Easy MCP AI – Connector for Claude, ChatGPT & SEO Data vs Alpaca Bot

Alpaca Bot is a chat screen inside WordPress admin, talking to a model you host. Conversations stay on your site, in your own database, and only their author can open them. It runs against Ollama out of the box, or any OpenAI-compatible endpoint. Features A chat screen in wp-admin: replies stream in as they are written, with a copy button on every message and code block, “Edit and resend” on your own, and an image attached from the media library for a model that can see. Your conversations, stored privately on your site (or not at all: the Privacy tab decides) and listed in the screen’s history. Switch models per conversation; where the site allows it, your pick is remembered as your default. A system prompt, per-model overrides (temperature, context window, keep-alive) and a receipt under every reply: model, tokens, time. Monthly usage caps, per site and per user, with the meter behind them. A REST API under alpaca-bot/v1 (docs/api.md) and a WP-CLI command. Requirements PHP 8.4+, WordPress 6.9+, an Ollama instance (or any provider php-agents supports) Setup Install Ollama on your localhost or server. In your WordPress admin, open Alpaca Bot > Settings and, on the Provider tab, enter the endpoint’s base URL. For Ollama it ends in /v1: http://localhost:11434/v1. Click Save Changes. The Models tab then lists what the provider serves; pick a default. ⭐️ Become a Patreon and support Alpaca Bot development. ⭐️ Usage The chat screen Click Alpaca Bot in the admin menu, below Dashboard and above Posts. The screen is open to every user who can edit posts (filter alpaca_bot/admin/menu_capability to change that). The model select in the header picks the model for this conversation; where the site allows it, your pick is saved as your default. The history select opens one of your earlier conversations, and New chat starts a fresh one. Type in the box at the foot of the screen. Enter sends, Shift+Enter adds a line, Escape clears the box. The image button attaches a picture from the media library to your next message, for a model that can see. The largest image the screen takes is set by the site’s PHP post_max_size, not its upload limit: the image travels inside the message, not as an upload. Replies stream in as they are written. Every message has a Copy button, your own have Edit and resend, and a code block has its own copy button. Under a reply is its receipt: the model, the tokens it used and how long it took. The Help tab at the top right of the screen repeats this, and documents the shortcodes. Settings Alpaca Bot > Settings (administrators) is one page in six tabs: **Provider** (the endpoint, its key, the timeout), **Models** (the default, temperature, context window, keep-alive, and per-model overrides), **Chat** (system prompt, welcome text, what users may change), **Privacy** (whether conversations and the usage log are stored, and for how long), **Limits** (monthly token caps for the site and per user) and **Tools** (what the model may do besides answer — read the next section before you leave those as they come). Every field is also readable and writable over the REST API (`GET`/`PUT /settings`). Tools, and what they let the model reach Settings > Tools switches the model's tools on and off. Three ship, **all three on by default**: `web_fetch` reads one public web page as text, `summarize` condenses text through the model, and `draft_post` writes a draft. Read this section before you leave `web_fetch` on, and before you open the chat to a role. web_fetch makes the web server send a request, and hands the reply back. Every URL is checked twice before the fetch — WordPress’s own wp_http_validate_url(), then the plugin’s own check over every address the name resolves to, on the first URL and on every redirect — and http(s) only, ports 80/443/8080 only, no private, loopback, link-local or other special-purpose address. What no check of that shape can cover is a name whose answer changes between the check and the connection: each is a separate DNS lookup, so a host under someone else’s control, with a short TTL, can answer the checks with a public address and the connection with 127.0.0.1 or a cloud metadata address. The response body then comes back as text. Closing that means pinning the resolved address into the transport, which is a compatibility project and is planned for a later 0.x release. Who can reach it, today, with no model involved: anyone who can edit posts — a Contributor included, since core grants Contributors edit_posts — can put [alpacabot_agent name="get" url="…"] in their own draft and preview