{"id":365227,"date":"2026-09-12T07:16:47","date_gmt":"2026-09-12T07:16:47","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/wpagently\/"},"modified":"2026-09-12T07:16:15","modified_gmt":"2026-09-12T07:16:15","slug":"honeycup","status":"publish","type":"plugin","link":"https:\/\/es-ec.wordpress.org\/plugins\/honeycup\/","author":14805065,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.2.0","stable_tag":"0.2.0","tested":"7.1","requires":"6.9","requires_php":"8.1","requires_plugins":null,"header_name":"Honeycup","header_author":"Honeycup","header_description":"Security-checked WordPress Abilities for content, media, taxonomies, and quality assurance.","assets_banners_color":"","last_updated":"2026-09-12 07:16:15","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":32,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.2.0":{"tag":"0.2.0","author":"finnhillebrandt","date":"2026-09-12 07:16:15","revision":3692414}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3692499,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3692499,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3692499,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.2.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[2353,569,529,242115,2345],"plugin_category":[],"plugin_contributors":[280330],"plugin_business_model":[],"class_list":["post-365227","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-automation","plugin_tags-content","plugin_tags-mcp","plugin_tags-productivity","plugin_contributors-finnhillebrandt","plugin_committers-finnhillebrandt"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/honeycup\/assets\/icon.svg?rev=3692499","icon":"https:\/\/ps.w.org\/honeycup\/assets\/icon.svg?rev=3692499","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Honeycup Free connects a supported AI client directly to your WordPress site. You stay in control of the WordPress user and its permissions.<\/p>\n\n<p>An Ability is a task that your AI client can discover. Honeycup Free provides 34 Abilities: 18 read WordPress state, 13 write within explicit boundaries, and 3 remain manual-only.<\/p>\n\n<h4>What can it do?<\/h4>\n\n<p>The 18 read Abilities can:<\/p>\n\n<ul>\n<li>Read and list posts.<\/li>\n<li>Read terms, media files, and comments.<\/li>\n<li>Inspect SEO metadata when a supported SEO plugin is active.<\/li>\n<li>Check WordPress blocks and the content format.<\/li>\n<li>Read basic site context and system diagnostics.<\/li>\n<li>List saved working instructions.<\/li>\n<\/ul>\n\n<p>The 13 write Abilities can:<\/p>\n\n<ul>\n<li>Create posts and pages from Markdown as drafts by default.<\/li>\n<li>Update titles, excerpts, page parents and Markdown content.<\/li>\n<li>Change post status, including publishing with permission and explicit confirmation.<\/li>\n<li>Move posts to Trash with confirmation and restore them as drafts. Permanent deletion is not exposed.<\/li>\n<li>Create and update public taxonomy terms and assign existing term IDs to posts.<\/li>\n<li>Upload validated raster images from local base64 data, update alt text and set featured images.<\/li>\n<li>Update local site context as an administrator.<\/li>\n<li>Refresh Honeycup's isolated local cache with <code>honeycup\/refresh-hooks<\/code>.<\/li>\n<\/ul>\n\n<p>Markdown is converted on the server into a bounded set of native WordPress core blocks. Raw HTML and shortcode execution are not supported. Honeycup Free does not replace page-builder layouts.<\/p>\n\n<h4>How do writes work?<\/h4>\n\n<p>Read the object first, then pass the returned state hash as <code>expected_hash<\/code>. Post fields, taxonomy assignments, featured images, terms, media and site context expose their own hashes. A stale hash stops the write. Honeycup serializes its own changes and reads the saved state back after WordPress runs its native hooks.<\/p>\n\n<p>These checks are optimistic. They do not make WordPress admin edits or other plugins participate in a single atomic transaction. Avoid simultaneous editing. A verification failure requires inspection of the current state; Honeycup does not automatically overwrite it to roll back.<\/p>\n\n<p>Creation of a post, term or upload requires a unique <code>idempotency_key<\/code>. Repeating the same successful request with that key returns the current authorized object instead of creating a duplicate. Reusing the key for different input is rejected. If a creation was interrupted, inspect WordPress before trying again and do not simply send a new key. Receipts remain local until uninstall; they store identifiers and fingerprints, not copies of content. A crashed write can retain its resource lock for administrator recovery.<\/p>\n\n<p>For <code>honeycup\/list-posts<\/code>, Honeycup applies WordPress's native status and privacy-policy-page capability rules before pagination, then checks every returned item again. <code>total<\/code> and <code>returned_count<\/code> count only the authorized items returned on the requested page. <code>total_scope<\/code> is always <code>page<\/code>. Honeycup Free intentionally does not report a cross-page total or perform a full enumeration, because either could reveal metadata about posts the connected WordPress user cannot edit. A user without <code>edit_private_posts<\/code> can list only that user's own private posts.<\/p>\n\n<p>For <code>honeycup\/list-media<\/code>, Honeycup checks <code>edit_post<\/code> for every attachment, including individual capability restrictions. Its <code>total<\/code> and <code>returned_count<\/code> likewise count only authorized items on the requested page, with <code>total_scope<\/code> set to <code>page<\/code>. A page can contain fewer items after permission filtering.