Title: SectionMate MCP
Author: jrobertosouza
Published: 12 de septiembre de 2026
Last modified: 12 de septiembre de 2026
---
Search plugins
# SectionMate MCP
By [jrobertosouza](https://profiles.wordpress.org/jrobertosouza/)
[Download](https://downloads.wordpress.org/plugin/sectionmate-mcp.2.2.0.zip)
* [Details](https://es-pr.wordpress.org/plugins/sectionmate-mcp/#description)
* [Reviews](https://es-pr.wordpress.org/plugins/sectionmate-mcp/#reviews)
* [Installation](https://es-pr.wordpress.org/plugins/sectionmate-mcp/#installation)
* [Development](https://es-pr.wordpress.org/plugins/sectionmate-mcp/#developers)
[Support](https://wordpress.org/support/plugin/sectionmate-mcp/)
## Description
SectionMate MCP connects your AI assistant to WordPress so it can **build and edit
page sections** — a hero, a pricing table, an FAQ, a features row — directly in
Elementor, Gutenberg or Spectra.
**Build one section at a time.** This is the most important thing to know. The AI
_can_ generate a whole page in one request, but the results are noticeably better
when you do one section, look at it, adjust it, then move on. Each section gets
the AI’s full attention instead of a fraction of it — and you catch a wrong direction
after one band instead of after twelve.
Nothing is saved until you approve it. Every edit shows you a preview and waits
for your confirmation.
#### Install and connect
1. Install and activate the plugin.
2. Open **SectionMate MCP** in the WordPress admin menu.
3. Type a name for the AI app you are connecting — «Claude», «Grok», «Cursor» — and
click **Create connector URL**.
4. Copy the URL. **It is shown only once.** It already contains your sign-in details,
so there is nothing else to fill in.
5. In your AI app, add it as a remote MCP server (some apps call this a «connector»
or «custom connector»).
6. Ask for a section: _«Add a pricing section to page 12 with three plans.»_
Your site needs to be reachable over HTTPS. For a site on your own computer, use
a tunnel such as Cloudflare Tunnel or ngrok.
#### Getting good results
* **One section at a time.** Finish and review the hero before asking for the features
row.
* **Give it something to work from.** A screenshot of a design you like, your brand
colours, a logo, images already in your Media Library.
* **Say what is wrong.** «Make the cards taller», «use the brand green» — it can
read the page back and change specific blocks rather than rebuilding everything.
* **Point at things visually.** Logged-in editors get an **Inspect** overlay on
the front end: click any block to grab a reference for the AI, or leave a note
it reads on the next turn.
* You can edit anything by hand afterwards. It is ordinary WordPress content.
#### What it does not do
It builds **content on a page**. It does not set up your theme, your site-wide header
and footer, or your menus. It can build a header-_looking_ band as part of a page,
which is not the same thing as a theme header.
#### Works with
* WordPress block editor (Gutenberg) — works out of the box
* Elementor (free)
* Spectra / Ultimate Addons for Gutenberg
* Spectra Blocks (V3)
Use one builder per page. Sections, headings, text, images, buttons and icons work
on all of them; counters, countdowns, FAQ accordions, icon lists and galleries work
wherever the builder provides them.
Not affiliated with or endorsed by Elementor, Brainstorm Force (Spectra), or Automattic.
#### Safety
The connector signs in **as you**. It can do exactly what your account can do and
no more, every edit is recorded as yours, and you can revoke one connected app on
its own without changing your password.
* **Turn the MCP connector switch off when you finish.** The plugin stays installed
and your pages keep working.
* Prefer a local or staging site for big redesigns. On a live site, work on drafts
and keep sessions short.
* Treat the connector URL like a password, because it contains one.
* If you deactivate the plugin, everything it built stays on your pages.
* Advanced: a `code` block can carry custom CSS and JavaScript. Writing JavaScript
follows WordPress’s own rule and needs the `unfiltered_html` capability — administrators
and editors have it on a normal single site.
#### Privacy
The plugin does not phone home, and it collects no analytics or telemetry of any
kind. It adds no third-party scripts and no trackers to your pages.
It does use two external services, and one of them (Google Fonts) is requested by
your visitors’ browsers. Both are described in **External services** below. Read
that section before using the plugin on a site with GDPR or similar obligations.
### External services
This plugin relies on the following external services. Each is listed with what
it does, what is sent, when, and links to that provider’s terms and privacy policy.
#### Google Fonts (fonts.googleapis.com, fonts.gstatic.com)
**What it is used for.** When a page you compiled specifies a Google font family,
the plugin enqueues that family’s stylesheet so the page renders in the font you
chose. The plugin’s own admin screen and the logged-in front-end Inspect overlay
also load one font (IBM Plex Mono) for their interface.
**What is sent and when.** The plugin builds a stylesheet URL containing only the
font family names and weights the page asks for. Your visitor’s browser then requests
that stylesheet from `fonts.googleapis.com` and the font files from `fonts.gstatic.
com`. Those requests are made by the browser, so Google receives the visitor’s IP
address and user-agent, as it does for any site using Google Fonts. This happens
on the front end for pages that use a Google font, and in the admin/editor for the
interface font. No personal data is sent by the plugin itself, and nothing is sent
when a page uses no Google font.
