The plugin that turns WordPress into a tool surface.
Install on any WordPress site. Issue scoped JWT tokens. Expose 90 typed REST endpoints — now with a full file explorer — to Claude, ChatGPT or any MCP-compatible AI client.
SHA-256 verifiedSystem requirements
- WordPress 6.0 – 7.0+
- PHP 8.1 – 8.4
- MySQL 5.7+ / MariaDB 10.3+
- HTTPS strongly recommended
Installation steps
- Plugins → Add New → Upload the .zip. Activate.
- Add
WPCB_JWT_SECRETtowp-config.php. - Xaflo → Tokens → New. Pick scopes, copy the token.
What's included
- 90 typed REST endpoints
- 23 granular JWT scopes
- Auto-backups + full audit log
- Analytics + SEO toolkits
- WPML / Polylang adapters
Changelog preview
- Raw HTML writes for admin tokens (unfiltered_html)
- Security hardening across the API surface
- 6 new file-explorer endpoints
A complete control plane for AI agents.
90 REST tools, typed
Every WordPress capability you actually use, exposed as a typed REST endpoint with JSON schema. Posts, pages, media, menus, plugins, themes, CLI, DB, files, debug.log, maintenance.
File explorer
Six new endpoints — mkdir, rename, delete, upload, download, search — so AI can organize files on the server. Deletes require an explicit confirmation step.
Remote maintenance
Toggle a styled 503 page from Xaflo Desktop or wp-admin. IP allow-list keeps operators in, everyone else out. Mirrors a .maintenance file + branded drop-in.
Debug.log tail
Parse + filter the WP error log over REST. Severity-aware, with an 8 MB tail cap. Ask your AI "why is my site throwing warnings?" and get a real answer.
JWT scoped tokens
23 granular scopes. Read-only for analytics. Write-only for content. Revoke instantly. No app passwords, no full admin.
Self-hosted auto-update
The plugin polls your update endpoint every 12 h. Every package is SHA-256 verified before unpack — no marketplace middleman.
Analytics built in
Top posts, no-traffic pages, keywords, referrers, period comparison — no GA4 SDK setup, no Search Console OAuth dance.
SEO toolkit
Bulk audit, single-page diagnosis, schema injection, sitemap status — works alongside Yoast / Rank Math / SEOPress without conflict.
Auto-backups
Every destructive write triggers a snapshot. Restore via wp_backup_restore — now transactional for database restores.
Audit log
Every API call: actor, scope, payload, timestamp. Stored in WordPress, exportable, GDPR-friendly.
WPML + Polylang
Multilingual aware. Read & write translations as first-class objects — no fragile locale hacks.
MCP-native pairing
Built to pair with the claude-wp-mcp server: 83 typed MCP tools for Claude Code, Claude Desktop and ChatGPT Desktop.
Security you can reason about.
v1.4.0 is a security-hardening release. Every layer that touches the outside world got tightened — without making the API any less useful to your AI.
SSRF guard on remote downloads
Optional, operator-controlled filtering of outbound fetches — block private ranges and metadata endpoints when the plugin downloads on your behalf.
Zip-slip fixed, restores transactional
Backup restore rejects path-traversal entries, and database restores are now transactional — they complete fully or roll back cleanly.
Spoof-proof IP allowlists
Allowlists resolve the real client address via trusted proxies only — forged X-Forwarded-For headers don't get you in.
Confirmation tokens on critical settings
Changing siteurl, home or admin_email requires a two-step confirmation — no single-call footguns.
Rate limits, actually enforced
Database write endpoints now enforce their declared rate limits — a runaway agent gets throttled, not trusted.
Why not just use WP's built-in REST API?
Because your AI needs typed, scoped, audited tool descriptors — not a 50-endpoint REST surface that talks JSON like it's 2014.
| Capability | Stock WP REST | Xaflo WP Connect |
|---|---|---|
| Typed tool descriptors | — | 83 tools |
| Scoped JWT auth | Application Passwords only | 23 granular scopes |
| Auto-backup before writes | No | Snapshot + restore |
| Audit log | No | Every call logged |
| File explorer | No | 6 endpoints, confirmed deletes |
| Remote maintenance toggle | No | Styled 503 + IP bypass |
| Debug.log tail | No | Parsed + severity-filtered |
| Analytics tools | No | 10 analytics endpoints |
| SEO bulk audit | No | Built in |
| CLI execution | No | wp_cli_exec (scoped) |
| Multilingual aware | No | WPML + Polylang |
| MCP-compatible | Manual wiring needed | Native via claude-wp-mcp |
| Self-hosted auto-update | No | SHA-256 verified |
Get the plugin.
No license key. No phone-home. No telemetry. Just a .zip and your wp-config.