MCP Logs vs Code Engine – PHP Snippets, AI Functions & Automation for WordPress

AI agents talk to WordPress sites directly now. Claude, ChatGPT, Cursor, and a growing list of MCP clients can connect to your site, read content, place orders, edit posts, or call any custom tool you expose. The Model Context Protocol (MCP) is the open standard that makes this possible. The problem is that by default you cannot see any of it. Requests arrive, things change, and there is no record of what an agent did, when it did it, or which user it acted as. MCP Logs writes a row for every MCP request the moment it hits your site. You get the route, the ability that was called, the user it acted as, the request body, the response, and whether it succeeded. All of it is browsable in a React admin page built with @wordpress/components, so it looks and behaves like the rest of WordPress. Version 1.1.0 adds the other half: detection rules that watch the traffic as it arrives, email alerts when one trips, and a kill switch that stops all MCP access in one click. A log you can actually search Filter by date range, ability name, and user. Sort any column, set page size between 10 and 500, and run full-text search across stored request and response bodies. Click a row to open the request and response in collapsible panels, copy either to your clipboard, or trace a single agent session end to end. Export the current view to CSV when you need to hand findings to someone else. Detection rules that run on every request Three rules evaluate after each logged request: Request velocity per session. Catches an agent stuck in a loop. Destructive tool use. Watches a list of abilities you nominate. It can populate that list for you by scanning previously seen tool names for delete, remove, and drop. Error storms. Catches an integration that has started failing. Each rule has its own enable toggle, threshold, time window, severity, and auto-disable setting. Detected events land in a Security Events tab with filters, stat cards, CSV export, and a per-event “mark as reviewed” so your queue reflects what you have already handled. Open any event and Session Replay steps through the full request timeline for that MCP session. Alerts arrive as HTML email stating whether the offending request ran or was blocked, with a one-click, nonce-protected link to disable MCP access. A 15-minute cooldown per rule and per session stops an alert storm. There is an optional daily digest, separate recipient lists for alerts and digests, and a test button so you can confirm delivery before you rely on it. A kill switch that keeps the record Turn off all MCP access from the admin screen, or let a detection rule trip it for you. Blocked requests are still logged before they are rejected, so the audit trail stays complete while access is off. Callers get a 503 explaining why access was disabled and when. A site-wide admin notice stays up until you turn it back on. Works with whichever MCP server you run MCP Logs is not an MCP server for your site and does not expose your content to agents. It detects requests by the Mcp-Session-Id header, which is part of the MCP transport spec, so traffic from any compliant server lands in the same table. If your site runs more than one, you get one log instead of several. Built for both halves of the audience If you run the site: install, activate, and open Tools then MCP Logs. There is no setup screen and no configuration. Logging starts the moment an MCP client makes a request. If you build on it: there is a full REST API covering every admin feature, authenticated via WordPress Application Passwords or WooCommerce API keys. The plugin is also MCP-aware itself, registering a server with ten abilities so an agent can introspect its own activity log. Source ships under src/ and builds with npm run build. Why log deletion is not exposed to AI agents The plugin registers ten MCP abilities. The two log-deletion abilities, clear-old-logs and clear-all-logs, are deliberately left out of that set. The same tool set reads log content that an untrusted caller can influence. Pairing that with a one-call wipe would let planted text steer an administrator’s agent into erasing the audit trail. Deletion stays available in the admin screen and over REST, where a human is doing it. Sites that accept the trade-off can re-add the abilities with the alfmcp_mcp_server_abilities filter. REST API Eighteen endpoints under /wp-json/activity-log-for-mcp/v1/: GET /requests for a list with filters, sort, and pagination GET /stats for totals, success rate, and calls per ability GET /sessions/{id} for every request in a session, in order GET /search for full-text search across routes, abilities, and bodies GET /errors for recent failed executions and HTTP errors GET /tool-performance for per-ability call count, error rate, and unique users GET /filters for distinct ability names and users GET /export-csv for a server-side streamed CSV download DELETE /requests to clear all logs DELETE /retention to delete logs older than a given date GET /security-events for detected events with