Mindio Magic MCP

Mindio Magic MCP exposes WordPress operations to compatible AI agents through the Model Context Protocol.

Mindio Magic MCP is independently developed and is not affiliated with or endorsed by UX Themes. Flatsome is a trademark of its respective owner.

Highlights:

• Stateless MCP Streamable HTTP endpoint with optional server-sent event streaming and progress notifications
• MCP resources and site-aware prompts alongside tools, including a configurable brand voice
• API keys, OAuth 2.1 authorization code flow, PKCE S256, and WordPress authentication
• Hierarchical read-only, editor, and administrator scopes, plus per-credential allow/deny patterns and daily call budgets
• Preview any write with dry_run, group writes into a revertible changeset, and park high-risk calls in a human approval queue
• One builder-neutral page blueprint that renders through Flatsome UX Builder, Elementor, or core blocks
• Structured Gutenberg block discovery and revision-safe block-tree editing
• explain_page semantic outlines with stable node IDs, heading structure, and accessibility gaps
• Post, media, comments, users, SEO, settings, plugin, theme, webhook, search, and diagnostics tools
• Official-directory plugin/theme search, installation, updates, deletion, generic theme settings, and Flatsome settings
• Free integrations for ACF, BetterDocs, Contact Form 7, WooCommerce, Yoast SEO, and Rank Math with fixed operation catalogs
• Opt-in, bounded, read-only filesystem and database inspection
• Native-first Flatsome sections, rows, columns, and 29 typed UX Builder components with reported HTML fallback
• Persian content support and RTL-safe generated layouts
• Conditional WooCommerce and multisite tools
• Rate limits, strict schemas, audit logs, SSRF controls, and destructive-action confirmations
• Audit export to a webhook or syslog every five minutes, with anomaly alerts for failure spikes, permission probing, destructive bursts, exhausted budgets, and credentials used from a new address
• Responsive flat enterprise admin console with compact 2–4px geometry and separate Overview, Tools, Credentials, Approvals, Webhooks, Activity, and Settings tabs
• Searchable, grouped per-site tool exposure policy with individual, group, and enable/disable-all controls
• Expandable per-operation integration policy; reads start enabled and writes start disabled
• Searchable diagnostics, copy-ready endpoints, accessible controls, and WordPress.org language-pack support

The core single-site plugin registers 95 MCP tool names. Each installed supported integration adds read and write dispatchers; all six integrations add 12 names and 147 fixed operations. Active WooCommerce adds 6 compatible legacy tools and WordPress multisite adds 2 tools.

No prompt or content is sent to an external AI provider by default. Generation and translation integrations are opt-in through documented WordPress filters.

Development source and reproducible release tooling are available at https://github.com/farvisun/mindio-magic-mcp.

External services

Mindio Magic MCP does not contact an external service merely because it is installed or activated, and it includes no telemetry or tracking.

• WordPress.org directory services: When an authorized administrator or MCP agent explicitly searches for, installs, or updates a plugin or theme, Mindio Magic MCP uses the WordPress.org APIs and official download servers. Search terms, package slugs, and standard HTTP connection metadata are sent to WordPress.org. Service: https://wordpress.org/ — Privacy policy: https://wordpress.org/about/privacy/.
• Administrator-selected media URLs: The upload_media tool can download a file from a URL supplied in that individual request. The selected server receives a normal HTTPS request from the WordPress site. No site content is added to that request.
• Administrator-configured webhooks: After an administrator registers and enables a webhook URL, subscribed WordPress events send a signed JSON payload to that URL. Payloads contain the site name and URL plus event-specific identifiers and metadata. The administrator is responsible for the destination service and its privacy terms.
• HTTPS OAuth Client ID Metadata: When an MCP client identifies itself with an HTTPS Client ID URL, Mindio Magic MCP retrieves that URL to validate the client’s redirect metadata before authorization. The client host receives a normal HTTPS request from the WordPress site.
• Optional automation providers: Mindio Magic MCP ships without an AI provider. A site owner may connect one through documented WordPress filters; data handling and terms then depend on that site-specific integration.

Privacy

Mindio Magic MCP stores credentials, OAuth client registrations, per-site policies, webhook configuration, and bounded audit/delivery logs in the WordPress database. Secrets are hashed or encrypted where they must be recoverable. The plugin does not sell data, display public credits, or track usage. Administrators control retention periods and can opt into full plugin-data removal on uninstall.