Start with the quick reference on this page. The complete project documentation — audits, inventories, test reports and verification logs — ships in the documentation archive and inside the plugin source.
POST https://your-site.com/wp-json/liyans-mcp/v1/mcp
Content-Type: application/json
Authorization: Bearer lym_… (or an OAuth 2.1 access token)One endpoint speaks JSON-RPC 2.0. On the legacy path it negotiates MCP revisions 2025-11-25, 2025-06-18 and 2024-11-05; supported methods: initialize, ping, tools/list, tools/call, resources/list, resources/read, prompts/list, prompts/get. Since 1.4.0 the same endpoint also serves the 2026-07-28 profile: no initialize handshake — clients call server/discover and negotiate per request via params._meta, receiving resultType envelopes on every result and ttlMs/cacheScope on list results; subscriptions/listen is not implemented and is not advertised. Batch arrays are processed item by item; methods the server does not offer answer -32601 and are never advertised.
/liyans-mcp/authorize on your own site. Clients may be public or confidential (client_secret_basic / client_secret_post; a confidential client’s secret is shown once and stored only as a hash, and the client authenticates before any exchange). Authorisation responses carry the RFC 9207 iss parameter, and the token endpoint validates the RFC 8707 resource indicator. The OAuth access-token lifetime is configurable (default 3600 seconds).| Scope | Grants |
|---|---|
read | Site inspection, listing and reading published content, resources, verification reads. Never drafts, private or trashed content, and never store revenue. |
write | Content and layout writes: pages, layouts, element edits, build sessions, structure import. |
publish | The explicit publishing paths. Without it, everything the assistant produces stays a draft. |
media | Media library reads, alt-text writes and image import. |
commerce | WooCommerce tools: products, terms, attributes, variations, store overview, gateway inspection. |
seo | SEO audit, metadata inspection and metadata writes (Yoast SEO / Rank Math). |
devices | Device records and responsive overrides. |
settings | Allowlisted site settings, homepage assignment and menu-location assignment (also requires the matching WordPress capability). |
Scopes are only half the story: every call also checks the live WordPress capabilities of the account that owns the token. Effective permission is the intersection. See Security and the article Understanding scopes and tokens.
| URI / name | What it is |
|---|---|
liyans://site/inspect | A live site-inspection snapshot, produced through the ordinary tool pipeline so authorisation applies. |
liyans://tools | The tool catalogue as visible to the current caller (scope-filtered). |
build_landing_page | Prompt template: brief → inspected, draft landing page. |
audit_page_seo | Prompt template: structured SEO audit of one page. |
redesign_page | Prompt template: snapshot-first redesign of an existing page. |
Protocol-level problems are JSON-RPC errors (for example -32700 for malformed JSON, -32601 for an unknown method, -32602 for invalid parameters). Tool-level failures are returned as tool results with isError: true and one of 27 named codes from a closed catalogue — among them not_found, insufficient_scope, dependency_missing, validation_failed, session_not_found, session_closed, plus the four RFC 6749 names used by the OAuth token endpoint. Details returned to callers are safe by construction; internal details go to the audit log only. On the modern (2026-07-28) profile, protocol negotiation failures use the SEP-2243 codes: -32020 for a protocol-version header mismatch, -32021 when client capabilities are missing, and -32022 for an unsupported version — the last with the list of versions the server does speak.
The project keeps its engineering record in the open. All of the following ship in the documentation and source archives:
| Document | Contents |
|---|---|
| 01 · Technical Audit | Full audit of the codebase: inventory, per-area status, premise verification. |
| 02 · Feature Inventory | Every tool and subsystem with its status and code evidence, including the 1.4.0 (Stage 2) addendum. |
| 03 · Bug Tracker | Defects found by testing, their severity and their fixes. |
| 04 · Security Report | The Stage-1 security review of the plugin. |
| 05 · Test Coverage Report | What was exercised, where, and what remains unverified. |
| 06 · Roadmap | Stage history and the standing rules of the project. |
| 07 · Integration Test Report | Stage-2 verification on a real WordPress, with commands and outputs. |
| 08 · Third-Party Verification Protocol | A protocol an independent party can follow to verify feature claims, build pinned by SHA-256. |
| 09 · Verification Execution Log | The executed subset of that protocol, with results stated as they came out. |
| 10 · Capability Gap Analysis | A clean-room capability comparison against a reference product, and what 1.3.0 built in response. |
| 11 · 1.3.0 Verification Report | The 1.3.0 evidence: environments, exercised areas, defects found and fixed, and the NOT VERIFIED list. |
| 12 · Deployment Instructions | How the release archives and this product website are deployed, and the checks to run first. |
| 13 · Commercialisation Roadmap | The separate-add-on commercial model around the free core — and what will never be paywalled. |
| 14 · Unified Repository Audit | The whole-repository audit that opened the Universal + Commercial programme: the code as it existed, premise by premise. |
| 15 · Wire MCP Comparison Refresh | A live re-study of the reference product’s current capabilities and pricing claims — reference only; nothing copied. |
| 16 · Universal Architecture | The design for the universal-connections work: the dual-era 2026-07-28 protocol profile, the client registry, the AI Clients hub and the Settings Center. |
| 17 · Commercial Architecture | The design for the commercial layer (plans, licensing, credits, portal) that lives outside the free core; it creates no prices and no commitments. |
| 18 · Per-Tool Verification | Every registered tool verified individually: registry and handler checks, and the live per-tool test record. |
| Stage 2 Acceptance Report | The gated acceptance record for core 1.4.0: the baseline-vs-regression tool matrix, connection preservation, the protocol, OAuth and rate-limit suites, and the NOT VERIFIED list. |