it. So treat web_fetch as a capability you are granting your authors, not as something only the model uses. An egress policy is the supported mitigation, and it is the one that holds for every plugin on the site at once: stop the web server’s host from opening outbound connections to your private ranges and to 169.254.169.254, at the network or the host firewall. On a cloud instance, require IMDSv2. If you cannot do that and do not need the tool, leave web_fetch off — the chat, the drafts and the summaries all work without it. Opening a route to a role opens the tools to that role too. alpaca_bot/capability/chat (and chat/stream) can name any capability, read and exist included, and that is deliberate — it is how a site builds a subscriber-facing or public chat. But the toolkits a turn may call are chosen by the toolkits.enabled setting alone: there is no second capability check between a role that may chat and the tools that are switched on. So a role you admit only to converse gets web_fetch with it. Only draft_post checks a capability of its own (edit_posts/edit_pages) and refuses a role that lacks it. Until a later 0.x release adds a floor of its own, use the alpaca_bot/toolkits filter to take web_fetch away from the users you are opening the chat to: add_filter( 'alpaca_bot/toolkits', function ( array $toolkits, int $user_id ): array { if ( ! user_can( $user_id, 'edit_posts' ) ) { unset( $toolkits['web_fetch'] ); } return $toolkits; }, 10, 2 ); REST API and WP-CLI Everything the screen does is a route under alpaca-bot/v1: a turn (POST /chat, then its stream as server-sent events), conversations, models, settings and usage. docs/api.md is the reference, with authentication, streaming and error examples. From the command line, wp alpaca-bot chat|models|usage|settings does the same. Shortcodes Both 0.4 shortcodes are back on the new pipeline. Both are for logged-in users who can edit posts (edit_posts); anyone else sees a notice. [alpacabot prompt="…"] Puts the model’s answer to the prompt in a post or page. prompt — The message sent to the model. Without it, the shortcode is the chat screen (below). model — the viewing editor’s model — The model, where the site lets users change it (Settings › Chat); it must be one the provider lists. Without it, the answer runs on the model the editor who first views the page would chat on (their own preference where the site lets users change it, else the site’s default), and the cache does not record which. system — the site’s system prompt — The system prompt for this answer. temperature — the model’s setting — The temperature for this answer, 0 to 2. format — markdown — markdown renders the answer (raw HTML stripped, links kept); text shows it as plain, escaped text. cache — 1h — How long the answer is kept: a number with a unit (45s, 30m, 1h, 2d), a year at most. off generates on every view. Anything else keeps the default. Generating an answer costs provider tokens and counts against the monthly cap of the user viewing the page, so it is cached (a transient, per shortcode, per post and per cache duration) and served from the cache until it expires. Two identical shortcodes on two pages are two answers; changing the site’s system prompt starts a new answer, changing its default model does not (the model is part of the answer’s identity only when the shortcode names one). When a turn fails, the page shows why in the words the chat uses (the cap, a model the provider does not list, or a fixed “could not complete” message: the provider’s own error, which quotes its endpoint, goes to the debug log under WP_DEBUG), and nothing is cached. The block editor and the REST API never generate. content.rendered carries the cached answer, or a notice when there is none; an answer is generated only when the page is viewed on the site. So a client listing a hundred posts over the API spends nothing, and the editor’s preview shows what the cache holds. A generation counts against the same per-minute limit as the chat. Thirty a minute per user, shared with the chat screen, the REST routes and the abilities, and moved everywhere at once by the alpaca_bot/rate_limit filter (bucket chat). A cached answer costs nothing; a page carrying more shortcodes than the minute allows shows the rest as a “Too many requests” notice, caches nothing for them, and fills them in on a view after the minute turns over. Anyone who can write a post can write a prompt. A Contributor can put a prompt, and a system prompt, in a draft; once it is published, the first user with edit_posts to view the page generates the answer, the tokens count against that viewer’s cap, and the answer