Current release: 1.1.0, out on WordPress.org and GitHub since 22 October 2026. 18 items are planned. The status on each item comes live from GitHub, so it changes the moment an issue closes. There are no dates. Fixes come first, then the safety controls, then everything else.
What safe means in Shim
Already true in 1.1.0
- Every ability checks a WordPress capability. Abilities that touch a specific post, page, user or comment also check your permission on that exact item.
- Plugins install only from WordPress.org, by slug. No URLs, uploads or file paths.
- No ability runs PHP code or shell commands.
- Options that look like credentials can't be read. Site-critical settings such as the site URL, admin email, default role and active plugins can't be changed. Option search returns names only.
wp-config.phpstays untouched unless you defineSHIM_MCP_ALLOW_CONFIG_WRITES.- Nothing leaves your site. There is no relay, account or telemetry. The only outside call is to WordPress.org when you install a plugin.
- Local use over WP-CLI needs no password and opens no port.
- Every change runs through automated tests on WordPress 6.9, the latest release and multisite.
Safe by default, as the items below ship
- Abilities added by other plugins start switched off until you turn them on (#55).
- A read-only mode for assistants that should look but not touch (#55).
- Destructive actions wait for a person to approve them (#56).
- An activity log, switched on, that never leaves your site (#57).
- Changes you can undo (#66).
- Web connectors get scoped access you can revoke, instead of a password with your full permissions (#54).
All safety work carries the safety label on GitHub.
Fixing first
-
Plugins can mark an ability as not meant for MCP. Shim exposes those today. It will stop.
-
The HTTP transport will refuse requests from unexpected web origins, as the MCP spec requires, to block DNS rebinding attacks.
-
When the MCP Adapter plugin is also loaded, for example because another plugin bundles it, Shim's server lists no tools. Shim will register its tools at the right moment and keep the two servers apart.
Safety controls
-
Switch abilities on and off in Tools > Shim MCP, with other plugins' abilities off until you enable them, plus a read-only mode.
-
Deletes and other destructive actions wait for a person to approve them, in the AI client or in wp-admin. The assistant can't approve its own request.
-
A record in wp-admin of every call a client made, including refused ones: who, what, when and whether it worked, with secrets left out.
-
Each change made over MCP gets an ID you can undo from the client or from wp-admin, for posts, options, terms, menus, users and plugin settings.
Help wanted -
Two filters, before and after every tool call, so developers can log, block or reshape calls. The log and approvals build on them.
Good first issue
Safe connections
-
An OAuth 2.1 sign-in you approve in wp-admin. Each connection gets its own scoped access, read-only if you like, and you can revoke it at any time. Application passwords keep working.
Help wanted -
Support for the 2025-11-25 and 2026-07-28 versions of the protocol, next to the three Shim speaks today.
Help wanted -
Ready-made setup for VS Code, Windsurf and Codex CLI, with no password ever placed in an install link, and a test that says exactly why a connection fails.
More of WordPress, with the same guards
-
Upload an image from a link instead of base64, with private and internal addresses refused, and set or clear a post's featured image.
Good first issue -
Read and write post meta, including ACF values, with WordPress's internal keys kept out of reach.
-
Titles, descriptions, canonical URLs and robots settings for Yoast SEO, Rank Math, All in One SEO and SEOPress, through one set of abilities.
Help wanted -
Templates, template parts such as the header and footer, global styles and patterns, with a reset to the theme's version.
Help wanted -
Activate and install themes, and apply plugin and theme updates, from WordPress.org only.
-
Products, orders and customers, through WooCommerce's own abilities where your version has them. Customer data goes only to users allowed to see it.
Help wanted -
Filter the ability list by category or text, so clients spend less context finding the right tool.
Good first issue
Not planned
- A hosted relay or an account. Your site's data would pass through someone else's server. Shim talks only to your site.
- Running PHP, shell or WP-CLI commands for the assistant. One mistaken command could do anything on your server.
- Installing plugins from a URL or a zip. WordPress.org only, so every plugin has been through the directory's review.
- Page builder editing for Elementor, Divi or Bricks, for now. Each builder stores content its own way.
- Rate limits and IP allowlists, for now. Your host or a security plugin does these better.
Think something here should be on the list? Say so on the roadmap issue.
How to help
- Tell us what matters to you. A comment on an issue is how it moves up the list.
- Pick up a good first issue. Send pull requests to the
devbranch. The README explains how to run the tests. - Found a security problem? Report it privately, as described in SECURITY.md. For anything else, open an issue.
Try Shim MCP today
57 WordPress abilities over WP-CLI stdio or Streamable HTTP, with a permission check on every one. Free, GPL, and nothing to sign up for.