LIYANS MCP is a WordPress plugin that turns your site into an MCP server. Point Claude, ChatGPT or any MCP client at one URL and it can inspect your site and build real, native, editable Elementor pages — by conversation, on your own hosting, under your rules.
POST https://your-site.com/wp-json/liyans-mcp/v1/mcpOne plugin, three jobs: understand your site, build on it, and never put it at risk while doing either.
Ask for a landing page, a pricing page, a redesign — the client builds native Elementor layouts you can open and edit in the Elementor editor afterwards. Not a screenshot, not a locked export.
The Elementor AI Builder →Site structure, pages, menus, media, SEO metadata, forms, store data — read tools and deep inspectors let the assistant understand what exists before it changes anything.
See all 61 tools →Writes land as drafts. Deletion means the WordPress Trash, never a permanent delete. Layout changes take a snapshot first, and every call is written to a local audit log you own.
How safety works →Every tool is a first-class MCP tool with a JSON Schema, a required scope and a WordPress capability check. A token only ever sees the tools its scopes allow.
22
Site inspection, pages, menus, media, settings, homepage, structure export/import and snapshots.
14
Layout building, HTML and visual-spec import, element-level editing, verification and design audit.
15
WooCommerce products, terms, attributes, variations and gateways; Yoast and Rank Math SEO; form inspection.
5
Resumable multi-page builds: plan, build page by page across requests, then finalise.
5
Per-device client records with their own scopes and responsive overrides.
8
read, write, publish, media, commerce, seo, devices, settings — combined with the token owner’s live WordPress capabilities on every call.
Create a token in wp-admin, paste it into your MCP client’s config, done. The secret is shown once and only a hash is stored. Tokens can expire, and you can revoke one at any time.
A full authorisation server inside the plugin: PKCE (S256), dynamic client registration (public or confidential), discovery documents, rotating refresh tokens and revocation — for clients and teams that prefer a sign-in flow over pasted secrets.
There is nothing to phone home to. LIYANS MCP sends no telemetry and contacts no third-party service: no tracking, no licence server, no usage reporting. The only network requests it ever makes are ones your own work requires — fetching your own site’s published pages during a render check, or downloading an image you explicitly asked it to import.
Tested in our lab. Release 1.3.0 was exercised end-to-end against a real WordPress 7.1.4 install with Elementor, WooCommerce and Yoast SEO active — including the OAuth flow over real HTTP, build sessions, inspectors and a full uninstall check confirming that site content is never touched. Release 1.3.1 changed admin screens only — the guided Connection page — and left every tool, scope and safety behaviour exactly as tested. Release 1.4.0 passed a gated acceptance run on a real WordPress 7.1.4 testbed: the identical 61-tool matrix ran against 1.3.1 and 1.4.0 with zero differences, an in-place upgrade preserved the exact pre-upgrade token, device, build session and settings, and the protocol, OAuth and rate-limit suites passed in full — the acceptance report ships in the documentation archive. What has not been verified is listed just as openly, in the roadmap and the project documentation.