slc-wp-mcp-bridge 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,373 @@
+SLC WP MCP Bridge
+Copyright (C) 2026 Silicate Labs
+
+This program is free software; you can redistribute it and/or modify it under the terms of the
+GNU General Public License as published by the Free Software Foundation; either version 2 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+General Public License below for more details.
+
+"SLC WP MCP Bridge", "Silicate Labs" and the associated logos are names and marks of Silicate Labs.
+The GPL grants rights to the code; it does not grant rights to use these names or marks.
+
+-------------------------------------------------------------------------------------------------
+
+GNU GENERAL PUBLIC LICENSE
+
+Version 2, June 1991
+
+    Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+    51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+
+    Everyone is permitted to copy and distribute verbatim copies
+    of this license document, but changing it is not allowed.
+
+### Preamble
+
+The licenses for most software are designed to take away your freedom
+to share and change it. By contrast, the GNU General Public License is
+intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users. This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it. (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.) You can apply it to
+your programs, too.
+
+When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if
+you distribute copies of the software, or if you modify it.
+
+For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have. You must make sure that they, too, receive or can get the
+source code. And you must show them these terms so they know their
+rights.
+
+We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software. If the software is modified by someone else and passed on,
+we want its recipients to know that what they have is not the
+original, so that any problems introduced by others will not reflect
+on the original authors' reputations.
+
+Finally, any free program is threatened constantly by software
+patents. We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary. To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at
+all.
+
+The precise terms and conditions for copying, distribution and
+modification follow.
+
+### TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+**0.** This License applies to any program or other work which
+contains a notice placed by the copyright holder saying it may be
+distributed under the terms of this General Public License. The
+"Program", below, refers to any such program or work, and a "work
+based on the Program" means either the Program or any derivative work
+under copyright law: that is to say, a work containing the Program or
+a portion of it, either verbatim or with modifications and/or
+translated into another language. (Hereinafter, translation is
+included without limitation in the term "modification".) Each licensee
+is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope. The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the Program
+(independent of having been made by running the Program). Whether that
+is true depends on what the Program does.
+
+**1.** You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a
+fee.
+
+**2.** You may modify your copy or copies of the Program or any
+portion of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+**a)** You must cause the modified files to carry prominent notices
+stating that you changed the files and the date of any change.
+
+**b)** You must cause any work that you distribute or publish, that in
+whole or in part contains or is derived from the Program or any part
+thereof, to be licensed as a whole at no charge to all third parties
+under the terms of this License.
+
+**c)** If the modified program normally reads commands interactively
+when run, you must cause it, when started running for such interactive
+use in the most ordinary way, to print or display an announcement
+including an appropriate copyright notice and a notice that there is
+no warranty (or else, saying that you provide a warranty) and that
+users may redistribute the program under these conditions, and telling
+the user how to view a copy of this License. (Exception: if the
+Program itself is interactive but does not normally print such an
+announcement, your work based on the Program is not required to print
+an announcement.)
+
+These requirements apply to the modified work as a whole. If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works. But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+**3.** You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+**a)** Accompany it with the complete corresponding machine-readable
+source code, which must be distributed under the terms of Sections 1
+and 2 above on a medium customarily used for software interchange; or,
+
+**b)** Accompany it with a written offer, valid for at least three
+years, to give any third party, for a charge no more than your cost of
+physically performing source distribution, a complete machine-readable
+copy of the corresponding source code, to be distributed under the
+terms of Sections 1 and 2 above on a medium customarily used for
+software interchange; or,
+
+**c)** Accompany it with the information you received as to the offer
+to distribute corresponding source code. (This alternative is allowed
+only for noncommercial distribution and only if you received the
+program in object code or executable form with such an offer, in
+accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it. For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable. However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+**4.** You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License. Any attempt otherwise
+to copy, modify, sublicense or distribute the Program is void, and
+will automatically terminate your rights under this License. However,
+parties who have received copies, or rights, from you under this
+License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+**5.** You are not required to accept this License, since you have not
+signed it. However, nothing else grants you permission to modify or
+distribute the Program or its derivative works. These actions are
+prohibited by law if you do not accept this License. Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+**6.** Each time you redistribute the Program (or any work based on
+the Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions. You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+**7.** If, as a consequence of a court judgment or allegation of
+patent infringement or for any other reason (not limited to patent
+issues), conditions are imposed on you (whether by court order,
+agreement or otherwise) that contradict the conditions of this
+License, they do not excuse you from the conditions of this License.
