wp-mcp-gateway 0.1.26 → 0.1.30

package/README.md

@@ -1,21 +1,188 @@
-# MCP Server (TypeScript)
+# WP MCP Gateway
 
-Local MCP server that connects Claude to a scoped WordPress plugin gateway.
+MCP server for managing WordPress content from Claude Desktop — create posts, upload images, manage SEO, and publish without ever opening WordPress.
 
-## Run
+## Quick Start
 
-1. Copy `.env.example` to `.env` and fill credentials.
-2. Install dependencies:
-   - `npm install`
-3. Start development server:
-   - `npm run dev`
+### Prerequisites
 
-## Test
+- WordPress 6.0+ with the [WP MCP Gateway plugin](https://github.com/XMPro/wordpress-mcp-server) installed and activated
+- Node.js 18+
+- Claude Desktop, Claude Code, or any MCP-compatible client
 
-- `npm test`
+### Setup
 
-## Key constraints
+```bash
+npx wp-mcp-gateway --setup
+```
 
-- Allowed content types default to: `post,page,featured_item`
-- Permanent delete is intentionally not exposed in v1
-- Yoast operations are limited to allowlisted Tier A/B routes
+This runs an interactive device authorization flow:
+
+1. Enter your WordPress site URL
+2. A 6-character code is displayed — enter it in your WordPress admin (Settings → MCP Gateway → Connect Claude)
+3. Credentials are saved securely to `~/.wp-mcp-gateway/credentials.json` (mode `0600`)
+4. Claude Desktop MCP config is written to `~/.claude/mcp.json`
+
+That's it — Claude can now manage your WordPress site.
+
+### Manage Connections
+
+```bash
+npx wp-mcp-gateway --list              # Show connected sites
+npx wp-mcp-gateway --remove example.com # Remove a site
+```
+
+### Manual Configuration (Advanced)
+
+For CI or custom setups, set environment variables directly:
+
+```bash
+WP_PLUGIN_BASE_URL=https://example.com/wp-json/wp-mcp-gateway/v1
+WP_USERNAME=your-username
+WP_APP_PASSWORD=xxxx xxxx xxxx xxxx xxxx xxxx
+```
+
+See `.env.example` for all available options.
+
+---
+
+## Available Tools (39)
+
+### Content Management
+
+| Tool | Description |
+|------|-------------|
+| `wp_getting_started` | Initialize session with editorial workflow guide (call first) |
+| `wp_site_info` | Get site metadata and capabilities |
+| `wp_list_content_types` | List allowed content types |
+| `wp_find_content` | Search content by type, status, author, taxonomy |
+| `wp_get_content` | Fetch single item with full edit context |
+| `wp_create_draft` | Create a new draft |
+| `wp_update_content` | Patch existing content |
+| `wp_publish_content` | Publish or schedule (confirmation required) |
+| `wp_clone_content` | Clone a post/page as a new draft |
+| `wp_get_preview_link` | Get WordPress preview + signed shareable URL |
+
+### Trash & Revisions
+
+| Tool | Description |
+|------|-------------|
+| `wp_trash_content` | Move to trash (confirmation required) |
+| `wp_restore_content` | Restore from trash (confirmation required) |
+| `wp_list_revisions` | List all revisions |
+| `wp_restore_revision` | Restore a specific revision (confirmation required) |
+
+### Authors & Taxonomies
+
+| Tool | Description |
+|------|-------------|
+| `wp_list_authors` | List allowlisted authors |
+| `wp_assign_author` | Change content author |
+| `wp_list_terms` | Search taxonomy terms |
+| `wp_create_term` | Create a new term |
+| `wp_assign_terms` | Assign terms to content |
+
+### Media
+
+| Tool | Description |
+|------|-------------|
+| `wp_search_media` | Search the media library |
+| `wp_get_media` | Get single media item with metadata |
+| `wp_update_media` | Update alt text, caption, description, title |
+| `wp_set_featured_image` | Set or remove featured image |
+| `wp_upload_media_from_url` | Upload from a URL (server-side download) |
+| `wp_find_media_file` | Search local filesystem for an image file |
+| `wp_upload_media_from_path` | Upload from a local file path |
+
+### Inline Images
+
+| Tool | Description |
+|------|-------------|
+| `wp_insert_inline_image` | Insert image into content with block-aware placement |
+| `wp_replace_inline_image` | Replace an inline image reference |
+| `wp_remove_inline_image` | Remove an inline image from content |
+
+### Yoast SEO
+
+| Tool | Description |
+|------|-------------|
+| `wp_get_yoast_analysis` | Get readability and SEO scores |
+| `wp_update_yoast_metadata` | Update focus keyphrase, meta description, SEO title |
+| `wp_get_yoast_head_preview` | Preview the rendered head/meta tags |
+
+### Image Generation & Stock Photos
+
+| Tool | Description |
+|------|-------------|
+| `wp_generate_image` | Generate an image with AI (Google Imagen or OpenAI) |
+| `wp_search_stock_photos` | Search Unsplash or Pexels |
+| `wp_import_stock_photo` | Import a stock photo with automatic attribution |
+| `wp_list_image_providers` | Show which providers are configured |
+| `wp_confirm_image` | Confirm a generated image to prevent auto-cleanup |
+
+### Upload Portal
+
+| Tool | Description |
+|------|-------------|
+| `wp_create_upload_session` | Create a temporary drag-and-drop upload link (15 min) |
+| `wp_get_upload_session` | Retrieve uploaded file details after user finishes |
+
+---
+
+## Configuration
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `WP_MCP_SITE` | — | Hostname to load from token store (auto-set by `--setup`) |
+| `WP_PLUGIN_BASE_URL` | — | Full REST base URL (legacy mode) |
+| `WP_USERNAME` | — | WordPress username (legacy mode) |
+| `WP_APP_PASSWORD` | — | Application password (legacy mode) |
+| `ALLOWED_CONTENT_TYPES` | `post,page,featured_item` | Comma-separated content types |
+| `ALLOWED_TAXONOMIES` | `category,post_tag,...` | Comma-separated taxonomies |
+| `ALLOWED_AUTHOR_IDS` | (all) | Comma-separated author IDs |
+| `MEDIA_MAX_SIZE_MB` | `10` | Max upload size in MB |
+| `MEDIA_REQUIRE_ALT_TEXT` | `true` | Require alt text on uploads |
+| `RATE_LIMIT_MAX_BURST` | `30` | Token bucket burst capacity |
+| `RATE_LIMIT_REFILL_PER_SECOND` | `1` | Token bucket refill rate |
+| `REQUEST_TIMEOUT_MS` | `30000` | HTTP request timeout |
+| `CONFIRMATION_TTL_SECONDS` | `300` | Confirmation token expiry |
+
+---
+
+## Authentication
+
+The plugin supports four authentication methods:
+
+1. **Application Passwords** (HTTP Basic Auth) — default for local MCP clients
+2. **Device Authorization** (RFC 8628) — used by `--setup` CLI flow
+3. **OAuth 2.1** (PKCE S256) — for web-based clients (ChatGPT, Claude Web)
+4. **Bearer Token** — for remote MCP-over-HTTP transport
+
+---
+
+## Development
+
+```bash
+npm run dev        # Run with tsx (hot reload)
+npm run build      # Compile TypeScript
+npm start          # Run compiled output
+npm test           # Run tests (Vitest)
+npm run test:watch # Watch mode
+```
+
+---
+
+## Security
+
+- **Confirmation tokens** — destructive actions (publish, trash, restore) require a single-use token
+- **Rate limiting** — token bucket rate limiter on all tool calls
+- **Policy enforcement** — dual-layer (TypeScript client + PHP server) allowlist validation
+- **Credential isolation** — secrets stored in `~/.wp-mcp-gateway/credentials.json` (mode `0600`), never in MCP config
+- **SVG sanitization** — upload portal strips scripts, event handlers, and dangerous attributes
+- **CSP headers** — upload portal pages use Content-Security-Policy with nonces
+
+---
+
+## License
+
+MIT

