Name: Invizo MCP – Secure AI Connector for Claude, Codex, Cursor and WooCommerce
Availability: InStock
Rating: 5 (1 reviews)
Author: Invizo

Secure WordPress MCP server for Claude, ChatGPT, Codex &amp; Cursor. Manage posts, WooCommerce, SEO, media, users, builders, LMS &amp; events.

Invizo MCP – Secure AI Connector for Claude, Codex, Cursor and WooCommerce

<p>Invizo MCP turns WordPress into a secure, self-hosted Model Context Protocol server. Connect Claude Code, Claude Desktop, Codex, Cursor, Antigravity, and other MCP-compatible AI clients directly to your WordPress admin workflows without an Invizo-hosted proxy.</p>
<p>Your site hosts the MCP endpoint:</p>
<pre><code>https://example.com/wp-json/mcp/invizo
</code></pre>
<p>Invizo MCP uses WordPress Application Passwords, administrator-only access, granular scopes, and the WordPress Abilities API. Administrators decide exactly what an AI client can discover and execute: read-only content, post creation, WooCommerce operations, media uploads, Elementor workflows, Rank Math metadata, LearnPress course actions, Events Calendar management, and more.</p>
<p>No Invizo account, subscription, license key, telemetry, or Invizo cloud service is required.</p>
<h4>Why choose Invizo MCP?</h4>
<ul>
<li><strong>Self-hosted WordPress MCP server:</strong> WordPress serves MCP JSON-RPC at <code>/wp-json/mcp/invizo</code>.</li>
<li><strong>Security-first access:</strong> only authenticated administrators with WordPress Application Passwords can connect.</li>
<li><strong>Granular permissions:</strong> separate read, write, and delete scopes for WordPress content and integrations.</li>
<li><strong>Compact AI tool surface:</strong> exposes <code>discover-abilities</code>, <code>get-ability-info</code>, and <code>execute-ability</code> instead of flooding clients with dozens of top-level tools.</li>
<li><strong>Official MCP packages:</strong> bundles the GPL-compatible WordPress MCP Adapter and PHP MCP Schema packages.</li>
<li><strong>Works with major clients:</strong> copy-ready setup for Claude Code, Claude Desktop, Codex, Cursor, and Antigravity.</li>
<li><strong>WooCommerce-ready:</strong> read, create, edit, and delete store data when WooCommerce scopes are enabled.</li>
<li><strong>Builder and SEO support:</strong> Gutenberg, Elementor, and Rank Math SEO scopes for content and metadata workflows.</li>
<li><strong>LMS and event workflows:</strong> LearnPress and The Events Calendar integrations activate only when those plugins are installed.</li>
<li><strong>No external Invizo service:</strong> no dashboard handshake, no shared secret, no remote Invizo backend.</li>
</ul>
<h4>What can AI clients do with Invizo MCP?</h4>
<p>After an administrator enables the endpoint, creates an Application Password, and selects scopes, approved AI clients can manage WordPress through MCP.</p>
<p><strong>WordPress content management</strong></p>
<ul>
<li>Read, create, update, delete, and search posts.</li>
<li>Read, create, update, and delete pages.</li>
<li>Upload, edit, read, and delete media.</li>
<li>Manage categories, tags, and taxonomy terms.</li>
<li>Read, create, edit, moderate, and delete comments.</li>
<li>Read revisions and delete revisions.</li>
<li>Read reusable blocks and patterns.</li>
<li>Create and edit reusable blocks.</li>
<li>Read and update block templates.</li>
<li>Read and update global styles.</li>
<li>Search site content.</li>
</ul>
<p><strong>Site administration</strong></p>
<ul>
<li>Read, create, edit, and delete users.</li>
<li>Read, create, edit, and delete menus.</li>
<li>Read site settings and structure.</li>
<li>Update safe site settings through allowlisted handlers.</li>
<li>Read plugins and themes.</li>
<li>Discover post types, taxonomies, and post statuses.</li>
</ul>
<p><strong>Custom content and metadata</strong></p>
<ul>
<li>Read custom post types.</li>
<li>Create and edit custom post type definitions.</li>
<li>Delete MCP-managed custom post type definitions.</li>
<li>Read post meta.</li>
<li>Update post meta.</li>
<li>Manage MCP-defined metadata fields without deleting existing WordPress content on uninstall.</li>
