pressbridge 1.1.0__tar.gz

pressbridge-1.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Paul Negrea
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pressbridge-1.1.0/PKG-INFO

@@ -0,0 +1,110 @@
+Metadata-Version: 2.4
+Name: pressbridge
+Version: 1.1.0
+Summary: Give Claude safe, audited access to your WordPress sites over MCP
+License-Expression: MIT
+Project-URL: Homepage, https://pressbridgesupport.github.io/pressbridge
+Project-URL: Source, https://github.com/pressbridgesupport/pressbridge
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: mcp<3,>=2.2
+Requires-Dist: PyYAML>=6
+Requires-Dist: uvicorn>=0.30
+Requires-Dist: starlette>=0.40
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: httpx>=0.27; extra == "dev"
+Dynamic: license-file
+
+# PressBridge Free
+
+<!-- mcp-name: io.github.pressbridgesupport/pressbridge -->
+
+**Let Claude look inside your WordPress site safely: read-only, sandboxed, secrets hidden.**
+
+[Website](https://pressbridgesupport.github.io/pressbridge) · [Demo video](https://youtu.be/hucKMlugERw) · [Get Pro](https://pressbridgesupport.github.io/pressbridge/#pricing) · [User guide](GUIDE.md) · [Security](SECURITY.md)
+
+```
+you     On mysite, where is the footer phone number set? And show me the DB password.
+
+claude  search "0744" in wp-content/themes  →  footer.php:41
+        read_file wp-config.php             →  refused: blocked by deny rule 'wp-config*'
+
+        The number is in wp-content/themes/mysite/footer.php, line 41.
+        I can't read wp-config.php: PressBridge hides it so passwords never reach me.
+```
+
+PressBridge is an MCP server that gives Claude (Claude Code, Claude Desktop, any MCP
+client) controlled access to a WordPress site. The Free edition is read-only and made
+for one site: perfect for debugging, audits and "where is this text coming from?".
+
+- Read, list and search theme and plugin files
+- `wp-config.php`, `.env`, SQL dumps, keys and `.git` are invisible
+- Nothing outside the site folder, symlink tricks included
+- Read-only WP-CLI: versions, plugin and theme lists, checksums, cron, users
+- `site_overview`: version and pending updates in one call
+- Includes the **wp-care-report** skill: a client-ready health and security report
+
+## Install (5 minutes, nothing exposed to the internet)
+
+On the server:
+
+```bash
+sudo apt install python3-venv php-cli php-mysql
+curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
+sudo install wp-cli.phar /usr/local/bin/wp
+python3 -m venv ~/pressbridge-venv
+~/pressbridge-venv/bin/pip install ./pressbridge
+mkdir -p ~/.pressbridge
+cat > ~/.pressbridge/config.yaml <<EOF
+data_dir: $HOME/.pressbridge/data
+sites:
+  mysite:
+    root: /var/www/mysite/public_html
+EOF
+~/pressbridge-venv/bin/pressbridge check --config ~/.pressbridge/config.yaml
+```
+
+Run it as the user that owns the site files (or one that can read them).
+
+On your computer, Claude Code:
+
+```bash
+claude mcp add pressbridge -- ssh you@server \
+  /home/you/pressbridge-venv/bin/pressbridge serve --config /home/you/.pressbridge/config.yaml
+```
+
+Claude Desktop (`claude_desktop_config.json`, Settings → Developer → Edit Config):
+
+```json
+{
+  "mcpServers": {
+    "pressbridge": {
+      "command": "ssh",
+      "args": ["-o", "BatchMode=yes", "you@server",
+               "/home/you/pressbridge-venv/bin/pressbridge", "serve",
+               "--config", "/home/you/.pressbridge/config.yaml"]
+    }
+  }
+}
+```
+
+Then ask Claude: *"Give me a health overview of mysite"* or *"Where in the theme is the
+footer phone number set?"*
+
+The full user guide, with every command, config option and tool, is in
+[GUIDE.md](GUIDE.md) (features marked **Pro** aren't in this edition).
+
+## Want Claude to fix things too?
+
+**PressBridge Pro** adds editing with automatic backups and one-call undo, PHP syntax
+checks before saving, plugin/theme/core updates, unlimited sites, a remote HTTPS server
+with Docker and automatic certificates, the audit log, and skills for safe edits and
+safe updates.
+
+**→ https://pressbridgesupport.github.io/pressbridge**
+
+## License
+
+MIT. See LICENSE.