package/dist/client/pluginApiClient.js

@@ -133,6 +133,13 @@ export class PluginApiClient {
     async confirmImage(mediaId) {
         return this.request("POST", `/image/${mediaId}/confirm`, { body: {} });
     }
+    // ── Upload Portal ─────────────────────────────────────────────────────
+    async createUploadSession(body = {}) {
+        return this.request("POST", "/upload/session", { body });
+    }
+    async getUploadSession(sessionId) {
+        return this.request("GET", `/upload/session/${sessionId}`);
+    }
     async request(method, path, options = {}) {
         const url = new URL(`${this.config.wpPluginBaseUrl}${path}`);
         for (const [key, value] of Object.entries(options.query ?? {})) {

package/dist/config.js

@@ -1,4 +1,4 @@
-import { loadCredentials } from './tokenStore.js';
+import { loadCredentials, listSites } from './tokenStore.js';
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -67,3 +67,74 @@ export async function loadConfig() {
         httpTimeout: getNumber(env['HTTP_TIMEOUT'], 30_000),
     };
 }
+// ---------------------------------------------------------------------------
+// hostnameFromUrl
+// ---------------------------------------------------------------------------
+/**
+ * Extract the hostname from a WordPress plugin base URL.
+ */
+export function hostnameFromUrl(wpPluginBaseUrl) {
+    try {
+        return new URL(wpPluginBaseUrl).hostname;
+    }
+    catch {
+        // Fallback: rough extraction
+        const match = wpPluginBaseUrl.match(/\/\/([^/]+)/);
+        return match ? match[1] : wpPluginBaseUrl;
+    }
+}
+// ---------------------------------------------------------------------------
+// loadAllConfigs — multi-site support
+// ---------------------------------------------------------------------------
+/**
+ * Load configs for ALL connected sites.
+ *
+ * Priority:
+ *  1. If WP_MCP_SITE is set → single-site mode (backward compat).
+ *  2. Otherwise → load all sites from token store.
+ *  3. If token store is empty → fall back to legacy env-var mode.
+ *
+ * Returns a Map keyed by hostname.
+ */
+export async function loadAllConfigs() {
+    const env = process.env;
+    // -------------------------------------------------------------------------
+    // Mode 1: Single-site (WP_MCP_SITE set) — backward compatible
+    // -------------------------------------------------------------------------
+    if (env['WP_MCP_SITE']) {
+        const config = await loadConfig();
+        const hostname = env['WP_MCP_SITE'].trim();
+        return new Map([[hostname, config]]);
+    }
+    // -------------------------------------------------------------------------
+    // Mode 2: Multi-site — load all from token store
+    // -------------------------------------------------------------------------
+    const allSites = await listSites();
+    if (allSites.length > 0) {
+        const map = new Map();
+        for (const site of allSites) {
+            map.set(site.hostname, {
+                wpPluginBaseUrl: site.wpPluginBaseUrl,
+                username: site.username,
+                appPassword: site.appPassword,
+                siteName: site.siteName,
+                // Global allowlists from env (shared across all sites)
+                allowedContentTypes: splitList(env['WP_ALLOWED_CONTENT_TYPES']),
+                allowedTaxonomies: splitList(env['WP_ALLOWED_TAXONOMIES']),
+                allowedAuthors: splitList(env['WP_ALLOWED_AUTHORS']),
+                allowedMediaTypes: splitList(env['WP_ALLOWED_MEDIA_TYPES']),
+                allowedYoastPaths: splitList(env['WP_ALLOWED_YOAST_PATHS']),
+                rateLimitTokens: getNumber(env['RATE_LIMIT_TOKENS'], 60),
+                rateLimitRefillRate: getNumber(env['RATE_LIMIT_REFILL_RATE'], 1),
+                httpTimeout: getNumber(env['HTTP_TIMEOUT'], 30_000),
+            });
+        }
+        return map;
+    }
+    // -------------------------------------------------------------------------
+    // Mode 3: Legacy env-var fallback (single site)
+    // -------------------------------------------------------------------------
+    const config = await loadConfig();
+    const hostname = hostnameFromUrl(config.wpPluginBaseUrl);
+    return new Map([[hostname, config]]);
+}