</ul>
<p><strong>Page builders and SEO</strong></p>
<ul>
<li>Work with Gutenberg content and page-builder workflows.</li>
<li>Work with Elementor page data when Elementor is active.</li>
<li>Read and update Rank Math SEO metadata when Rank Math SEO is active.</li>
</ul>
<p><strong>WooCommerce AI automation</strong></p>
<ul>
<li>Read WooCommerce products, variations, orders, customers, coupons, and terms.</li>
<li>Create and update WooCommerce products, variations, orders, customers, coupons, order notes, order statuses, and product terms.</li>
<li>Delete WooCommerce data only when delete scopes are enabled.</li>
</ul>
<p><strong>LearnPress LMS</strong></p>
<ul>
<li>Read LearnPress courses, lessons, quizzes, questions, orders, terms, and enrollments.</li>
<li>Create and edit LearnPress data when LearnPress is active.</li>
<li>Delete LearnPress data only when delete scopes are enabled.</li>
<li>Use LearnPress builder workflows when enabled.</li>
</ul>
<p><strong>The Events Calendar</strong></p>
<ul>
<li>Read Events Calendar events, venues, and organizers.</li>
<li>Create and edit event data when The Events Calendar is active.</li>
</ul>
<h4>MCP tools exposed to clients</h4>
<p>Invizo MCP keeps the connected AI client clean and efficient. Instead of publishing every action as a separate top-level tool, it exposes three compact adapter tools:</p>
<ul>
<li><code>discover-abilities</code></li>
<li><code>get-ability-info</code></li>
<li><code>execute-ability</code></li>
</ul>
<p>These tools let Claude, Codex, Cursor, Antigravity, and other clients discover available WordPress abilities, inspect schemas, and execute only the abilities allowed by the administrator-selected scopes.</p>
<h4>Supported AI clients</h4>
<p>The settings page generates copy-ready configuration for:</p>
<ul>
<li>Claude Code</li>
<li>Claude Desktop</li>
<li>Codex</li>
<li>Cursor</li>
<li>Antigravity</li>
</ul>
<p>Clients that require local STDIO MCP can use the <code>@automattic/mcp-wordpress-remote</code> bridge through <code>npx</code>. Clients that support authenticated remote HTTP MCP can connect directly to the WordPress endpoint.</p>
<h4>Built for administrators, developers, stores, agencies, and site managers</h4>
<p>Invizo MCP is for WordPress administrators, WooCommerce store owners, agencies, developers, SEO teams, educators, and site maintainers who want trusted AI clients to work with WordPress through a documented, scoped protocol.</p>
<p>Use read-only scopes for research and reporting. Add write scopes for content workflows. Enable delete scopes only for trusted clients and tested workflows.</p>
<h4>Authentication</h4>
<p>Invizo MCP uses WordPress Application Passwords and WordPress REST authentication.</p>
<p>Only authenticated users with the <code>manage_options</code> capability can access the MCP transport or execute Invizo abilities. In a standard WordPress installation this means administrators only.</p>
<p>Create a dedicated Application Password from <strong>Settings &gt; Invizo MCP</strong> for every AI client or computer. Passwords can be revoked individually from the same screen.</p>
<p>Application Passwords normally require HTTPS. Local HTTP sites can enable them by setting:</p>
<pre><code>define( 'WP_ENVIRONMENT_TYPE', 'local' );
</code></pre>
<p>Security plugins can disable Application Passwords. Invizo reports this condition on its settings screen.</p>
<h4>Scopes and safeguards</h4>
<p>Administrators choose exactly which read, write, and delete scopes are enabled. Abilities outside enabled scopes are hidden from MCP discovery and rejected during execution.</p>
<p>Optional integration scopes are unavailable unless their required plugin is active.</p>
<p>Existing handler safeguards remain in place, including:</p>
<ul>
<li>WordPress sanitization and validation.</li>
<li>Plugin availability checks.</li>
<li>Scope checks inside action handlers.</li>
<li>Dry-run previews for supported risky operations.</li>
<li>Explicit <code>confirm: true</code> requirements for supported destructive operations.</li>
