=== SectionMate MCP ===
Contributors: jrobertosouza
Tags: page builder, elementor, gutenberg, mcp, ai
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.2.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Build a page one section at a time with AI. Compiles to Elementor, Gutenberg and Spectra blocks.

== Description ==

https://www.youtube.com/watch?v=Uzzww4QAu2s

SectionMate MCP connects your AI assistant to WordPress so it can **build and edit page sections** — a hero, a pricing table, an FAQ, a features row — directly in Elementor, Gutenberg or Spectra.

**Build one section at a time.** This is the most important thing to know. The AI *can* generate a whole page in one request, but the results are noticeably better when you do one section, look at it, adjust it, then move on. Each section gets the AI's full attention instead of a fraction of it — and you catch a wrong direction after one band instead of after twelve.

Nothing is saved until you approve it. Every edit shows you a preview and waits for your confirmation.

= Install and connect =

1. Install and activate the plugin.
2. Open **SectionMate MCP** in the WordPress admin menu.
3. Type a name for the AI app you are connecting — "Claude", "Grok", "Cursor" — and click **Create connector URL**.
4. Copy the URL. **It is shown only once.** It already contains your sign-in details, so there is nothing else to fill in.
5. In your AI app, add it as a remote MCP server (some apps call this a "connector" or "custom connector").
6. Ask for a section: *"Add a pricing section to page 12 with three plans."*

Your site needs to be reachable over HTTPS. For a site on your own computer, use a tunnel such as Cloudflare Tunnel or ngrok.

= Getting good results =

* **One section at a time.** Finish and review the hero before asking for the features row.
* **Give it something to work from.** A screenshot of a design you like, your brand colours, a logo, images already in your Media Library.
* **Say what is wrong.** "Make the cards taller", "use the brand green" — it can read the page back and change specific blocks rather than rebuilding everything.
* **Point at things visually.** Logged-in editors get an **Inspect** overlay on the front end: click any block to grab a reference for the AI, or leave a note it reads on the next turn.
* You can edit anything by hand afterwards. It is ordinary WordPress content.

= What it does not do =

It builds **content on a page**. It does not set up your theme, your site-wide header and footer, or your menus. It can build a header-*looking* band as part of a page, which is not the same thing as a theme header.

= Works with =

* WordPress block editor (Gutenberg) — works out of the box
* Elementor (free)
* Spectra / Ultimate Addons for Gutenberg
* Spectra Blocks (V3)

Use one builder per page. Sections, headings, text, images, buttons and icons work on all of them; counters, countdowns, FAQ accordions, icon lists and galleries work wherever the builder provides them.

Not affiliated with or endorsed by Elementor, Brainstorm Force (Spectra), or Automattic.

= Safety =

The connector signs in **as you**. It can do exactly what your account can do and no more, every edit is recorded as yours, and you can revoke one connected app on its own without changing your password.

* **Turn the MCP connector switch off when you finish.** The plugin stays installed and your pages keep working.
* Prefer a local or staging site for big redesigns. On a live site, work on drafts and keep sessions short.
* Treat the connector URL like a password, because it contains one.
* If you deactivate the plugin, everything it built stays on your pages.
* Advanced: a `code` block can carry custom CSS and JavaScript. Writing JavaScript follows WordPress's own rule and needs the `unfiltered_html` capability — administrators and editors have it on a normal single site.

= Privacy =

The plugin does not phone home, and it collects no analytics or telemetry of any kind. It adds no third-party scripts and no trackers to your pages.

It does use two external services, and one of them (Google Fonts) is requested by your visitors' browsers. Both are described in **External services** below. Read that section before using the plugin on a site with GDPR or similar obligations.

== External services ==

This plugin relies on the following external services. Each is listed with what it does, what is sent, when, and links to that provider's terms and privacy policy.

= Google Fonts (fonts.googleapis.com, fonts.gstatic.com) =

**What it is used for.** When a page you compiled specifies a Google font family, the plugin enqueues that family's stylesheet so the page renders in the font you chose. The plugin's own admin screen and the logged-in front-end Inspect overlay also load one font (IBM Plex Mono) for their interface.

**What is sent and when.** The plugin builds a stylesheet URL containing only the font family names and weights the page asks for. Your visitor's browser then requests that stylesheet from `fonts.googleapis.com` and the font files from `fonts.gstatic.com`. Those requests are made by the browser, so Google receives the visitor's IP address and user-agent, as it does for any site using Google Fonts. This happens on the front end for pages that use a Google font, and in the admin/editor for the interface font. No personal data is sent by the plugin itself, and nothing is sent when a page uses no Google font.

**Avoiding it.** Pages that use only system or theme fonts make no request. If you need zero third-party font requests, do not specify Google font families when designing, and use a font-hosting plugin for the interface font.