package/dist/index.js

@@ -1,39 +1,57 @@
 #!/usr/bin/env node
 import 'dotenv/config';
-import { loadConfig } from './config.js';
+import { loadAllConfigs } from './config.js';
 // ---------------------------------------------------------------------------
 // Main MCP server entry point
 // ---------------------------------------------------------------------------
 async function main() {
-    const config = await loadConfig();
+    const configMap = await loadAllConfigs();
     // Lazy-import heavy MCP SDK dependencies so the --setup path stays fast
     const { McpServer } = await import('@modelcontextprotocol/sdk/server/mcp.js');
     const { StdioServerTransport } = await import('@modelcontextprotocol/sdk/server/stdio.js');
-    const server = new McpServer({
-        name: 'wp-mcp-gateway',
-        version: '0.1.20',
-        description: 'WordPress MCP Gateway — proxies Claude tool calls to a WordPress site via the WP MCP Gateway plugin. ' +
-            'Always call wp_getting_started first. Follow the IDEATE → DRAFT → PACKAGE workflow. ' +
-            'Destructive actions (publish, trash, restore) require a confirmation token.',
-    });
     // Dynamically import service and tool modules to keep top-level light
     const { PluginApiClient } = await import('./client/pluginApiClient.js');
     const { PolicyService } = await import('./services/policyService.js');
+    const { SiteManager } = await import('./services/siteManager.js');
     const { ConfirmationService } = await import('./services/confirmationService.js');
     const { RateLimiter } = await import('./services/rateLimiter.js');
     const { SessionImageStore } = await import('./services/sessionImageStore.js');
     const { registerTools } = await import('./tools/registerTools.js');
     const { registerPrompts } = await import('./prompts/registerPrompts.js');
-    const apiClient = new PluginApiClient(config);
-    const policyService = new PolicyService(config);
+    // Build services for each connected site
+    const siteServicesMap = new Map();
+    for (const [hostname, config] of configMap) {
+        siteServicesMap.set(hostname, {
+            config,
+            client: new PluginApiClient(config),
+            policy: new PolicyService(config),
+        });
+    }
+    // Determine initial active site
+    const initialSite = process.env['WP_MCP_SITE']?.trim() || Array.from(configMap.keys())[0];
+    const siteManager = new SiteManager(siteServicesMap, initialSite);
+    // Build server description with site indicator
+    const activeSiteName = siteManager.getCurrent().config.siteName || initialSite;
+    const siteCount = configMap.size;
+    const siteIndicator = siteCount > 1
+        ? ` Connected to ${siteCount} sites (active: ${activeSiteName}). Use wp_switch_site to change.`
+        : '';
+    const server = new McpServer({
+        name: 'wp-mcp-gateway',
+        version: '0.1.30',
+        description: 'WordPress MCP Gateway — proxies Claude tool calls to a WordPress site via the WP MCP Gateway plugin.' +
+            siteIndicator +
+            ' Always call wp_getting_started first. Follow the IDEATE → DRAFT → PACKAGE workflow. ' +
+            'Destructive actions (publish, trash, restore) require a confirmation token.',
+    });
+    // Global services (not per-site)
+    const firstConfig = configMap.get(initialSite);
     const confirmationService = new ConfirmationService(300);
-    const rateLimiter = new RateLimiter(config.rateLimitTokens, config.rateLimitRefillRate);
+    const rateLimiter = new RateLimiter(firstConfig.rateLimitTokens, firstConfig.rateLimitRefillRate);
     const sessionImageStore = new SessionImageStore();
     const context = {
         server,
-        config,
-        client: apiClient,
-        policy: policyService,
+        siteManager,
         confirmations: confirmationService,
         rateLimiter,
         sessionImageStore,

package/dist/services/siteManager.js

@@ -0,0 +1,60 @@
+import { ToolError } from '../utils/errors.js';
+// ---------------------------------------------------------------------------
+// SiteManager
+// ---------------------------------------------------------------------------
+/**
+ * Manages multiple WordPress site connections and tracks which one is active.
+ *
+ * Tools access the active site's services via `getCurrent()`.
+ * The active site can be changed at runtime via `switchTo()`.
+ */
+export class SiteManager {
+    sites;
+    activeSiteHostname;
+    constructor(sites, initialHostname) {
+        this.sites = sites;
+        if (!sites.has(initialHostname)) {
+            throw new Error(`Initial site "${initialHostname}" not found in loaded sites: ${Array.from(sites.keys()).join(', ')}`);
+        }
+        this.activeSiteHostname = initialHostname;
+    }
+    /**
+     * Get the active site's services (config, client, policy).
+     */
+    getCurrent() {
+        return this.sites.get(this.activeSiteHostname);
+    }
+    /**
+     * Get the hostname of the currently active site.
+     */
+    getCurrentHostname() {
+        return this.activeSiteHostname;
+    }
+    /**
+     * Switch the active site to a different connected site.
+     * Throws ToolError if the hostname is not in the loaded sites.
+     */
+    switchTo(hostname) {
+        if (!this.sites.has(hostname)) {
+            const available = Array.from(this.sites.keys()).join(', ');
+            throw new ToolError('SITE_NOT_FOUND', `Site "${hostname}" is not connected. Available sites: ${available}`);
+        }
+        this.activeSiteHostname = hostname;
+    }
+    /**
+     * List all connected sites with an isActive flag.
+     */
+    listSites() {
+        return Array.from(this.sites.entries()).map(([hostname, services]) => ({
+            hostname,
+            siteName: services.config.siteName || hostname,
+            isActive: hostname === this.activeSiteHostname,
+        }));
+    }
+    /**
+     * True if more than one site is loaded.
+     */
+    isMultiSite() {
+        return this.sites.size > 1;
+    }
+}

