Skip to content

cognizonline/webmcp-ability-studio

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
.github
.github
 
 
GCA_webmcp
GCA_webmcp
 
 
docs
docs
 
 
.gitignore
.gitignore
 
 
CHANGELOG.md
CHANGELOG.md
 
 
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
 
 
CONTRIBUTING.md
CONTRIBUTING.md
 
 
README.md
README.md
 
 
SECURITY.md
SECURITY.md
 
 

Repository files navigation

WebMCP Ability Studio

Version WordPress PHP License WebMCP PRs Welcome

Make any WordPress site agent-ready in minutes.

WebMCP Ability Studio (WMAS) exposes your WordPress site as a structured tool surface that AI agents can interact with directly — no DOM scraping, no screenshot parsing, no brittle hacks. Register once, available everywhere: browser-native WebMCP agents, MCP desktop clients (Claude Desktop, Cursor, VS Code), and automation platforms like Make.com.

Built on the W3C WebMCP Community Group spec and the WordPress Abilities API (WordPress 6.9+).

Why WMAS?

Vision-based agents that scrape or screenshot pages achieve ~45% task accuracy. Schema-driven tool interfaces hit ~98%. WMAS gives your site the latter.

The web is growing a second interface — not pages, but capabilities. Sites that expose structured tool contracts become the default for AI agents. Sites that do not get bypassed. WMAS puts you on the right side of that shift, today, before it becomes table stakes.

Architecture

┌──────────────────────────────────────────────────────────────┐
│                       WordPress Site                          │
│                                                               │
│   wp_register_ability("wmas/search-content", ...)            │
│          │                                                    │
│          └─── registered once ── exposed via three paths:    │
│                                                               │
│   ┌──────────────┐   ┌──────────────────┐   ┌────────────┐  │
│   │  MCP Adapter │   │ webmcp-abilities  │   │ WMAS REST  │  │
│   │  HTTP / STDIO│   │ navigator.        │   │ /wmas/v1/  │  │
│   │  MCP protocol│   │ modelContext      │   │ flat API   │  │
│   └──────┬───────┘   └────────┬─────────┘   └─────┬──────┘  │
└──────────┼────────────────────┼─────────────────── ┼─────────┘
           │                    │                     │
           ▼                    ▼                     ▼
    Claude Desktop /     Chrome 146+ /          Make.com /
    Cursor / VS Code     Browser agents         REST clients

The key insight: wp_register_ability() is the single source of truth. All three transports read from it automatically. Write the capability once; ship it everywhere.

Features

  • 5 built-in abilities — get-site-info, search-content, get-post, list-terms, search-media
  • Public tool directory — GET /wp-json/wmas/v1/tools (machine-readable JSON index)
  • Flat-param REST route — GET /wp-json/wmas/v1/run/{slug}?query=solar (no envelope required)
  • Abilities API route — GET /wp-json/wp-abilities/v1/abilities/wmas/{ability}/run?input[key]=val
  • SVG badge — embeddable "agent tools | 5" badge for your site
  • Discovery signal — <link rel="model-context-tools"> injected into <head> for crawlers
  • Browser WebMCP bridge — registers tools via navigator.modelContext (Chrome 146+ EPP, experimental)
  • Declarative form hints — adds toolname / toolparamdescription to existing WP forms
  • Rate limiting — per-IP, per-minute, configurable
  • Audit logging — privacy-respecting (args hash + 120-char preview, never full payload)
  • MCP Adapter compatible — works out of the box with WordPress/mcp-adapter

Quick Install

  1. Download or clone this repo
  2. Upload the GCA_webmcp/ folder to /wp-content/plugins/
  3. Activate WebMCP Ability Studio in WP Admin → Plugins
  4. Go to Settings → WebMCP Ability Studio
  5. Enable Public Read-Only and Tool Directory
  6. Visit yoursite.com/agent-tools/ — your site is agent-ready

Endpoints

Discovery

Method Endpoint Auth Description
GET /wp-json/wmas/v1/tools Public Machine-readable tool index JSON
GET /wp-json/wmas/v1/badge Public SVG badge (image/svg+xml)

Flat-Param Run Route

Plain query params — no input[] envelope needed:

Method Endpoint Auth Description
GET /wp-json/wmas/v1/run/get-site-info Public* Site name, description, URLs, language
GET /wp-json/wmas/v1/run/search-content?query=solar Public* Search published posts and pages
GET /wp-json/wmas/v1/run/get-post?post_id=1 Session Fetch a single post by ID
GET /wp-json/wmas/v1/run/list-terms?taxonomy=category Session List taxonomy terms
GET /wp-json/wmas/v1/run/search-media?query=logo Session Search the media library

*Requires Public Read-Only enabled in plugin settings.

