How It Works

One endpoint. A strict pipeline behind it.

LIYANS MCP is a normal WordPress plugin. It adds one REST endpoint to your site; everything an AI assistant does flows through the same checked pipeline — authentication, authorisation, dispatch, audit — with no side channels.

POST https://your-site.com/wp-json/liyans-mcp/v1/mcp

The life of a single request

1

The client asks

Your MCP client sends a JSON-RPC 2.0 request — initialize, tools/list, tools/call — over HTTPS, carrying a bearer token or an OAuth 2.1 access token. Batch arrays are processed item by item; notifications are accepted and never answered.

2

Identity is resolved

The credential is checked against stored hashes. An unknown token fails hard — there is no silent fallback to browser cookies; WordPress session cookies do not authenticate the endpoint unless an administrator explicitly enables that setting.

3

Permission is intersected

Effective permission = the token’s scopes ∩ the live WordPress capabilities of the account that owns the token. Demote or delete that account and its tokens lose power immediately.

4

Arguments are validated

Every tool call is validated against the tool’s JSON Schema before any handler runs. Unknown arguments are rejected, and schema failures come back as tool errors with isError: true.

5

Adapters do the work

Handlers talk to WordPress through purpose-built adapters — Elementor, the HTML converter, WooCommerce and SEO — so output is native data: real Elementor element trees, real products, real post meta.

6

Everything is logged

The call, its tool, its outcome and (only if you enable content logging) its arguments are written to the plugin’s local audit log — a table in your own database, with configurable retention and CSV export.

A build, step by step

  1. Inspect. The assistant reads the site first — structure, existing pages, menus, the active theme and the widgets Elementor actually has registered.
  2. Plan. For multi-page work it opens a build session: the plan is validated and slug conflicts are reported before a single page is written.
  3. Build as drafts. Pages are created as drafts, always. Publishing stays on the plugin’s explicit paths — or in your hands in wp-admin.
  4. Verify. liyans_verify_layout checks the stored structure; liyans_render_check renders the page server-side and confirms element ids and texts appear in the real rendered output.
  5. Change safely. Rebuilds and element edits snapshot the previous layout first; liyans_restore_snapshot brings it back byte-for-byte.
  6. You publish. Review the draft like any other draft, then publish it yourself. The assistant’s work is ordinary WordPress content — nothing is locked in.

Errors that mean something

Tool failures use a closed catalogue of 27 named error codes — among them not_found, insufficient_scope, dependency_missing, validation_failed, session_not_found and session_closed. Responses carry a safe, human-readable detail; internal exception details are written to the audit log, never returned to the caller. A dependency-gated tool (say, a WooCommerce tool on a site without WooCommerce) answers dependency_missing in the tool list’s place — it is visible, and it refuses cleanly when called.

Developer resources   Install it in minutes