pressbridge-1.1.0/README.md

@@ -0,0 +1,91 @@
+# PressBridge Free
+
+<!-- mcp-name: io.github.pressbridgesupport/pressbridge -->
+
+**Let Claude look inside your WordPress site safely: read-only, sandboxed, secrets hidden.**
+
+[Website](https://pressbridgesupport.github.io/pressbridge) · [Demo video](https://youtu.be/hucKMlugERw) · [Get Pro](https://pressbridgesupport.github.io/pressbridge/#pricing) · [User guide](GUIDE.md) · [Security](SECURITY.md)
+
+```
+you     On mysite, where is the footer phone number set? And show me the DB password.
+
+claude  search "0744" in wp-content/themes  →  footer.php:41
+        read_file wp-config.php             →  refused: blocked by deny rule 'wp-config*'
+
+        The number is in wp-content/themes/mysite/footer.php, line 41.
+        I can't read wp-config.php: PressBridge hides it so passwords never reach me.
+```
+
+PressBridge is an MCP server that gives Claude (Claude Code, Claude Desktop, any MCP
+client) controlled access to a WordPress site. The Free edition is read-only and made
+for one site: perfect for debugging, audits and "where is this text coming from?".
+
+- Read, list and search theme and plugin files
+- `wp-config.php`, `.env`, SQL dumps, keys and `.git` are invisible
+- Nothing outside the site folder, symlink tricks included
+- Read-only WP-CLI: versions, plugin and theme lists, checksums, cron, users
+- `site_overview`: version and pending updates in one call
+- Includes the **wp-care-report** skill: a client-ready health and security report
+
+## Install (5 minutes, nothing exposed to the internet)
+
+On the server:
+
+```bash
+sudo apt install python3-venv php-cli php-mysql
+curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
+sudo install wp-cli.phar /usr/local/bin/wp
+python3 -m venv ~/pressbridge-venv
+~/pressbridge-venv/bin/pip install ./pressbridge
+mkdir -p ~/.pressbridge
+cat > ~/.pressbridge/config.yaml <<EOF
+data_dir: $HOME/.pressbridge/data
+sites:
+  mysite:
+    root: /var/www/mysite/public_html
+EOF
+~/pressbridge-venv/bin/pressbridge check --config ~/.pressbridge/config.yaml
+```
+
+Run it as the user that owns the site files (or one that can read them).
+
+On your computer, Claude Code:
+
+```bash
+claude mcp add pressbridge -- ssh you@server \
+  /home/you/pressbridge-venv/bin/pressbridge serve --config /home/you/.pressbridge/config.yaml
+```
+
+Claude Desktop (`claude_desktop_config.json`, Settings → Developer → Edit Config):
+
+```json
+{
+  "mcpServers": {
+    "pressbridge": {
+      "command": "ssh",
+      "args": ["-o", "BatchMode=yes", "you@server",
+               "/home/you/pressbridge-venv/bin/pressbridge", "serve",
+               "--config", "/home/you/.pressbridge/config.yaml"]
+    }
+  }
+}
+```
+
+Then ask Claude: *"Give me a health overview of mysite"* or *"Where in the theme is the
+footer phone number set?"*
+
+The full user guide, with every command, config option and tool, is in
+[GUIDE.md](GUIDE.md) (features marked **Pro** aren't in this edition).
+
+## Want Claude to fix things too?
+
+**PressBridge Pro** adds editing with automatic backups and one-call undo, PHP syntax
+checks before saving, plugin/theme/core updates, unlimited sites, a remote HTTPS server
+with Docker and automatic certificates, the audit log, and skills for safe edits and
+safe updates.
+
+**→ https://pressbridgesupport.github.io/pressbridge**
+
+## License
+
+MIT. See LICENSE.

pressbridge-1.1.0/pyproject.toml

@@ -0,0 +1,34 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pressbridge"
+version = "1.1.0"
+license = "MIT"
+description = "Give Claude safe, audited access to your WordPress sites over MCP"
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = [
+    "mcp>=2.2,<3",
+    "PyYAML>=6",
+    "uvicorn>=0.30",
+    "starlette>=0.40",
+]
+
+[project.urls]
+Homepage = "https://pressbridgesupport.github.io/pressbridge"
+Source = "https://github.com/pressbridgesupport/pressbridge"
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "httpx>=0.27"]
+
+[project.scripts]
+pressbridge = "pressbridge.__main__:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]

pressbridge-1.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

pressbridge-1.1.0/src/pressbridge/__init__.py

@@ -0,0 +1,3 @@
+"""PressBridge: give Claude safe, audited access to WordPress sites."""
+
+__version__ = "1.1.0"

