AlphaBridge MCP – WordPress MCP Server: Connect Claude, ChatGPT and AI Agents

Changelog

4.10.0

• Page-builder texts and search and replace in the free plugin, 82 tools in all. wp_update_builder_element and wp_search_replace came with AlphaBridge MCP Pro only; they work as they did there, with the same checks, and their messages come in the plugin’s languages.
• wp_update_builder_element changes the text, link or image of one element on pages of the WordPress blocks, GenerateBlocks, Kadence Blocks, Spectra, Stackable, Pagelayer, Elementor, Beaver Builder, SiteOrigin Page Builder, SeedProd, WPBakery Page Builder, Divi 4, Avada, Flatsome and Enfold. It previews by default; applied, it records an undo point first, saves through the builder and reads the page back.
• wp_search_replace replaces across posts, postmeta, options and terms, safe for serialized and JSON values, with a dry run per table first. On page-builder pages (scope text) only the fields the builder’s writer may change are touched, and matches in locked places are counted in locked_matches; scope raw replaces the stored data as text.
• New: post_ids and expected_count. post_ids keeps a replace to the posts it names; with expected_count, apply=true writes only when the call still finds as many matching rows as its dry run did.
• New: undo for option rows. The option rows a replace changes get an undo point of their own (options_undo_token), recorded before the first of them is written.
• Undo for page-builder pages. wp_undo puts every stored copy of a page back byte for byte and leaves a page changed since as it is, unless force=true.
• Protected options (the site address, active plugins and theme, roles and registration, the mail server, keys, AlphaBridge’s own settings) stay out of every replace.

4.9.0

• 22 more tools in the free plugin, 80 in all, undo included. Until now they came with AlphaBridge MCP Pro only; they work as they did there, with the same rights checks, and their messages come in the plugin’s languages. wp_update_user_meta and wp_update_term_meta keep the backslashes in a value.
• Undo. wp_update_post (the post fields it changes, not custom fields or terms), wp_bulk_update_status and wp_update_site_settings keep an undo point with the previous values; wp_undo_list lists your own points, wp_undo puts one back (with dry_run=true it only shows what it would do), wp_undo_discard throws one away. If only part comes back, the undo point is replaced by one with just the rest (rest_token, same expiry), so trying again never writes back what already came back. Putting back a file’s former parent needs the right to edit that post now. Undo points expire after 7 days; the newest 50 and 100 MB at most are kept, as copies in a protected folder in the uploads. A restore asks again for the right to the post or the setting, as the original change did. Undo points that Pro recorded on this site stay where they are: Pro reverses them, and without Pro they expire.
• Posts. Bring back an earlier revision (wp_restore_revision), set one custom field (wp_update_post_meta; page-builder data takes the unfiltered_html capability), and publish, unpublish or trash up to 500 posts at once (wp_bulk_update_status).
• Users. Create, change and delete user accounts (wp_create_user, wp_update_user, wp_delete_user), within the roles your own account may give; the last administrator cannot be deleted or demoted. Set user and term meta (wp_update_user_meta, wp_update_term_meta).
• WooCommerce. Change the price, sale price, stock and status of a product, the status of an order, and create coupons (wp_wc_update_product, wp_wc_update_order_status, wp_wc_create_coupon), with the right to the one product or order.
• Widgets and settings. Add, change and remove widgets (wp_add_widget, wp_update_widget, wp_delete_widget); set the site title, tagline, admin email, timezone and posts per page (wp_update_site_settings), each read back.
• Maintenance. Clear the object cache, OPcache and the page cache of supported caching plugins (wp_clear_cache), refresh the rewrite rules (wp_flush_rewrite_rules), optimise the site’s database tables (wp_db_optimize) and remove expired transients (wp_cleanup_transients).
• All of them write only with write access on, as every writing tool does. Deleting the plugin also removes the undo points, unless AlphaBridge MCP Pro is still installed.

