MCP Logs vs Easy MCP AI – Connector for Claude, ChatGPT & SEO Data

AI agents talk to WordPress sites directly now. Claude, ChatGPT, Cursor, and a growing list of MCP clients can connect to your site, read content, place orders, edit posts, or call any custom tool you expose. The Model Context Protocol (MCP) is the open standard that makes this possible. The problem is that by default you cannot see any of it. Requests arrive, things change, and there is no record of what an agent did, when it did it, or which user it acted as. MCP Logs writes a row for every MCP request the moment it hits your site. You get the route, the ability that was called, the user it acted as, the request body, the response, and whether it succeeded. All of it is browsable in a React admin page built with @wordpress/components, so it looks and behaves like the rest of WordPress. Version 1.1.0 adds the other half: detection rules that watch the traffic as it arrives, email alerts when one trips, and a kill switch that stops all MCP access in one click. A log you can actually search Filter by date range, ability name, and user. Sort any column, set page size between 10 and 500, and run full-text search across stored request and response bodies. Click a row to open the request and response in collapsible panels, copy either to your clipboard, or trace a single agent session end to end. Export the current view to CSV when you need to hand findings to someone else. Detection rules that run on every request Three rules evaluate after each logged request: Request velocity per session. Catches an agent stuck in a loop. Destructive tool use. Watches a list of abilities you nominate. It can populate that list for you by scanning previously seen tool names for delete, remove, and drop. Error storms. Catches an integration that has started failing. Each rule has its own enable toggle, threshold, time window, severity, and auto-disable setting. Detected events land in a Security Events tab with filters, stat cards, CSV export, and a per-event “mark as reviewed” so your queue reflects what you have already handled. Open any event and Session Replay steps through the full request timeline for that MCP session. Alerts arrive as HTML email stating whether the offending request ran or was blocked, with a one-click, nonce-protected link to disable MCP access. A 15-minute cooldown per rule and per session stops an alert storm. There is an optional daily digest, separate recipient lists for alerts and digests, and a test button so you can confirm delivery before you rely on it. A kill switch that keeps the record Turn off all MCP access from the admin screen, or let a detection rule trip it for you. Blocked requests are still logged before they are rejected, so the audit trail stays complete while access is off. Callers get a 503 explaining why access was disabled and when. A site-wide admin notice stays up until you turn it back on. Works with whichever MCP server you run MCP Logs is not an MCP server for your site and does not expose your content to agents. It detects requests by the Mcp-Session-Id header, which is part of the MCP transport spec, so traffic from any compliant server lands in the same table. If your site runs more than one, you get one log instead of several. Built for both halves of the audience If you run the site: install, activate, and open Tools then MCP Logs. There is no setup screen and no configuration. Logging starts the moment an MCP client makes a request. If you build on it: there is a full REST API covering every admin feature, authenticated via WordPress Application Passwords or WooCommerce API keys. The plugin is also MCP-aware itself, registering a server with ten abilities so an agent can introspect its own activity log. Source ships under src/ and builds with npm run build. Why log deletion is not exposed to AI agents The plugin registers ten MCP abilities. The two log-deletion abilities, clear-old-logs and clear-all-logs, are deliberately left out of that set. The same tool set reads log content that an untrusted caller can influence. Pairing that with a one-call wipe would let planted text steer an administrator’s agent into erasing the audit trail. Deletion stays available in the admin screen and over REST, where a human is doing it. Sites that accept the trade-off can re-add the abilities with the alfmcp_mcp_server_abilities filter. REST API Eighteen endpoints under /wp-json/activity-log-for-mcp/v1/: GET /requests for a list with filters, sort, and pagination GET /stats for totals, success rate, and calls per ability GET /sessions/{id} for