WordPress.org

English (Australia)

Get WordPress
WordPress.org

Plugin Directory

SectionMate MCP

SectionMate MCP

By jrobertosouza
Download

Description

SectionMate MCP connects your AI assistant to WordPress so it can build and edit page sections — a hero, a pricing table, an FAQ, a features row — directly in Elementor, Gutenberg or Spectra.

Build one section at a time. This is the most important thing to know. The AI can generate a whole page in one request, but the results are noticeably better when you do one section, look at it, adjust it, then move on. Each section gets the AI’s full attention instead of a fraction of it — and you catch a wrong direction after one band instead of after twelve.

Nothing is saved until you approve it. Every edit shows you a preview and waits for your confirmation.

Install and connect

  1. Install and activate the plugin.
  2. Open SectionMate MCP in the WordPress admin menu.
  3. Type a name for the AI app you are connecting — “Claude”, “Grok”, “Cursor” — and click Create connector URL.
  4. Copy the URL. It is shown only once. It already contains your sign-in details, so there is nothing else to fill in.
  5. In your AI app, add it as a remote MCP server (some apps call this a “connector” or “custom connector”).
  6. Ask for a section: “Add a pricing section to page 12 with three plans.”

Your site needs to be reachable over HTTPS. For a site on your own computer, use a tunnel such as Cloudflare Tunnel or ngrok.

Getting good results

  • One section at a time. Finish and review the hero before asking for the features row.
  • Give it something to work from. A screenshot of a design you like, your brand colours, a logo, images already in your Media Library.
  • Say what is wrong. “Make the cards taller”, “use the brand green” — it can read the page back and change specific blocks rather than rebuilding everything.
  • Point at things visually. Logged-in editors get an Inspect overlay on the front end: click any block to grab a reference for the AI, or leave a note it reads on the next turn.
  • You can edit anything by hand afterwards. It is ordinary WordPress content.

What it does not do

It builds content on a page. It does not set up your theme, your site-wide header and footer, or your menus. It can build a header-looking band as part of a page, which is not the same thing as a theme header.

Works with

  • WordPress block editor (Gutenberg) — works out of the box
  • Elementor (free)
  • Spectra / Ultimate Addons for Gutenberg
  • Spectra Blocks (V3)

Use one builder per page. Sections, headings, text, images, buttons and icons work on all of them; counters, countdowns, FAQ accordions, icon lists and galleries work wherever the builder provides them.

Not affiliated with or endorsed by Elementor, Brainstorm Force (Spectra), or Automattic.

Safety

The connector signs in as you. It can do exactly what your account can do and no more, every edit is recorded as yours, and you can revoke one connected app on its own without changing your password.

  • Turn the MCP connector switch off when you finish. The plugin stays installed and your pages keep working.
  • Prefer a local or staging site for big redesigns. On a live site, work on drafts and keep sessions short.
  • Treat the connector URL like a password, because it contains one.
  • If you deactivate the plugin, everything it built stays on your pages.
  • Advanced: a code block can carry custom CSS and JavaScript. Writing JavaScript follows WordPress’s own rule and needs the unfiltered_html capability — administrators and editors have it on a normal single site.

Privacy

The plugin does not phone home, and it collects no analytics or telemetry of any kind. It adds no third-party scripts and no trackers to your pages.

It does use two external services, and one of them (Google Fonts) is requested by your visitors’ browsers. Both are described in External services below. Read that section before using the plugin on a site with GDPR or similar obligations.

External services

This plugin relies on the following external services. Each is listed with what it does, what is sent, when, and links to that provider’s terms and privacy policy.

Google Fonts (fonts.googleapis.com, fonts.gstatic.com)

What it is used for. When a page you compiled specifies a Google font family, the plugin enqueues that family’s stylesheet so the page renders in the font you chose. The plugin’s own admin screen and the logged-in front-end Inspect overlay also load one font (IBM Plex Mono) for their interface.

What is sent and when. The plugin builds a stylesheet URL containing only the font family names and weights the page asks for. Your visitor’s browser then requests that stylesheet from fonts.googleapis.com and the font files from fonts.gstatic.com. Those requests are made by the browser, so Google receives the visitor’s IP address and user-agent, as it does for any site using Google Fonts. This happens on the front end for pages that use a Google font, and in the admin/editor for the interface font. No personal data is sent by the plugin itself, and nothing is sent when a page uses no Google font.

Avoiding it. Pages that use only system or theme fonts make no request. If you need zero third-party font requests, do not specify Google font families when designing, and use a font-hosting plugin for the interface font.

Service provided by Google: terms of service, privacy policy, Google Fonts privacy FAQ.

Wikimedia Commons API (commons.wikimedia.org)

What it is used for. The optional search_placeholder_images MCP tool searches Wikimedia Commons for openly licensed photographs, so an AI agent can suggest real images for a design instead of inventing image paths that render blank. It is read-only and returns image URLs, dimensions, suggested alt text, and licence/attribution information.

What is sent and when. Only when you or your connected AI agent explicitly calls that tool. The request is made from your server and contains the search terms supplied in the call, plus a requested image width and result limit. No personal data, no site information, and no account or API key are involved.

Avoiding it. The tool only runs on request. If it is never called, the plugin never contacts Wikimedia. Turning the MCP connector off under Setup blocks it along with every other tool.

Service provided by the Wikimedia Foundation: terms of use, privacy policy, API documentation.

Images you choose to import (no fixed provider)

What it is used for. The import_media tool, and the media sideloading step of compile_and_insert / compile_elementor, download an image from a URL and add it to your Media Library so the page serves it locally rather than hotlinking.

What is sent and when. Your server makes an HTTP request to whatever URL you or your agent supplies — there is no fixed third party, and the plugin has no default host. It runs only on explicit request, requires the upload_files capability, and is confirm-gated: the first call returns a preview and nothing is downloaded until a second call confirms it. Whichever host the URL points at will see a request from your server’s IP address.

Avoiding it. Supply only URLs you trust, or upload images through the WordPress Media Library instead and reference them by attachment id.

Screenshots

Admin screen with safety warning and MCP connector URL
Admin screen with safety warning and MCP connector URL
Setup steps for connecting an AI client
Setup steps for connecting an AI client
Front-end Inspect / design review for logged-in editors
Front-end Inspect / design review for logged-in editors

Installation

  1. Install from Plugins Add New, or upload the sectionmate-mcp folder to /wp-content/plugins/.
  2. Activate SectionMate MCP on the Plugins screen.
  3. Open SectionMate MCP in the WordPress admin menu.
  4. Name the AI app you are connecting and click Create connector URL. Copy the URL — it is shown only once, and it already contains your sign-in details.
  5. Add that URL in your AI app as a remote MCP server.
  6. Turn the MCP connector switch off when you finish a session.

Your site must be reachable over HTTPS. For a site on your own computer, use a tunnel such as Cloudflare Tunnel or ngrok.

Optional: install Spectra and/or Elementor if you want to build with those. Gutenberg works without anything extra.

FAQ

Can I use this on a live production site?

Yes, carefully. Prefer draft pages and short editing sessions. Do not leave the MCP connector switch on unattended on production. Prefer local or staging for large redesigns. When finished, turn the MCP connector off under Setup — the pages you built stay, and the same URL works again when you re-enable. Anyone with the secret URL can edit pages only while the connector is on.

What does the MCP connector switch do?

When off, the plugin stays installed but MCP tools refuse every request, whoever is asking. When on, your connector URLs work again — they are not invalidated by the switch. This is the recommended way to secure a site after a design session, because it is one click and reversible. Revoke an individual connector instead if its URL may have leaked.

What happens if I deactivate the plugin?

Compiled page content remains (Spectra/Gutenberg blocks, Elementor data, and any CSS/JS already saved into the page). MCP, Inspect, and annotations stop until you activate again. Prefer the connector switch over full deactivation when you only need to block remote AI access.

Do I need an API key or paid AI subscription?

The plugin does not sell AI access. You connect your own AI client (Claude, Cursor, Grok, ChatGPT, etc.) using the connector URL. Any AI costs are between you and that provider.

Why are my username and password in the connector URL?

Because many AI clients accept only a URL — no place to enter a username, a password, or a request header. HTTP has always allowed credentials in the URL itself (https://USER:APP-PASSWORD@your-site.com/…), and that is standard HTTP Basic authentication, which is how WordPress Application Passwords work.

Two things follow from that. It is a real WordPress sign-in, so the connector is limited to your account’s permissions and every edit is attributed to you. And unlike a secret in the query string, this part of the URL is not written into server access logs.

Treat the URL as the password it contains. If a client can set request headers, you can send Authorization: Basic instead and use the plain URL.

Does every edit apply immediately?

No. Write tools return a preview first. Nothing is saved until a second call confirms with the one-time confirmation token. Only a response with status applied means the page changed.

Which page builders are supported?

Spectra Legacy (UAGB / uagb/*), Spectra Blocks V3 (spectra/*), core Gutenberg blocks, and Elementor (free) element trees. Install the builders you need on the site. On empty pages, agents must ask which backend to use.

Can it set up my theme header / site-wide navigation?

