themes |
+| `wp_themes_activate` | Activate a theme |
+| `wp_users_list` | List users |
+| `wp_users_get` | Get a user by ID |
+| `wp_users_create` | Create a new user |
+| `wp_users_me` | Get the authenticated user |
+| `wp_settings_get` | Get site settings |
+| `wp_settings_update` | Update site settings |
+
+### Advanced (Tier 3)
+
+| Tool | Description |
+|------|-------------|
+| `wp_menus_list` | List navigation menus |
+| `wp_menu_items_list` | List menu items |
+| `wp_search` | Search across all content |
+| `wp_site_health` | Get site health status |
+
+### Meta
+
+| Tool | Description |
+|------|-------------|
+| `wp_discover_routes` | Re-scan the site for new REST API endpoints |
+
+## Auto-Discovery
+
+On startup (when `WP_MCP_DISCOVER=true`), the server fetches `/wp-json/` and automatically generates MCP tools for every custom plugin endpoint it finds. Core `wp/v2` routes are skipped since they're already covered by hand-crafted tools.
+
+### Example: WooCommerce
+
+If WooCommerce is installed, these tools appear automatically:
+
+| Tool | Endpoint |
+|------|----------|
+| `wc_products_list` | GET `/wc/v3/products` |
+| `wc_products_get` | GET `/wc/v3/products/{id}` |
+| `wc_products_create` | POST `/wc/v3/products` |
+| `wc_orders_list` | GET `/wc/v3/orders` |
+| `wc_orders_notes_list` | GET `/wc/v3/orders/{id}/notes` |
+
+### Naming Convention
+
+```
+{namespace_prefix}_{resource}_{action}
+
+GET  /wc/v3/products          -> wc_products_list
+GET  /wc/v3/products/{id}     -> wc_products_get
+POST /wc/v3/products          -> wc_products_create
+GET  /acf/v1/posts/{id}       -> acf_posts_get
+GET  /yoast/v1/indexables     -> yoast_indexables_list
+```
+
+### Re-scanning After Plugin Install
+
+Use the `wp_discover_routes` tool to re-scan the site after installing or activating a new plugin:
+
+```
+wp_discover_routes({ namespace_filter: "wc/v3" })
+```
+
+## Development
+
+```bash
+git clone https://github.com/wpgaurav/wp-mcp.git
+cd wp-mcp
+npm install
+npm run typecheck
+npm test
+npm run build
+```
+
+## Library Usage
+
+```typescript
+import { createWpMcpServer, loadConfig } from "wp-mcp";
+
+const config = loadConfig({
+  wpUrl: "https://example.com",
+  wpUsername: "admin",
+  wpAppPassword: "xxxx xxxx xxxx xxxx",
+});
+
+const { server, client, registry } = await createWpMcpServer(config);
+```
+
+## License
+
+MIT

package/dist/bin/wp-mcp.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=wp-mcp.d.ts.map

package/dist/bin/wp-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wp-mcp.d.ts","sourceRoot":"","sources":["../../bin/wp-mcp.ts"],"names":[],"mappings":""}

package/dist/bin/wp-mcp.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { loadConfig } from "../src/config.js";
+import { createWpMcpServer } from "../src/server.js";
+import { createStdioTransport } from "../src/transports/stdio.js";
+import { startHttpTransport } from "../src/transports/http.js";
+async function main() {
+    const args = process.argv.slice(2);
+    const overrides = {};
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--transport" && args[i + 1]) {
+            overrides["transport"] = args[++i];
+        }
+        else if (arg === "--port" && args[i + 1]) {
+            overrides["port"] = args[++i];
+        }
+        else if (arg === "--host" && args[i + 1]) {
+            overrides["host"] = args[++i];
+        }
+        else if (arg === "--no-discover") {
+            overrides["discover"] = "false";
+        }
+    }
+    const config = loadConfig({
+        transport: overrides["transport"],
+        port: overrides["port"] ? parseInt(overrides["port"], 10) : undefined,
+        host: overrides["host"],
+        discover: overrides["discover"] === "false" ? false : undefined,
+    });
+    const { server } = await createWpMcpServer(config);
+    if (config.transport === "http") {
+        await startHttpTransport(server, config.host, config.port);
+    }
+    else {
+        const transport = createStdioTransport();
+        await server.connect(transport);
+        console.error("wp-mcp server running on stdio");
+    }
+}
+main().catch((err) => {
+    console.error("Fatal:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=wp-mcp.js.map