every request in a session, in order GET /search for full-text search across routes, abilities, and bodies GET /errors for recent failed executions and HTTP errors GET /tool-performance for per-ability call count, error rate, and unique users GET /filters for distinct ability names and users GET /export-csv for a server-side streamed CSV download DELETE /requests to clear all logs DELETE /retention to delete logs older than a given date GET /security-events for detected events with filters and pagination GET /security-events/stats for alert counts, active sessions, and top rule over 7 days GET /security-events/export-csv for a CSV of detected events PUT /security-events/{id}/acknowledge to mark an event reviewed DELETE /security-events/clear-acknowledged to remove reviewed events GET|PUT /security-settings to read or update detection and alerting settings POST /security-settings/test-alert to send a test alert email MCP abilities The plugin registers an MCP server (activity-log-for-mcp-server) with ten abilities: get-activity for paginated log retrieval with filters get-stats for summary metrics with an optional date range get-activity-by-session for a full session trace, with optional body exclusion for lighter payloads search-activity for full-text search across stored requests and responses analyze-errors for recent errors with full details get-tool-performance for per-ability performance metrics get-security-events for detected events with filters get-security-stats for alert counts, active sessions, and top rule over 7 days acknowledge-event to mark a security event reviewed test-alert to send a test alert email Privacy and data handling Everything stays in your WordPress database. Logs live in {prefix}alfmcp_requests and detected events in {prefix}alfmcp_security_events. There is no telemetry, no third-party call, and no external dependency at runtime. Credential-bearing headers including Authorization, Cookie, and X-Api-Key are replaced with [redacted] before anything is written, so the log never becomes a store of replayable credentials. Add your own header names with the alfmcp_sensitive_headers filter. Request and response bodies are stored up to 64 KB each and truncated beyond that, adjustable with alfmcp_max_body_bytes. You control retention and can clear everything from the admin screen or over REST. Disclaimer MCP Logs is not affiliated with, endorsed by, or sponsored by any AI provider or the Model Context Protocol project. “MCP” and “Model Context Protocol” are referenced solely to describe the open protocol that this plugin observes. Privacy Policy MCP Logs records REST API requests that contain the Mcp-Session-Id header. Logged data includes request routes, methods, headers, bodies, response data, user IDs, and timestamps. Credential-bearing headers are redacted before storage. All data is stored in your WordPress database and is never transmitted to external services.

Easy MCP AI is the most complete free WordPress MCP server — a remote MCP server built so AI assistants and autonomous AI agents can run your entire site workflow, from content and publishing to SEO research, traffic monitoring, and daily admin, through the Model Context Protocol. It works as an MCP adapter for any MCP-compatible AI client, making your site agent-ready out of the box. Ask your AI about Google Analytics, Google Search Console, and SEO data without leaving your chat. You bring the direction. Your AI handles the execution. No Node.js. No external proxy. No complicated setup. Just install, generate a token, and start building. At a glance: 243 tools — 96 core WordPress tools (posts, pages, media, users, comments, menus, taxonomies, change history, and more), 93 plugin-integration tools (WooCommerce, ACF, The Events Calendar, BuddyPress, and 6 SEO plugins), and 54 data-integration tools (Google Analytics 4, Google Search Console, Semrush, SE Ranking, DataforSEO, Ahrefs) 1-click OAuth 2.0/2.1 with per-scope consent (Claude Desktop, Cursor, etc.) Plugin integrations — WooCommerce, ACF, The Events Calendar, BuddyPress, and SEO plugins (Yoast, Rank Math, AIOSEO, SEOPress, Slim SEO, The SEO Framework) Google Analytics 4 & Google Search Console — ask your AI about traffic, top pages, conversions, search queries, clicks, impressions, and indexing status Semrush, SE Ranking, DataforSEO & Ahrefs — ask your AI for SEO and competitive research: keyword and backlink data, organic competitors, SERP results, rank tracking, and AI-search visibility (Ahrefs Domain Rating needs a free Ahrefs API key) Auto-discovers WordPress 6.9+ Abilities API Full