<\/p>\n\n<h4>What stays manual?<\/h4>\n\n<p>The remaining 3 change Abilities are manual-only: SEO metadata changes, comment moderation and comment replies. They remain visible for planning but return HTTP 409 with <code>honeycup_core_manual_only<\/code> and <code>manual_only: true<\/code> before changing WordPress. Complete those steps in the WordPress dashboard.<\/p>\n\n<h4>Privacy and data<\/h4>\n\n<p>Honeycup Free has no account requirement, license key, hosted relay, remote package loader, or timed feature restriction. The plugin itself makes no outbound network request.<\/p>\n\n<p>Your chosen AI client and AI provider may process information that you ask the client to read. Their terms and privacy policy apply to that separate connection.<\/p>\n\n<p>Honeycup stores its own local settings, cryptographic secrets, write locks, creation receipts and a bounded activity ledger under the <code>honeycup_core_<\/code> option namespace. Posts, terms and media you create are normal WordPress data.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate Honeycup.<\/li>\n<li>Open Honeycup in wp-admin. The setup page checks your local WordPress, PHP, HTTPS, and Application Password requirements.<\/li>\n<li>Create a separate WordPress user with only the permissions needed for your tasks.<\/li>\n<li>Sign in as that user and open Users &gt; Profile. Under Application Passwords, create a password with a clear name.<\/li>\n<li>Copy the password directly into your private local client configuration. Never place it in a URL, repository, prompt, or shared file.<\/li>\n<li>Use the secret-free template on the Honeycup setup page to connect Codex or Claude Code.<\/li>\n<\/ol>\n\n<p>The local MCP endpoint is <code>\/wp-json\/honeycup\/v1\/mcp<\/code>. It uses WordPress authentication and checks the current user's permission for every Ability.<\/p>\n\n<p>Claude Desktop does not directly load this remote HTTP configuration, and Honeycup Free does not include a local desktop transport. ChatGPT requires a public HTTPS OAuth connection. Honeycup Free does not provide an OAuth server or pass an Application Password to ChatGPT.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20honeycup%20free%20change%20my%20posts%3F\"><h3>Does Honeycup Free change my posts?<\/h3><\/dt>\n<dd><p>Yes, when your connected WordPress user has the required permissions. New posts default to drafts. Publishing and moving content to Trash require explicit confirmation, and edits require a fresh state hash.<\/p><\/dd>\n<dt id=\"does%20activation%20contact%20an%20external%20service%3F\"><h3>Does activation contact an external service?<\/h3><\/dt>\n<dd><p>No. Activation creates local cryptographic secrets for the activity ledger and authenticated MCP sessions when they are missing.<\/p><\/dd>\n<dt id=\"does%20the%20setup%20page%20send%20a%20connection%20test%20to%20another%20service%3F\"><h3>Does the setup page send a connection test to another service?<\/h3><\/dt>\n<dd><p>No. Its checks read local WordPress and PHP state only. The page does not create, store, or display an Application Password.<\/p><\/dd>\n<dt id=\"how%20do%20i%20disconnect%20a%20client%3F\"><h3>How do I disconnect a client?<\/h3><\/dt>\n<dd><p>Open the connected WordPress user's profile and revoke the individual Application Password used by that client. This leaves the user's other passwords and connections unchanged.<\/p><\/dd>\n<dt id=\"can%20honeycup%20free%20run%20beside%20the%20commercial%20honeycup%20plugin%3F\"><h3>Can Honeycup Free run beside the commercial Honeycup plugin?<\/h3><\/dt>\n<dd><p>Yes. The Free plugin does not register duplicate Abilities while the commercial plugin owns the shared Ability namespace. Its own local options remain separate.<\/p><\/dd>\n<dt id=\"does%20uninstall%20remove%20its%20data%3F\"><h3>Does uninstall remove its data?<\/h3><\/dt>\n<dd><p>Yes. It removes only Honeycup Free options, locks, creation receipts and transient data. It leaves your WordPress posts, taxonomy terms and media intact. Uninstalling removes duplicate-creation protection for old keys.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.2.0<\/h4>\n\n<ul>\n<li>Native post, taxonomy, raster image and site-context writes with capability checks, optimistic state hashes, creation receipts and readback.<\/li>\n<li>Publishing and Trash confirmation; restore to draft.<\/li>\n<li>SEO changes and comment mutations remain manual-only.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial standalone Free release.<\/li>\n<\/ul>","raw_excerpt":"Turn WordPress into your worker bee. Connect Codex or Claude Code to WordPress with 34 security-checked WordPress Abilities and no hosted relay.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/365227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=365227"}],"author":[{"embeddable":true,"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/finnhillebrandt"}],"wp:attachment":[{"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=365227"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=365227"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=365227"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=365227"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=365227"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/es-ec.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=365227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}