+If you cannot distribute so as to satisfy simultaneously your
+obligations under this License and any other pertinent obligations,
+then as a consequence you may not distribute the Program at all. For
+example, if a patent license would not permit royalty-free
+redistribution of the Program by all those who receive copies directly
+or indirectly through you, then the only way you could satisfy both it
+and this License would be to refrain entirely from distribution of the
+Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices. Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+**8.** If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded. In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+**9.** The Free Software Foundation may publish revised and/or new
+versions of the General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation. If the Program does not specify a
+version number of this License, you may choose any version ever
+published by the Free Software Foundation.
+
+**10.** If you wish to incorporate parts of the Program into other
+free programs whose distribution conditions are different, write to
+the author to ask for permission. For software which is copyrighted by
+the Free Software Foundation, write to the Free Software Foundation;
+we sometimes make exceptions for this. Our decision will be guided by
+the two goals of preserving the free status of all derivatives of our
+free software and of promoting the sharing and reuse of software
+generally.
+
+**NO WARRANTY**
+
+**11.** BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+**12.** IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+### END OF TERMS AND CONDITIONS
+
+### How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these
+terms.
+
+To do so, attach the following notices to the program. It is safest to
+attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    one line to give the program's name and an idea of what it does.
+    Copyright (C) yyyy  name of author
+
+    This program is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License
+    as published by the Free Software Foundation; either version 2
+    of the License, or (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+Also add information on how to contact you by electronic and paper
+mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details
+    type `show w'.  This is free software, and you are welcome
+    to redistribute it under certain conditions; type `show c'
+    for details.
+
+The hypothetical commands \`show w' and \`show c' should show the
+appropriate parts of the General Public License. Of course, the
+commands you use may be called something other than \`show w' and
+\`show c'; they could even be mouse-clicks or menu items--whatever
+suits your program.
+
+You should also get your employer (if you work as a programmer) or
+your school, if any, to sign a "copyright disclaimer" for the program,
+if necessary. Here is a sample; alter the names:
+
+    Yoyodyne, Inc., hereby disclaims all copyright
+    interest in the program `Gnomovision'
+    (which makes passes at compilers) written
+    by James Hacker.
+
+    signature of Ty Coon, 1 April 1989
+    Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program
+into proprietary programs. If your program is a subroutine library,
+you may consider it more useful to permit linking proprietary
+applications with the library. If this is what you want to do, use the
+[GNU Lesser General Public
+License](http://www.gnu.org/licenses/lgpl.html) instead of this
+License.
+
+---

package/README.md

@@ -1,3 +1,101 @@
-# Temporary Holding Version
+# slc-wp-mcp-bridge
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Design WordPress sites with AI (Claude Code, Claude Desktop or any MCP client) using **native Gutenberg blocks**.
+Build and test on your own machine, then deploy to your live site, or work on your live site directly.
+
+This is the connector for the **SLC WP MCP Bridge** WordPress plugin. Built by Silicate Labs.
+
+## Quick start
+
+**1. Local site (optional, recommended).** Needs Node.js 20+. No Docker required.
+
+```bash
+npx slc-wp-mcp-bridge@1.0.0 dev
+```
+
+This starts a private local WordPress at `http://127.0.0.1:9400` (reachable only from your computer) with the plugin installed and configured.