pressbridge-1.1.0/src/pressbridge/__main__.py

@@ -0,0 +1,166 @@
+"""Command line entry point.
+
+    pressbridge serve --config config.yaml              # stdio (Claude Desktop / Claude Code, local)
+    pressbridge serve --config config.yaml --http       # HTTPS-ready HTTP server (Pro)
+    pressbridge check --config config.yaml              # validate config and WP-CLI access
+    pressbridge token                                   # print a new random token
+    pressbridge watch run|daemon|status|report|test-alert   # security watch (Agent)
+"""
+from __future__ import annotations
+
+import argparse
+import os
+import secrets
+import shutil
+import sys
+
+from . import __version__
+from .config import ConfigError, load_config
+from .edition import EDITION
+
+
+def _cmd_check(cfg) -> int:
+    from . import wpcli
+
+    ok = True
+    print(f"PressBridge {__version__} ({EDITION})")
+    print(f"Data dir: {cfg.data_dir}")
+    if not shutil.which(cfg.wp_bin):
+        print(f"  ! WP-CLI '{cfg.wp_bin}' not found on PATH")
+        ok = False
+    for s in cfg.sites.values():
+        print(f"- {s.name}: root={s.root} mode={s.mode} wp={s.wp_path or 'none'} profile={s.wp_profile}")
+        if s.wp_path and shutil.which(cfg.wp_bin):
+            r = wpcli.run(cfg, s, ["core", "version"])
+            if r["exit_code"] == 0:
+                print(f"    WordPress {r['stdout'].strip()}")
+            else:
+                ok = False
+                print(f"    ! WP-CLI failed: {r['stderr'].strip()[:300]}")
+    print("OK" if ok else "Problems found")
+    return 0 if ok else 1
+
+
+def _cmd_watch(cfg, a) -> int:
+    if EDITION != "agent":
+        print("PressBridge Watch is part of PressBridge Agent (https://pressbridgesupport.github.io/pressbridge).", file=sys.stderr)
+        return 2
+    from .watch import parse_settings
+    from .watch import runner
+
+    try:
+        settings = parse_settings(cfg.watch)
+    except ConfigError as e:
+        print(f"Config error: {e}", file=sys.stderr)
+        return 2
+
+    if a.watch_cmd == "status":
+        print(runner.status(cfg, settings))
+        return 0
+    if a.watch_cmd == "report":
+        p = runner.watch_dir(cfg) / "reports" / "latest.txt"
+        print(p.read_text() if p.exists() else "No report yet. Run: pressbridge watch run")
+        return 0
+    if a.watch_cmd == "test-alert":
+        errors = runner.test_alert(settings)
+        for e in errors:
+            print(f"! {e}", file=sys.stderr)
+        if not errors:
+            print("Test alert sent.")
+        return 1 if errors else 0
+    if a.watch_cmd == "daemon":
+        try:
+            runner.daemon(cfg, settings, run_now=a.now, log=lambda m: print(m, flush=True))
+        except KeyboardInterrupt:
+            pass
+        return 0
+
+    try:
+        result = runner.run_once(cfg, settings, sites=a.site, notify=not a.no_notify,
+                                 use_claude=not a.no_claude, force_notify=a.notify_always,
+                                 save=not a.dry_run)
+    except (RuntimeError, ValueError) as e:
+        print(f"Error: {e}", file=sys.stderr)
+        return 3
+    print(result.report_path.read_text() if result.report_path else "")
+    if result.notified:
+        print("Alert sent.")
+    for e in result.delivery_errors:
+        print(f"! Alert delivery failed: {e}", file=sys.stderr)
+    return result.exit_code
+
+
+def main(argv: list[str] | None = None) -> int:
+    p = argparse.ArgumentParser(prog="pressbridge", description="Safe WordPress access for Claude")
+    p.add_argument("--version", action="version", version=f"pressbridge {__version__} ({EDITION})")
+    sub = p.add_subparsers(dest="cmd", required=True)
+
+    serve = sub.add_parser("serve", help="Run the MCP server")
+    serve.add_argument("--config", default=os.environ.get("PRESSBRIDGE_CONFIG", "/config/config.yaml"))
+    serve.add_argument("--http", action="store_true", help="Serve over HTTP instead of stdio (Pro)")
+    serve.add_argument("--port", type=int, default=int(os.environ.get("PRESSBRIDGE_PORT", "8765")))
+    serve.add_argument("--host", default=os.environ.get("PRESSBRIDGE_HOST", "0.0.0.0"),
+                       help="Interface to bind in HTTP mode (use 127.0.0.1 behind a proxy on the host network)")
+
+    check = sub.add_parser("check", help="Validate the config and WP-CLI access")
+    check.add_argument("--config", default=os.environ.get("PRESSBRIDGE_CONFIG", "/config/config.yaml"))
+
+    sub.add_parser("token", help="Generate a random bearer token")
+
+    watch = sub.add_parser("watch", help="Security watch: nightly checks and alerts (Agent edition)")
+    watch.add_argument("--config", default=os.environ.get("PRESSBRIDGE_CONFIG", "/config/config.yaml"))
+    wsub = watch.add_subparsers(dest="watch_cmd", required=True)
+    w_run = wsub.add_parser("run", help="Check all sites once now")
+    w_run.add_argument("--site", action="append", help="Only this site (repeatable)")
+    w_run.add_argument("--no-notify", action="store_true", help="Don't send alerts")
+    w_run.add_argument("--no-claude", action="store_true", help="Skip Claude's review")
+    w_run.add_argument("--notify-always", action="store_true", help="Send the report even if all is clear")
+    w_run.add_argument("--dry-run", action="store_true", help="Don't save the new baseline (compare only)")
+    w_daemon = wsub.add_parser("daemon", help="Run on the schedule, forever (for Docker or systemd)")
+    w_daemon.add_argument("--now", action="store_true", help="Also run once at start")
+    wsub.add_parser("status", help="Show the last run, the next run and each site's baseline")
+    wsub.add_parser("test-alert", help="Send a test alert to every configured channel")
+    wsub.add_parser("report", help="Print the latest report")
+
+    a = p.parse_args(argv)
+    if a.cmd == "token":
+        print(secrets.token_hex(32))
+        return 0
+
+    try:
+        cfg = load_config(a.config)
+    except ConfigError as e:
+        print(f"Config error: {e}", file=sys.stderr)
+        return 2
+
+    if a.cmd == "check":
+        return _cmd_check(cfg)
+
+    if a.cmd == "watch":
+        return _cmd_watch(cfg, a)
+
+    if a.http:
+        if EDITION == "free":
+            print("HTTP mode is a PressBridge Pro feature. Free runs over stdio.", file=sys.stderr)
+            return 2
+        import uvicorn
+
+        from .server import build_http_app
+
+        try:
+            app = build_http_app(cfg)
+        except ConfigError as e:
+            print(f"Config error: {e}", file=sys.stderr)
+            return 2
+        uvicorn.run(app, host=a.host, port=a.port, log_level="info", proxy_headers=True,
+                    forwarded_allow_ips="*")
+        return 0
+
+    from .server import build_server
+
+    build_server(cfg).run("stdio")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

