README

The MCP content connector for Legend Has It's WordPress sites: an OAuth 2.1 server, an MCP/JSON-RPC transport, and a registry-driven validated write engine. A Composer package a Roots/Acorn theme (such as Cube) installs and binds its palette and control plane into through the three interfaces below.

The package owns the mechanism, never the palette. Blocks, CPTs and taxonomies stay in the host theme. The connector receives them as data through the Palette interface, so a new block is a theme file with zero package change.

Requirements

• PHP >= 8.3
• A Roots/Acorn 6 host (Sage 11 theme). Acorn provides the Illuminate\* runtime the providers/commands extend, so it is a dev-only dependency here (the host supplies it at runtime; the illuminate/* ^13 floor that Acorn 6 ships is the supported baseline).

What the host must provide

The package resolves three per-clone contracts from the host container. Bind them in a theme service provider:

use LegendHasIt\Connector\Contracts\{Palette, Config, OptionsCatalog};

$this->app->singleton(Palette::class,        fn () => new \App\Connector\CubePalette);
$this->app->singleton(Config::class,         fn () => new \App\Connector\CubeConfig);
$this->app->singleton(OptionsCatalog::class, fn () => new \App\Connector\CubeOptionsCatalog);

• Palette — the block/CPT/taxonomy palette, projected to plain data (pre-built ACF field arrays). The host flattens its registries into the struct shapes documented on the interface.
• Config — the control plane (enabled, capabilities, allowed types, publish/term opt-ins).
• OptionsCatalog — the Website-Options allow-list the connector may read/write.

Providers

Register the two providers with Acorn. Either list them in the theme's functions.php withProviders([...]), or rely on Acorn package discovery by adding extra.acorn.providers to your install — pick one, not both, or they double-register.

• LegendHasIt\Connector\Providers\OAuthServiceProvider — discovery docs, the authorize/consent + token grant (PKCE), dynamic client registration, the opt-in client_credentials grant.
• LegendHasIt\Connector\Providers\ConnectorServiceProvider — the MCP endpoint at cube-mcp/v1/rpc, the dashboard panels, and the connector CLI commands (registered when running in console).

Development

composer install
composer test     # phpunit
composer lint     # pint --test
composer verify   # lint + test
php tests/provider-load.php   # providers load + boot with no fatal

The suite mocks WordPress (Brain Monkey + class doubles) and drives the engine through a fixture Palette/Config/OptionsCatalog, so it needs no database.

Notes

• Token storage uses transients. Fine per-site, but an aggressive object cache can evict a token before its 8h TTL on some hosts.
• