AICOM – AI Commander vs WEBO MCP

AICOM – AI Commander connects your WordPress site to any AI agent via MCP (Model Context Protocol) or OpenAPI. Use your existing AI subscription — Claude Code, OpenAI Codex, ChatGPT Custom GPTs, Copilot Studio, Dify, n8n, OpenClaw, Celine, Goose, or any MCP-compatible client — to manage content, build pages, run audits, and automate repetitive tasks, all without leaving your AI interface. No more copy-pasting between your AI assistant and the WordPress dashboard. Describe what you want, and your agent does it — safely, with a full record of every action. Content Management Create, update, and publish posts, pages, and custom post types directly from your AI agent. Build and duplicate Elementor pages, manage menus, upload media, update taxonomies, and handle bulk SEO fields including Yoast SEO meta, titles, and social previews — all in a single conversation. What used to take hours of dashboard work can be delegated to your AI in minutes. Safety You Control AICOM puts you in charge at every level: Scope-based API keys — each key grants access only to the operations you explicitly allow. One key for read-only content review, another for full publishing access. Soft Lock / Hard Lock — freeze all write operations (Soft) or block everything except public tools (Hard) with one click from the admin bar or Safety page. Working Hours Schedule — automatically apply Soft or Hard Lock outside your configured working hours and days. Agents can’t make changes at night or on weekends unless you explicitly override it. Dry-run mode — test any operation before it runs. See exactly what would change without touching live data. Confirm flag — destructive operations require an explicit "confirm": true parameter. Accidental deletions are prevented by design. Backup & Restore AICOM automatically snapshots a post, term, or Elementor page/template right before your agent updates, trashes, deletes, or edits it — no extra step required, even if the agent never calls a backup tool itself. If something goes wrong, restore the exact previous version in one call, or undo an entire session at once: the Snapshots page lists every session that touched content, with a one-click Restore session button that reverts every post, term, and Elementor page it modified — including Elementor Theme Builder display conditions. Backups are stored in the database and can be cleaned up automatically based on age or total size. Full Audit Trail Every request is logged: timestamp, remote IP, API key label, tool used, parameters, result, and response time. Logs are grouped into named sessions — when an agent opens a session, all its actions are recorded together so you can review, replay, or undo an entire workflow at once. The Audit Logs page includes a session activity chart and a direct Restore button for each session. Built for Reliable Automation AICOM speaks strict MCP JSON-RPC: every successful call returns a content field for full client compatibility, protocol errors use standard integer codes, and errors from a tool that actually ran are reported as isError so your agent can see and react to them. Pass an idempotency_key on any write call and a retried request (dropped connection, flaky client) returns the original result instead of repeating the action — no duplicate posts from an accidental double-send. Responses are hardened against corrupted output, so your agent always gets valid JSON back. Accessibility Audits — New in v3.2.0 AICOM now includes a dedicated Accessibility module so your AI agent can audit and fix WCAG issues across your entire site — no external tools or services required: Site report — instantly see how many images are missing alt text across your entire media library, with a ranked preview of the top offenders and a percentage score. Post audit — scan any post or page for heading hierarchy errors (missing H1, skipped heading levels), images without alt text, and links with non-descriptive anchor text (“click here”, “read more”). Each issue is rated by severity and the post receives an overall accessibility score from 0 to 100. Fix in place — set alt text on any media library image in one call. Pass an empty string to correctly mark it as decorative (aria-hidden). Full dry-run support so you can preview changes before saving. Screenshot before & after — combine AICOM’s audit tools with your AI agent’s browser capabilities to capture a visual record of the page before and after remediation. A typical AI-driven accessibility workflow: run the site report, get the list of problem images, let the agent analyse each image visually and write descriptive alt text, apply the fixes — then run the audit again to confirm the score improved. All in one session, with a full audit trail. Supported Modules WordPress Core — posts, pages, custom post types, terms, meta, options, menus, plugins Media — upload, update, delete media; direct file system access Users & Roles — create, update, manage users and role assignments Backup — automatic snapshots for posts, terms, and Elementor pages/templates