The plugin no longer adds a block to the editor \u2014 the unused "SectionMate" import block is removed. Verified against Spectra Legacy 2.20.3, Spectra Blocks 1.0.7 and Elementor 4.2.4. Other plugins' admin notices no longer show on the SectionMate screen.<\/p>","2.1.29":"
Action required \u2014 token URLs stop working.<\/strong> Create an Application Password under Users \u2192 Profile and use https:\/\/USER:APP-PASSWORD@your-site.com\/wp-json\/sectionmate-mcp\/v1\/mcp instead. The connector now acts as you, with your permissions.<\/p>","2.1.28":" Documents the plugin's two external services (Google Fonts, Wikimedia Commons search) and corrects a Privacy claim that wrongly said no third-party fonts were added to your pages. Agents now import images into your Media Library instead of hotlinking.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3692696,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3692696,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.jpg":{"filename":"banner-1544x500.jpg","revision":3692707,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.jpg":{"filename":"banner-772x250.jpg","revision":3692707,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.1.29","2.2.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3692735,"resolution":"1","location":"assets","locale":"","width":1440,"height":1625},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3692735,"resolution":"2","location":"assets","locale":"","width":860,"height":400},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3692735,"resolution":"3","location":"assets","locale":"","width":396,"height":701}},"screenshots":{"1":"Admin screen with safety warning and MCP connector URL","2":"Setup steps for connecting an AI client","3":"Front-end Inspect \/ design review for logged-in editors"}},"plugin_section":[],"plugin_tags":[2353,76538,148076,242115,1084],"plugin_category":[],"plugin_contributors":[280371],"plugin_business_model":[],"class_list":["post-357345","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-elementor","plugin_tags-gutenberg","plugin_tags-mcp","plugin_tags-page-builder","plugin_contributors-jrobertosouza","plugin_committers-jrobertosouza"],"banners":{"banner":"https:\/\/ps.w.org\/sectionmate-mcp\/assets\/banner-772x250.jpg?rev=3692707","banner_2x":"https:\/\/ps.w.org\/sectionmate-mcp\/assets\/banner-1544x500.jpg?rev=3692707","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/sectionmate-mcp\/assets\/icon-128x128.png?rev=3692696","icon_2x":"https:\/\/ps.w.org\/sectionmate-mcp\/assets\/icon-256x256.png?rev=3692696","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/sectionmate-mcp\/assets\/screenshot-1.png?rev=3692735","caption":"Admin screen with safety warning and MCP connector URL"},{"src":"https:\/\/ps.w.org\/sectionmate-mcp\/assets\/screenshot-2.png?rev=3692735","caption":"Setup steps for connecting an AI client"},{"src":"https:\/\/ps.w.org\/sectionmate-mcp\/assets\/screenshot-3.png?rev=3692735","caption":"Front-end Inspect \/ design review for logged-in editors"}],"raw_content":"\n SectionMate MCP connects your AI assistant to WordPress so it can build and edit page sections<\/strong> \u2014 a hero, a pricing table, an FAQ, a features row \u2014 directly in Elementor, Gutenberg or Spectra.<\/p>\n\n Build one section at a time.<\/strong> This is the most important thing to know. The AI can<\/em> generate a whole page in one request, but the results are noticeably better when you do one section, look at it, adjust it, then move on. Each section gets the AI's full attention instead of a fraction of it \u2014 and you catch a wrong direction after one band instead of after twelve.<\/p>\n\n Nothing is saved until you approve it. Every edit shows you a preview and waits for your confirmation.<\/p>\n\n Your site needs to be reachable over HTTPS. For a site on your own computer, use a tunnel such as Cloudflare Tunnel or ngrok.<\/p>\n\n It builds content on a page<\/strong>. It does not set up your theme, your site-wide header and footer, or your menus. It can build a header-looking<\/em> band as part of a page, which is not the same thing as a theme header.