4.8.1

• The request for a review comes sooner and where administrators look. It appears once the plugin has been in use for 3 days with at least 25 successful tool calls (before: 14 days and 50 calls), as before as a strip in the header of Settings → AlphaBridge MCP and now also as a notice on the Dashboard and the Plugins screen, for administrators only. One answer ends it everywhere: «Write a review» or «Don’t show again». It never comes back, also not after an update, and nothing is sent anywhere.

4.8.0

• SEO fields in the free plugin, 58 tools in all. wp_seo_set sets the SEO title, meta description and focus keyword of a post in Yoast SEO or Rank Math: only the fields given, tags and line breaks stripped, with the right to edit the post and each of its SEO fields. Until now it came with AlphaBridge MCP Pro only. A backslash in a value is stored as written, and so are the variables the SEO plugin fills in, such as %%category%% or %date%. With All in One SEO or without a supported SEO plugin the call is refused, and the answer says why and what to do.
• Wording: the hub. The free service at connect.alphabridge-mcp.com that links your sites to Claude and ChatGPT is called the hub, explained where the readme first names it.

4.7.0

• 17 more tools in the free plugin, 57 in all. Menus: list them, read one with its items, create one, add and remove items (wp_list_menus, wp_get_menu, wp_create_menu, wp_add_menu_item, wp_delete_menu_item). WooCommerce, read only: orders, one order, products, one product, coupons and customers (wp_wc_list_orders, wp_wc_get_order, wp_wc_list_products, wp_wc_get_product, wp_wc_list_coupons, wp_wc_list_customers). User accounts, read only (wp_list_users, wp_get_user), the installed plugins and themes (wp_list_plugins, wp_list_themes), the scheduled WP-Cron events (wp_get_cron) and the last lines of debug.log (wp_get_error_log, only with write access on, like the reader of user profile fields). Until now they came with AlphaBridge MCP Pro only; they work as they did there, with the same rights checks, and their messages come in the plugin’s languages. Changing prices, stock and order status, creating coupons and creating, changing or deleting user accounts stay in Pro.

4.6.12

• Security: the right to the one term and the one comment. Changing or deleting a term now also needs the right to that very term (edit_term, delete_term), as in wp-admin, not only the taxonomy’s right. Assigning terms to a post asks assign_term for every term, as the block editor does: where a term is refused, that taxonomy keeps the post’s terms (a new post gets none from the list), and a duplicated post gets the terms of the original the account may assign. Moderating or deleting a comment needs the right to edit it (edit_comment), replying under a post the right to edit the post (edit_post), as on the comments screen. A site that withholds single terms, comments or posts from an account through map_meta_cap is now followed by these tools too. A taxonomy’s default term is kept, as in wp-admin, and the answer says where the default is changed. A term id below 1 is refused as naming no term.

4.6.11

• A tool error names its kind, in a short code. When a tool reports an error, the answer carries the header X-AlphaBridge-Error with a code such as tool:ab_mcp_bad_status, params:ab_mcp_invalid_args, auth:ab_mcp_read_mode, unknown_tool or internal: where the call stopped, and the error’s own identifier, never its text. A code that is not a plain identifier, such as one another plugin made from a sentence or an address, is passed on as tool:other. The first error of a request counts, also in a batch and for a request a tool answers inside another. The hosted connection service counts these codes, so a tool that keeps failing shows up there; the answer to the AI is unchanged, and the plugin makes no request of its own: the code travels only in the header of the answer to whoever called the tool.

4.6.10

• A clearer listing on WordPress.org. The title, the short description and the start of the description name at a glance what the plugin does: «Claude and ChatGPT for WordPress, SEO and Shop», with three lines for Free, Pro and Agency. The tags are claude, chatgpt, mcp, seo and ai.
• The invitation to the affiliate programme names no rate. The line in the side column of the settings page now reads «Recommend AlphaBridge and profit. As an affiliate you profit from every Pro and Agency purchase made through your link.», with a gift icon in place of the percentage, in every bundled language. The rate and the full terms stand on the programme’s page on alphabridge-mcp.com, which the line links to; the FAQ answers the same way. No tool or setting changed.