package/dist/setup.js

@@ -85,11 +85,15 @@ function entryTargetsHostname(entry, hostname) {
 }
 /**
  * Merge an entry into ~/.claude/mcp.json.
- * Reads the existing file (defaulting to {}), removes any duplicate entries
- * that reference wp-mcp-gateway and target the same hostname, then sets
- * mcpServers["wordpress-{hostname}"] without touching unrelated keys.
+ *
+ * Writes a SINGLE unified "wordpress" entry with no WP_MCP_SITE env.
+ * The MCP server loads all connected sites from the token store at startup
+ * and supports runtime switching via wp_switch_site.
+ *
+ * Also cleans up old per-site entries (e.g. "wordpress-example.com") that
+ * were created by earlier versions.
  */
-async function writeMcpJson(hostname) {
+async function writeMcpJson(_hostname) {
     const mcpJsonPath = path.join(os.homedir(), '.claude', 'mcp.json');
     let existing = {};
     try {
@@ -108,23 +112,22 @@ async function writeMcpJson(hostname) {
         !Array.isArray(existing['mcpServers'])
         ? existing['mcpServers']
         : {};
-    // Remove duplicate entries that point at the same site
-    const targetKey = `wordpress-${hostname}`;
+    // Remove ALL old per-site wp-mcp-gateway entries (wordpress-{hostname} pattern).
+    // The unified "wordpress" entry replaces them all.
     for (const key of Object.keys(mcpServers)) {
-        if (key === targetKey)
+        if (key === 'wordpress')
             continue;
         const entry = mcpServers[key];
-        if (entryRefsWpMcp(entry) && entryTargetsHostname(entry, hostname)) {
-            console.log(`Replacing existing entry: ${key}`);
+        if (entryRefsWpMcp(entry)) {
+            console.log(`Removing old single-site entry: ${key}`);
             delete mcpServers[key];
         }
     }
-    mcpServers[targetKey] = {
+    // Write the unified multi-site entry (no WP_MCP_SITE — loads all from token store)
+    mcpServers['wordpress'] = {
         command: 'npx',
         args: ['-y', 'wp-mcp-gateway'],
-        env: {
-            WP_MCP_SITE: hostname,
-        },
+        env: {},
     };
     existing['mcpServers'] = mcpServers;
     // Ensure directory exists
@@ -132,10 +135,10 @@ async function writeMcpJson(hostname) {
     await fs.writeFile(mcpJsonPath, JSON.stringify(existing, null, 2), 'utf-8');
 }
 /**
- * Remove the wordpress-{hostname} entry from ~/.claude/mcp.json.
- * No-op if the file does not exist or the key is absent.
+ * Remove the wp-mcp-gateway entry from ~/.claude/mcp.json when the last
+ * site is removed. Also cleans up any legacy per-site entries.
  */
-async function removeFromMcpJson(hostname) {
+async function removeFromMcpJson(_hostname) {
     const mcpJsonPath = path.join(os.homedir(), '.claude', 'mcp.json');
     let existing = {};
     try {
@@ -152,7 +155,14 @@ async function removeFromMcpJson(hostname) {
         typeof existing['mcpServers'] === 'object' &&
         !Array.isArray(existing['mcpServers'])) {
         const mcpServers = existing['mcpServers'];
-        delete mcpServers[`wordpress-${hostname}`];
+        // Remove legacy per-site entry if it exists
+        delete mcpServers[`wordpress-${_hostname}`];
+        // Check if there are any remaining sites in the token store.
+        // If none remain, remove the unified "wordpress" entry too.
+        const remaining = await listSites();
+        if (remaining.length === 0) {
+            delete mcpServers['wordpress'];
+        }
         existing['mcpServers'] = mcpServers;
         await fs.writeFile(mcpJsonPath, JSON.stringify(existing, null, 2), 'utf-8');
     }
@@ -191,11 +201,17 @@ export async function runSetup(siteUrlArg) {
         // Step 2 — POST /wp-json/wp-mcp-gateway/v1/device/code
         // -----------------------------------------------------------------------
         const deviceCodeEndpoint = `${siteUrl}/wp-json/wp-mcp-gateway/v1/device/code`;
+        // Build a descriptive client label for the Connection Manager.
+        const clientType = process.env.CLAUDE_DESKTOP ? 'Claude Desktop'
+            : process.env.CLAUDE_COWORK ? 'Cowork'
+                : 'CLI';
+        const clientLabel = `${clientType} — ${os.hostname()}`;
         let deviceCodeData;
         try {
             const res = await fetch(deviceCodeEndpoint, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ client_label: clientLabel }),
             });
             if (res.status === 404) {
                 console.error('MCP Gateway plugin not found. Is it installed and activated?');