audit trail — every AI action on your site is logged in a searchable user activity log Change History — every MCP-originated write (posts, meta, terms, users, options, comments, WooCommerce, BuddyPress) is recorded with before/after snapshots and queryable via 3 dedicated wp_history_* tools Works With Every Major AI Connect any of the following AI assistants or AI agents to your site through the WordPress MCP endpoint — full integration guides here: Manus — the autonomous AI agent that can run multi-step workflows start to finish Claude (Claude.ai, Claude Desktop, Claude Code) — connect Claude to WordPress in one click via OAuth ChatGPT (OpenAI) — connect ChatGPT to WordPress and manage your entire site by chat Gemini AI (Antigravity CLI / Google Antigravity) — Google’s AI tools with MCP support Cursor, Windsurf, Cline, Roo Code — AI-powered code editors that can also manage your content n8n — automation for content pipelines and publishing workflows Any MCP-compatible client — the protocol is open and supported by a growing ecosystem What Can Your AI Do On Your Site? Once connected, your AI agent can handle everything you’d normally do in the WordPress admin: AI Content Writing & Publishing — let your AI agent draft, rewrite, SEO-optimize, schedule, and publish WordPress posts and pages; update existing posts and pages AI Media Library & Alt Text — upload images from chat, browse the media library, and auto-generate AI alt text and captions for SEO and accessibility Taxonomy & Navigation — manage categories, tags, term meta, and WordPress navigation menus; assign terms from any taxonomy to posts User Management — create WordPress user accounts, assign roles, update profiles, and manage user meta Plugins & Themes — list installed plugins and themes; see which theme is currently active WordPress Settings — read and update site title, tagline, timezone, date format, time format, and posts-per-page WooCommerce AI Agent — manage WooCommerce products, variations, attributes, orders, customers, coupons, and webhooks; view order refunds, shipping zones, shipping methods, tax rates, and payment gateways; pull sales, top-seller, and revenue reports; bulk update products, variations, and orders SEO with Yoast, Rank Math, AIOSEO, SEOPress, Slim SEO & The SEO Framework — read and update post (and term) SEO metadata across all six major SEO plugins: SEO titles, meta descriptions, canonical URLs, robots and advanced-robots directives, Open Graph and Twitter card fields, focus / target keywords, primary term, breadcrumb titles, and schema / cornerstone / pillar settings Advanced Custom Fields (ACF) — read and write ACF custom field values on posts and users; read ACF fields on taxonomy terms; list ACF field groups Events Calendar & BuddyPress — create, edit, and delete events with The Events Calendar; create and view venues; create and list organizers; list BuddyPress members, groups, group members, and private message threads; create and delete activity stream posts Comment Moderation — let AI list, approve, hold, mark as spam, edit, or delete WordPress comments Change History & Rollback Awareness — every write your AI makes is recorded with structured before/after snapshots. Ask “what did the AI change on this post last week?”, diff any two revisions, or audit per-user activity through the wp_history_list, wp_history_get, and wp_history_diff tools — plus a full Change History admin page with retention and on/off controls Gutenberg & Full Site Editing — create, edit, and reuse Gutenberg blocks; update block templates and global styles for FSE themes Custom Post Types (CPT) — read and write any registered custom post type — portfolios, listings, courses, reviews, anything Google Analytics 4 — ask about traffic, top pages, conversions, custom dimensions/metrics, and realtime active users Google Search Console — ask about top search queries, clicks, impressions, sitemaps, and URL indexing status Semrush — pull domain overviews, keyword research, organic keywords, organic competitors, keyword difficulty and related keywords, question phrases, and backlink overview / referring domains / anchors for any target SE Ranking — pull domain overviews (regional and worldwide), keyword and backlink research, organic competitors, top pages, keyword comparisons, and AI-search visibility (how a domain appears in Google AI Overviews, ChatGPT, Perplexity, and Gemini) for any domain DataforSEO — run on-page SEO audits on any URL, check keyword search volumes and trends, pull live SERP results, analyse backlinks, and look up ranked and site keywords for any domain Ahrefs — look up the Domain Rating (backlink-profile strength, 0–100) for any domain or URL; needs a free Ahrefs APIv3 key, which costs nothing and uses no API units Any Plugin — automatically connects to plugins that support WordPress 6.9+ Abilities API, no custom code needed Ask your AI anything — for example: * “Write a 500-word blog post about healthy eating and publish it as a draft” * “Show me today’s WooCommerce orders and their total revenue” * “What keywords does my homepage rank for and what are the click counts?” Tools 243 Tools, Ready to Use 96 core tools cover every major WordPress content type — posts, pages, media, categories, tags, custom taxonomies, comments, users, menus, custom post types, post/term/user meta, revisions, Gutenberg blocks, templates, global styles, site settings, plugins, themes, and full-text search. Each type supports create, read, update, delete and more, plus conveniences like one-call full-post reads, find-and-replace in post content, and AI alt-text on media. 11 Google Analytics 4 Tools Account & Property — list account summaries, get property details, check compatibility, get metadata Reports — run standard reports, pivot reports, and realtime reports Configuration — list data streams, conversion events, custom dimensions, and custom metrics 6 Google Search Console Tools Sites — list verified properties Search Analytics — query top search terms, pages, countries, devices with clicks, impressions, CTR, and position Sitemaps — list and inspect submitted sitemaps URL Inspection — check indexing status and coverage for any URL on your site 13 Semrush Tools Domain — domain overview and organic competitor research Keywords — keyword research tools: domain organic keywords, URL organic keywords, keyword overview, related keywords, keyword difficulty, and phrase questions Backlinks — backlinks overview, backlinks list, referring domains, and anchors 15 SE Ranking Tools Domain — regional and worldwide domain overviews, organic keywords, organic competitors, top pages/subdomains, and keyword comparisons Keywords — keyword research (similar, related, questions, long-tail) and multi-keyword overview with volume, CPC, and difficulty Backlinks — backlink summary, detailed backlinks / anchors / referring domains, and domain authority (InLink Rank) AI Search — AI-search visibility across Google AI Overviews, ChatGPT, Perplexity, and Gemini, plus brand discovery and AI prompts 8 DataforSEO Tools SERP — fetch live search engine results pages for any keyword and location Keywords — look up monthly search volume and trend data for one or more keywords Labs — get ranked keywords for any domain, or find keywords a specific page ranks for Backlinks — get a backlink summary and list of referring domains for any target URL On-Page — run a full on-page SEO audit on any URL and get a list of actionable issues 1 Ahrefs Tool Domain Rating — look up the Ahrefs Domain Rating (0–100) for any domain or URL. Needs a free Ahrefs APIv3 key (no cost, no API units). Attribution “Domain Rating by Ahrefs” is required when displaying the value. 10 Plugin Integrations WooCommerce — 46 WooCommerce AI tools for products, orders, customers, coupons, shipping, reports, and more Advanced Custom Fields (ACF) — 6 tools to get and update ACF fields on posts, users, and terms; list ACF field groups The Events Calendar — 10 tools to create and manage events, venues, and organizers BuddyPress — 10 tools for members, activity stream, groups, group members, and private messages Yoast SEO — get and update post SEO metadata, plus rendered SEO head output Rank Math — get and update post SEO metadata, plus rendered SEO head output All in One SEO (AIOSEO) — get and update post SEO metadata, plus breadcrumb data SEOPress — get and update post and term SEO metadata, plus content analysis Slim SEO — get and update post SEO metadata The SEO Framework — get and update post SEO metadata Connect Any Plugin with Abilities API WordPress 6.9+ introduces Abilities API — a standard way for plugins to declare what they can do. Easy MCP AI acts as an MCP adapter for any plugin that registers Abilities — automatically discovering and exposing them as MCP tools with no custom code needed. If a plugin supports the Abilities API, your AI can use it out of the box. One-Click Connect with OAuth 2.0/2.1 Skip manual token copy-paste. Your WordPress MCP endpoint ships with a full OAuth 2.0/2.1 authorization server — PKCE, refresh-token rotation, and Dynamic Client Registration (RFC 7591) built in. Compatible MCP clients like Claude Desktop can connect with a single click: they