is on the page for everyone without anyone having read it first. The markdown is sanitised (no scripts, no raw HTML), but links and images the model writes reach the public page. Review a page after its answer appears. A per-site capability setting for this belongs to the admin-wide panel of a later 0.x release. A visitor never triggers a generation. A visitor, or a logged-in user who cannot edit posts, sees a notice in place of the answer. A site that wants visitors to see the answer returns true from the alpaca_bot/shortcode/allow_guests filter ((bool $allow, int $postId, string $tag)); they then see the cached answer and nothing else. When the cache has expired, visitors see the notice again until someone who can edit posts opens the page. That is the point: a page nobody with the capability opens spends nothing, whatever the model costs. add_filter('alpaca_bot/shortcode/allow_guests', '__return_true'); [alpacabot] With no prompt, the chat screen on a page, for logged-in users who can edit posts, with the same bundle and stylesheet as in wp-admin (a front-end design of its own is a later 0.x release). A visitor sees a login notice and loads nothing. The REST API and the block editor show a notice in its place, as for a prompt. The screen’s markup carries the viewing user’s REST nonce, as it does in wp-admin; it is useless without their cookies, but a full-page cache set to cache pages for logged-in users would store one editor’s page and serve it to another, so leave a page carrying the shell out of such a cache. [alpacabot_agent name="get|summarize" url="…" length="…"] (deprecated) The 0.4 form still works, under the same rules and cache: get shows the page’s readable text, summarize fetches it and asks the model for a summary (length is free text, “2 sentences”; model and cache as above). The fetch is the chat’s web_fetch tool itself, so it runs only while that tool is on under Settings › Tools, and through the same address guard: a private, local or non-http(s) address is refused. It logs a deprecation notice once per request under WP_DEBUG and goes away in a later 0.x release. Put the text to summarize in a prompt instead, or open the URL in the chat, where the fetch and summarize tools read it for you: [alpacabot prompt="Summarize https://…"] would not work, since a shortcode’s turn runs no tools and the model cannot open the URL. Support Questions and bug reports go to the WordPress.org support forum. Say which plugin, WordPress and PHP versions you run. For premium support, book a call: video calls, help setting up your Ollama instance or provider, troubleshooting, and onsite setup assistance. If the plugin has been useful, star Alpaca Bot on GitHub; a star helps other site owners find it. Made Possible By Emma Delaney’s How to Create Your Own ChatGPT in HTML CSS and JavaScript Lucide Beautiful & consistent icons – ISC license htmx High power tools for HTML – 0BSD license league/commonmark Markdown parser for PHP – BSD-3-Clause license php-agents Provider-agnostic AI agents for PHP – MIT license Ollama Get up and running with large language models locally – MIT license

Easy MCP AI is the most complete free WordPress MCP server — a remote MCP server built so AI assistants and autonomous AI agents can run your entire site workflow, from content and publishing to SEO research, traffic monitoring, and daily admin, through the Model Context Protocol. It works as an MCP adapter for any MCP-compatible AI client, making your site agent-ready out of the box. Ask your AI about Google Analytics, Google Search Console, and SEO data without leaving your chat. You bring the direction. Your AI handles the execution. No Node.js. No external proxy. No complicated setup. Just install, generate a token, and start building. At a glance: 243 tools — 96 core WordPress tools (posts, pages, media, users, comments, menus, taxonomies, change history, and more), 93 plugin-integration tools (WooCommerce, ACF, The Events Calendar, BuddyPress, and 6 SEO plugins), and 54 data-integration tools (Google Analytics 4, Google Search Console, Semrush, SE Ranking, DataforSEO, Ahrefs) 1-click OAuth 2.0/2.1 with per-scope consent (Claude Desktop, Cursor, etc.) Plugin integrations — WooCommerce, ACF, The Events Calendar, BuddyPress, and SEO plugins (Yoast, Rank Math, AIOSEO, SEOPress, Slim SEO, The SEO Framework) Google Analytics 4 & Google Search Console — ask your AI about traffic, top pages, conversions, search queries, clicks, impressions, and indexing status Semrush, SE Ranking, DataforSEO & Ahrefs — ask your AI for SEO and competitive research: keyword and backlink data, organic competitors, SERP