Service provided by Google: [terms of service](https://policies.google.com/terms), [privacy policy](https://policies.google.com/privacy), [Google Fonts privacy FAQ](https://developers.google.com/fonts/faq/privacy).

= Wikimedia Commons API (commons.wikimedia.org) =

**What it is used for.** The optional `search_placeholder_images` MCP tool searches Wikimedia Commons for openly licensed photographs, so an AI agent can suggest real images for a design instead of inventing image paths that render blank. It is read-only and returns image URLs, dimensions, suggested alt text, and licence/attribution information.

**What is sent and when.** Only when you or your connected AI agent explicitly calls that tool. The request is made from your server and contains the search terms supplied in the call, plus a requested image width and result limit. No personal data, no site information, and no account or API key are involved.

**Avoiding it.** The tool only runs on request. If it is never called, the plugin never contacts Wikimedia. Turning the MCP connector off under Setup blocks it along with every other tool.

Service provided by the Wikimedia Foundation: [terms of use](https://foundation.wikimedia.org/wiki/Policy:Terms_of_Use), [privacy policy](https://foundation.wikimedia.org/wiki/Policy:Privacy_policy), [API documentation](https://www.mediawiki.org/wiki/API:Main_page).

= Images you choose to import (no fixed provider) =

**What it is used for.** The `import_media` tool, and the media sideloading step of `compile_and_insert` / `compile_elementor`, download an image from a URL and add it to your Media Library so the page serves it locally rather than hotlinking.

**What is sent and when.** Your server makes an HTTP request to whatever URL you or your agent supplies — there is no fixed third party, and the plugin has no default host. It runs only on explicit request, requires the `upload_files` capability, and is confirm-gated: the first call returns a preview and nothing is downloaded until a second call confirms it. Whichever host the URL points at will see a request from your server's IP address.

**Avoiding it.** Supply only URLs you trust, or upload images through the WordPress Media Library instead and reference them by attachment id.

== Installation ==

1. Install from **Plugins → Add New**, or upload the `sectionmate-mcp` folder to `/wp-content/plugins/`.
2. Activate **SectionMate MCP** on the **Plugins** screen.
3. Open **SectionMate MCP** in the WordPress admin menu.
4. Name the AI app you are connecting and click **Create connector URL**. Copy the URL — it is shown only once, and it already contains your sign-in details.
5. Add that URL in your AI app as a remote MCP server.
6. Turn the **MCP connector** switch off when you finish a session.

Your site must be reachable over HTTPS. For a site on your own computer, use a tunnel such as Cloudflare Tunnel or ngrok.

Optional: install Spectra and/or Elementor if you want to build with those. Gutenberg works without anything extra.

== Frequently Asked Questions ==

= Can I use this on a live production site? =

Yes, carefully. Prefer **draft** pages and short editing sessions. Do **not** leave the MCP connector switch on unattended on production. Prefer local or staging for large redesigns. When finished, turn the **MCP connector** off under Setup — the pages you built stay, and the same URL works again when you re-enable. Anyone with the secret URL can edit pages only while the connector is on.

= What does the MCP connector switch do? =

When **off**, the plugin stays installed but MCP tools refuse every request, whoever is asking. When **on**, your connector URLs work again — they are not invalidated by the switch. This is the recommended way to secure a site after a design session, because it is one click and reversible. Revoke an individual connector instead if its URL may have leaked.

= What happens if I deactivate the plugin? =

Compiled page content remains (Spectra/Gutenberg blocks, Elementor data, and any CSS/JS already saved into the page). MCP, Inspect, and annotations stop until you activate again. Prefer the connector switch over full deactivation when you only need to block remote AI access.

= Do I need an API key or paid AI subscription? =

The plugin does not sell AI access. You connect your own AI client (Claude, Cursor, Grok, ChatGPT, etc.) using the connector URL. Any AI costs are between you and that provider.

= Why are my username and password in the connector URL? =

Because many AI clients accept only a URL — no place to enter a username, a password, or a request header. HTTP has always allowed credentials in the URL itself (`https://USER:APP-PASSWORD@your-site.com/…`), and that is standard HTTP Basic authentication, which is how WordPress Application Passwords work.

Two things follow from that. It is a real WordPress sign-in, so the connector is limited to your account's permissions and every edit is attributed to you. And unlike a secret in the query string, this part of the URL is not written into server access logs.

Treat the URL as the password it contains. If a client can set request headers, you can send `Authorization: Basic` instead and use the plain URL.

= Does every edit apply immediately? =

No. Write tools return a preview first. Nothing is saved until a second call confirms with the one-time confirmation token. Only a response with status `applied` means the page changed.

= Which page builders are supported? =

Spectra Legacy (UAGB / `uagb/*`), Spectra Blocks V3 (`spectra/*`), core Gutenberg blocks, and Elementor (free) element trees. Install the builders you need on the site. On empty pages, agents must ask which backend to use.