4.6.9

• Security: the consent screen names the host the browser really goes to. An app registering with the site could give a redirect address that PHP and a browser read differently, for example with a percent sign or a letter of another alphabet in the host; the consent screen could then name a host the browser would not go to. Redirect addresses now count only in a strict form (https, or http on this computer; a plain ASCII host or an IPv6 address as browsers write it, port, path and query; no user name, backslash, spaces, control characters or fragment), from a registration and from a metadata document alike. The consent screen reads the host the same way, and an address stored by an earlier version is checked again before it is used. The addresses of Claude, ChatGPT, the connection service and local development tools are not affected.

4.6.8

• Every tool explains itself to AI assistants. Each description says what the tool is for, when it fits, what it changes along the way and what a repeated call does, and every parameter is described (105 of 105, before 42). The texts state facts and give the assistant no instructions, as the directories of OpenAI and Anthropic ask.
• Readable tool titles. AI clients show «Change a post or page» instead of «Update Post»: each tool’s title is its short English name from the fine-tuning, whatever the language of the site.
• A tool of another edition is named without a link. When an assistant asks for a tool of AlphaBridge MCP Pro or its Agency plan, the answer and the server instructions say which edition has it; they no longer link the page about the editions.
• A file from a URL over the size limit is refused. wp_upload_media_from_url could store a file larger than the limit (20 MB by default) cut off at the limit and report it uploaded; such a file is now refused with an error.
• For add-ons: a tool definition can state open_world itself, as it can state destructive.

4.6.7

• French, Italian, Spanish and Portuguese. Everything of the plugin a person reads now comes in these languages too, as it does in German: the settings page with its cards, switch, fine-tuning and notices, the consent screen with its access levels and error pages, the description in the plugin list, the log, and the refusals and error messages an assistant passes on. The plugin brings the files itself (fr_FR, it_IT, es_ES, pt_PT); a language pack from translate.wordpress.org still takes precedence for every text it has. The notice and the boxes before write access goes on stay in English and German, as the Terms of Use.
• A site in another variant of a language reads that language. A locale without a file of its own reads the main file of its language: fr_CA and fr_BE read French, es_MX and the other Spanish locales Spanish, pt_BR and pt_PT_ao90 Portuguese. Until now they read English.

4.6.6

• The connection service is named by what it is. The readme calls the free service at connect.alphabridge-mcp.com the connection service of AlphaBridge MCP, and the error page of the sign-in is titled AlphaBridge MCP. A connection made through the service keeps its label in the connections list, also once the service’s own pages carry a new name.

4.6.5

• Bulk status changes are marked as reaching beyond the site. wp_bulk_update_status (AlphaBridge MCP Pro) can publish many posts at once, so its openWorldHint is now true, like wp_create_post and wp_update_post. A client that asks before such steps can now ask here too.

4.6.4

• Everything about connecting sits in one place: the connect card. The settings moved up from a card of their own at the foot of the page into the panel of the app they concern — the sign-in for apps under Claude and under ChatGPT (there with the status line for ChatGPT and Codex, «Check again» and the link to switch the direct sign-in off), the connector address with the token under Cursor and «Other», next to the token form. Each has its own Save.
• Claude: both ways in, side by side, nothing folded away. «Through the hub» (one connection, up to 10 sites) with its three steps, and «Directly» (this site only) with two: add a custom connector in Claude with this site’s address, then sign in here and approve.

4.6.3

• Sign-in works behind firewalls that block app IDs in address form. Some hosts (Bluehost with Mod_Security) answer «406 Not Acceptable» as soon as an app’s ID is a web address, which is how ChatGPT and Codex identify themselves. The site now checks this itself with one request to its own sign-in page and, where the firewall blocks it, stops offering that way, so apps register with the site instead; the ChatGPT panel and the setting say so. The check runs when the settings page opens (again after six hours), on every save of the settings and on «Check again». Reported in the support forum on 12 October 2026, thank you.
• The settings for how apps connect sit on one card: two settings and a status line for ChatGPT and Codex. «Sign-in for apps» and «Connector address with token» replace the three folded «advanced» sections, each with one sentence on what it is for; the status line says whether ChatGPT and Codex sign in directly or register with the site, with «Check again» and a link to switch the direct sign-in off. The switch for the MCP revision 2026-07-28 leaves the page: the setting keeps its value, and the ab_mcp_modern_protocol filter stays (see FAQ).
• FAQ: «Sign-in ends with “Not Acceptable” or mentions Mod_Security».