package/dist/tools/registerTools.js

@@ -27,7 +27,12 @@ function requireConfirmation(confirmations, action, key, input, confirmationToke
     return { confirmed: true };
 }
 export function registerTools(context) {
-    const { server, client, policy, confirmations, rateLimiter, sessionImageStore } = context;
+    const { server, siteManager, confirmations, rateLimiter, sessionImageStore } = context;
+    // Convenience: get the active site's services. Called inside each tool handler
+    // so it always returns the CURRENT site (respects wp_switch_site).
+    function site() {
+        return siteManager.getCurrent();
+    }
     async function runToolWithLimit(name, input, fn) {
         try {
             rateLimiter.consume();
@@ -40,14 +45,14 @@ export function registerTools(context) {
             return respond({ success: false, tool: name, error: serialized });
         }
     }
-    server.tool("wp_site_info", "Get site and capability metadata.", {}, async () => runToolWithLimit("wp_site_info", {}, async () => client.siteInfo()));
+    server.tool("wp_site_info", "Get site and capability metadata.", {}, async () => runToolWithLimit("wp_site_info", {}, async () => site().client.siteInfo()));
     server.tool("wp_getting_started", [
         "CALL THIS FIRST before any other WordPress tools at the start of a session.",
         "Returns site context, theme info, and the complete editorial workflow guide.",
         "Provides everything Claude needs to make correct decisions about content structure, shortcodes, images, SEO, and publishing.",
         "Do not proceed with content operations without calling this first.",
     ].join(" "), {}, async () => runToolWithLimit("wp_getting_started", {}, async () => {
-        const siteInfo = await client.siteInfo();
+        const siteInfo = await site().client.siteInfo();
         return {
             MANDATORY_RULES: [
                 "⛔ RULE 1 — MARKDOWN FILE FIRST, NO EXCEPTIONS: Before calling wp_create_draft you MUST: (a) call create_file to write a .md file containing the metadata header + full post/page content, (b) call present_files to show it to the user, (c) wait for the user to explicitly say something like 'looks good', 'create the draft', 'send it to WordPress', or 'ready'. The words 'go ahead', 'start writing', 'yes', or 'sure' do NOT count as draft approval — they mean begin writing the .md file.",
@@ -161,7 +166,7 @@ export function registerTools(context) {
             },
         };
     }));
-    server.tool("wp_list_content_types", "List content types allowed for this MCP server.", {}, async () => runToolWithLimit("wp_list_content_types", {}, async () => client.listContentTypes()));
+    server.tool("wp_list_content_types", "List content types allowed for this MCP server.", {}, async () => runToolWithLimit("wp_list_content_types", {}, async () => site().client.listContentTypes()));
     server.tool("wp_find_content", "Search and list content items across allowed content types.", {
         content_type: ContentTypeSchema.optional(),
         search: z.string().optional(),
@@ -174,12 +179,12 @@ export function registerTools(context) {
         solutions_only: z.boolean().optional(),
     }, async (rawInput) => runToolWithLimit("wp_find_content", rawInput, async () => {
         if (typeof rawInput.content_type === "string") {
-            policy.assertAllowedContentType(rawInput.content_type);
+            site().policy.assertAllowedContentType(rawInput.content_type);
         }
         if (typeof rawInput.author === "number") {
-            policy.assertAllowedAuthor(rawInput.author);
+            site().policy.assertAllowedAuthor(rawInput.author);
         }
-        const results = await client.findContent(rawInput);
+        const results = await site().client.findContent(rawInput);
         // Strip full content field — use wp_get_content to fetch content for a specific post
         return results.map((item) => {
             const { content: _content, ...rest } = item;
@@ -199,8 +204,8 @@ export function registerTools(context) {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
     }, async (rawInput) => runToolWithLimit("wp_get_content", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        return client.getContent(Number(rawInput.id));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        return site().client.getContent(Number(rawInput.id));
     }));
     server.tool("wp_create_draft", [
         "🛑 ARTIFACT-FIRST GATE: All content creation and editing happens in the conversation artifact first — NOT in WordPress.",
@@ -222,17 +227,17 @@ export function registerTools(context) {
         yoast_meta: z.record(z.unknown()).optional(),
     }, async (rawInput) => runToolWithLimit("wp_create_draft", rawInput, async () => {
         const contentType = String(rawInput.content_type);
-        policy.assertAllowedContentType(contentType);
+        site().policy.assertAllowedContentType(contentType);
         if (typeof rawInput.author === "number") {
-            policy.assertAllowedAuthor(rawInput.author);
+            site().policy.assertAllowedAuthor(rawInput.author);
         }
         if (rawInput.terms && typeof rawInput.terms === "object") {
             for (const taxonomy of Object.keys(rawInput.terms)) {
-                policy.assertAllowedTaxonomy(taxonomy);
+                site().policy.assertAllowedTaxonomy(taxonomy);
             }
         }
         if (rawInput.yoast_meta && typeof rawInput.yoast_meta === "object") {
-            policy.assertYoastMetaKeys(rawInput.yoast_meta);
+            site().policy.assertYoastMetaKeys(rawInput.yoast_meta);
         }
         const contentFormat = rawInput.content_format || "auto";
         const processedInput = { ...rawInput, status: "draft" };
@@ -242,7 +247,7 @@ export function registerTools(context) {
         if (typeof processedInput.excerpt === "string" && processedInput.excerpt) {
             processedInput.excerpt = toHtml(processedInput.excerpt, contentFormat);
         }
-        return client.createContent(processedInput);
+        return site().client.createContent(processedInput);
     }));
     server.tool("wp_update_content", "Patch an existing content item.", {
         id: z.number().int().positive(),
@@ -251,11 +256,11 @@ export function registerTools(context) {
         content_format: z.enum(["html", "markdown", "auto"]).optional(),
     }, async (rawInput) => runToolWithLimit("wp_update_content", rawInput, async () => {
         const contentType = String(rawInput.content_type);
-        policy.assertAllowedContentType(contentType);
+        site().policy.assertAllowedContentType(contentType);
         const patch = rawInput.patch;
-        policy.assertPatchFields(patch);
+        site().policy.assertPatchFields(patch);
         if (typeof patch.author === "number") {
-            policy.assertAllowedAuthor(patch.author);
+            site().policy.assertAllowedAuthor(patch.author);
         }
         const contentFormat = rawInput.content_format || "auto";
         if (typeof patch.content === "string") {
@@ -264,7 +269,7 @@ export function registerTools(context) {
         if (typeof patch.excerpt === "string" && patch.excerpt) {
             patch.excerpt = toHtml(patch.excerpt, contentFormat);
         }
-        const result = await client.updateContent(Number(rawInput.id), {
+        const result = await site().client.updateContent(Number(rawInput.id), {
             content_type: contentType,
             patch,
         });