<li>Reserved metadata protection and safe site-setting allow lists.</li>
</ul>
<h4>Complete scope list</h4>
<p>Invizo MCP includes scope controls for:</p>
<ul>
<li>Read Posts</li>
<li>Create/Edit Posts</li>
<li>Delete Posts</li>
<li>Read Media</li>
<li>Upload/Edit Media</li>
<li>Delete Media</li>
<li>Read Pages</li>
<li>Create/Edit Pages</li>
<li>Delete Pages</li>
<li>Read Categories and Tags</li>
<li>Create/Edit Categories and Tags</li>
<li>Delete Categories and Tags</li>
<li>Read Comments</li>
<li>Create/Edit Comments</li>
<li>Delete Comments</li>
<li>Read Users</li>
<li>Create/Edit Users</li>
<li>Delete Users</li>
<li>Read Menus</li>
<li>Create/Edit Menus</li>
<li>Delete Menus</li>
<li>Read Custom Post Types</li>
<li>Create/Edit Custom Post Types</li>
<li>Delete Custom Post Types</li>
<li>Read Post Meta</li>
<li>Update Post Meta</li>
<li>Read Revisions</li>
<li>Delete Revisions</li>
<li>Read Reusable Blocks and Patterns</li>
<li>Create/Edit Reusable Blocks</li>
<li>Delete Reusable Blocks</li>
<li>Read Block Templates</li>
<li>Update Block Templates</li>
<li>Read Global Styles</li>
<li>Update Global Styles</li>
<li>Read Site Settings and Structure</li>
<li>Update Safe Site Settings</li>
<li>Read Plugins and Themes</li>
<li>Search Site Content</li>
<li>Gutenberg Page Builder</li>
<li>Elementor Page Builder</li>
<li>Rank Math SEO</li>
<li>Read Events Calendar Data</li>
<li>Create/Edit Events Calendar Data</li>
<li>Read WooCommerce Data</li>
<li>Create/Edit WooCommerce Data</li>
<li>Delete WooCommerce Data</li>
<li>Read LearnPress Data</li>
<li>Create/Edit LearnPress Data</li>
<li>Delete LearnPress Data</li>
<li>LearnPress Page Builder</li>
</ul>
<h4>Data stored by the plugin</h4>
<p>Invizo MCP stores:</p>
<ul>
<li>Endpoint enabled/disabled status and selected scopes in the <code>invizo_mcp_settings</code> option.</li>
<li>MCP-managed custom post type definitions in the <code>invizo_mcp_registered_cpts</code> option.</li>
<li>MCP-managed post meta definitions in the <code>invizo_mcp_registered_meta_fields</code> option.</li>
<li>A plugin version option used for upgrades.</li>
</ul>
<p>Application Passwords are created and stored by WordPress in user metadata. Invizo tags only the credentials it creates so they can be listed and revoked from the settings page.</p>
<p>Invizo MCP does not collect analytics or send usage information to Invizo.</p>
<h3>Client Configuration</h3>
<p>The settings page generates current, copy-ready values using your site endpoint and WordPress username.</p>
<h4>Claude Code</h4>
<p>The primary setup uses <code>@automattic/mcp-wordpress-remote</code> through <code>npx</code>, with the endpoint, username, and Application Password stored as environment variables.</p>
<p>A direct HTTP <code>.mcp.json</code> alternative is also shown for clients that support authenticated HTTP MCP servers.</p>
<h4>Claude Desktop</h4>
<p>Add the generated JSON to:</p>
<ul>
<li>macOS: <code>~/Library/Application Support/Claude/claude_desktop_config.json</code></li>
<li>Windows: <code>%APPDATA%\Claude\claude_desktop_config.json</code></li>
</ul>
<h4>Codex</h4>
<p>Add the generated TOML to:</p>
<ul>
<li>Project: <code>.codex/config.toml</code></li>
<li>Global: <code>~/.codex/config.toml</code></li>
</ul>
<p>Both <code>npx</code> bridge and direct authenticated HTTP examples are provided.</p>
<h4>Cursor</h4>
<p>Add the generated JSON to:</p>
<ul>
<li>Project: <code>.cursor/mcp.json</code></li>
<li>Global: <code>~/.cursor/mcp.json</code></li>
</ul>
<h4>Antigravity</h4>
<p>Add the generated JSON to:</p>
<ul>
<li>macOS/Linux: <code>~/.gemini/antigravity/mcp_config.json</code></li>
<li>Windows: <code>%USERPROFILE%\.gemini\antigravity\mcp_config.json</code></li>
</ul>
<h4>Local HTTPS</h4>
<p>Trust your local certificate whenever possible. For local development only, bridge configurations may use <code>NODE_TLS_REJECT_UNAUTHORIZED=0</code> when the certificate cannot be trusted normally.</p>
<p>Never commit Application Passwords to source control or paste them into prompts, tickets, screenshots, or chat messages.</p>
<h3>Privacy and Security</h3>