results, rank tracking, and AI-search visibility (Ahrefs Domain Rating needs a free Ahrefs API key) Auto-discovers WordPress 6.9+ Abilities API Full audit trail — every AI action on your site is logged in a searchable user activity log Change History — every MCP-originated write (posts, meta, terms, users, options, comments, WooCommerce, BuddyPress) is recorded with before/after snapshots and queryable via 3 dedicated wp_history_* tools Works With Every Major AI Connect any of the following AI assistants or AI agents to your site through the WordPress MCP endpoint — full integration guides here: Manus — the autonomous AI agent that can run multi-step workflows start to finish Claude (Claude.ai, Claude Desktop, Claude Code) — connect Claude to WordPress in one click via OAuth ChatGPT (OpenAI) — connect ChatGPT to WordPress and manage your entire site by chat Gemini AI (Antigravity CLI / Google Antigravity) — Google’s AI tools with MCP support Cursor, Windsurf, Cline, Roo Code — AI-powered code editors that can also manage your content n8n — automation for content pipelines and publishing workflows Any MCP-compatible client — the protocol is open and supported by a growing ecosystem What Can Your AI Do On Your Site? Once connected, your AI agent can handle everything you’d normally do in the WordPress admin: AI Content Writing & Publishing — let your AI agent draft, rewrite, SEO-optimize, schedule, and publish WordPress posts and pages; update existing posts and pages AI Media Library & Alt Text — upload images from chat, browse the media library, and auto-generate AI alt text and captions for SEO and accessibility Taxonomy & Navigation — manage categories, tags, term meta, and WordPress navigation menus; assign terms from any taxonomy to posts User Management — create WordPress user accounts, assign roles, update profiles, and manage user meta Plugins & Themes — list installed plugins and themes; see which theme is currently active WordPress Settings — read and update site title, tagline, timezone, date format, time format, and posts-per-page WooCommerce AI Agent — manage WooCommerce products, variations, attributes, orders, customers, coupons, and webhooks; view order refunds, shipping zones, shipping methods, tax rates, and payment gateways; pull sales, top-seller, and revenue reports; bulk update products, variations, and orders SEO with Yoast, Rank Math, AIOSEO, SEOPress, Slim SEO & The SEO Framework — read and update post (and term) SEO metadata across all six major SEO plugins: SEO titles, meta descriptions, canonical URLs, robots and advanced-robots directives, Open Graph and Twitter card fields, focus / target keywords, primary term, breadcrumb titles, and schema / cornerstone / pillar settings Advanced Custom Fields (ACF) — read and write ACF custom field values on posts and users; read ACF fields on taxonomy terms; list ACF field groups Events Calendar & BuddyPress — create, edit, and delete events with The Events Calendar; create and view venues; create and list organizers; list BuddyPress members, groups, group members, and private message threads; create and delete activity stream posts Comment Moderation — let AI list, approve, hold, mark as spam, edit, or delete WordPress comments Change History & Rollback Awareness — every write your AI makes is recorded with structured before/after snapshots. Ask “what did the AI change on this post last week?”, diff any two revisions, or audit per-user activity through the wp_history_list, wp_history_get, and wp_history_diff tools — plus a full Change History admin page with retention and on/off controls Gutenberg & Full Site Editing — create, edit, and reuse Gutenberg blocks; update block templates and global styles for FSE themes Custom Post Types (CPT) — read and write any registered custom post type — portfolios, listings, courses, reviews, anything Google Analytics 4 — ask about traffic, top pages, conversions, custom dimensions/metrics, and realtime active users Google Search Console — ask about top search queries, clicks, impressions, sitemaps, and URL indexing status Semrush — pull domain overviews, keyword research, organic keywords, organic competitors, keyword difficulty and related keywords, question phrases, and backlink overview / referring domains / anchors for any target SE Ranking — pull domain overviews (regional and worldwide), keyword and backlink research, organic competitors, top pages, keyword comparisons, and AI-search visibility (how a domain appears in Google AI Overviews, ChatGPT, Perplexity, and Gemini) for any domain DataforSEO — run on-page SEO audits on any URL, check keyword search volumes and trends, pull