package/dist/bin/wp-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wp-mcp.js","sourceRoot":"","sources":["../../bin/wp-mcp.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,aAAa,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACzC,SAAS,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;QACtC,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3C,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;QACjC,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3C,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;QACjC,CAAC;aAAM,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YACnC,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC;QACxB,SAAS,EAAE,SAAS,CAAC,WAAW,CAAiC;QACjE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACrE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC;QACvB,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAChE,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/src/client/auth.d.ts

@@ -0,0 +1,2 @@
+export declare function basicAuthHeader(username: string, password: string): string;
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/client/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/client/auth.ts"],"names":[],"mappings":"AAAA,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1E"}

package/dist/src/client/auth.js

@@ -0,0 +1,5 @@
+export function basicAuthHeader(username, password) {
+    const encoded = Buffer.from(`${username}:${password}`).toString("base64");
+    return `Basic ${encoded}`;
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/client/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/client/auth.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,QAAgB;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1E,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/dist/src/client/errors.d.ts

@@ -0,0 +1,14 @@
+export declare class WpApiError extends Error {
+    readonly statusCode: number;
+    readonly wpCode: string;
+    constructor(statusCode: number, wpCode: string, message: string);
+    toMcpError(): {
+        content: Array<{
+            type: "text";
+            text: string;
+        }>;
+        isError: true;
+    };
+}
+export declare function parseWpError(response: Response): Promise<WpApiError>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/client/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/client/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,UAAW,SAAQ,KAAK;aAEjB,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM;gBADd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM;IAMjB,UAAU,IAAI;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE;CAMhF;AAQD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAa1E"}

package/dist/src/client/errors.js

@@ -0,0 +1,27 @@
+export class WpApiError extends Error {
+    statusCode;
+    wpCode;
+    constructor(statusCode, wpCode, message) {
+        super(message);
+        this.statusCode = statusCode;
+        this.wpCode = wpCode;
+        this.name = "WpApiError";
+    }
+    toMcpError() {
+        return {
+            content: [{ type: "text", text: `WordPress API error (${this.statusCode}): [${this.wpCode}] ${this.message}` }],
+            isError: true,
+        };
+    }
+}
+export async function parseWpError(response) {
+    let body = {};
+    try {
+        body = (await response.json());
+    }
+    catch {
+        // non-JSON error response
+    }
+    return new WpApiError(response.status, body.code ?? "unknown_error", body.message ?? response.statusText);
+}
+//# sourceMappingURL=errors.js.map

package/dist/src/client/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/client/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAEjB;IACA;IAFlB,YACkB,UAAkB,EAClB,MAAc,EAC9B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,eAAU,GAAV,UAAU,CAAQ;QAClB,WAAM,GAAN,MAAM,CAAQ;QAI9B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;IAED,UAAU;QACR,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAI,CAAC,UAAU,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/G,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;CACF;AAQD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB;IACnD,IAAI,IAAI,GAAgB,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IAED,OAAO,IAAI,UAAU,CACnB,QAAQ,CAAC,MAAM,EACf,IAAI,CAAC,IAAI,IAAI,eAAe,EAC5B,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,CACpC,CAAC;AACJ,CAAC"}

package/dist/src/client/wp-client.d.ts

@@ -0,0 +1,24 @@
+import { WpApiError } from "./errors.js";
+import type { WpMcpConfig } from "../config.js";
+export interface WpRequestOptions {
+    method?: string;
+    params?: Record<string, unknown>;
+    body?: Record<string, unknown> | FormData;
+    rawBody?: Buffer;
+    headers?: Record<string, string>;
+}
+export interface WpPaginatedResponse<T> {
+    data: T;
+    total: number;
+    totalPages: number;
+}
+export declare class WpClient {
+    private readonly baseUrl;
+    private readonly authHeader;
+    constructor(config: Pick<WpMcpConfig, "wpUrl" | "wpUsername" | "wpAppPassword">);
+    request<T = unknown>(endpoint: string, options?: WpRequestOptions): Promise<T>;
+    requestPaginated<T = unknown>(endpoint: string, options?: WpRequestOptions): Promise<WpPaginatedResponse<T>>;
+    fetchRawJson<T = unknown>(path: string): Promise<T>;
+    get wpApiError(): typeof WpApiError;
+}
+//# sourceMappingURL=wp-client.d.ts.map