**Avoiding it.** Pages that use only system or theme fonts make no request. If you
need zero third-party font requests, do not specify Google font families when designing,
and use a font-hosting plugin for the interface font.
Service provided by Google: [terms of service](https://policies.google.com/terms),
[privacy policy](https://policies.google.com/privacy), [Google Fonts privacy FAQ](https://developers.google.com/fonts/faq/privacy).
#### Wikimedia Commons API (commons.wikimedia.org)
**What it is used for.** The optional `search_placeholder_images` MCP tool searches
Wikimedia Commons for openly licensed photographs, so an AI agent can suggest real
images for a design instead of inventing image paths that render blank. It is read-
only and returns image URLs, dimensions, suggested alt text, and licence/attribution
information.
**What is sent and when.** Only when you or your connected AI agent explicitly calls
that tool. The request is made from your server and contains the search terms supplied
in the call, plus a requested image width and result limit. No personal data, no
site information, and no account or API key are involved.
**Avoiding it.** The tool only runs on request. If it is never called, the plugin
never contacts Wikimedia. Turning the MCP connector off under Setup blocks it along
with every other tool.
Service provided by the Wikimedia Foundation: [terms of use](https://foundation.wikimedia.org/wiki/Policy:Terms_of_Use),
[privacy policy](https://foundation.wikimedia.org/wiki/Policy:Privacy_policy), [API documentation](https://www.mediawiki.org/wiki/API:Main_page).
#### Images you choose to import (no fixed provider)
**What it is used for.** The `import_media` tool, and the media sideloading step
of `compile_and_insert` / `compile_elementor`, download an image from a URL and
add it to your Media Library so the page serves it locally rather than hotlinking.
**What is sent and when.** Your server makes an HTTP request to whatever URL you
or your agent supplies — there is no fixed third party, and the plugin has no default
host. It runs only on explicit request, requires the `upload_files` capability,
and is confirm-gated: the first call returns a preview and nothing is downloaded
until a second call confirms it. Whichever host the URL points at will see a request
from your server’s IP address.
**Avoiding it.** Supply only URLs you trust, or upload images through the WordPress
Media Library instead and reference them by attachment id.
## Screenshots
[⌊Admin screen with safety warning and MCP connector URL⌉⌊Admin screen with safety
warning and MCP connector URL⌉[
Admin screen with safety warning and MCP connector URL
[⌊Setup steps for connecting an AI client⌉⌊Setup steps for connecting an AI client⌉[
Setup steps for connecting an AI client
[⌊Front-end Inspect / design review for logged-in editors⌉⌊Front-end Inspect / design
review for logged-in editors⌉[
Front-end Inspect / design review for logged-in editors
## Installation
1. Install from **Plugins Add New**, or upload the `sectionmate-mcp` folder to `/
wp-content/plugins/`.
2. Activate **SectionMate MCP** on the **Plugins** screen.
3. Open **SectionMate MCP** in the WordPress admin menu.
4. Name the AI app you are connecting and click **Create connector URL**. Copy the
URL — it is shown only once, and it already contains your sign-in details.
5. Add that URL in your AI app as a remote MCP server.
6. Turn the **MCP connector** switch off when you finish a session.
Your site must be reachable over HTTPS. For a site on your own computer, use a tunnel
such as Cloudflare Tunnel or ngrok.
Optional: install Spectra and/or Elementor if you want to build with those. Gutenberg
works without anything extra.
## FAQ
### Can I use this on a live production site?
Yes, carefully. Prefer **draft** pages and short editing sessions. Do **not** leave
the MCP connector switch on unattended on production. Prefer local or staging for
large redesigns. When finished, turn the **MCP connector** off under Setup — the
pages you built stay, and the same URL works again when you re-enable. Anyone with
the secret URL can edit pages only while the connector is on.
### What does the MCP connector switch do?
When **off**, the plugin stays installed but MCP tools refuse every request, whoever
is asking. When **on**, your connector URLs work again — they are not invalidated
by the switch. This is the recommended way to secure a site after a design session,
because it is one click and reversible. Revoke an individual connector instead if
its URL may have leaked.
### What happens if I deactivate the plugin?
Compiled page content remains (Spectra/Gutenberg blocks, Elementor data, and any
CSS/JS already saved into the page). MCP, Inspect, and annotations stop until you
activate again. Prefer the connector switch over full deactivation when you only
need to block remote AI access.
### Do I need an API key or paid AI subscription?
The plugin does not sell AI access. You connect your own AI client (Claude, Cursor,
Grok, ChatGPT, etc.) using the connector URL. Any AI costs are between you and that
provider.
### Why are my username and password in the connector URL?
Because many AI clients accept only a URL — no place to enter a username, a password,
or a request header. HTTP has always allowed credentials in the URL itself (`https://
USER:APP-PASSWORD@your-site.com/…`), and that is standard HTTP Basic authentication,
which is how WordPress Application Passwords work.