live SERP results, analyse backlinks, and look up ranked and site keywords for any domain Ahrefs — look up the Domain Rating (backlink-profile strength, 0–100) for any domain or URL; needs a free Ahrefs APIv3 key, which costs nothing and uses no API units Any Plugin — automatically connects to plugins that support WordPress 6.9+ Abilities API, no custom code needed Ask your AI anything — for example: * “Write a 500-word blog post about healthy eating and publish it as a draft” * “Show me today’s WooCommerce orders and their total revenue” * “What keywords does my homepage rank for and what are the click counts?” Tools 243 Tools, Ready to Use 96 core tools cover every major WordPress content type — posts, pages, media, categories, tags, custom taxonomies, comments, users, menus, custom post types, post/term/user meta, revisions, Gutenberg blocks, templates, global styles, site settings, plugins, themes, and full-text search. Each type supports create, read, update, delete and more, plus conveniences like one-call full-post reads, find-and-replace in post content, and AI alt-text on media. 11 Google Analytics 4 Tools Account & Property — list account summaries, get property details, check compatibility, get metadata Reports — run standard reports, pivot reports, and realtime reports Configuration — list data streams, conversion events, custom dimensions, and custom metrics 6 Google Search Console Tools Sites — list verified properties Search Analytics — query top search terms, pages, countries, devices with clicks, impressions, CTR, and position Sitemaps — list and inspect submitted sitemaps URL Inspection — check indexing status and coverage for any URL on your site 13 Semrush Tools Domain — domain overview and organic competitor research Keywords — keyword research tools: domain organic keywords, URL organic keywords, keyword overview, related keywords, keyword difficulty, and phrase questions Backlinks — backlinks overview, backlinks list, referring domains, and anchors 15 SE Ranking Tools Domain — regional and worldwide domain overviews, organic keywords, organic competitors, top pages/subdomains, and keyword comparisons Keywords — keyword research (similar, related, questions, long-tail) and multi-keyword overview with volume, CPC, and difficulty Backlinks — backlink summary, detailed backlinks / anchors / referring domains, and domain authority (InLink Rank) AI Search — AI-search visibility across Google AI Overviews, ChatGPT, Perplexity, and Gemini, plus brand discovery and AI prompts 8 DataforSEO Tools SERP — fetch live search engine results pages for any keyword and location Keywords — look up monthly search volume and trend data for one or more keywords Labs — get ranked keywords for any domain, or find keywords a specific page ranks for Backlinks — get a backlink summary and list of referring domains for any target URL On-Page — run a full on-page SEO audit on any URL and get a list of actionable issues 1 Ahrefs Tool Domain Rating — look up the Ahrefs Domain Rating (0–100) for any domain or URL. Needs a free Ahrefs APIv3 key (no cost, no API units). Attribution “Domain Rating by Ahrefs” is required when displaying the value. 10 Plugin Integrations WooCommerce — 46 WooCommerce AI tools for products, orders, customers, coupons, shipping, reports, and more Advanced Custom Fields (ACF) — 6 tools to get and update ACF fields on posts, users, and terms; list ACF field groups The Events Calendar — 10 tools to create and manage events, venues, and organizers BuddyPress — 10 tools for members, activity stream, groups, group members, and private messages Yoast SEO — get and update post SEO metadata, plus rendered SEO head output Rank Math — get and update post SEO metadata, plus rendered SEO head output All in One SEO (AIOSEO) — get and update post SEO metadata, plus breadcrumb data SEOPress — get and update post and term SEO metadata, plus content analysis Slim SEO — get and update post SEO metadata The SEO Framework — get and update post SEO metadata Connect Any Plugin with Abilities API WordPress 6.9+ introduces Abilities API — a standard way for plugins to declare what they can do. Easy MCP AI acts as an MCP adapter for any plugin that registers Abilities — automatically discovering and exposing them as MCP tools with no custom code needed. If a plugin supports the Abilities API, your AI can use it out of the box. One-Click Connect with OAuth 2.0/2.1 Skip manual token copy-paste. Your WordPress MCP endpoint ships with a full OAuth 2.0/2.1 authorization server — PKCE, refresh-token rotation, and Dynamic Client Registration (RFC 7591) built in. Compatible MCP clients like