+It is kept between runs. Credentials are random per machine and stored in `~/.slc-wp-mcp/local.json`.
+
+**2. Connect your live site** (optional). On the site: install **SLC WP MCP Bridge**, enable it under
+Settings > SLC WP MCP Bridge, allow your user, and create an Application Password (Users > Profile). Then:
+
+```bash
+npx slc-wp-mcp-bridge@1.0.0 connect --url https://your-site.com
+```
+
+The password is typed with hidden input, checked against the site, and saved in `~/.slc-wp-mcp/sites.json`,
+readable only by your OS user. It never goes into a command line, shell history, MCP config or chat.
+
+**3. Add the connector to your AI client** once (Claude Code shown). No secrets in this command:
+
+```bash
+claude mcp add wordpress -- npx -y slc-wp-mcp-bridge@1.0.0
+```
+
+**4. Ask**, for example:
+
+- "Design a homepage for a bakery on the local site with a hero, three feature columns and a contact call to action."
+- "Make buttons pill-shaped and use the accent color for headings."
+- "Build a header with the site title and a menu: Home, Menu, About, Contact."
+- "Deploy everything to live." (The assistant shows a dry-run plan first.)
+
+## Tools
+
+| Area | Tools |
+|---|---|
+| Sites | `wp_list_sites`, `wp_site_info`, `wp_audit_log` |
+| Blocks | `wp_describe_block`, `wp_build_blocks`, `wp_validate_markup` |
+| Pages, posts, menus, synced patterns | `wp_list_content`, `wp_get_content`, `wp_save_content`, `wp_publish_content`, `wp_rollback_content` |
+| Templates and header/footer | `wp_list_templates`, `wp_get_template`, `wp_save_template`, `wp_rollback_template`, `wp_reset_template` |
+| Global styles | `wp_get_styles`, `wp_update_styles`, `wp_rollback_styles` |
+| Patterns, media, identity | `wp_list_patterns`, `wp_get_pattern`, `wp_upload_image`, `wp_set_site_identity` |
+| Local to live | `wp_deploy` (dry run first) |
+
+## How blocks stay valid
+
+The assistant sends a block tree (`{ name, attributes, innerBlocks }`). The connector builds the HTML with
+WordPress's own block code (`@wordpress/blocks`), so the editor accepts it, and the plugin validates it again
+before saving. Unsupported attributes are reported instead of silently lost.
+
+## Security
+
+**On your computer**
+- Credentials are saved by `connect` in a file only your OS user can read (Windows ACL / chmod 600) and are sent only
+  to your site, over https (plain http only for localhost). The connector refuses to send them if TLS certificate
+  checking is disabled (`NODE_TLS_REJECT_UNAUTHORIZED=0`), and never follows redirects with them.
+- The local dev site listens on 127.0.0.1 only; its credentials are random per machine.
+- Local images can only be uploaded from the media folder (current directory or `SLC_MEDIA_ROOT`), must be real
+  JPEG/PNG/GIF/WebP/AVIF files (checked by content) and at most 10 MB.
+- No install scripts; the full dependency tree is pinned with `npm-shrinkwrap.json`. Pin the version in your MCP
+  config (`slc-wp-mcp-bridge@1.0.0`) so updates only happen when you choose.
+
+**On your site**
+- Only Application Passwords from users an administrator allowed; WordPress capabilities always apply.
+- WordPress's HTML filter runs on everything the assistant writes, even for administrator accounts; anything it would
+  strip is rejected. Pages stay drafts unless publishing is enabled; live design changes need a separate switch.
+- Every overwrite is snapshotted (rollbacks are safety-checked too); every write is audited and rate limited.
+- `wp_deploy` only runs with the confirmation token from a dry run of the same plan, so a deploy can't skip the preview.
+- Treat site content as untrusted: the assistant is told so, and the protections above hold even if it is fooled.