@@ -289,13 +294,13 @@ export function registerTools(context) {
     }, async (rawInput) => runToolWithLimit("wp_publish_content", rawInput, async () => {
         const id = Number(rawInput.id);
         const contentType = String(rawInput.content_type);
-        policy.assertAllowedContentType(contentType);
+        site().policy.assertAllowedContentType(contentType);
         const key = `${contentType}:${id}:publish`;
         const gate = requireConfirmation(confirmations, "publish_content", key, rawInput, rawInput.confirmation_token);
         if (!gate.confirmed) {
             return gate.payload;
         }
-        return client.publishContent(id, {
+        return site().client.publishContent(id, {
             content_type: contentType,
             date: rawInput.date,
         });
@@ -307,13 +312,13 @@ export function registerTools(context) {
     }, async (rawInput) => runToolWithLimit("wp_trash_content", rawInput, async () => {
         const id = Number(rawInput.id);
         const contentType = String(rawInput.content_type);
-        policy.assertAllowedContentType(contentType);
+        site().policy.assertAllowedContentType(contentType);
         const key = `${contentType}:${id}:trash`;
         const gate = requireConfirmation(confirmations, "trash_content", key, rawInput, rawInput.confirmation_token);
         if (!gate.confirmed) {
             return gate.payload;
         }
-        return client.trashContent(id);
+        return site().client.trashContent(id);
     }));
     server.tool("wp_restore_content", "Restore content from trash (confirmation required).", {
         id: z.number().int().positive(),
@@ -322,20 +327,20 @@ export function registerTools(context) {
     }, async (rawInput) => runToolWithLimit("wp_restore_content", rawInput, async () => {
         const id = Number(rawInput.id);
         const contentType = String(rawInput.content_type);
-        policy.assertAllowedContentType(contentType);
+        site().policy.assertAllowedContentType(contentType);
         const key = `${contentType}:${id}:restore`;
         const gate = requireConfirmation(confirmations, "restore_content", key, rawInput, rawInput.confirmation_token);
         if (!gate.confirmed) {
             return gate.payload;
         }
-        return client.restoreContent(id);
+        return site().client.restoreContent(id);
     }));
     server.tool("wp_list_revisions", "List revisions for a content item.", {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
     }, async (rawInput) => runToolWithLimit("wp_list_revisions", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        return client.listRevisions(Number(rawInput.id));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        return site().client.listRevisions(Number(rawInput.id));
     }));
     server.tool("wp_restore_revision", "Restore a specific revision (confirmation required).", {
         id: z.number().int().positive(),
@@ -346,23 +351,23 @@ export function registerTools(context) {
         const id = Number(rawInput.id);
         const revisionId = Number(rawInput.revision_id);
         const contentType = String(rawInput.content_type);
-        policy.assertAllowedContentType(contentType);
+        site().policy.assertAllowedContentType(contentType);
         const key = `${contentType}:${id}:revision:${revisionId}`;
         const gate = requireConfirmation(confirmations, "restore_revision", key, rawInput, rawInput.confirmation_token);
         if (!gate.confirmed) {
             return gate.payload;
         }
-        return client.restoreRevision(id, revisionId);
+        return site().client.restoreRevision(id, revisionId);
     }));
-    server.tool("wp_list_authors", "List allowlisted authors.", {}, async () => runToolWithLimit("wp_list_authors", {}, async () => client.listAuthors()));
+    server.tool("wp_list_authors", "List allowlisted authors.", {}, async () => runToolWithLimit("wp_list_authors", {}, async () => site().client.listAuthors()));
     server.tool("wp_assign_author", "Assign an allowlisted author to content.", {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
         author_id: z.number().int().positive(),
     }, async (rawInput) => runToolWithLimit("wp_assign_author", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        policy.assertAllowedAuthor(Number(rawInput.author_id));
-        return client.assignAuthor(Number(rawInput.id), Number(rawInput.author_id));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        site().policy.assertAllowedAuthor(Number(rawInput.author_id));
+        return site().client.assignAuthor(Number(rawInput.id), Number(rawInput.author_id));
     }));
     server.tool("wp_list_terms", "List terms for an allowlisted taxonomy.", {
         taxonomy: z.string().min(1),
@@ -372,8 +377,8 @@ export function registerTools(context) {
         per_page: z.number().int().positive().max(100).optional(),
     }, async (rawInput) => runToolWithLimit("wp_list_terms", rawInput, async () => {
         const taxonomy = String(rawInput.taxonomy);
-        policy.assertAllowedTaxonomy(taxonomy);
-        return client.listTerms(taxonomy, rawInput);
+        site().policy.assertAllowedTaxonomy(taxonomy);
+        return site().client.listTerms(taxonomy, rawInput);
     }));
     server.tool("wp_create_term", "Create a term in an allowlisted taxonomy.", {
         taxonomy: z.string().min(1),
@@ -383,20 +388,20 @@ export function registerTools(context) {
         description: z.string().optional(),
     }, async (rawInput) => runToolWithLimit("wp_create_term", rawInput, async () => {
         const taxonomy = String(rawInput.taxonomy);
-        policy.assertAllowedTaxonomy(taxonomy);
-        return client.createTerm(taxonomy, rawInput);
+        site().policy.assertAllowedTaxonomy(taxonomy);
+        return site().client.createTerm(taxonomy, rawInput);
     }));
     server.tool("wp_assign_terms", "Assign term IDs to a content item.", {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
         terms: z.record(z.array(z.number().int().positive())),
     }, async (rawInput) => runToolWithLimit("wp_assign_terms", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
         const terms = rawInput.terms;
         for (const taxonomy of Object.keys(terms)) {
-            policy.assertAllowedTaxonomy(taxonomy);
+            site().policy.assertAllowedTaxonomy(taxonomy);
         }
-        return client.assignTerms(Number(rawInput.id), {
+        return site().client.assignTerms(Number(rawInput.id), {
             content_type: rawInput.content_type,
             terms,
         });
@@ -406,21 +411,21 @@ export function registerTools(context) {
         page: z.number().int().positive().optional(),
         per_page: z.number().int().positive().max(100).optional(),
         mime_type: z.string().optional(),
-    }, async (rawInput) => runToolWithLimit("wp_search_media", rawInput, async () => client.searchMedia(rawInput)));
+    }, async (rawInput) => runToolWithLimit("wp_search_media", rawInput, async () => site().client.searchMedia(rawInput)));
     server.tool("wp_update_media", "Update media metadata.", {
         id: z.number().int().positive(),
         alt_text: z.string().optional(),
         caption: z.string().optional(),
         description: z.string().optional(),
         title: z.string().optional(),
-    }, async (rawInput) => runToolWithLimit("wp_update_media", rawInput, async () => client.updateMedia(Number(rawInput.id), rawInput)));
