Track Debug – MCP Server and AI Site Control

Deskripsi

Track Debug connects your WordPress site to AI assistants using the open Model Context Protocol (MCP). It publishes a small, safe set of site “abilities” as MCP tools and gives you a self-contained admin dashboard to manage the connection — no third-party account and no data leaving your site except to the AI client you choose to connect.

Under the hood the plugin registers its features with the WordPress Abilities API and exposes them through a bundled MCP server at:

/wp-json/track-debug/mcp

Connections authenticate with a standard WordPress application password, so you are not creating or storing any new credential system. You can create, list, and revoke those passwords from the dashboard at any time.

What you can do

Once connected, an MCP-compatible AI client (for example, Claude Desktop or Codex) can call these tools:

Read (informational, non-destructive)

• Get site info — site name, URL, WordPress and PHP versions, active theme, and whether debugging is enabled.
• List content — list posts or pages with id, title, status and link, filtered by a search term and status.
• Read debug log — return the most recent lines of wp-content/debug.log so you can diagnose errors from your AI client (administrators only).

Write (content)

• Create page — create a new page (defaults to draft).
• Create post — create a new post (defaults to draft).
• Update post or page — update the title, content, or status of an existing item.

Every tool declares a JSON schema for its input and output, so the AI client knows exactly how to call it, and every tool runs a WordPress capability check before it does anything.

The dashboard

The plugin adds a Track Debug screen to wp-admin with:

• Application Passwords — create a key in one click, see the keys you already have, and revoke any you no longer use. WordPress shows an application password only once, so the dashboard makes that moment clear.
• Connection — a ready-to-paste configuration for your AI client, or a plain-language prompt that sets it up for you. Switch between clients (such as Claude or Codex) and between the raw config and the prompt.
• Overview — your MCP endpoint URL, site URL, active key count, and WordPress/PHP versions at a glance.
• Light and dark mode, and a layout that works on phones as well as the desktop.

How connecting works

AI clients talk to your site over HTTP using MCP. Because most desktop AI clients launch MCP servers as local commands, the dashboard’s generated configuration uses a small, open-source client-side proxy (@automattic/mcp-wordpress-remote) that runs on your own computer and forwards requests to your site’s endpoint using your application password. Your WordPress site does not call out to any external service on its own.

Security model

• Every ability checks a WordPress capability before running. Reading the debug log and any site-management action require an administrator.
• Access is authenticated with an application password that you create and can revoke at any time.
• The free plugin intentionally does not include high-risk operations such as running arbitrary PHP or deleting data.

Higher-risk, advanced abilities — running PHP, and managing plugins, themes, users, options, and the database — are available only in the separate Track Debug Pro add-on, where they are gated behind an administrator capability and a “Power Mode” switch that is off by default and logs every call.

Open source

This plugin is free software licensed under the GPL. It bundles the WordPress MCP Adapter library (GPL-2.0-or-later) to expose the Abilities API over MCP. If the official MCP Adapter plugin is active on your site, Track Debug uses that copy instead of its bundled one.