before every write; session-wide restore Sessions — named audit sessions with grouped action history Accessibility — site-wide alt text audit, post-level WCAG check, alt text fixes WooCommerce (optional) — products, categories, settings Elementor (optional) — page creation from template, widget inspection, theme builder conditions Polylang (optional) — translations, language assignment, string management, and one-call bilingual post pair creation Yoast SEO (optional) — read and write SEO titles, meta descriptions, Open Graph and Twitter card fields; bulk audit across all posts in one session Clautron (optional) — blueprint management, capability catalog, event analytics ECS (optional) — Ele Custom Skin color schemes, font schemes, custom looks Who is this for? Content teams using Claude, ChatGPT, or any AI assistant who want it to publish and update WordPress content directly Agencies managing multiple client sites and wanting AI-assisted workflows with a full paper trail Developers building AI-powered WordPress tools or automation pipelines Accessibility specialists who want to audit and remediate WCAG issues at scale with AI assistance Claude Code users — point AICOM as an MCP server from your terminal and control WordPress alongside your code OpenAI Codex users — connect Codex to your site via AICOM’s MCP endpoint and let it manage content as part of your dev workflow ChatGPT, Copilot Studio, Dify, n8n users — import the OpenAPI schema URL into any OpenAPI-compatible client; all tools are discovered automatically with Bearer auth OpenClaw / Celine / Goose users — native MCP connector, works out of the box How it works AICOM exposes a secure HTTP endpoint on your WordPress site. Your AI agent sends structured MCP requests, AICOM authenticates the request, checks scopes and lock state, executes the operation, logs it, and returns a structured response. AI Agent → AICOM Endpoint → WordPress API Key Scopes Each API key is granted specific scopes — you control exactly what each AI agent can and cannot do: read.wp, `write.wp.posts`, `manage.taxonomies`, `manage.meta`, `manage.wordpress.settings`, `manage.media`, `manage.files`, `manage.users`, `manage.plugins`, `manage.backups`, `manage.a11y`, `manage.woocommerce.products`, `manage.woocommerce.settings`, `manage.elementor`, `manage.polylang`, `manage.yoast`, `manage.clautron` Endpoint REST API: POST /wp-json/aicom/v1/mcp Fallback (no mod_rewrite required): POST /?aicom=1 Health check: GET /?aicom=1 Authentication Authorization: Bearer aicom_XXXXXXXX_ or: X-API-Key: aicom_XXXXXXXX_ MCP Request Example {"jsonrpc":"2.0","method":"tools/call","params":{"name":"wp.posts.list","arguments":{"post_type":"post","posts_per_page":10}},"id":1}

WEBO MCP is a WordPress MCP server — a complete Model Context Protocol gateway for WordPress. It lets AI agents and MCP-compatible clients (Claude Desktop, Cursor, Windsurf, n8n, and more) call well-defined tools over REST using JSON-RPC, instead of scraping the admin or sharing broad credentials. Official WEBO MCP website, documentation, and ecosystem hub: https://webomcp.com Why use WEBO MCP as your WordPress MCP server? Token-optimized unified tools: every domain exposes two abilities — *-query (all reads) and *-mutate (all writes) — with a single action discriminator. tools/list payload is up to 70% smaller than per-operation APIs, which means less of the model’s context window is consumed by tool schemas, lower cost per session, and fewer hallucinated tool names. Primary router endpoint: POST /wp-json/mcp/v1/router Standard MCP-style flow: initialize → tools/list → tools/call Session lifecycle for clients (pass session_id or Mcp-Session-Id after initialize) Built-in tool registry for common WordPress operations (posts, media, terms, menus, options, and more) Bundled Abilities API + MCP Adapter integration, with automatic bridging from registered abilities to MCP tools (configurable) WordPress 7.0/Core-aware bridge mode that uses Core Abilities/API surfaces when available and falls back only when needed Public tool policy controls (category filters and optional allowlists) plus optional internal tool exposure for private environments Bounded MCP audit log, optional per-user/role/client tool allowlists, and a read-only administrator health/status tool Security model (high level) MCP access requires a real WordPress user context: Application Password over HTTP Basic, or an existing logged-in session. Optional site-wide or per-user API key and HMAC can be enabled in Settings as an additional gate (they do not replace WordPress authentication). Generate/rotate from Settings → Security; by default they are skipped for Application Password and Bearer clients unless you enable “Require for App Password / Bearer”. Do not put the normal WEBO API key in URLs. For clients that cannot send headers, create a short-lived scoped mcp_token URL connector token in Settings -> WEBO MCP. Default access expectations for the router and GET /wp-json/webo-mcp/v1/tools: users who are super admins, can manage_options, or can