Developer Reference

Constants

Constant	Value	Description
`WCOPS_VERSION`	e.g. `1.1.1`	Plugin version
`WCOPS_PLUGIN_FILE`	`__FILE__`	Absolute path to the main plugin file
`WCOPS_PLUGIN_DIR`	`plugin_dir_path()`	Plugin directory path
`WCOPS_PLUGIN_URL`	`plugin_dir_url()`	Plugin directory URL
`WCOPS_REST_NAMESPACE`	`windcodex-ops/v1`	REST namespace
`WCOPS_REST_ROUTE`	`/mcp`	MCP route
`WCOPS_PLUGIN_BASE`	`plugin_basename()`	Plugin basename
`WCOPS_PRO_PLUGIN_BASE`	`windcodex-ops-pro/windcodex-ops-pro.php`	Used to detect Ops Pro

REST Routes

Route	Method	Description
`/wp-json/windcodex-ops/v1/mcp`	POST	MCP JSON-RPC endpoint (Bearer token required)
`/wp-json/windcodex-ops/v1/oauth/register`	POST	Dynamic client registration (10 per hour per IP)
`/wp-json/windcodex-ops/v1/oauth/token`	POST	Token exchange and refresh (30 per 5 minutes per IP)
`/wcops-oauth/authorize`	GET/POST	Consent screen (rewrite rule, not REST)

OAuth lifetimes: authorization code 5 minutes, access token 1 hour, refresh token 30 days.

Options

Option	Description
`wcops_settings`	All plugin settings (shared with Ops Pro)

Key settings inside wcops_settings:

Key	Default	Description
`enabled`	`true`	Master switch for the connector
`read_only`	`false`	Expose read-only tools only
`max_results_limit`	`50`	Cap on rows returned by list tools
`tool_groups`	all `true`	Per-group toggles: `wp_site`, `wp_posts`, `wp_pages`, `wp_media`, `wp_taxonomy`, `wp_navigation`, `wp_site_health`, `wp_seo`
`requests_per_minute_limit`	`120`	Clamped to 10-600 on every read
`allow_dynamic_registration`	`true`	OAuth auto-registration
`connect_capability`	`manage_options`	Who can connect: `manage_options` (Administrators only) or `edit_others_posts` (Editors and above). Any other value falls back to `manage_options`
`require_preview_on_high_risk`	`true`	Preview gate for irreversible single-item tools
`log_ai_activity`	`true`	Record tool calls in the activity log
`enable_undo_log`	`true`	Keep undo history
`undo_window_hours`	`72`	Undo window (72, 96, or 168)
`email_alerts_on_high_risk`	`false`	Email the admin address when a high-risk action runs (max 10/hour)
`weekly_activity_summary`	`true`	Weekly digest email
`delete_data_on_uninstall`	`false`	Remove data on uninstall

Cron

Hook	Schedule	Description
`wcops_weekly_summary`	Weekly	Sends the weekly activity summary (from 1.1.1). Scheduled while the setting is on; removed on deactivation

Filters

Filter	Arguments	Description
`wcops_ability_capability`	`$capability (string)`, `$tool_name (string)`, `$destructive (bool)`	Change the WordPress capability required to run a tool through the Abilities API
`wcops_connect_capability`	`$capability (string)`	Change the capability a user needs to approve a connection, which the connection's user must keep on every request and tool call

add_filter( 'wcops_ability_capability', function ( $capability, $tool_name, $destructive ) {
    if ( 'wp_cleanup_database' === $tool_name ) {
        return 'manage_options';
    }
    return $capability;
}, 10, 3 );

Default capabilities: content tools require edit_posts (or delete_posts when destructive); other tools require manage_options.

WordPress Abilities API

On WordPress 6.9+, each tool is also registered as an ability in the windcodex-ops category. Ability names follow windcodex-ops/<tool-name-with-dashes>, for example windcodex-ops/wp-create-post.

Tool definitions are not a public PHP API. Treat the MCP endpoint and the Abilities API as the supported integration surfaces.

Troubleshooting Overview