Claude Desktop can connect with a single click: they register themselves, you approve the scopes on a consent screen, and you’re done. Bearer tokens still work for power users and automation. Built for Security Giving an AI access to your site is serious — so security is built into every layer: Bearer token authentication with SHA-256 hashing — the raw token is never stored Per-token permissions — create a read-only token for one AI, a full-access token for another WordPress capability checks on every single tool call Rate limiting per token (default 60 requests/min, configurable) Full audit trail — every tool call is logged in a searchable user activity log with the token used, arguments, result, and client IP IP whitelisting — optionally restrict which IPs can use the MCP endpoint Simple Admin Interface Dashboard — your MCP endpoint URL and one-click connection configs for every major AI client API Tokens — create and manage tokens with a checkbox-based tool permission tree Audit Log — a paginated, searchable user activity log of every AI action taken on your site Change History — a dedicated page with before/after snapshots of every MCP-originated write, inline diff expand, and user / object / date filtering Settings — tune rate limits, audit and change-history retention, IP whitelist, and more External services This plugin connects to the following third-party services only after a site administrator explicitly enables them in Easy MCP AI → External Data (by saving their own external account credentials). Nothing is contacted on a default install. Ahrefs Domain Rating API — api.ahrefs.com When: only after an administrator saves an Ahrefs APIv3 key and enables the tool under Easy MCP AI → External Data → Ahrefs (it is OFF by default — nothing is contacted on a default install). Thereafter: when an authorized MCP client calls the wp_ahrefs_domain_rating_free tool, and once each time an administrator saves the key or presses Test Connection on the External Data screen (both validate the key against Ahrefs). What is sent: your Ahrefs APIv3 key, as an Authorization: Bearer header, plus the target domain or URL supplied with the call. No WordPress credentials or personal data are transmitted. Terms: https://ahrefs.com/legal/domain-rating-license Privacy: https://ahrefs.com/legal/privacy-policy Semrush API — api.semrush.com, www.semrush.com When: only if an admin saves a Semrush API key. What is sent: the configured Semrush API key plus the parameters supplied per call (target domain, target URL, keyword/phrase, database/region code, display limits). Terms: https://www.semrush.com/company/legal/terms-of-service/ Privacy: https://www.semrush.com/company/legal/privacy-policy/ DataForSEO — api.dataforseo.com When: only if an admin saves a DataForSEO account login + API password. What is sent: the configured DataForSEO login + API password (HTTP Basic auth), plus the parameters supplied per call (keyword, target domain, target URL, location code, language code). Terms: https://dataforseo.com/terms-of-use Privacy: https://dataforseo.com/privacy-policy SE Ranking API — api.seranking.com When: only if an admin saves a SE Ranking API key. What is sent: the configured SE Ranking API key (sent as an Authorization token) plus the parameters supplied per call (target domain, target URL, keyword, region/source code, search engine, display limits). Terms: https://seranking.com/legal/terms-of-service.html Privacy: https://seranking.com/legal/privacy-statement.html Google Analytics 4 Data API & Google Search Console API — analyticsdata.googleapis.com, searchconsole.googleapis.com / www.googleapis.com/webmasters/v3 (token exchange via oauth2.googleapis.com) When: only if an admin uploads a Google service-account JSON. What is sent: a signed JWT minted from the service-account key, plus the chosen target and per-call parameters — for Analytics, the GA4 property id and report definition (dimensions, metrics, date range, filters); for Search Console, the site URL and query parameters (date range, dimensions, URL to inspect, sitemap URL). Terms: https://policies.google.com/terms Privacy: https://policies.google.com/privacy Easy MCP AI connection diagnostics (optional) — easymcpai.com When: only if you click the Diagnose Connection button on the Easy MCP AI dashboard. The plugin never contacts this service on its own — it simply opens the page in a new browser tab. What is sent: only your site’s address (its hostname), so the diagnostic page can check that your MCP endpoint is reachable. No credentials, content, or personal data are sent. Privacy: https://easymcpai.com/privacy Author Developed by EasyMCPAI.