Developer Reference

Constants

Constant	Value	Description
`WCFORGE_VERSION`	`1.0.0`	Plugin version
`WCFORGE_PLUGIN_FILE`	`__FILE__`	Main plugin file
`WCFORGE_PLUGIN_DIR`	`plugin_dir_path()`	Plugin directory
`WCFORGE_PLUGIN_URL`	`plugin_dir_url()`	Plugin URL
`WCFORGE_REST_NAMESPACE`	`windcodex-forge/v1`	REST namespace
`WCFORGE_REST_ROUTE`	`/mcp`	MCP route

REST Routes

Route	Method	Description
`/wp-json/windcodex-forge/v1/mcp`	POST	MCP JSON-RPC endpoint (Bearer token)
`/wp-json/windcodex-forge/v1/oauth/register`	POST	Dynamic client registration (10 per hour per IP)
`/wp-json/windcodex-forge/v1/oauth/token`	POST	Token exchange and refresh
`/wcforge-oauth/authorize`	GET/POST	Consent screen (rewrite rule)

OAuth lifetimes: authorization code 5 minutes, access token 1 hour, refresh token 30 days.

Options

Option	Description
`wcforge_settings`	All settings (shared with Forge Pro)

Notable keys: enabled, read_only, acting_user_id, max_results_limit (default 50), requests_per_minute_limit (10-600, default 120), allow_dynamic_registration, delete_data_on_uninstall, primitive_enabled (per-tool toggles).

Filters

Filter	Arguments	Description
`wcforge_ability_capability`	`$capability (string)`, `$tool_name (string)`	Change the capability required to run a tool through the Abilities API. Default `manage_options`

add_filter( 'wcforge_ability_capability', function ( $capability, $tool_name ) {
    if ( 'wp_list_plugins' === $tool_name ) {
        return 'activate_plugins';
    }
    return $capability;
}, 10, 2 );

WordPress Abilities API

On WordPress 6.9+, each tool is registered as an ability in the windcodex-forge category.

The MCP endpoint and the Abilities API are the supported integration surfaces. Internal PHP classes are not a public API.

Troubleshooting Overview