edit_posts, consistent with typical site operator and editor workflows (filterable). Client guidance Always discover tools before calling them: run tools/list, pick an exact tool name from the response, validate required arguments, then call tools/call. This reduces mistakes and keeps automation predictable in production. Further documentation and optional integrations Official website, documentation, and ecosystem notes: https://webomcp.com Optional n8n community node (separate package): https://www.npmjs.com/package/n8n-nodes-webo-mcp Release notes and migration map: see docs/RELEASE_NOTES_2.1.0.md and docs/MIGRATION_GUIDE_2.1.0.md in the GitHub repository Cross-addon dispatcher map (granular legacy names removed from discovery): docs/MCP_TOOL_MIGRATION.md Compatibility note: any MCP-capable client can be used; which large language model runs inside the client is outside this plugin. Standalone core tools included: – Site info – Content (posts/pages): webo/content-query (list, get, find-by-url, search-replace, list-revisions, get-revision; with author/date/taxonomy filters) and webo/content-mutate (create, update, delete, bulk-update-status, restore-revision, change-author) – Users: webo/list-users and webo/user-mutate (add-to-blog, set-role) – Media: webo/media-query (list with search/MIME/post_id filters, get) and webo/media-mutate (upload, update, delete) – Comments: webo/comment-query (list, get) and webo/comment-mutate (create, update, delete) – Taxonomy/Terms: webo/taxonomy-query (discover, list, get) and webo/taxonomy-mutate (create, update, delete) – Nav menus: list menus, list menu items (menu_order, db_id), add menu link from post (explicit post_id + menu_order required) – Plugins: webo/plugin-query (installed, active, updates, …) and webo/plugin-mutate (install, activate, deactivate; supports child-site site_id / blog_id activation for network admins) – Health: webo/health-status (REST/router status, Application Password support, permalinks, cron, object cache, plugin update summary, WordPress/PHP versions, and redacted MCP config) – Client health: webo/client-health-report (score 0–100, grade A–D, Markdown scoreboard for agency clients; hybrid foundation for Pro collectors later) – 404 logs: webo/get-404-logs (read-only Rank Math / Redirection 404 monitor: url, hits, accessed, referrer) – Abilities bridge: webo/ability-query and webo/ability-execute in default layered mode. Only abilities with meta.mcp.public === true are visible and executable through WEBO MCP. – Themes: webo/theme-query (installed themes) and webo/theme-mutate (install from WordPress.org by slug, switch installed theme) – Theme context: webo/theme-context (active theme info, block editor settings, style presets, registered blocks) – Block patterns: webo/block-patterns (list/get patterns, list/get synced patterns) – Site stats: webo/site-stats (overview, post counts, comment counts, user counts, media stats, activity summary) – Activity log: webo/activity-log (list events, summary, clear) – User profile: webo/user-profile (get own profile, update display name / bio / preferences) – Site settings: webo/site-settings (get and update the 20 most common WordPress options via MCP) – Content search: webo/content-search (full-text cross-post-type search with grouped results) – Menus: webo/menu-query, webo/menu-mutate (navigation menu items; not post/CPT list order) – Post/CPT order (optional): webo/reorder-query, webo/reorder-mutate when Webo Reorder is active — see docs/abilities/reorder.md – Options: get/update (safe allowlist only), set site icon/favicon from media – SEO (WordPress post): seo/article-analysis — requires post_id; merges Rank Math meta when available (same data path as webo-rank-math/get-post-seo-meta); optional related-keyword suggestions via outbound request unless no_autocomplete is true Excluded by default in standalone-safe mode: – Bulk/mass execution tools – Plugin/theme write-management abilities – Multisite-specific abilities Privacy This plugin does not phone home or send telemetry. MCP traffic is initiated by clients you configure. Some tools may perform outbound HTTP requests only when a client invokes them (for example seo/article-analysis may request keyword suggestions from a third-party suggest API unless you pass no_autocomplete). The plugin stores the following options in the WordPress database when configured: – webo_mcp_api_key: API key used to authenticate MCP requests. – webo_mcp_hmac_secret: HMAC secret used to sign and validate MCP requests. – webo_mcp_require_secondary_credentials: when enabled, also require API key/HMAC for Application Password and Bearer clients (off by default so standard connectors are not blocked). – webo_mcp_url_connector_tokens: hashed, expirable, revocable URL connector tokens for clients that cannot send headers. Raw tokens are shown once and are not stored. – webo_mcp_tool_allowlist_enabled and webo_mcp_tool_allowlist_rules: optional administrator-configured MCP tool allowlist policy. – webo_mcp_audit_log_enabled, webo_mcp_audit_log_max_entries, and