mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbach
c19dd690f3
WordPress serves MCP through two addons rather than a sidecar, because the application already carries the extension point. The mu-plugin is the entire tool surface. The MCP Adapter publishes an ability only when it carries meta.mcp.public, so whatever is not registered in that file cannot be reached over MCP no matter what else the installation has. Every ability reads already-published content and carries its own permission callback, which is not decoration: the adapter authorizes the transport, the callback authorizes the operation, and dropping it would let any authenticated caller reach the ability. The second addon fetches the release asset rather than the tag's source archive. The source archive unpacks as mcp-adapter-<version>, which no longer answers to the slug the generic activation step uses, and it ships no vendor directory. Three Playwright specs cover what needs no credential: both addons active, the abilities registered, and a guest served nothing. The mcp role joins the role catalogue instead of replacing it.
15 lines
619 B
YAML
15 lines
619 B
YAML
---
|
|
roles:
|
|
subscriber:
|
|
description: Can read posts and leave comments but cannot write or manage content
|
|
author:
|
|
description: Can write and manage own posts
|
|
contributor:
|
|
description: Can write and submit posts for review but cannot publish
|
|
editor:
|
|
description: Can publish and manage all posts, including those by other users
|
|
administrator:
|
|
description: "Has full administrative access: manage themes, plugins, settings, and users"
|
|
mcp:
|
|
description: Can drive this application through an MCP client, which acts with the credentials the deployment issued rather than the caller's own
|