4.6.2

• Tools that can publish now say so to AI clients. Eight tools can make content public on your site: creating and updating posts, replying to and approving comments, uploading media from a file or a web address, changing the texts of media, and renaming categories and tags. All eight now report openWorldHint: true and destructiveHint: true, because what is published cannot be taken back once it is out: a published post pings other sites and may go to newsletter subscribers, a reply reaches the commenter at once, and an uploaded file can be downloaded by anyone. An AI client can then ask you before it runs them. Reading, drafts, new categories and tags, and deleting stay inside the site as before.
• This follows OpenAI’s review rules for tool hints. No setting changed.

4.6.1

• ChatGPT connects directly again while «Accept apps with a metadata document» is on. ChatGPT identifies itself with a metadata document that prefers the token method private_key_jwt and also lists «none» among the methods it supports. The plugin refused any document whose preferred method was not «none», so ChatGPT could not connect to the site directly. It now takes «none» from that list and treats the app as a public client, with PKCE as before. A document that asks for a shared client secret, or that offers no «none» at all, is still refused, and so is a list that does not contain the document’s own preferred method. Reported in the support forum on 3 October 2026, thank you. No setting changed.

4.6.0

• Switching on write access asks for two boxes, the second for the Terms of Use. The notice says, as before, that changes take effect immediately, that not everything can be undone and that write access is switched on at the site owner’s own risk, and now also that statutory rights and the liability rules of the Terms of Use remain unaffected. With the first box the administrator agrees to how write access works; with the second, to the Terms of Use of CultureClub Kulturagentur UG (haftungsbeschränkt), version of 7 October 2026, which the dialog links. Neither box is ticked in advance. Without a paid licence both are required; with a valid licence of Pro or Agency the second is optional, because the terms already apply from the purchase. Switching on by code is no agreement to the terms. The button reads «Agree and switch on write access».
• No box confirms a fact any more («Understood», «I have a current backup»): both say what the administrator agrees to.
• The notice and the boxes come in English and German only, as the Terms of Use, and from the plugin itself: a language pack does not change them. Other languages read English. The link goes to the German version of the terms on a German site.
• The record of a switch-on also holds the wording of the second box, the address it linked, whether and to which version of the terms the administrator agreed, and the edition. It stays on the site; nothing is sent anywhere. The notice is version 3; a record of version 1 or 2 stays valid.
• Where write access was switched on before this version, it stays on. The settings page says once that the agreement to the terms is asked for the next time write access is switched on; «Dismiss» hides it for this version of the terms.

4.5.3

• All visible texts of the plugin come in German on a German site (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal): the settings page with its cards, notices, tables, buttons, tooltips and the texts of its script; the consent screen with its access levels and its error pages; the description in the plugin list; the log, whose status and time now follow the language; and the refusals and error messages of the tools that an assistant passes on. The plugin brings these files itself; a language pack from translate.wordpress.org still takes precedence for every text it has.
• Stays English on purpose: what is written for the assistant — the descriptions of the tools and their parameters (shown behind the «i» in the fine-tuning), the server instructions and the notes on single elements in the outline that wp_get_builder_layout hands over — and the protocol’s own errors (JSON-RPC, and the error codes the OAuth standard sends to an app). The names and descriptions of abilities come from the plugins that offer them.
• The reasons why an app’s metadata document is refused, the note of wp_seo_detect about AIOSEO and the status and time in the log are translatable now. The plugin header names /languages as its Domain Path, so the plugin list shows the description in German also while the plugin is inactive.
• A command for Claude Code. After a connection is created, the settings page shows a ready-made claude mcp add --transport http … command with the endpoint and the token, as the guide on alphabridge-mcp.com does. The config with mcp-remote is now labelled for Cursor only: in Claude Code, ${AUTH} in that config stayed empty and /mcp reported it missing.
• The note under the fine-tuning names the rate limit without «(fixed)».
• The readme says what the audit log keeps: the latest 200 tool calls.