<p>The MCP endpoint is disabled by default on new installations. Enabling it does not expose abilities until scopes are selected.</p>
<p>The endpoint requires:</p>
<ul>
<li>Valid WordPress Application Password authentication.</li>
<li>A WordPress user with the <code>manage_options</code> capability.</li>
<li>An enabled Invizo scope for the requested ability.</li>
</ul>
<p>Use one dedicated Application Password per client or device so individual connections can be revoked without changing the WordPress account password.</p>
<p>When the plugin is uninstalled, Invizo-created Application Passwords are always revoked. Plugin settings and MCP-managed definitions are removed only when <strong>Delete Invizo settings and MCP-managed CPT/meta definitions when the plugin is uninstalled</strong> is enabled. Existing posts and post meta values are never deleted by the uninstaller.</p>
<h4>Reporting security issues</h4>
<p>Please report security issues privately through the contact information on https://invizo.io/. Do not publish sensitive vulnerability details in a public support topic before a fix is available.</p>
<h3>Upgrade from 1.x</h3>
<p>Version 2.0 automatically removes the stored external MCP Server URL and shared secret.</p>
<p>It preserves:</p>
<ul>
<li>Enabled scopes.</li>
<li>MCP-managed custom post type definitions.</li>
<li>MCP-managed post meta definitions.</li>
<li>WordPress content and integration data.</li>
</ul>
<p>Sites that previously had a shared secret configured are migrated with the standalone endpoint enabled. Other installations remain disabled until an administrator explicitly enables the endpoint.</p>
<p>The legacy signed endpoint <code>/wp-json/invizo/v1/execute</code> and its HMAC headers have been removed.</p>
<h3>External Services</h3>
<p>Invizo MCP does not contact an Invizo-hosted service.</p>
<p>MCP clients may use the third-party npm package <code>@automattic/mcp-wordpress-remote</code> as a local bridge when configured by the administrator. The package is downloaded from the npm registry and runs on the computer hosting the AI client, not inside WordPress.</p>
<p>When the bridge is used, it sends the configured WordPress endpoint, username, Application Password, and MCP request data directly to the administrator&#8217;s WordPress site. It does not send those credentials to Invizo.</p>
<ul>
<li>Package: https://www.npmjs.com/package/@automattic/mcp-wordpress-remote</li>
<li>Source: https://github.com/Automattic/mcp-wordpress-remote</li>
<li>npm Terms of Use: https://docs.npmjs.com/policies/terms</li>
<li>npm Privacy Notice: https://docs.npmjs.com/policies/privacy</li>
</ul>
<p>Media upload actions can fetch a public file URL explicitly supplied by an authenticated MCP caller through WordPress media sideloading. In that case, the remote file host receives a normal HTTP request from the WordPress site. The service and data destination depend entirely on the URL supplied by the administrator&#8217;s MCP client.</p>
<p>No external request is made merely by installing or activating Invizo MCP.</p>
<h3>Build and Source Files</h3>
<p>The distributed plugin contains the human-readable PHP source used at runtime.</p>
<h4>PHP dependencies</h4>
<p>Composer dependencies are included under <code>vendor/</code> because they are required for the standalone MCP endpoint:</p>
<ul>
<li><code>automattic/jetpack-autoloader</code></li>
<li><code>wordpress/mcp-adapter</code></li>
<li><code>wordpress/php-mcp-schema</code></li>
</ul>
<p>All bundled packages use the GPL-2.0-or-later license. Package source, Composer metadata, and individual license files are included. See <code>third-party-notices.txt</code>.</p>
<h4>Rebuilding dependencies</h4>
<p>From the plugin directory:</p>
<pre><code>composer install --no-dev --optimize-autoloader
</code></pre>
<p>Create the WordPress.org submission ZIP from the parent plugins directory while excluding Git metadata, operating-system files, logs, and Node dependencies.</p>


Alternative Plugins for

Discover the Lists with Invizo MCP – Secure AI Connector for Claude, Codex, Cursor and WooCommerce