webo_mcp_audit_log: bounded MCP tool-call audit log settings and compact audit events. Audit entries include user/tool/action/status data, anonymized IPs, and hashed session IDs; they do not store request payloads, API keys, HMAC secrets, or Application Passwords. – webo_mcp_installed_at and webo_mcp_review_notice: local timestamps/state for an optional WordPress.org review request notice (not sent off-site; dismissible). These options are removed when the plugin is uninstalled via the WordPress Plugins screen. External services This plugin can connect to Google Suggest (Autocomplete) when a client calls the seo/article-analysis tool and does not set no_autocomplete to true. This external request is used to return related keyword suggestions for SEO analysis. Service provider: Google LLC (Google Suggest / Autocomplete API endpoint). Data sent and when: – Sent only when seo/article-analysis is called with autocomplete enabled. – Sends the analysis query text to https://suggestqueries.google.com/complete/search as the q parameter. – Sends standard HTTP request metadata such as IP address and User-Agent as part of the web request. Terms of Service: https://policies.google.com/terms Privacy Policy: https://policies.google.com/privacy Developer Hooks The plugin exposes the following actions and filters for developers: Actions webo_mcp_register_tools Fired during plugin bootstrap after standalone tools are registered. Use this to register custom MCP tools from other plugins. Filters webo_mcp_current_user_can_use_mcp (bool $allowed, int $user_id) Gate for all MCP REST access. Default: super admin OR manage_options OR edit_posts. Override to tighten (e.g. super-admin only) in hardened installs. webo_mcp_secondary_credentials_exempt (bool $exempt, WP_REST_Request $request) When true, skip optional API key / HMAC after WordPress auth. Default true for Application Password (Basic) and Bearer sessions unless Settings → Security → “Require for App Password / Bearer” is enabled. Return false to always enforce X-WEBO-* headers. webo_mcp_allow_internal_tools (bool $allow_internal, WP_REST_Request $request) Controls whether internal tools are included in tools/list responses. Defaults to false for public environments. webo_mcp_public_categories (array $categories, WP_REST_Request $request, array $tool) Filters which tool categories are exposed as public. Defaults to array( ‘wordpress’ ). webo_mcp_rate_limit_per_hour (int $limit, string $client, array|null $profile) Adjust effective hourly limit (fallback for both buckets). webo_mcp_rate_limit_read_per_hour / webo_mcp_rate_limit_mutate_per_hour (int $limit, string $client, array|null $profile) Per-bucket limits after admin/profile resolution. webo_mcp_tool_is_mutating (bool $is_mutating, string $tool_name, array|null $tool_definition, array $arguments) Override mutating classification for rate limits and read-only profiles. webo_mcp_tool_arguments_allow_extra (bool $allow, string $tool_name, array $schema, array $arguments) When true, unknown tool argument keys are passed through (default false). webo_mcp_disallow_url_token_query (bool $disallowed) Block URL connector tokens in query strings (admin setting is the default source). webo_mcp_rest_bom_guard_json_api_requests (bool $activate, string $uri_raw) Opt-in BOM sanitizer for all /wp-json/ responses (default false; MCP routes only). webo_mcp_bridge_deny_patterns (array $patterns) Controls which abilities are excluded when auto-bridging abilities into MCP tools (e.g. bulk, themes/, multisite/). webo_mcp_auto_bridge_abilities (bool $enabled) Enables or disables automatic bridging of registered abilities into MCP tools. Defaults to true; bridge mode still controls whether the bridge is off, layered, or full. webo_mcp_bridge_mode (string $mode) Controls Abilities bridge mode after the WEBO_MCP_BRIDGE_MODE constant and before the stored option. Values: off, layered, full. Default: layered. webo_mcp_enable_adapter (bool $enabled) Enables or disables the bundled WordPress MCP Adapter runtime. Defaults to true. webo_mcp_validate_media_fetch_url (true|\WP_Error $ok, string $url, array $parsed) Reject unsafe URLs for webo/media-mutate upload action (return WP_Error to block). webo_mcp_tool_allowlist_allowed (bool $allowed, string $tool_name, WP_REST_Request $request, array $params, array $allowed_tools) Filters the optional per-user/role/client allowlist decision. Credits Special thanks to the authors and open source projects that contributed to this plugin: – WordPress (https://wordpress.org) – Abilities API (https://github.com/WordPress/abilities-api) Reference: https://make.wordpress.org/ai/2025/07/17/abilities-api/ – MCP Adapter (https://github.com/WordPress/mcp-adapter) Reference: https://make.wordpress.org/ai/2025/07/17/mcp-adapter/ – Composer (https://getcomposer.org) – Other PHP and JS libraries from the community If you use this plugin, please give credit to the authors of these libraries. License This plugin is licensed under the GPLv2 or later. See https://www.gnu.org/licenses/gpl-2.0.html for details.