<\/p>\n\n Use one builder per page. Sections, headings, text, images, buttons and icons work on all of them; counters, countdowns, FAQ accordions, icon lists and galleries work wherever the builder provides them.<\/p>\n\n Not affiliated with or endorsed by Elementor, Brainstorm Force (Spectra), or Automattic.<\/p>\n\n The connector signs in as you<\/strong>. It can do exactly what your account can do and no more, every edit is recorded as yours, and you can revoke one connected app on its own without changing your password.<\/p>\n\n The plugin does not phone home, and it collects no analytics or telemetry of any kind. It adds no third-party scripts and no trackers to your pages.<\/p>\n\n It does use two external services, and one of them (Google Fonts) is requested by your visitors' browsers. Both are described in External services<\/strong> below. Read that section before using the plugin on a site with GDPR or similar obligations.<\/p>\n\n This plugin relies on the following external services. Each is listed with what it does, what is sent, when, and links to that provider's terms and privacy policy.<\/p>\n\n What it is used for.<\/strong> When a page you compiled specifies a Google font family, the plugin enqueues that family's stylesheet so the page renders in the font you chose. The plugin's own admin screen and the logged-in front-end Inspect overlay also load one font (IBM Plex Mono) for their interface.<\/p>\n\n What is sent and when.<\/strong> The plugin builds a stylesheet URL containing only the font family names and weights the page asks for. Your visitor's browser then requests that stylesheet from Avoiding it.<\/strong> Pages that use only system or theme fonts make no request. If you need zero third-party font requests, do not specify Google font families when designing, and use a font-hosting plugin for the interface font.<\/p>\n\n Service provided by Google: terms of service<\/a>, privacy policy<\/a>, Google Fonts privacy FAQ<\/a>.<\/p>\n\n What it is used for.<\/strong> The optional What is sent and when.<\/strong> Only when you or your connected AI agent explicitly calls that tool. The request is made from your server and contains the search terms supplied in the call, plus a requested image width and result limit. No personal data, no site information, and no account or API key are involved.<\/p>\n\n Avoiding it.<\/strong> The tool only runs on request. If it is never called, the plugin never contacts Wikimedia. Turning the MCP connector off under Setup blocks it along with every other tool.<\/p>\n\n Service provided by the Wikimedia Foundation: terms of use<\/a>, privacy policy<\/a>, API documentation<\/a>.<\/p>\n\n What it is used for.<\/strong> The What is sent and when.<\/strong> Your server makes an HTTP request to whatever URL you or your agent supplies \u2014 there is no fixed third party, and the plugin has no default host. It runs only on explicit request, requires the Avoiding it.<\/strong> Supply only URLs you trust, or upload images through the WordPress Media Library instead and reference them by attachment id.<\/p>\n\n\n Your site must be reachable over HTTPS. For a site on your own computer, use a tunnel such as Cloudflare Tunnel or ngrok.<\/p>\n\n Optional: install Spectra and\/or Elementor if you want to build with those. Gutenberg works without anything extra.<\/p>\n\n\n Yes, carefully. Prefer draft<\/strong> pages and short editing sessions. Do not<\/strong> leave the MCP connector switch on unattended on production. Prefer local or staging for large redesigns. When finished, turn the MCP connector<\/strong> off under Setup \u2014 the pages you built stay, and the same URL works again when you re-enable. Anyone with the secret URL can edit pages only while the connector is on.<\/p><\/dd>\n When off<\/strong>, the plugin stays installed but MCP tools refuse every request, whoever is asking. When on<\/strong>, your connector URLs work again \u2014 they are not invalidated by the switch. This is the recommended way to secure a site after a design session, because it is one click and reversible. Revoke an individual connector instead if its URL may have leaked.