Appearance
MCP Server
The MCP Server function lets an AI assistant work on your Voxel site directly. Instead of describing your setup to it and copying changes back by hand, the assistant can read your post types, add a field, create categories, query listings and check which toolkit functions are enabled — through the Model Context Protocol.
Every configuration change it makes is snapshotted first, so anything can be undone in a single step.
Overview
MCP is an open standard for connecting AI assistants to external systems. This function publishes 26 tools describing what an assistant may do on your site, and the assistant chooses among them.
Key Features
- 26 tools across post types, fields, taxonomies, terms, listings and toolkit settings
- Automatic snapshot before every configuration change, with one-call restore
- Changes merge rather than replace, so a partial payload can't delete what it omits
- Dry run on every write — see exactly what would change before committing
- Listing values go through Voxel's own validation
- A setup page that builds your client configuration for you
- Permissions are the connected user's; MCP grants nothing extra
Requirements
| Requirement | Notes |
|---|---|
| Voxel theme | Supplies the post types and listings the tools operate on |
| WordPress Abilities API | In WordPress core from 7.0. On earlier versions, install the Abilities API feature plugin |
| MCP Adapter | Ships inside Voxel Toolkit — nothing to install |
The adapter is bundled, so a normal install needs nothing extra. If another plugin already provides one, or you have the standalone plugin, that copy is used instead. The MCP page tells you which one is running.
If a requirement is missing the function stays dormant and says so. Nothing else on your site is affected.
Setup Instructions
Step 1: Enable the Function
- Navigate to Voxel Toolkit → Functions
- Find MCP Server and toggle it on
- Click Save Changes
A new Voxel Toolkit → MCP page appears.
Step 2: Create an Application Password
MCP authenticates as a WordPress user. Use an application password rather than your login password, so access can be revoked later without changing how you sign in.
- On the MCP page, click Create application password
- WordPress shows the password once — copy it
HTTPS is required
WordPress disables application passwords on sites not served over HTTPS. Set up SSL before connecting.
Step 3: Build Your Client Configuration
On the MCP page, enter your username and paste the application password, then pick your client. The configuration snippet is built for you with a one-click copy.
The password stays in your browser. It is never sent to the server, never saved, and never written into the page — it is only used to build the snippet.
Step 4: Check It Works
Ask the assistant to list your Voxel post types. It should reply with your real post type keys and field counts.
Supported Clients
Clients differ in more than branding, so the page generates the right shape for each.
| Client | Where it goes |
|---|---|
| Claude Code | A terminal command |
| Claude Desktop | claude_desktop_config.json — runs a local bridge |
| Cursor | .cursor/mcp.json |
| VS Code / Copilot | .vscode/mcp.json (note: uses servers, not mcpServers) |
| Codex | ~/.codex/config.toml — TOML rather than JSON |
| Generic | Endpoint URL and header values for anything else |
Desktop and CLI only
Mobile apps connect to a URL from the vendor's own servers and expect OAuth, which this endpoint does not offer. Claude Desktop also launches a local bridge rather than connecting directly, which a phone cannot do.
Available Tools
Tools marked Write change your site; the rest only read. The full list, with descriptions, is on the MCP page itself.
Post types and fields
list-post-types · get-post-type · list-post-type-fields — read update-post-type · upsert-post-type-field · delete-post-type-field — write
Taxonomies and terms
list-taxonomies · get-taxonomy · list-terms — read create-taxonomy · update-taxonomy · create-term · update-term · delete-term — write
Listings
list-posts · get-post — read create-post · update-post · delete-post — write
Voxel Toolkit settings
list-toolkit-functions · get-toolkit-function — read set-toolkit-function-enabled · update-toolkit-function-settings — write
Undo
list-snapshots · get-snapshot — read restore-snapshot — write
What It Can and Cannot Do
Protections
- Every config change is snapshotted. The previous state is captured before the write and can be restored in one call. Restores are snapshotted too.
- Changes merge by default. Sending three settings changes those three; anything not mentioned is left alone.
- Fields are edited one at a time. No tool accepts a whole field list, so a partial payload cannot wipe the fields it omits.
- Anything can be previewed. Every write accepts a dry run that reports what would change and writes nothing.
- Values go through Voxel's validation. A value Voxel would reject in its own form is rejected here rather than written to the database.
- The server cannot switch itself off. Disabling the MCP function through MCP is refused.
Limits worth knowing
- Snapshots cover configuration, not content. Post types, taxonomies and toolkit settings can be rolled back. Listings and terms cannot — deleted listings go to the trash, deleted terms are gone.
- Deleting a field does not delete its data. Stored values remain but become unreachable. The delete tool reports how many posts hold a value first.
- Writes need Administrator, reads need Edit Posts. Connecting as a lower role gives read-only access, which is a reasonable way to try this out.
- Only the last 30 snapshots are kept. Undo a mistake in the same session rather than a week later.
- It is a real connection to a real site. Try it on staging first.
Recent Changes
The MCP page lists every configuration change made through MCP — when, what target, what changed and who did it, with the snapshot ID. To roll one back, ask the assistant to restore that ID.
Troubleshooting
The MCP menu item isn't there. The page only appears while the function is enabled.
The page says it isn't running. Check the Status table — it names each requirement and whether it's present.
The assistant can read but not write. Writing requires Administrator. Check which user the application password belongs to.
A tool is missing. Another plugin may be supplying an older MCP Adapter. The Status section names the version in use and where it came from.