Two things follow from that. It is a real WordPress sign-in, so the connector is
limited to your account’s permissions and every edit is attributed to you. And unlike
a secret in the query string, this part of the URL is not written into server access
logs.
Treat the URL as the password it contains. If a client can set request headers,
you can send `Authorization: Basic` instead and use the plain URL.
### Does every edit apply immediately?
No. Write tools return a preview first. Nothing is saved until a second call confirms
with the one-time confirmation token. Only a response with status `applied` means
the page changed.
### Which page builders are supported?
Spectra Legacy (UAGB / `uagb/*`), Spectra Blocks V3 (`spectra/*`), core Gutenberg
blocks, and Elementor (free) element trees. Install the builders you need on the
site. On empty pages, agents must ask which backend to use.
### Can it set up my theme header / site-wide navigation?
**No — and that is intentional.** This is a **page** designer for page builders,
not a theme or full-site designer. The AI **can** build a navigation or hero “header”**
as content on the page** (logo, links, buttons as blocks). It **cannot** configure
the WordPress theme header, Customizer menus as the site header, FSE header templates,
or products like Astra Site Builder / Header Footer Builder. Themes differ widely;
a true custom theme header often needs a theme’s pro site builder. We stay on page
builders so results stay portable. For a full-bleed landing page you may use `hideHeaderFooter`
to **hide** the theme header/footer on that page only — that still does not create
a theme header.
### Is this affiliated with Elementor or Spectra?
No. It is an independent tool that compiles into those formats when those plugins
are present.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“SectionMate MCP” is open source software. The following people have contributed
to this plugin.
Contributors
* [ jrobertosouza ](https://profiles.wordpress.org/jrobertosouza/)
[Translate “SectionMate MCP” into your language.](https://translate.wordpress.org/projects/wp-plugins/sectionmate-mcp)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/sectionmate-mcp/),
check out the [SVN repository](https://plugins.svn.wordpress.org/sectionmate-mcp/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/sectionmate-mcp/)
by [RSS](https://plugins.trac.wordpress.org/log/sectionmate-mcp/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
The last two releases. Full history: `changelog.txt`, shipped with the plugin.
#### 2.2.0
* **The plugin no longer registers a block.** The «SectionMate» import block (`
sectionmate-mcp/import`) let you paste clean JSON into the editor and have it
compile in place. It predates the MCP connector, which does the same job better,
and it has not been the recommended path for a long time. The block, its editor
script, its block category and the `/v1/compile` REST route it was the only caller
of are all removed. Nothing else used them, and no saved page content depends
on the block — it replaced itself with real blocks whenever it ran.
* **Verified against the current builders:** Spectra Legacy 2.20.3, Spectra Blocks
1.0.7 and Elementor 4.2.4. No compiler change was needed for any of them. All
41 design-lab runs reproduce their previous score exactly, the selftest is clean
on all 23 fixtures, and element boxes agree across all four backends at 1440
and 1600.
* Two changelog entries were worth testing rather than trusting. Spectra Blocks
1.0.5 said «buttons and button-style links now output valid HTML markup» — `spectra/
button` is a static-save block, so a changed `save()` would invalidate every
button already written; the editor loads clean. Spectra Blocks 1.0.7 moved responsive
editing «to follow core’s breakpoints»; boxes still agree across backends. Elementor
4.2.4 carries a third consecutive «improved code security enforcement» line,
and the end-to-end `code` node test still passes.
* **Other plugins’ admin notices no longer appear on the SectionMate screen.**
Upgrade prompts hooked globally by other plugins were pushing the connector UI
down the page and reading as though they belonged here. Suppressed on this plugin’s
own screen only — anywhere else they are the user’s business, and `user_admin_notices`
is left alone.
* Settings screen headline now matches the directory banner, and carries the habit
that most affects output quality: build one section at a time.
#### 2.1.29
* **The connector authenticates as a real WordPress user.** The plugin’s own secret
token, and the `/mcp/` route that carried it, are gone. Authentication
is now WordPress’s own: an Application Password, created under Users Profile,
sent over HTTP Basic. Clients that accept only a URL can carry it as `https://
USER:APP-PASSWORD@your-site.com/…`, which keeps single-URL setup working and,
unlike a token in the path or query string, is not written into server access
logs.
* **This is a breaking change.** Existing token URLs stop working and must be replaced.
In exchange, access is per-client and revocable from your profile without disturbing
anything else, and it is your account — not an anonymous bearer secret — that
the site records as making the edit.
* **The plugin no longer impersonates an administrator.** When a write lacked `
unfiltered_html`, it looked up the first administrator account, called `wp_set_current_user()`
into it so Elementor’s sanitizer would stand down, and fell back to writing `
_elementor_data` with direct SQL if that failed. Both paths are deleted. With
a real user behind the request an administrator simply has the capability, and
Elementor leaves the tree alone by itself.
* **KSES is respected instead of removed.** Saves used to strip `wp_filter_post_kses`
unconditionally, which handed any token holder the equivalent of `unfiltered_html`—
including a live `