Ostheimer Cockpit for WebMCP

Ostheimer Cockpit for WebMCP turns your WordPress site into a set of structured tools for

AI agents that run through your browser. It implements the experimental

WebMCP Draft Community Group Report,

which is not a W3C Standard. Compatible browser agents can discover what your

site can do and act on it. The plugin requires no separate MCP server and no

plugin API key.

The agent drafts; the human approves.

How it works

• Install and activate the plugin, then open the normal WordPress dashboard

or the Cockpit for WebMCP page — both register the agent tools in your

browser. A native dashboard box shows the live status and quick links.

• Enable experimental WebMCP support. Chrome 149+ offers an origin trial and

a local testing flag; the cockpit links to the current Chrome instructions.

• Tell your browser’s AI agent what to do, for example:

”

• The agent drafts the content and submits it with the status

Zur Prüfung (pending review) — it never publishes on its own.

• You review the draft in the review queue and approve it with one click.

Tool registration and WordPress requests run in your browser tab and your own

WordPress installation. The plugin itself does not send content to the plugin

developer or another third-party service. Your chosen browser, AI agent, or

extension may process prompts, page content, tool inputs, or tool results on

external systems under its provider’s terms and privacy policy.

Agent tools included

• create_post / update_post — common core post fields: title, content,

excerpt, slug, author, scheduling date (planned posts), comment and ping

status, password protection, sticky, post format, page attributes

(parent, template, order).

• Featured images in one step — the agent passes an image URL or uploads

self-generated images as Base64 (PNG, JPEG, WebP, GIF), the plugin puts

them into the media library and sets the featured image.

• Taxonomies by name — categories_names / tags_names resolve names to

terms; missing tags are created automatically.

• SEO fields are written to Yoast SEO or Rank Math automatically when

active, so agents can set meta titles and descriptions where your SEO

plugin actually reads them.

• list_posts, get_post, get_post_markdown — search and read content in

agent-friendly formats.

• list_comments, moderate_comment — triage the comment queue: the agent

sorts pending comments and spam, you decide what gets approved. Author

email and IP address are never handed to the agent.

• list_revisions, compare_revisions, restore_revision — read a post’s

revision history and roll back to an earlier one. Restoring follows the

same review boundary as update_post (published or scheduled content

cannot be touched) and is itself reversible, because WordPress saves the

pre-restore state as a new revision before restoring.

• list_terms, get_site_info, get_activity — context and audit trail.

• upload_media, upload_media_base64 — media library uploads.

• Developers can register their own agent tools with the

webmcp_cockpit_tools filter — anything a PHP callback can do becomes an

agent tool.

Safe by design

• Agent content lands in a dedicated review status, invisible to visitors.

• Publishing is only possible from the review queue, and only for users with

the publish capability.

• Successful and failed agent tool calls plus workflow actions are written to

a controllable activity log with timestamp and user. Read entries contain

metadata only, never post content, search terms, tool inputs or tool results.

• Session-bound authentication with a dedicated workflow nonce; per-user rate

limiting on write operations.

• Works with caching plugins (Autoptimize, WP Rocket, LiteSpeed Cache,

W3 Total Cache, SG Optimizer) and with the Classic Editor and Gutenberg.

For developers

The cockpit is extensible: register custom tools via

apply_filters( ‘webmcp_cockpit_tools’, $tools ) with a name, description,

JSON schema and PHP callback. Custom tools appear alongside the built-in ones

in the browser agent’s tool list.