Abilities API Run Route

Standard WordPress Abilities input[key]=value envelope — used by MCP Adapter and Make.com:

GET /wp-json/wp-abilities/v1/abilities/wmas/search-content/run?input[query]=solar&input[per_page]=5

Both routes call identical underlying execution logic and share the same permission checks, rate limits, and audit logs.

Usage Examples

# Verify plugin is live and check version
curl https://yoursite.com/wp-json/wmas/v1/tools | jq '.plugin.version'

# Search content — flat params
curl "https://yoursite.com/wp-json/wmas/v1/run/search-content?query=solar&per_page=5"

# Get site info
curl https://yoursite.com/wp-json/wmas/v1/run/get-site-info

# Get post with content
curl "https://yoursite.com/wp-json/wmas/v1/run/get-post?post_id=1&include_content=true" \
  -H "Authorization: Basic <base64(user:app-password)>"

# Search media
curl "https://yoursite.com/wp-json/wmas/v1/run/search-media?query=hero"

# Embed the badge in HTML
<a href="https://yoursite.com/agent-tools/">
  <img src="https://yoursite.com/wp-json/wmas/v1/badge" alt="Agent tools">
</a>

Make.com Integration

WMAS endpoints map cleanly to Make.com HTTP modules or a custom branded app. See docs/make-com-integration.md for full setup instructions, module reference, and connection configuration.

Browser WebMCP (Experimental)

When the bridge is enabled, WMAS registers tools via navigator.modelContext for Chrome 146+ (Early Preview Program). The W3C spec is still evolving — this transport is experimental. The Abilities API / REST transports are stable and production-ready.

See docs/webmcp-primer.md for background on the WebMCP spec.

Documentation

Document Description
docs/architecture.md Plugin internals, class structure, transport layers
docs/api-reference.md Full endpoint reference with schemas and examples
docs/webmcp-primer.md What WebMCP is and why it matters
docs/make-com-integration.md Make.com setup and module reference
CONTRIBUTING.md How to contribute
SECURITY.md Vulnerability disclosure policy
CHANGELOG.md Version history

Security

  • All public endpoints enforce per-IP rate limiting (default: 30 req/min)
  • Write abilities are disabled by default
  • Audit log records args hash + truncated preview — never the full payload
  • Auth headers are sanitized from all request logs
  • Input schema validation runs before every ability execution

Report vulnerabilities privately — see SECURITY.md.

Roadmap

  • wmas/submit-inquiry — structured inquiry ability with configurable webhook (AI-CRM)
  • WooCommerce ability pack (product lookup, cart, order status)
  • Admin UI ability tester (built-in Postman-style inspector)
  • wp_register_ability() compatibility shim for WordPress < 6.9
  • WordPress.org plugin directory submission
  • Full WebMCP spec compliance as Chrome rolls out stable support

Related Projects

Project Role
WordPress/mcp-adapter Exposes Abilities to CLI/HTTP MCP clients
code-atlantic/webmcp-abilities Bridges Abilities to browser navigator.modelContext
GoogleChromeLabs/webmcp-tools Google's WebMCP demo tools and Chrome extension inspector
W3C WebMCP CG Report The spec
WordPress Abilities API The server-side registration layer

Contributing

We welcome contributions of all sizes. Please read CONTRIBUTING.md before opening a PR.

License

GPL-2.0-or-later. See GCA_webmcp/LICENSE.

Built by Green Circuit · Live demo: greencircuit.co.za/agent-tools/

About

Make any WordPress site agent-ready in minutes. Registers typed Abilities and exposes them to MCP clients, browser-native WebMCP agents, and automation tools.

greencircuit.co.za/agent-tools/

Resources

Readme

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors

Languages