filters and pagination GET /security-events/stats for alert counts, active sessions, and top rule over 7 days GET /security-events/export-csv for a CSV of detected events PUT /security-events/{id}/acknowledge to mark an event reviewed DELETE /security-events/clear-acknowledged to remove reviewed events GET|PUT /security-settings to read or update detection and alerting settings POST /security-settings/test-alert to send a test alert email MCP abilities The plugin registers an MCP server (activity-log-for-mcp-server) with ten abilities: get-activity for paginated log retrieval with filters get-stats for summary metrics with an optional date range get-activity-by-session for a full session trace, with optional body exclusion for lighter payloads search-activity for full-text search across stored requests and responses analyze-errors for recent errors with full details get-tool-performance for per-ability performance metrics get-security-events for detected events with filters get-security-stats for alert counts, active sessions, and top rule over 7 days acknowledge-event to mark a security event reviewed test-alert to send a test alert email Privacy and data handling Everything stays in your WordPress database. Logs live in {prefix}alfmcp_requests and detected events in {prefix}alfmcp_security_events. There is no telemetry, no third-party call, and no external dependency at runtime. Credential-bearing headers including Authorization, Cookie, and X-Api-Key are replaced with [redacted] before anything is written, so the log never becomes a store of replayable credentials. Add your own header names with the alfmcp_sensitive_headers filter. Request and response bodies are stored up to 64 KB each and truncated beyond that, adjustable with alfmcp_max_body_bytes. You control retention and can clear everything from the admin screen or over REST. Disclaimer MCP Logs is not affiliated with, endorsed by, or sponsored by any AI provider or the Model Context Protocol project. “MCP” and “Model Context Protocol” are referenced solely to describe the open protocol that this plugin observes. Privacy Policy MCP Logs records REST API requests that contain the Mcp-Session-Id header. Logged data includes request routes, methods, headers, bodies, response data, user IDs, and timestamps. Credential-bearing headers are redacted before storage. All data is stored in your WordPress database and is never transmitted to external services.

Code Engine is a snippets manager that doesn’t stop at snippets. Yes, it runs your PHP and JavaScript exactly where and when you want: frontend, backend, on a schedule, or inside your content. But its real magic is what happens after you write a function: the same little piece of code instantly becomes a tool your AI chatbots can call, a step you can drag into a visual workflow, and an endpoint the outside world can trigger. One function, three superpowers. Most “code snippets” plugins stop at a textarea and a toggle. Code Engine treats your functions as first-class building blocks for the whole Meow Apps ecosystem, and for anything that can speak REST. Think out of the box, let your creativity flow, because the possibilities really are endless! ✨ For more, check the official website and come say hi on the Discord. Quick Intro Hello! ☀️ I built Code Engine because I was tired of pasting mystery snippets into functions.php and praying. I wanted a place where small bits of code are organized, safe, AI-assisted, and reusable everywhere. Here’s the idea. You write a function (or let the AI write it for you from a plain-English description). That function immediately shows up in three places: AI Engine: your chatbots and MCP clients (Claude, ChatGPT, Claude Code) can call it as a tool, with real arguments. Ask “how many orders shipped today?” and your chatbot runs your function to answer. Workflow Engine: your function appears in the step picker as its very own block. Drag it onto the canvas, wire it between an AI step and a Slack step, done. No glue code. REST / External tools: give it a secure endpoint and a token, then trigger it from Make.com, n8n, Zapier, a cron job, or a webhook. You never wrote an “integration.” You just wrote a function. Code Engine did the rest. 🤝 Core Modules 🧩 Snippets Manager Backend, Frontend, Persistent, Scheduled, Functions, and in-content (PHP/JS) snippets, all in one clean dashboard with tags, search, scope filters, and priorities. 🪄 AI-Assisted Coding Describe what you want in plain English and let AI Engine write the snippet: code, name, arguments, and scope included. Refine existing code or implement it straight from your comments. 🤖 Functions as AI Tools Every Function snippet becomes a function-calling tool and an MCP tool, so your AI Engine chatbots (and external AI agents) can actually do things on your site, not just talk. 🔀 Functions as Workflow Steps Workflow Engine surfaces each of your functions as its own draggable step. Your custom logic becomes a first-class citizen on the automation canvas. 