4.5.2

• The request for a review is a short strip at the foot of the coloured header of Settings → AlphaBridge MCP instead of a WordPress notice. As before it appears only there, once the site has used the plugin for at least 14 days and made at least 50 successful tool calls, names exactly these figures and asks everyone the same way. «Write a review» now counts as an answer: the strip does not come back afterwards, as after «Don’t show again». Its texts, and «(opens in a new tab)» for screen readers, come in German with the plugin, and so do the texts of the header around it that were still English on German sites («Connect your AI assistant», the question below it and the hints on the assistant buttons).
• A «Settings» link in the plugin list. The plugin’s row under Plugins now starts with «Settings», which opens Settings → AlphaBridge MCP, as WordPress plugins usually do. It shows only to users who may open that page, and it comes in German with the plugin (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal).

4.5.1

• The answer to a tool of AlphaBridge MCP Pro, and the paragraph about Pro in the server instructions, state facts only. A call of a tool that belongs to the separate AlphaBridge MCP Pro or its Agency plan is answered with the edition it belongs to and the page that describes the editions and their tools (https://alphabridge-mcp.com/docs). The steps to install Pro, the request to the assistant to point the person to Pro and the link to the prices are gone: ChatGPT’s app directory allows saying that a feature is missing, not promoting an upgrade. The server instructions of a site without Pro list what is not on the site and name the same page. No tool, permission or setting changed.
• The description says which reading tool waits for write access. It said that with write access off assistants could not read code, files, the database, logs or credentials; this plugin has no tool for any of these. Its only reading tool that waits for write access reads user profile fields (wp_get_user_meta). The description, the installation steps and the FAQ now say so. The description also says that each connection keeps its access level (Full, Content or Read only) when write access is on.
• The directory page is shorter: a shorter name and short description, the description in short paragraphs, the AlphaBridge Connect hub under its own heading (up to 10 sites in one chat, free, in every edition) and AlphaBridge MCP Pro as a list. «fast, stable» and «faster and more stable» are gone from the plugin’s description and the readme; nothing measured backs them. The captions of screenshots 1 and 5 match the current settings page.
• The new sentence of the answer to a Pro tool comes in German with the plugin (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal); the two sentences with the steps to install Pro are gone.
• A token in the query string or in the request body is never accepted, also with the connector URL switched on. With the connector URL on, /mcp?token=… and a token field in the body were taken as the token too; only the path /mcp/<token> was meant. Now only the path counts, as the FAQ says. Header authentication is unchanged.
• The server instructions of a site without Pro name changing the texts, links and images of page-builder elements as not on this site, instead of the texts of page-builder pages: reading them with wp_get_builder_layout works on every site. The list of what AlphaBridge MCP Pro adds says that its test requests run after PHP code is saved and catch the fatal errors they hit, not every error.