= Can it set up my theme header / site-wide navigation? =

**No — and that is intentional.** This is a **page** designer for page builders, not a theme or full-site designer. The AI **can** build a navigation or hero “header” **as content on the page** (logo, links, buttons as blocks). It **cannot** configure the WordPress theme header, Customizer menus as the site header, FSE header templates, or products like Astra Site Builder / Header Footer Builder. Themes differ widely; a true custom theme header often needs a theme’s pro site builder. We stay on page builders so results stay portable. For a full-bleed landing page you may use `hideHeaderFooter` to **hide** the theme header/footer on that page only — that still does not create a theme header.

= Is this affiliated with Elementor or Spectra? =

No. It is an independent tool that compiles into those formats when those plugins are present.

== Screenshots ==

1. Admin screen with safety warning and MCP connector URL
2. Setup steps for connecting an AI client
3. Front-end Inspect / design review for logged-in editors

== Upgrade Notice ==

= 2.2.1 =
Verified against Elementor 4.3.1 and Spectra Blocks 1.0.9. A solid card placed on a photograph stays opaque on Spectra Blocks.

= 2.2.0 =
The plugin no longer adds a block to the editor — the unused "SectionMate" import block is removed. Verified against Spectra Legacy 2.20.3, Spectra Blocks 1.0.7 and Elementor 4.2.4. Other plugins' admin notices no longer show on the SectionMate screen.

= 2.1.29 =
**Action required — token URLs stop working.** Create an Application Password under Users → Profile and use https://USER:APP-PASSWORD@your-site.com/wp-json/sectionmate-mcp/v1/mcp instead. The connector now acts as you, with your permissions.

= 2.1.28 =
Documents the plugin's two external services (Google Fonts, Wikimedia Commons search) and corrects a Privacy claim that wrongly said no third-party fonts were added to your pages. Agents now import images into your Media Library instead of hotlinking.

== Changelog ==

The last two releases. Full history: `changelog.txt`, shipped with the plugin.

= 2.2.1 =
* **Verified against Elementor 4.3.1 and Spectra Blocks 1.0.9.** Spectra Legacy is still 2.20.3. Elementor 4.3.0 added its own MCP page, an accordion and background video; none of that is in the classic container lane this compiler writes. A `code` node still survives save and render — the style, the base64 script and the raw HTML fragment — 11 checks of 11.
* **A solid card on a photograph went transparent on Spectra Blocks.** Since 1.0.8 a container colour is painted on a `::before` at `z-index: -1` with no stacking context of its own, so the colour paints behind the ancestor photo. Review cards, the energy panel and the chemical-supply cards all showed the photo through them. Those cards now keep their colour. The rule applies only inside a photo or video: applying it to every coloured container hid the gradient highlight on the scale lab.
* Compiler markup is unchanged. The selftest is clean on all 23 fixtures (0 drift, 0 round-trip, 0 errors). 47 of 55 design-lab runs reproduce their previous score. Eight runs on engagement, more-data and the Zephyr Gutenberg page sit within about a point of where they were, same layout, mostly closer to the reference.

= 2.2.0 =
* **The plugin no longer registers a block.** The "SectionMate" import block (`sectionmate-mcp/import`) let you paste clean JSON into the editor and have it compile in place. It predates the MCP connector, which does the same job better, and it has not been the recommended path for a long time. The block, its editor script, its block category and the `/v1/compile` REST route it was the only caller of are all removed. Nothing else used them, and no saved page content depends on the block — it replaced itself with real blocks whenever it ran.
* **Verified against the current builders:** Spectra Legacy 2.20.3, Spectra Blocks 1.0.7 and Elementor 4.2.4. No compiler change was needed for any of them. All 41 design-lab runs reproduce their previous score exactly, the selftest is clean on all 23 fixtures, and element boxes agree across all four backends at 1440 and 1600.
* Two changelog entries were worth testing rather than trusting. Spectra Blocks 1.0.5 said "buttons and button-style links now output valid HTML markup" — `spectra/button` is a static-save block, so a changed `save()` would invalidate every button already written; the editor loads clean. Spectra Blocks 1.0.7 moved responsive editing "to follow core's breakpoints"; boxes still agree across backends. Elementor 4.2.4 carries a third consecutive "improved code security enforcement" line, and the end-to-end `code` node test still passes.
* **Other plugins' admin notices no longer appear on the SectionMate screen.** Upgrade prompts hooked globally by other plugins were pushing the connector UI down the page and reading as though they belonged here. Suppressed on this plugin's own screen only — anywhere else they are the user's business, and `user_admin_notices` is left alone.
* Settings screen headline now matches the directory banner, and carries the habit that most affects output quality: build one section at a time.