package/dist/src/client/wp-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wp-client.d.ts","sourceRoot":"","sources":["../../../src/client/wp-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,eAAe,CAAC;IAKzE,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC;IAkDlF,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IA0C5B,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAazD,IAAI,UAAU,IAAI,OAAO,UAAU,CAElC;CACF"}

package/dist/src/client/wp-client.js

@@ -0,0 +1,101 @@
+import { basicAuthHeader } from "./auth.js";
+import { parseWpError, WpApiError } from "./errors.js";
+export class WpClient {
+    baseUrl;
+    authHeader;
+    constructor(config) {
+        this.baseUrl = `${config.wpUrl.replace(/\/+$/, "")}/wp-json`;
+        this.authHeader = basicAuthHeader(config.wpUsername, config.wpAppPassword);
+    }
+    async request(endpoint, options = {}) {
+        const { method = "GET", params, body, rawBody, headers = {} } = options;
+        let url = `${this.baseUrl}${endpoint}`;
+        if (params) {
+            const searchParams = new URLSearchParams();
+            for (const [key, value] of Object.entries(params)) {
+                if (value !== undefined && value !== null) {
+                    searchParams.set(key, String(value));
+                }
+            }
+            const qs = searchParams.toString();
+            if (qs)
+                url += `?${qs}`;
+        }
+        const isFormData = typeof FormData !== "undefined" && body instanceof FormData;
+        const fetchHeaders = {
+            Authorization: this.authHeader,
+            ...headers,
+        };
+        let fetchBody;
+        if (rawBody) {
+            fetchBody = rawBody;
+        }
+        else if (isFormData) {
+            fetchBody = body;
+        }
+        else if (body) {
+            fetchHeaders["Content-Type"] ??= "application/json";
+            fetchBody = JSON.stringify(body);
+        }
+        const response = await fetch(url, {
+            method,
+            headers: fetchHeaders,
+            body: fetchBody,
+        });
+        if (!response.ok) {
+            throw await parseWpError(response);
+        }
+        if (response.status === 204) {
+            return {};
+        }
+        return (await response.json());
+    }
+    async requestPaginated(endpoint, options = {}) {
+        const { method = "GET", params, body, headers = {} } = options;
+        let url = `${this.baseUrl}${endpoint}`;
+        if (params) {
+            const searchParams = new URLSearchParams();
+            for (const [key, value] of Object.entries(params)) {
+                if (value !== undefined && value !== null) {
+                    searchParams.set(key, String(value));
+                }
+            }
+            const qs = searchParams.toString();
+            if (qs)
+                url += `?${qs}`;
+        }
+        const fetchHeaders = {
+            Authorization: this.authHeader,
+            ...headers,
+        };
+        if (body) {
+            fetchHeaders["Content-Type"] = "application/json";
+        }
+        const response = await fetch(url, {
+            method,
+            headers: fetchHeaders,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        if (!response.ok) {
+            throw await parseWpError(response);
+        }
+        const data = (await response.json());
+        const total = parseInt(response.headers.get("X-WP-Total") ?? "0", 10);
+        const totalPages = parseInt(response.headers.get("X-WP-TotalPages") ?? "0", 10);
+        return { data, total, totalPages };
+    }
+    async fetchRawJson(path) {
+        const url = `${this.baseUrl}${path}`;
+        const response = await fetch(url, {
+            headers: { Authorization: this.authHeader },
+        });
+        if (!response.ok) {
+            throw await parseWpError(response);
+        }
+        return (await response.json());
+    }
+    get wpApiError() {
+        return WpApiError;
+    }
+}
+//# sourceMappingURL=wp-client.js.map