4.5.0

• The main switch «Write access for AI assistants» replaces the box with the modes Read and Full. It sits where the box was, the first thing on Settings → AlphaBridge MCP, and holds for every connection — Claude, ChatGPT, Cursor and all others. Off (as every site starts) assistants only read; on, they read and write with full power. The page calls the states «write access off (read only)» and «write access on (full power)»; the internal names (read, full), the option and the PHP interface stay as they were. Switching on opens a small window at the switch with the notice and a box to tick (without JavaScript the same fields stand in the page); switching off takes one click. The notice is new (version 2): changes take effect immediately, they can create, change and also delete, not everything can be undone, at your own risk, a current backup. A confirmation of the notice of 4.4.0 stays valid; nobody has to confirm again.
• Switching on write access switches everything on. Every tool is on afterwards, also one that was switched off before or kept off from a version before 4.4.0. Single tools can be switched off under Fine-tuning; that holds until write access is switched on the next time. Only a switch from off to on does this: a second click from an old tab while write access is on changes nothing. An update alone resets nothing.
• The fine-tuning, compact and open. Four main groups, seven at most with the Pro add-on (Content; Site & users; Plugins, themes & code; Database & operations; Shop; Undo; Abilities of other plugins), each with its switch, its tool groups and how many of its tools are on; every tool group opens its tools. Every tool shows a short name in your language next to its name in code, and its description for the assistant behind an «i»; the search finds a tool by either and by the names of its groups. The only badges left are «Reads» and «Writes», each with a symbol; readers that wait for write access say «only with write access». One button saves everything.
• Refusals of the switch, the access level, the role and the fine-tuning lead to the place where they are changed. When write access is off, the connection’s access level does not include a tool, the account lacks the capability, or a tool is switched off under Fine-tuning, the answer says why in one sentence, what the person can do, gives a direct link (to the switch, the fine-tuning, the connections or the users) and asks the assistant to pass it on kindly and try again afterwards. The same holds where a tool itself refuses because the account’s role does not allow it — this post, this user’s meta, publishing: the answer adds that an administrator can change the account’s role under Users, with the link.
• Tools of AlphaBridge MCP Pro are named as such. A call of a tool that belongs to the separate AlphaBridge MCP Pro or its Agency plan is answered with what it is and where it comes from instead of «Unknown tool», and the server instructions of a site without Pro say in a short paragraph what Pro adds. Nothing in this plugin is locked or limited by it.
• New connections start with the full access level. The consent screen preselects «Full», and says that the switch for write access on the site decides whether assistants may write; an approval without a choice gets the full level too. Connections made before keep their level.
• The texts of the switch and the fine-tuning, the short names of the tools and the refusals for the account’s role come in German with the plugin (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal); dates on the settings page follow the language.
• For add-ons: the action ab_mcp_reset_switches (write access switched on), the filters ab_mcp_unavailable_tool_message and ab_mcp_tool_label (a tool’s short name), the action ab_mcp_fine_save (one save for the fine-tuning), the helpers AB_MCP_Admin::fine_row_html(), fine_sub_html(), count_badges() and addon_text(), and the class AB_MCP_Guidance with role_refusal().

4.4.0

• Page builders: wp_get_builder_layout recognises the builder a page was made with and reads the page as an outline. For an account that may edit the post, it lists the page’s elements in page order, each with its id, type and parent, and with its visible text, heading, HTML, link and image fields. Code, forms, global parts and elements it does not know are listed as locked, with the reason and without their content; the raw builder data, styling, attributes and scripts are never handed out. The answer also names the builder, whether it is active, what the site shows (storage), where copies of the page are kept, a hash of the layout to compare before and after a change, and the tools that change the page with a visible effect (write_via). Read, as of 1 October 2026: WordPress blocks, Elementor (classic and atomic elements), Beaver Builder, SiteOrigin Page Builder, SeedProd, GenerateBlocks, Kadence Blocks, Spectra, Stackable, Pagelayer, Otter Blocks and CoBlocks (both as plain blocks), WPBakery Page Builder, Divi 4, Avada, Flatsome and Enfold — the last five from the vendors‘ documentation and code, not yet checked on a live installation, which the answer says. Further builders, among them Bricks, Breakdance, Oxygen and Divi 5, are recognised but not read; the dated list is in the FAQ. An Elementor element that Elementor has not registered is listed as locked with the way: the plugin that provides it; for a container while Elementor’s Container feature is off, the switch under Elementor › Settings › Features; for an atomic element while Elementor’s Atomic Editor is off, the switch under Elementor › Settings › Atomic Editor. A guided prompt, edit_builder_page, takes an assistant through recognising, reading, previewing, applying and checking a change.
• wp_get_post says which page builder a post was made with. The new field built_with names the builder, whether it is active, its version, what the site shows and the tools that change the page with a visible effect, with a note where post_content is not simply the page.
• wp_list_posts filters by page builder. built_with takes a builder id as wp_get_post …