+    }, async (rawInput) => runToolWithLimit("wp_update_media", rawInput, async () => site().client.updateMedia(Number(rawInput.id), rawInput)));
     server.tool("wp_set_featured_image", "Set or remove a featured image on content.", {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
         media_id: z.number().int().positive().nullable(),
     }, async (rawInput) => runToolWithLimit("wp_set_featured_image", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        return client.setFeaturedImage(Number(rawInput.id), rawInput.media_id);
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        return site().client.setFeaturedImage(Number(rawInput.id), rawInput.media_id);
     }));
     server.tool("wp_insert_inline_image", "Insert an inline image into content in block-aware mode with HTML fallback.", {
         id: z.number().int().positive(),
@@ -434,8 +439,8 @@ export function registerTools(context) {
         caption: z.string().optional(),
         alt_text: z.string().optional(),
     }, async (rawInput) => runToolWithLimit("wp_insert_inline_image", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        const result = await client.insertInlineImage(Number(rawInput.id), rawInput);
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        const result = await site().client.insertInlineImage(Number(rawInput.id), rawInput);
         if (result && typeof result === "object") {
             const { content: _c, ...slim } = result;
             return slim;
@@ -451,11 +456,11 @@ export function registerTools(context) {
         alt_text: z.string().optional(),
         caption: z.string().optional(),
     }, async (rawInput) => runToolWithLimit("wp_replace_inline_image", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
         if (!rawInput.match_media_id && !rawInput.match_src_substring) {
             throw new ToolError("INLINE_MATCH_REQUIRED", "Either match_media_id or match_src_substring must be provided");
         }
-        const result = await client.replaceInlineImage(Number(rawInput.id), rawInput);
+        const result = await site().client.replaceInlineImage(Number(rawInput.id), rawInput);
         if (result && typeof result === "object") {
             const { content: _c, ...slim } = result;
             return slim;
@@ -468,11 +473,11 @@ export function registerTools(context) {
         match_media_id: z.number().int().positive().optional(),
         match_src_substring: z.string().optional(),
     }, async (rawInput) => runToolWithLimit("wp_remove_inline_image", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
         if (!rawInput.match_media_id && !rawInput.match_src_substring) {
             throw new ToolError("INLINE_MATCH_REQUIRED", "Either match_media_id or match_src_substring must be provided");
         }
-        const result = await client.removeInlineImage(Number(rawInput.id), rawInput);
+        const result = await site().client.removeInlineImage(Number(rawInput.id), rawInput);
         if (result && typeof result === "object") {
             const { content: _c, ...slim } = result;
             return slim;
@@ -488,9 +493,9 @@ export function registerTools(context) {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
     }, async (rawInput) => runToolWithLimit("wp_get_yoast_analysis", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        policy.assertYoastPath("/yoast/analysis");
-        return client.getYoastAnalysis(Number(rawInput.id));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        site().policy.assertYoastPath("/yoast/analysis");
+        return site().client.getYoastAnalysis(Number(rawInput.id));
     }));
     server.tool("wp_update_yoast_metadata", [
         "Update allowlisted Yoast metadata for content.",
@@ -505,10 +510,10 @@ export function registerTools(context) {
         content_type: ContentTypeSchema,
         yoast_meta: z.record(z.unknown()),
     }, async (rawInput) => runToolWithLimit("wp_update_yoast_metadata", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        policy.assertYoastPath("/yoast/metadata");
-        policy.assertYoastMetaKeys(rawInput.yoast_meta);
-        return client.updateYoastMetadata(Number(rawInput.id), {
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        site().policy.assertYoastPath("/yoast/metadata");
+        site().policy.assertYoastMetaKeys(rawInput.yoast_meta);
+        return site().client.updateYoastMetadata(Number(rawInput.id), {
             content_type: rawInput.content_type,
             yoast_meta: rawInput.yoast_meta,
         });
@@ -517,21 +522,21 @@ export function registerTools(context) {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
     }, async (rawInput) => runToolWithLimit("wp_get_yoast_head_preview", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        policy.assertYoastPath("/yoast/head");
-        return client.getYoastHeadPreview(Number(rawInput.id));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        site().policy.assertYoastPath("/yoast/head");
+        return site().client.getYoastHeadPreview(Number(rawInput.id));
     }));
     server.tool("wp_get_preview_link", "Return both WordPress preview and signed shareable preview URLs.", {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
     }, async (rawInput) => runToolWithLimit("wp_get_preview_link", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        return client.getPreviewLink(Number(rawInput.id));
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        return site().client.getPreviewLink(Number(rawInput.id));
     }));
     server.tool("wp_get_media", "Get a single media item by ID with full metadata (dimensions, URLs, alt text).", {
         id: z.number().int().positive(),
     }, async (rawInput) => runToolWithLimit("wp_get_media", rawInput, async () => {
-        return client.getMedia(Number(rawInput.id));
+        return site().client.getMedia(Number(rawInput.id));
     }));
     server.tool("wp_upload_media_from_url", "Upload media to WordPress by fetching from a URL (server-side download, no base64 needed).", {
         url: z.string().url(),
@@ -540,7 +545,7 @@ export function registerTools(context) {
         caption: z.string().optional(),
         description: z.string().optional(),
     }, async (rawInput) => runToolWithLimit("wp_upload_media_from_url", rawInput, async () => {
-        return client.uploadMediaFromUrl(rawInput);
+        return site().client.uploadMediaFromUrl(rawInput);
     }));
     // ─── Local Filesystem Image Tools ────────────────────────────────────────
     server.tool("wp_find_media_file", [
@@ -601,7 +606,7 @@ export function registerTools(context) {
         const { base64, filename, mimeType } = sessionImageStore.readImage(expanded);
         // Policy check using the decoded byte length
         const sizeBytes = Buffer.from(base64, "base64").byteLength;
-        policy.assertMediaPolicy(mimeType, sizeBytes, rawInput.alt_text);
+        site().policy.assertMediaPolicy(mimeType, sizeBytes, rawInput.alt_text);
         const meta = {};
         if (rawInput.alt_text)
             meta.alt_text = rawInput.alt_text;
@@ -611,15 +616,15 @@ export function registerTools(context) {
             meta.description = rawInput.description;
         if (rawInput.title)
             meta.title = rawInput.title;
-        return client.uploadMediaFromPath(expanded, base64, filename, mimeType, meta);
+        return site().client.uploadMediaFromPath(expanded, base64, filename, mimeType, meta);
     }));
