Download
Download megamcp-connector.zip Version 1.0.0 · WordPress 6.0+ · PHP 7.4+
The WordPress connection works without it, using WordPress's own REST API and an application password. The plugin adds the few things that API doesn't expose.
Install
- Download megamcp-connector.zip. Don't unzip it.
- In WordPress, open Plugins → Add New → Upload Plugin, choose the zip, click Install Now, then Activate.
- Ask your AI for the WordPress site overview (
wordpress_site_info). It shows the plugin as active with its version. If the site was connected with an Editor, connect it again with an Administrator's application password for redirects, cache purges and IndexNow.
What it unlocks
| What | MegaMCP tools | WordPress user needs |
|---|---|---|
| SEO title, meta description, canonical URL, noindex and focus keyword per post or page | wordpress_set_seo_meta | Can edit that post (Author, Editor, Administrator) |
| One JSON-LD document per post or page, printed in the page head | wordpress_set_schema | Can edit that post |
| Redirects: up to 500 exact-path rules, 301/302/307/308, with hit counts | wordpress_redirects, wordpress_set_redirects | Administrator (manage_options) |
| Clear page caches (WP Rocket, W3 Total Cache, LiteSpeed Cache, WP Super Cache, WP Fastest Cache, SiteGround Optimizer, Autoptimize) and the object cache | wordpress_purge_cache | Administrator |
| Serve the IndexNow key file at https://your-site/<key>.txt without uploading it | wordpress_set_indexnow_key | Administrator |
Every change is a plan with a before-and-after diff that a person approves, like every other write. Plans stop if the value changed in WordPress after the plan was made, and everything except a cache purge can be undone. Without the plugin, these tools reply with a link to this page.
Permissions and security
- No new login. The plugin's REST routes (namespace
megamcp/v1) use the application password MegaMCP already has. WordPress checks it; the plugin then checks capabilities on every request. - Per-post changes (SEO fields, JSON-LD) need permission to edit that post. Site-wide changes (redirects, cache purges, the IndexNow key) need
manage_options, which only administrators have. - Validated input, escaped output. Titles and descriptions are plain text. Canonical URLs and redirect targets must be http(s). JSON-LD must be a JSON object with
@contextand@type, at most 20 KB, and is encoded so it can't close its script tag. Redirects can't take over/wp-admin, the login page or the REST API, and loops and duplicates are refused. - Nothing else. No outside calls, no telemetry, no admin screens, no code execution, no theme or file edits.
wordpress_redirects.What it stores
- SEO fields: in Yoast SEO's or Rank Math's post fields when one is active, otherwise in the plugin's own post fields (
_megamcp_seo_*,_megamcp_focus_keyword). - JSON-LD: one post field per post (
_megamcp_schema). - Redirects and their hit counts: two options that aren't loaded on every page (
megamcp_redirects,megamcp_redirect_hits). - The IndexNow key: one option (
megamcp_indexnow_key). The key is public by design: search engines fetch it from your site.
Uninstall
Deactivate and delete it under Plugins. Deleting runs its uninstaller, which removes its options (redirects, hit counts, the IndexNow key) and its own post fields (SEO fields and JSON-LD) on every site of a multisite network. Values it wrote into Yoast SEO or Rank Math fields stay, since they belong to those plugins.
FAQ
Do I need the plugin to connect WordPress?
No. Posts, pages, media, the SEO audit and plugin lists work with an application password alone. The plugin adds SEO fields, JSON-LD, redirects, cache purges and the IndexNow key file.
Does it work with Yoast SEO or Rank Math?
Yes. With either one active, SEO titles, descriptions, canonical URLs, noindex and focus keywords are written to that plugin's own fields, so it keeps printing them. Without one, the MegaMCP Connector prints the tags itself.
Can the plugin run code or change my theme?
No. It has no way to run code, edit theme or plugin files, or change settings other than its own redirects and IndexNow key. It makes no outside calls and sends no telemetry.
What does deleting it remove?
Deleting it from Plugins removes its redirects, redirect hit counts, the IndexNow key, its own SEO fields and every JSON-LD document it stored. Values it wrote into Yoast SEO or Rank Math fields stay, because they belong to those plugins. Deactivating keeps everything; it just stops working until you reactivate it.
Haven't started yet? The trial is 14 days, no credit card, and the sandbox is waiting.
Start free trial