+
+## Environment variables
+
+| Variable | Purpose |
+|---|---|
+| `WP_SITE_URL`, `WP_USERNAME`, `WP_APP_PASSWORD` | Alternative to `connect` for CI (all three; prefer `connect` on personal machines) |
+| `SLC_MEDIA_ROOT` | Folder local images may be uploaded from (default: current directory) |
+| `SLC_WP_MCP_HOME` | Where the local site and its credentials live (default: `~/.slc-wp-mcp`) |
+
+## Commands
+
+```
+npx slc-wp-mcp-bridge                      run the MCP server (started by your AI client)
+npx slc-wp-mcp-bridge dev [--port 9400]    start the local WordPress
+npx slc-wp-mcp-bridge connect [--name live] [--url URL]   save a site (password typed privately)
+npx slc-wp-mcp-bridge disconnect [--name live]
+npx slc-wp-mcp-bridge info [--show-password]
+npx slc-wp-mcp-bridge reset --yes          delete the local site
+```
+
+## License
+
+GPL-2.0-or-later. Copyright (C) 2026 Silicate Labs. "SLC WP MCP Bridge" and "Silicate Labs" are names of Silicate Labs.

package/bin/cli.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// SLC WP MCP Bridge connector by Silicate Labs. GPL-2.0-or-later.
+import { parseArgs } from 'node:util';
+
+const [cmd, ...rest] = process.argv.slice(2);
+
+const HELP = `slc-wp-mcp-bridge: design WordPress with AI using native blocks (by Silicate Labs)
+
+Usage
+  npx slc-wp-mcp-bridge                     Run the MCP server (your AI client starts this)
+  npx slc-wp-mcp-bridge dev [--port N]      Start a private local WordPress for designing and testing
+  npx slc-wp-mcp-bridge connect [--name live] [--url URL] [--user NAME]
+                                            Save a live site; the Application Password is typed privately
+  npx slc-wp-mcp-bridge disconnect [--name live]
+  npx slc-wp-mcp-bridge info [--show-password]   Show local site details
+  npx slc-wp-mcp-bridge reset --yes         Delete the local site
+
+Never paste an Application Password into a chat or a command line.
+`;
+
+try {
+	if (!cmd || cmd === 'serve') {
+		const { startServer } = await import('../src/server.js');
+		await startServer();
+	} else if (cmd === 'dev') {
+		const { values } = parseArgs({ args: rest, options: { port: { type: 'string' } } });
+		const { runDev } = await import('../src/dev.js');
+		await runDev({ port: values.port });
+	} else if (cmd === 'connect') {
+		const { values } = parseArgs({ args: rest, options: { name: { type: 'string' }, url: { type: 'string' }, user: { type: 'string' } } });
+		const { connect } = await import('../src/connect.js');
+		await connect(values);
+	} else if (cmd === 'disconnect') {
+		const { values } = parseArgs({ args: rest, options: { name: { type: 'string' } } });
+		const { disconnect } = await import('../src/connect.js');
+		disconnect(values);
+	} else if (cmd === 'info') {
+		const { values } = parseArgs({ args: rest, options: { 'show-password': { type: 'boolean' } } });
+		const { showInfo } = await import('../src/dev.js');
+		showInfo({ showPassword: values['show-password'] });
+	} else if (cmd === 'reset') {
+		const { values } = parseArgs({ args: rest, options: { yes: { type: 'boolean' } } });
+		const { resetLocal } = await import('../src/dev.js');
+		resetLocal({ yes: values.yes });
+	} else if (cmd === '--version' || cmd === '-v') {
+		const { VERSION } = await import('../src/version.js');
+		console.log(VERSION);
+	} else {
+		console.log(HELP);
+		if (cmd !== '--help' && cmd !== '-h') process.exitCode = 1;
+	}
+} catch (e) {
+	process.stderr.write(`slc-wp-mcp-bridge: ${e.message}\n`);
+	process.exitCode = 1;
+}