pressbridge-1.1.0/src/pressbridge/audit.py

@@ -0,0 +1,58 @@
+"""Append-only JSON Lines audit log of every tool call."""
+from __future__ import annotations
+
+import json
+import threading
+from datetime import datetime, timezone
+from pathlib import Path
+
+_lock = threading.Lock()
+_MAX_FIELD = 500
+
+
+def _shorten(value):
+    if isinstance(value, str) and len(value) > _MAX_FIELD:
+        return value[:_MAX_FIELD] + f"... [{len(value)} chars]"
+    if isinstance(value, list):
+        return [_shorten(v) for v in value]
+    if isinstance(value, dict):
+        return {k: _shorten(v) for k, v in value.items()}
+    return value
+
+
+def record(log_path: Path, *, tool: str, site: str | None, args: dict, ok: bool, error: str | None = None,
+           result_summary: dict | None = None) -> None:
+    entry = {
+        "ts": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+        "tool": tool,
+        "site": site,
+        "args": _shorten(args),
+        "ok": ok,
+    }
+    if error:
+        entry["error"] = error[:_MAX_FIELD]
+    if result_summary:
+        entry["result"] = result_summary
+    line = json.dumps(entry, ensure_ascii=False)
+    with _lock:
+        log_path.parent.mkdir(parents=True, exist_ok=True)
+        with log_path.open("a", encoding="utf-8") as f:
+            f.write(line + "\n")
+
+
+def tail(log_path: Path, limit: int = 50, site: str | None = None) -> list[dict]:
+    if not log_path.exists():
+        return []
+    lines = log_path.read_text(encoding="utf-8").splitlines()
+    out: list[dict] = []
+    for line in reversed(lines):
+        try:
+            item = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if site and item.get("site") != site:
+            continue
+        out.append(item)
+        if len(out) >= limit:
+            break
+    return out