Rectus Content Access for MCP

ЧПП

Does Rectus Content Access for MCP require an external service?

No service operated by the plugin author is required. MCP requests are handled by WordPress through the bundled official MCP Adapter library. When an OAuth client uses an HTTPS URL as its client ID, Rectus Content Access for MCP retrieves public client metadata from that client-provided URL as described below.

What data is sent when URL-based OAuth client metadata is retrieved?

During OAuth authorization, a connecting client may provide an HTTPS metadata URL as its client ID. Rectus Content Access for MCP then sends a server-side GET request to that exact URL with an Accept: application/json header. The response is limited to 64 KB and valid metadata is cached for one hour. No WordPress content, passwords, OAuth codes, or tokens are sent. The destination is selected and operated by the connecting MCP client, not by the plugin author, so the destination operator’s terms and privacy policy apply.

Does the WordPress server need Node.js?

No. The server-side plugin runs in PHP. An MCP client may have its own local runtime requirements, depending on the client.

Does Rectus Content Access for MCP send my WordPress password to the MCP client?

No. The user signs in on the WordPress site and approves the connection in the browser. The MCP client receives short-lived OAuth tokens instead of the WordPress password.

How do I revoke a connection?

Open Settings, Rectus Content Access for MCP and revoke the connection in the OAuth connections table. MCP clients may also clear or revoke their saved authorization.

How are local images uploaded without Base64?

Codex and Claude Code should call the media upload ticket tool with the local image filename, byte size, MIME type, and attachment metadata. The tool returns a plugin REST endpoint and a short-lived, one-time token. The client then sends the image bytes directly as multipart form data. The image does not enter the model context, and no Application Password or second WordPress login is required.

The ticket is valid for five minutes, is bound to the authorized WordPress user and expected file metadata, and is stored only as a SHA-256 hash. Repeating a completed request with the same ticket returns the existing attachment instead of creating a duplicate.

MCP clients that cannot perform the direct HTTP upload may continue to use the Base64 media upload tool. Files already present in the WordPress uploads/mcp-inbox directory may use the media import tool without transferring image bytes through MCP.

How do I select and delete media?

Use the media list tool to search the WordPress media library and obtain the exact attachment ID and filename. Then call the media delete tool with that ID, the matching filename, and confirm set to true. WordPress checks the authorized user’s delete permission for the selected attachment.

Deletion is permanent and removes the attachment and its generated files. Existing links to that media in post content are not rewritten, so clients should show the selected ID and filename to the user before confirming.

How is the MCP server name chosen?

Rectus Content Access for MCP derives the client configuration name from the site’s domain and subdirectory path. For example, rectus.co.jp becomes wordpress-rectus-co-jp, while example.com/site-a becomes wordpress-example-com-site-a. This prevents different WordPress sites from overwriting each other’s MCP client configuration.

Why should I run the Codex login command only when needed?

Codex App and Codex CLI share MCP configuration. After the add command saves the server, Codex App may open the authorization screen automatically. Approve that screen once. Run codex mcp login only when authorization does not start; running both flows at the same time can create a duplicate OAuth connection.

How do I authenticate Claude Code?

Run the displayed claude mcp add command, then run claude mcp login. The login command opens the browser authorization screen directly, so there is no need to start Claude Code and run /mcp manually.

Why do new MCP clients fail to connect while existing clients keep working?

The OAuth discovery URLs under /.well-known/ are served through WordPress. Server rules that handle /.well-known/ before WordPress break new authorizations while issued tokens keep refreshing. Rectus Content Access for MCP reports this state in Site Health and in the Discovery metadata row on the settings screen.

Does OAuth support random localhost callback ports?

Yes. Native MCP clients may select an available loopback port when authorization starts. Rectus Content Access for MCP follows RFC 8252 by allowing the port to differ for localhost, 127.0.0.1, and ::1 redirect URIs while still requiring the scheme, host, path, and query to match. All other redirect URIs require an exact match.

Is post content sanitized before it is saved?

Yes, by the same rule WordPress applies to the block and classic editors. Content from a user who holds the unfiltered_html capability, which on a single site means an administrator, is stored as written and left to the content_save_pre filters that wp_insert_post() applies, so nothing is removed that the editors would have kept. Content from every other user is filtered with wp_kses_post(), which strips script elements, event handler attributes, and anything else outside the allowed list. Rectus Content Access for MCP additionally allows schema.org microdata attributes there, because WordPress core omits them and structured data lives in the post content.

An MCP connection therefore never grants more reach than the approving WordPress user already had in the editor.

Which custom post types are available?

Rectus Content Access for MCP lists non-built-in post types that have a WordPress editing screen and support a title, editor, or excerpt. Administrators must explicitly enable each post type.

Are ACF and other custom fields supported?

Not in version 0.5.2. Standard title, content, excerpt, slug, status, and assigned taxonomies are supported. Plugin-specific custom fields require a separate integration.

Which languages are supported?

English source strings are included. After publication on WordPress.org, community translations are provided through translate.wordpress.org and delivered as WordPress language packs.