🌐 External Access (REST) Expose any runnable snippet through a secured REST endpoint with a bearer token. Perfect for Make.com, n8n, webhooks, and scheduled external jobs. 🛡️ Safe Mode A snippet that throws a fatal error is automatically caught and disabled before it can take your site down. Code with confidence. ⏰ Scheduling Run a snippet daily at a chosen time via WP-Cron (reports, cleanups, syncs) without touching the server crontab. 🧱 Code Blocks & Shortcodes (Pro) Drop PHP or JS straight into a post or page with a Gutenberg block or the [code-engine] shortcode, with safety guards. 🧩 Snippets, the way they should be Code Engine organizes your code by scope, so each snippet runs exactly where it belongs: Persistent: runs everywhere (frontend and backend). Your everyday “add this to functions.php” code, but managed. Frontend: runs only on the public site. Backend: runs only in the admin. Function: a named, callable function with typed arguments and defaults. This is the reusable building block (see below). Scheduled: runs on a WP-Cron schedule, at the hour and minute you pick. Content (PHP / JS): runs inside a specific post or page, via a Gutenberg Code Block or the [code-engine] shortcode (Pro). Everything is searchable, taggable, sortable by priority, and importable/exportable. The CodeMirror editor gives you proper syntax highlighting and keyboard shortcuts (Cmd+S to save, Cmd+Enter to run). A nikic/php-parser pass validates your PHP before it ever runs. 🪄 Let AI write it for you Don’t feel like writing the boilerplate? Describe the snippet in plain language and Code Engine, powered by AI Engine, generates the whole thing: the code, a sensible name, a description, the right scope, and, for functions, the argument list with names, types, and defaults. Already have code? Ask the AI to modify it from a prompt, or write a few comments describing what you want and let it fill in the implementation. It’s pair programming, right inside your dashboard. ✨ The big idea: write once, use everywhere This is what makes Code Engine different. A Function snippet is not just code you call from other code. It’s a reusable capability that the rest of your stack can plug into. The moment you save it, the same function is available in three places at once: 1. As an AI tool, for chatbots and AI agents With AI Engine active, your functions are exposed through function calling and over MCP (Model Context Protocol). Your on-site chatbot can run them mid-conversation, and external AI agents (Claude, Claude Code, ChatGPT, OpenClaw) can call them too. Want a chatbot that checks stock, looks up a booking, or kicks off a process? Write the function; the chatbot gains the skill. 2. As a workflow step, for automation With Workflow Engine, every active function shows up in the Add-step picker as its own block, named after your snippet, with one input per argument. Drag it onto the canvas and wire it between other steps: an AI step that summarizes, your function that saves, a Social Engine step that posts. There’s also a generic “Execute snippet (by ID / by name)” step when you want to call one dynamically. You never write integration code; your function is the integration. 3. As a REST endpoint, for the outside world Give a snippet a custom endpoint name and a bearer token, and it’s instantly callable from anywhere: POST /wp-json/code-engine/v1/snippets-endpoint/your-endpoint Pass arguments as JSON in the body, secure it with a token, and trigger it from Make.com, n8n, Zapier, GitHub Actions, or a humble cron job. Automation without a middleware bill. 🛡️ Safe by default Running arbitrary code is powerful, so Code Engine takes safety seriously: Safe Mode catches fatal errors and auto-disables the offending snippet, so a typo never white-screens your site. REST whitelisting means global snippets only run on trusted REST routes by default, so you choose what to open up. Per-snippet tokens secure your external endpoints. Validation with a real PHP parser before code is saved. For developers who want fewer guardrails, there’s a “Bypass REST Security” option and filters (mwcode_rest_authorized, mwcode_rest_whitelist) to tailor exactly what’s allowed. Works beautifully with the Meow Apps family Code Engine is one engine in a connected set, each one useful alone, magical together: AI Engine: chatbots, content generation, and MCP. Turns your functions into AI tools. Workflow Engine: visual automation. Turns your functions into draggable steps. SEO Engine: smart, lightweight AI SEO. Social Engine: schedule and automate social posts. Why Code Engine? Reusable, not throwaway Other snippet plugins give you a place to paste code. Code Engine gives you a place to build capabilities that your AI, your workflows, and your external tools can all use. Native to WordPress Clean, fast, and built the WordPress way. No clunky external dashboards, no bloat. AI-native Write snippets with AI, expose them to AI. The whole loop lives in your wp-admin. Developer friendly REST API, MCP tools, function calling, scheduling, import/export, and plenty of filters to hook into. Cared for Part of the Meow Apps family, with regular updates and a real human behind it. 💕