register themselves, you approve the scopes on a consent screen, and you’re done. Bearer tokens still work for power users and automation. Built for Security Giving an AI access to your site is serious — so security is built into every layer: Bearer token authentication with SHA-256 hashing — the raw token is never stored Per-token permissions — create a read-only token for one AI, a full-access token for another WordPress capability checks on every single tool call Rate limiting per token (default 60 requests/min, configurable) Full audit trail — every tool call is logged in a searchable user activity log with the token used, arguments, result, and client IP IP whitelisting — optionally restrict which IPs can use the MCP endpoint Simple Admin Interface Dashboard — your MCP endpoint URL and one-click connection configs for every major AI client API Tokens — create and manage tokens with a checkbox-based tool permission tree Audit Log — a paginated, searchable user activity log of every AI action taken on your site Change History — a dedicated page with before/after snapshots of every MCP-originated write, inline diff expand, and user / object / date filtering Settings — tune rate limits, audit and change-history retention, IP whitelist, and more External services This plugin connects to the following third-party services only after a site administrator explicitly enables them in Easy MCP AI → External Data (by saving their own external account credentials). Nothing is contacted on a default install. Ahrefs Domain Rating API — api.ahrefs.com When: only after an administrator saves an Ahrefs APIv3 key and enables the tool under Easy MCP AI → External Data → Ahrefs (it is OFF by default — nothing is contacted on a default install). Thereafter: when an authorized MCP client calls the wp_ahrefs_domain_rating_free tool, and once each time an administrator saves the key or presses Test Connection on the External Data screen (both validate the key against Ahrefs). What is sent: your Ahrefs APIv3 key, as an Authorization: Bearer header, plus the target domain or URL supplied with the call. No WordPress credentials or personal data are transmitted. Terms: https://ahrefs.com/legal/domain-rating-license Privacy: https://ahrefs.com/legal/privacy-policy Semrush API — api.semrush.com, www.semrush.com When: only if an admin saves a Semrush API key. What is sent: the configured Semrush API key plus the parameters supplied per call (target domain, target URL, keyword/phrase, database/region code, display limits). Terms: https://www.semrush.com/company/legal/terms-of-service/ Privacy: https://www.semrush.com/company/legal/privacy-policy/ DataForSEO — api.dataforseo.com When: only if an admin saves a DataForSEO account login + API password. What is sent: the configured DataForSEO login + API password (HTTP Basic auth), plus the parameters supplied per call (keyword, target domain, target URL, location code, language code). Terms: https://dataforseo.com/terms-of-use Privacy: https://dataforseo.com/privacy-policy SE Ranking API — api.seranking.com When: only if an admin saves a SE Ranking API key. What is sent: the configured SE Ranking API key (sent as an Authorization token) plus the parameters supplied per call (target domain, target URL, keyword, region/source code, search engine, display limits). Terms: https://seranking.com/legal/terms-of-service.html Privacy: https://seranking.com/legal/privacy-statement.html Google Analytics 4 Data API & Google Search Console API — analyticsdata.googleapis.com, searchconsole.googleapis.com / www.googleapis.com/webmasters/v3 (token exchange via oauth2.googleapis.com) When: only if an admin uploads a Google service-account JSON. What is sent: a signed JWT minted from the service-account key, plus the chosen target and per-call parameters — for Analytics, the GA4 property id and report definition (dimensions, metrics, date range, filters); for Search Console, the site URL and query parameters (date range, dimensions, URL to inspect, sitemap URL). Terms: https://policies.google.com/terms Privacy: https://policies.google.com/privacy Easy MCP AI connection diagnostics (optional) — easymcpai.com When: only if you click the Diagnose Connection button on the Easy MCP AI dashboard. The plugin never contacts this service on its own — it simply opens the page in a new browser tab. What is sent: only your site’s address (its hostname), so the diagnostic page can check that your MCP endpoint is reachable. No credentials, content, or personal data are sent. Privacy: https://easymcpai.com/privacy Author Developed by EasyMCPAI.