package/dist/src/client/wp-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wp-client.js","sourceRoot":"","sources":["../../../src/client/wp-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBvD,MAAM,OAAO,QAAQ;IACF,OAAO,CAAS;IAChB,UAAU,CAAS;IAEpC,YAAY,MAAmE;QAC7E,IAAI,CAAC,OAAO,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,OAAO,CAAc,QAAgB,EAAE,UAA4B,EAAE;QACzE,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAExE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;QAEvC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC1C,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,EAAE;gBAAE,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,QAAQ,KAAK,WAAW,IAAI,IAAI,YAAY,QAAQ,CAAC;QAE/E,MAAM,YAAY,GAA2B;YAC3C,aAAa,EAAE,IAAI,CAAC,UAAU;YAC9B,GAAG,OAAO;SACX,CAAC;QAEF,IAAI,SAAiD,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,GAAG,OAAO,CAAC;QACtB,CAAC;aAAM,IAAI,UAAU,EAAE,CAAC;YACtB,SAAS,GAAG,IAAgB,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,YAAY,CAAC,cAAc,CAAC,KAAK,kBAAkB,CAAC;YACpD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAO,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,UAA4B,EAAE;QAE9B,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAE/D,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;QAEvC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC1C,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,EAAE;gBAAE,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,YAAY,GAA2B;YAC3C,aAAa,EAAE,IAAI,CAAC,UAAU;YAC9B,GAAG,OAAO;SACX,CAAC;QAEF,IAAI,IAAI,EAAE,CAAC;YACT,YAAY,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAEhF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAc,IAAY;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IACtC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/src/config.d.ts

@@ -0,0 +1,11 @@
+export interface WpMcpConfig {
+    wpUrl: string;
+    wpUsername: string;
+    wpAppPassword: string;
+    transport: "stdio" | "http";
+    port: number;
+    host: string;
+    discover: boolean;
+}
+export declare function loadConfig(overrides?: Partial<WpMcpConfig>): WpMcpConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,SAAS,GAAE,OAAO,CAAC,WAAW,CAAM,GAAG,WAAW,CAmB5E"}

package/dist/src/config.js

@@ -0,0 +1,20 @@
+export function loadConfig(overrides = {}) {
+    const config = {
+        wpUrl: overrides.wpUrl ?? process.env["WP_URL"] ?? "",
+        wpUsername: overrides.wpUsername ?? process.env["WP_USERNAME"] ?? "",
+        wpAppPassword: overrides.wpAppPassword ?? process.env["WP_APP_PASSWORD"] ?? "",
+        transport: (overrides.transport ?? process.env["WP_MCP_TRANSPORT"] ?? "stdio"),
+        port: overrides.port ?? parseInt(process.env["WP_MCP_PORT"] ?? "3000", 10),
+        host: overrides.host ?? process.env["WP_MCP_HOST"] ?? "127.0.0.1",
+        discover: overrides.discover ?? (process.env["WP_MCP_DISCOVER"] !== "false"),
+    };
+    config.wpUrl = config.wpUrl.replace(/\/+$/, "");
+    if (!config.wpUrl)
+        throw new Error("WP_URL is required");
+    if (!config.wpUsername)
+        throw new Error("WP_USERNAME is required");
+    if (!config.wpAppPassword)
+        throw new Error("WP_APP_PASSWORD is required");
+    return config;
+}
+//# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,UAAU,CAAC,YAAkC,EAAE;IAC7D,MAAM,MAAM,GAAgB;QAC1B,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACrD,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;QACpE,aAAa,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAC9E,SAAS,EACP,CAAC,SAAS,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAA6B;QACjG,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC;QAC1E,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,WAAW;QACjE,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,OAAO,CAAC;KAC7E,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEhD,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAE1E,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/discovery/engine.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { WpClient } from "../client/wp-client.js";
+import type { ToolRegistry } from "../tools/registry.js";
+export declare function runDiscovery(server: McpServer, client: WpClient, registry: ToolRegistry): Promise<number>;
+//# sourceMappingURL=engine.d.ts.map

package/dist/src/discovery/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/discovery/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAoBzD,wBAAsB,YAAY,CAChC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,QAAQ,EAChB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,MAAM,CAAC,CA4CjB"}