<\/p><\/dd>\n Compiled page content remains (Spectra\/Gutenberg blocks, Elementor data, and any CSS\/JS already saved into the page). MCP, Inspect, and annotations stop until you activate again. Prefer the connector switch over full deactivation when you only need to block remote AI access.<\/p><\/dd>\n The plugin does not sell AI access. You connect your own AI client (Claude, Cursor, Grok, ChatGPT, etc.) using the connector URL. Any AI costs are between you and that provider.<\/p><\/dd>\n Because many AI clients accept only a URL \u2014 no place to enter a username, a password, or a request header. HTTP has always allowed credentials in the URL itself ( Two things follow from that. It is a real WordPress sign-in, so the connector is limited to your account's permissions and every edit is attributed to you. And unlike a secret in the query string, this part of the URL is not written into server access logs.<\/p>\n\n Treat the URL as the password it contains. If a client can set request headers, you can send No. Write tools return a preview first. Nothing is saved until a second call confirms with the one-time confirmation token. Only a response with status Spectra Legacy (UAGB \/ Install and connect<\/h4>\n\n
\n
Getting good results<\/h4>\n\n
\n
What it does not do<\/h4>\n\n
Works with<\/h4>\n\n
\n
Safety<\/h4>\n\n
\n
code<\/code> block can carry custom CSS and JavaScript. Writing JavaScript follows WordPress's own rule and needs the unfiltered_html<\/code> capability \u2014 administrators and editors have it on a normal single site.<\/li>\n<\/ul>\n\nPrivacy<\/h4>\n\n
External services<\/h3>\n\n
Google Fonts (fonts.googleapis.com, fonts.gstatic.com)<\/h4>\n\n
fonts.googleapis.com<\/code> and the font files from fonts.gstatic.com<\/code>. Those requests are made by the browser, so Google receives the visitor's IP address and user-agent, as it does for any site using Google Fonts. This happens on the front end for pages that use a Google font, and in the admin\/editor for the interface font. No personal data is sent by the plugin itself, and nothing is sent when a page uses no Google font.<\/p>\n\nWikimedia Commons API (commons.wikimedia.org)<\/h4>\n\n
search_placeholder_images<\/code> MCP tool searches Wikimedia Commons for openly licensed photographs, so an AI agent can suggest real images for a design instead of inventing image paths that render blank. It is read-only and returns image URLs, dimensions, suggested alt text, and licence\/attribution information.<\/p>\n\nImages you choose to import (no fixed provider)<\/h4>\n\n
import_media<\/code> tool, and the media sideloading step of compile_and_insert<\/code> \/ compile_elementor<\/code>, download an image from a URL and add it to your Media Library so the page serves it locally rather than hotlinking.<\/p>\n\nupload_files<\/code> capability, and is confirm-gated: the first call returns a preview and nothing is downloaded until a second call confirms it. Whichever host the URL points at will see a request from your server's IP address.<\/p>\n\n\n
sectionmate-mcp<\/code> folder to \/wp-content\/plugins\/<\/code>.<\/li>\n\n
Can I use this on a live production site?<\/h3><\/dt>\n
What does the MCP connector switch do?<\/h3><\/dt>\n
What happens if I deactivate the plugin?<\/h3><\/dt>\n
Do I need an API key or paid AI subscription?<\/h3><\/dt>\n
Why are my username and password in the connector URL?<\/h3><\/dt>\n
https:\/\/USER:APP-PASSWORD@your-site.com\/\u2026<\/code>), and that is standard HTTP Basic authentication, which is how WordPress Application Passwords work.<\/p>\n\nAuthorization: Basic<\/code> instead and use the plain URL.<\/p><\/dd>\nDoes every edit apply immediately?<\/h3><\/dt>\n
applied<\/code> means the page changed.<\/p><\/dd>\nWhich page builders are supported?<\/h3><\/dt>\n
uagb\/*<\/code>), Spectra Blocks V3 (spectra\/*<\/code>), core Gutenberg blocks, and Elementor (free) element trees. Install the builders you need on the site. On empty pages, agents must ask which backend to use.<\/p><\/dd>\n