No — and that is intentional. This is a page designer for page builders, not a theme or full-site designer. The AI can build a navigation or hero “header” as content on the page (logo, links, buttons as blocks). It cannot configure the WordPress theme header, Customizer menus as the site header, FSE header templates, or products like Astra Site Builder / Header Footer Builder. Themes differ widely; a true custom theme header often needs a theme’s pro site builder. We stay on page builders so results stay portable. For a full-bleed landing page you may use hideHeaderFooter to hide the theme header/footer on that page only — that still does not create a theme header.

Is this affiliated with Elementor or Spectra?

No. It is an independent tool that compiles into those formats when those plugins are present.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“SectionMate MCP” is open source software. The following people have contributed to this plugin.

Contributors

Translate “SectionMate MCP” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

The last two releases. Full history: changelog.txt, shipped with the plugin.

2.2.0

  • The plugin no longer registers a block. The “SectionMate” import block (sectionmate-mcp/import) let you paste clean JSON into the editor and have it compile in place. It predates the MCP connector, which does the same job better, and it has not been the recommended path for a long time. The block, its editor script, its block category and the /v1/compile REST route it was the only caller of are all removed. Nothing else used them, and no saved page content depends on the block — it replaced itself with real blocks whenever it ran.
  • Verified against the current builders: Spectra Legacy 2.20.3, Spectra Blocks 1.0.7 and Elementor 4.2.4. No compiler change was needed for any of them. All 41 design-lab runs reproduce their previous score exactly, the selftest is clean on all 23 fixtures, and element boxes agree across all four backends at 1440 and 1600.
  • Two changelog entries were worth testing rather than trusting. Spectra Blocks 1.0.5 said “buttons and button-style links now output valid HTML markup” — spectra/button is a static-save block, so a changed save() would invalidate every button already written; the editor loads clean. Spectra Blocks 1.0.7 moved responsive editing “to follow core’s breakpoints”; boxes still agree across backends. Elementor 4.2.4 carries a third consecutive “improved code security enforcement” line, and the end-to-end code node test still passes.
  • Other plugins’ admin notices no longer appear on the SectionMate screen. Upgrade prompts hooked globally by other plugins were pushing the connector UI down the page and reading as though they belonged here. Suppressed on this plugin’s own screen only — anywhere else they are the user’s business, and user_admin_notices is left alone.
  • Settings screen headline now matches the directory banner, and carries the habit that most affects output quality: build one section at a time.

2.1.29

  • The connector authenticates as a real WordPress user. The plugin’s own secret token, and the /mcp/<token> route that carried it, are gone. Authentication is now WordPress’s own: an Application Password, created under Users Profile, sent over HTTP Basic. Clients that accept only a URL can carry it as https://USER:APP-PASSWORD@your-site.com/…, which keeps single-URL setup working and, unlike a token in the path or query string, is not written into server access logs.
  • This is a breaking change. Existing token URLs stop working and must be replaced. In exchange, access is per-client and revocable from your profile without disturbing anything else, and it is your account — not an anonymous bearer secret — that the site records as making the edit.
  • The plugin no longer impersonates an administrator. When a write lacked unfiltered_html, it looked up the first administrator account, called wp_set_current_user() into it so Elementor’s sanitizer would stand down, and fell back to writing _elementor_data with direct SQL if that failed. Both paths are deleted. With a real user behind the request an administrator simply has the capability, and Elementor leaves the tree alone by itself.
  • KSES is respected instead of removed. Saves used to strip wp_filter_post_kses unconditionally, which handed any token holder the equivalent of unfiltered_html — including a live <script> — while the admin screen claimed that capability was required. The capability is now checked. Users who have it are unaffected; users who do not get the same treatment as core’s Custom HTML block.
  • The real problem under that bypass was narrow and is fixed properly: default post KSES has no svg/path and lowercases viewBox, so compiled button and icon-list icons were emptied and the block’s save() match broken. The allowlist now permits inline SVG shapes — no script, no event attributes, no href — so an editor gets working icons and still cannot write JavaScript.
  • Connectors are created and revoked from the plugin’s own Setup screen. Name the client, click once, and the finished URL appears with your credentials already in it — no copying a password out of your profile and splicing it into a pattern by hand. Below it, every connector with access is listed with its created and last used dates, each with its own Revoke button. Passwords are not listed and cannot be: WordPress stores only a hash, which is also why the new URL is shown exactly once.
  • Bundled templates renamed from .markup to .html. Same contents; the directory only permits file types normally found in a plugin.

Meta

Ratings

No reviews have been submitted yet.

Your review

See all reviews

Contributors

Support

Got something to say? Need help?

View support forum