package/dist/src/discovery/engine.js

@@ -0,0 +1,116 @@
+import { z } from "zod";
+import { handleWpError, jsonResult } from "../tools/shared.js";
+import { shouldSkipNamespace } from "./naming.js";
+import { registerDiscoveredTool } from "./tool-generator.js";
+export async function runDiscovery(server, client, registry) {
+    const discovery = await client.fetchRawJson("/");
+    const routes = discovery.routes ?? {};
+    let count = 0;
+    for (const [routePath, routeInfo] of Object.entries(routes)) {
+        const namespace = routeInfo.namespace ?? inferNamespace(routePath);
+        if (!namespace || shouldSkipNamespace(namespace))
+            continue;
+        const endpoints = routeInfo.endpoints ?? [];
+        if (endpoints.length === 0 && routeInfo.methods) {
+            for (const method of routeInfo.methods) {
+                const discovered = {
+                    namespace,
+                    path: stripNamespaceFromPath(routePath, namespace),
+                    method: method.toUpperCase(),
+                    args: {},
+                };
+                if (registerDiscoveredTool(server, client, registry, discovered)) {
+                    count++;
+                }
+            }
+            continue;
+        }
+        for (const endpoint of endpoints) {
+            for (const method of endpoint.methods) {
+                const discovered = {
+                    namespace,
+                    path: stripNamespaceFromPath(routePath, namespace),
+                    method: method.toUpperCase(),
+                    args: endpoint.args ?? {},
+                };
+                if (registerDiscoveredTool(server, client, registry, discovered)) {
+                    count++;
+                }
+            }
+        }
+    }
+    registerDiscoverRoutesTool(server, client, registry);
+    console.error(`Auto-discovery: registered ${count} tools from custom endpoints`);
+    return count;
+}
+function registerDiscoverRoutesTool(server, client, registry) {
+    if (registry.has("wp_discover_routes"))
+        return;
+    server.registerTool("wp_discover_routes", {
+        description: "Re-scan the WordPress site for REST API endpoints. Useful after installing new plugins.",
+        inputSchema: {
+            namespace_filter: z.string().optional().describe("Only discover routes in this namespace (e.g. 'wc/v3')"),
+        },
+    }, async ({ namespace_filter }) => {
+        try {
+            const discovery = await client.fetchRawJson("/");
+            const namespaces = discovery.namespaces ?? [];
+            const routes = discovery.routes ?? {};
+            if (namespace_filter) {
+                let count = 0;
+                for (const [routePath, routeInfo] of Object.entries(routes)) {
+                    const ns = routeInfo.namespace ?? inferNamespace(routePath);
+                    if (ns !== namespace_filter)
+                        continue;
+                    const endpoints = routeInfo.endpoints ?? [];
+                    for (const endpoint of endpoints) {
+                        for (const method of endpoint.methods) {
+                            const discovered = {
+                                namespace: ns,
+                                path: stripNamespaceFromPath(routePath, ns),
+                                method: method.toUpperCase(),
+                                args: endpoint.args ?? {},
+                            };
+                            if (registerDiscoveredTool(server, client, registry, discovered)) {
+                                count++;
+                            }
+                        }
+                    }
+                }
+                return jsonResult({ message: `Discovered ${count} new tools in namespace ${namespace_filter}`, namespaces });
+            }
+            return jsonResult({
+                namespaces,
+                route_count: Object.keys(routes).length,
+                registered_tools: registry.all(),
+            });
+        }
+        catch (err) {
+            return handleWpError(err);
+        }
+    });
+    registry.register("wp_discover_routes");
+}
+function inferNamespace(routePath) {
+    const clean = routePath.replace(/^\//, "");
+    const parts = clean.split("/");
+    if (parts.length >= 2 && /^v\d+/.test(parts[1])) {
+        return `${parts[0]}/${parts[1]}`;
+    }
+    if (parts.length >= 1) {
+        return parts[0];
+    }
+    return undefined;
+}
+function stripNamespaceFromPath(routePath, namespace) {
+    const prefix = `/${namespace}/`;
+    if (routePath.startsWith(prefix)) {
+        return routePath.slice(prefix.length);
+    }
+    const prefixNoSlash = `/${namespace}`;
+    if (routePath === prefixNoSlash) {
+        return "";
+    }
+    return routePath.replace(/^\//, "");
+}
+//# sourceMappingURL=engine.js.map