Secure file operations for WordPress via MCP.

Tested up to: 6.9 Stable tag: 1.0.6 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

This add-on plugin exposes filesystem operations through MCP (Model Context Protocol). Your AI assistant can read plugin files, edit configuration, manage uploads - all through conversation. Security-hardened to prevent PHP injection and path traversal attacks.

Part of the MCP Expose Abilities ecosystem.

• WordPress 6.9+
• PHP 8.0+
• Abilities API plugin
• MCP Adapter plugin

1. Install the required plugins (Abilities API, MCP Adapter)
2. Download the latest release from Releases
3. Upload via WordPress Admin → Plugins → Add New → Upload Plugin
4. Activate the plugin

{
  "ability_name": "filesystem/read-file",
  "parameters": {
    "path": "wp-content/plugins/my-plugin/config.json"
  }
}

{
  "ability_name": "filesystem/write-file",
  "parameters": {
    "path": "wp-content/uploads/data/export.csv",
    "content": "name,email\nJohn,john@example.com"
  }
}

{
  "ability_name": "filesystem/list-directory",
  "parameters": {
    "path": "wp-content/uploads/2024/",
    "recursive": false
  }
}

{
  "ability_name": "filesystem/delete-file",
  "parameters": {
    "path": "wp-content/uploads/old-file.txt"
  }
}

Files are backed up to wp-content/mcp-backups/YYYY-MM-DD/ before deletion.

This plugin includes extensive security hardening:

• PHP Injection Detection - Blocks <?php, <?=, and obfuscated PHP patterns
• Encoding Bypass Protection - Detects UTF-7, UTF-16, and Base64 encoded PHP
• Path Traversal Protection - Blocks ../ and absolute paths outside WordPress
• Directory Restrictions - Limited to the WordPress root directory
• Automatic Backups - Files backed up before deletion
• 50+ Attack Vectors Tested - Comprehensive security testing

• Docs: expanded the WordPress-standard readme.txt so the published ZIP now includes fuller requirements, abilities, use cases, and Devenia ecosystem links

• Added: max_items limit for safer recursive directory listing
• Added: returned and truncated output fields for list-directory

• Improve log append efficiency for filesystem operations

• Security: Restrict filesystem operations to the WordPress root directory
• Fixed: Use WP_Filesystem for backups and copy operations

• Fixed: Use WP_Filesystem API instead of native PHP functions
• Fixed: Proper sanitization of REMOTE_ADDR

GPL-2.0+

Devenia - We've been doing SEO and web development since 1993.

• Plugin Page
• Core Plugin (MCP Expose Abilities)
• All Add-on Plugins