     server.tool("wp_clone_content", "Clone an existing post or page as a new draft. Copies content, taxonomies, featured image, and Yoast meta.", {
         id: z.number().int().positive(),
         content_type: ContentTypeSchema,
         title: z.string().optional(),
     }, async (rawInput) => runToolWithLimit("wp_clone_content", rawInput, async () => {
-        policy.assertAllowedContentType(String(rawInput.content_type));
-        return client.cloneContent(Number(rawInput.id), rawInput);
+        site().policy.assertAllowedContentType(String(rawInput.content_type));
+        return site().client.cloneContent(Number(rawInput.id), rawInput);
     }));
     // ── Image Providers ───────────────────────────────────────────────────
     server.tool("wp_generate_image", "Generate an image using AI (Google Imagen or OpenAI) and save it to the WordPress media library. The image is generated server-side — no image data passes through the conversation. Returns the media ID and URL so you can show the preview inline and then use wp_set_featured_image or wp_insert_inline_image. TIP: Help the user refine the prompt before generating. Show the result URL inline as a markdown image for preview.", {
@@ -627,20 +632,57 @@ export function registerTools(context) {
         provider: z.enum(["google_imagen", "openai"]).optional().describe("Provider. Defaults to first enabled."),
         aspect_ratio: z.enum(["1:1", "16:9", "9:16", "4:3", "3:4"]).optional().describe("Aspect ratio. Default: 16:9."),
         quality: z.enum(["low", "medium", "high"]).optional().describe("Quality tier (affects OpenAI cost). Default: medium."),
-    }, async (input) => runToolWithLimit("wp_generate_image", input, async () => client.generateImage(input)));
+    }, async (input) => runToolWithLimit("wp_generate_image", input, async () => site().client.generateImage(input)));
     server.tool("wp_search_stock_photos", "Search for free stock photos from Unsplash or Pexels. Returns preview URLs you can display inline as markdown images for the user to choose from. Once they pick one, call wp_import_stock_photo.", {
         query: z.string().describe("Search terms."),
         provider: z.enum(["unsplash", "pexels"]).optional().describe("Stock provider. Defaults to first enabled."),
         orientation: z.enum(["landscape", "portrait", "square"]).optional().describe("Orientation filter."),
         per_page: z.number().int().min(1).max(10).optional().describe("Results count (1-10). Default: 5."),
-    }, async (input) => runToolWithLimit("wp_search_stock_photos", input, async () => client.searchStockPhotos(input)));
+    }, async (input) => runToolWithLimit("wp_search_stock_photos", input, async () => site().client.searchStockPhotos(input)));
     server.tool("wp_import_stock_photo", "Import a stock photo into the WordPress media library. Use provider + provider_id from wp_search_stock_photos results. Handles attribution automatically.", {
         provider: z.enum(["unsplash", "pexels"]).describe("Stock provider."),
         provider_id: z.string().describe("Photo ID from search results."),
         alt_text: z.string().optional().describe("Override alt text."),
-    }, async (input) => runToolWithLimit("wp_import_stock_photo", input, async () => client.importStockPhoto(input)));
-    server.tool("wp_list_image_providers", "List which image generation and stock photo providers are configured and enabled on this site.", {}, async () => runToolWithLimit("wp_list_image_providers", {}, async () => client.listImageProviders()));
+    }, async (input) => runToolWithLimit("wp_import_stock_photo", input, async () => site().client.importStockPhoto(input)));
+    server.tool("wp_list_image_providers", "List which image generation and stock photo providers are configured and enabled on this site.", {}, async () => runToolWithLimit("wp_list_image_providers", {}, async () => site().client.listImageProviders()));
     server.tool("wp_confirm_image", "Confirm a generated image after user approval. Prevents auto-cleanup. Call this when the user says they want to keep/use a generated image.", {
         media_id: z.number().int().describe("Media ID of the generated image."),
-    }, async (input) => runToolWithLimit("wp_confirm_image", input, async () => client.confirmImage(Number(input.media_id))));
+    }, async (input) => runToolWithLimit("wp_confirm_image", input, async () => site().client.confirmImage(Number(input.media_id))));
+    // ── Upload Portal ───────────────────────────────────────────────────
+    server.tool("wp_create_upload_session", "Create a temporary upload portal link for the user to drag-and-drop files " +
+        "into the WordPress media library. The link expires in 15 minutes. Present " +
+        "the URL to the user as a clickable link. This works for ALL clients. " +
+        "For quick single-file uploads on Claude Desktop/Cowork, wp_upload_media_from_path " +
+        "may be simpler. After the user uploads files, call wp_get_upload_session.", {
+        ip_binding: z.boolean().optional().describe("Lock session to creator's IP for extra security"),
+    }, async (input) => runToolWithLimit("wp_create_upload_session", input, async () => site().client.createUploadSession({ ip_binding: input.ip_binding })));
+    server.tool("wp_get_upload_session", "Check the status of an upload session and retrieve uploaded file details " +
+        "(media IDs, URLs, filenames). Call this after the user confirms they've " +
+        "finished uploading via the portal.", {
+        session_id: z.string().describe("Session ID from wp_create_upload_session"),
+    }, async (input) => runToolWithLimit("wp_get_upload_session", input, async () => site().client.getUploadSession(String(input.session_id))));
+    // ── Multi-Site Management ─────────────────────────────────────────────
+    server.tool("wp_list_sites", "List all connected WordPress sites and indicate which is currently active. Use wp_switch_site to change the active site.", {}, async () => runToolWithLimit("wp_list_sites", {}, async () => {
+        const sites = siteManager.listSites();
+        return {
+            sites,
+            multi_site_enabled: siteManager.isMultiSite(),
+            hint: siteManager.isMultiSite()
+                ? "Use wp_switch_site with a hostname to change the active site."
+                : "Only one site is connected. Connect more sites with: npx wp-mcp-gateway --setup <site-url>",
+        };
+    }));
+    server.tool("wp_switch_site", "Switch the active WordPress site. All subsequent tool calls will target the new site. Use wp_list_sites to see available sites.", {
+        hostname: z.string().min(1).describe("Hostname of the site to switch to (e.g. 'xmpro.com')"),
+    }, async (input) => runToolWithLimit("wp_switch_site", input, async () => {
+        const hostname = String(input.hostname);
+        siteManager.switchTo(hostname);
+        const { config } = siteManager.getCurrent();
+        return {
+            switched: true,
+            active_site: hostname,
+            site_name: config.siteName || hostname,
+            message: `Switched to ${config.siteName || hostname}. All WordPress tools now target this site.`,
+        };
+    }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wp-mcp-gateway",
-  "version": "0.1.26",
+  "version": "0.1.30",
   "type": "module",
   "description": "MCP server for managing WordPress content from Claude Desktop — create posts, upload images, manage SEO, and publish without ever opening WordPress.",
   "main": "dist/index.js",