MCP and browser agent tools

Install WordPress MCP Adapter, enable read-only Cybermaps connections, and reconnect clients upgrading from 7.x.

How it works

The shipped contract uses a revision-pinned Cybermaps conformance profile for AI Discovery Protocol 3.0 Level 3. The profile covers the manifest, bounded updates, and the four /news/* publications; it does not claim an unqualified ADP implementation level, and every publication remains conditional on its own AI Publishing setting.

OpenAPI 3.2.0 is canonical. The retained 3.1.2 document is available through explicit Accept negotiation or the documented version=3.1.2 query form, with Vary: Accept on negotiated responses. The API Catalog and generated contracts identify the exact representation served.

The established API discovery surface uses RFC 9727 and RFC 9264. The catalog contains an enriched Linkset for every advertised public API rather than one undifferentiated route list. GET /wp-json/cybermaps/v1/health is a bounded public health resource; it reports public service state without exposing private WordPress diagnostics or replacing external monitoring.

The current MCP Server Card is experimental. Its canonical resource is GET /wp-json/cybermaps/v1/mcp/server-card; the requested scanner compatibility path is /.well-known/mcp/server-card.json. The card describes optional MCP separately from OpenAPI and does not imply that a client supports the current draft. The Agentic Resource Discovery catalog is also a draft: its canonical path is /.well-known/ai-catalog.json, /ai-catalog.json is a compatibility alias, and it lists only capabilities active for the current site.

Markdown for Agents is an opt-in vendor convention, not an RFC. When enabled, eligible canonical singular, homepage, blog, and public archive URLs return bounded stored-content Markdown when text/markdown is explicitly preferred over HTML. Singular output preserves stored headings and safe links. Default requests remain HTML; both variants declare Vary: Accept. Cybermaps reports its four-bytes-per-token estimate in X-Markdown-Tokens and marks native output with X-Cybermaps-Markdown-Source: origin. It does not render theme HTML, execute shortcodes, claim Cloudflare byte parity, or emit an X-Original-Tokens value.

The existing Content-Signal header and robots declaration remain unchanged. The optional AIPREF Content-Usage attachment is disabled by default; when enabled it publishes bounded sitewide or path-specific train-ai and search preferences. ai-input remains Content-Signal-only. IndexNow submissions use the existing eligible-URL behavior and, when enabled, a durable deduplicating same-host database queue with bounded retries and batches of up to 10,000 URLs.

MCP connections are optional and require the separate MCP Adapter plugin by WordPress.org, version 0.7.0 or newer. Cybermaps works independently for sitemaps, AI publications, analytics, reports and dashboard operations. In AI Publishing → Model Context Protocol, install or activate the adapter through WordPress, then explicitly enable Cybermaps MCP (read-only) and save. Installing the adapter alone does not opt Cybermaps in. The AI Publication Hub must also be enabled.

The dedicated endpoint is /wp-json/mcp/cybermaps. It exposes the cybermaps-search tool and enabled public Core discovery resources, using their canonical publication URLs. Resources and search honor public-content eligibility and exclusions. Cybermaps does not project other plugins’ abilities. Its four former operation abilities have also been removed from the native Abilities API. The standalone native cybermaps/search ability remains public and read-only. ai-actions.json describes operator-declared links and does not create tools.

For HTTP clients, use HTTPS and a WordPress Application Password for a dedicated Subscriber account with the read capability. Enter credentials in the client; Cybermaps does not collect them. Clients must support WordPress authentication; OAuth-only clients cannot use the retired Cybermaps consent flow. The adapter also supports local/SSH WP-CLI transport via wp mcp-adapter serve --server=cybermaps --user=USERNAME. The adapter owns protocol negotiation, sessions and transport. MCP Adapter 0.7.0 supports revisions 2025-11-25 and 2026-07-28. Connect to the dedicated Cybermaps server. The adapter’s separate default server may expose abilities supplied by other plugins; Cybermaps does not control it.

Upgrading from 7.x: the custom MCP server, OAuth/device routes, generic ability dispatcher and remote operation tools are deleted from the plugin. The old /wp-json/cybermaps/v1/mcp endpoint, OAuth metadata and Auth.md are gone. Upgrade cleanup deletes retired settings, credential tables and queued jobs; it does not retain a dormant server. Install the adapter, enable the new integration and reconnect clients. Use the dashboard for audit, static purge/reconciliation and IndexNow operations.

The current integration has one boolean setting, enable_mcp_adapter, defaulting to false. It has no operational modes. An explicit adapter opt-in made on 8.0.0 is converted only when no current enable_mcp_adapter choice exists; an explicit opt-out is preserved. The 7.x preferences never grant adapter consent. The empty OAuth upgrade step and obsolete migration notice are removed. Deletion-only cleanup remains for sites upgrading directly from older versions. If cleanup detects a concurrent settings save, it remains pending for a later retry. Deactivating the adapter withdraws MCP advertisements while preserving the new opt-in for later reactivation.

The default-off WebMCP bridge registers only three read-only browser tools: cybermaps.search_site, cybermaps.get_page_markdown, and cybermaps.list_discovery_resources. It prefers document.modelContext.registerTool, falls back to navigator.modelContext.registerTool, and safely performs no registration in unsupported browsers. It grants no new server-side authority.

Static diagnostics report body parity separately from origin-header parity, including RFC 9111 edge policy, RFC 9530 Repr-Digest, Content-Usage, and deployment headers. Static claims are conditional on the selected Static File Engine mode and equivalent web-server/CDN routing.

The administration UI places visible maturity guidance beside the relevant controls: established RFC standards, current drafts, early protocols, experimental previews, and vendor conventions are labelled separately and link to their authoritative sources. These labels describe specification maturity, not client adoption or a promise that any crawler will use the publication.

AI Discovery Status separates configuration, advertisement, availability, body validity, and protocol conformance. When an alias works but its canonical well-known URL does not, the page identifies likely /.well-known/ interception. Discovery mode materializes only the registered static targets; the API Catalog, Agentic Resource Catalog, MCP Server Card compatibility route, and Discovery Index remain dynamic. Their requests must reach WordPress.

Diagnostics distinguish body availability from media-type and header conformance. Generated header guidance preserves origin responses; filesystem snapshots are diagnostic information, not deployable validator values. Cybermaps can maintain an owned well-known rewrite block on compatible Apache/LiteSpeed installations and, after explicit authorization, its own Cloudflare rules. It does not edit nginx or Varnish configuration.