by
Riaan K.
5 (1 reviews)
MCP Logs
See what AI agents do on your WordPress site. MCP Logs records every Model Context Protocol request, flags risky behavior, and can cut off access.
MCP Logs ranks #53,443 among WordPress.org plugins with 0+ active installations, a 5/5 rating from 1 reviews, and was last updated Aug 1, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Tested up to WP 7.0.8 (Current: 7.1.4)
v1.1.0
Current Version v1.1.0
Updated 3 months ago
Last Update on 01 Aug, 2026
Refreshed 1 week ago
Last Refreshed on
Rank
#53,443
—
No change
Active Installs
0+
-100%
KW Avg Position
133.3
0.3 worse
Downloads
513
+2 today
Support Resolved
0%
—
No change
Rating
100%
Review 5 out of 5
5
(1 reviews)
Next Milestone 10
0+
10+
25,875
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 6 more installs to reach 10+
Rank Changes
Current
#53,443
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
1 reviews
Overall
100%
5
1
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Support Threads Overview
Resolved
Unresolved
1
Total Threads
0
Resolved
1
Unresolved
0%
Resolution Rate
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.1.0
- Last Updated
- Aug 01, 2026
- Requires WP
- 6.9+
- Tested Up To
- 7.0.8
- PHP Version
- 7.4 or higher
- Author
- Riaan K.
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 1
- Support Threads
- 1
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade Now
Frequently Asked Questions
Common questions about MCP Logs
If no AI agents connect to your site, probably not. This plugin is for sites that expose MCP servers, either through custom code or through another plugin, and want visibility into how agents use them. If you have started exploring AI integrations for WordPress, installing this before something goes wrong is much easier than reconstructing what happened afterward.
Yes, as long as the client sends the Mcp-Session-Id header, which is part of the MCP transport spec and which most clients send automatically. MCP Logs detects requests by that header rather than by plugin, so traffic from any compliant server is logged.
That depends on how much detail you need. A server's own log usually records the tool name and some parameters. MCP Logs stores the full request and response bodies, groups requests by session, and adds detection rules, alerts, and the kill switch on top. If your site runs more than one MCP server, it also gives you one log instead of several.
By default, no. The plugin observes and records, and requests pass through untouched. The one exception is the kill switch, which is off unless you turn it on or unless you enable auto-disable on a detection rule. While it is on, MCP requests are logged and then rejected with a 503 explaining why.
Route, HTTP method, request headers, request body, response status, response body, ability name, execution status (success, error, or unknown), user ID, MCP session ID, and timestamp.
No. Authorization, Cookie, X-Api-Key, and similar credential-bearing headers are replaced with [redacted] before anything is written. Add your own header names with the alfmcp_sensitive_headers filter.
No measurable impact on regular page loads. The logger only fires on MCP REST endpoints, writes a single row per request, and object-caches all subsequent reads. There is no front-end JavaScript and no admin overhead outside the plugin's own page.
In two custom tables in your own database, {prefix}alfmcp_requests and {prefix}alfmcp_security_events. Nothing is transmitted externally, not to Anthropic, not to any third party, not anywhere.
WordPress Application Passwords (Users then Your Profile then Application Passwords) work out of the box over HTTP Basic Auth. WooCommerce API keys are also supported when WooCommerce is active, but as of 1.1.0 they require an HTTPS connection and must be sent in the Authorization header. Passing them as consumer_key and consumer_secret URL arguments is no longer accepted, because secrets in a URL end up in server logs, proxy logs, and browser history. Either method maps to a real WordPress user, and that user needs the manage_options capability.
Yes. Call the DELETE /retention endpoint or the clear-old-logs ability with a before_date, manually or from a scheduled cron job. Cutoffs inside the last 24 hours are refused, so a scheduled job cannot quietly erase the record of what just happened.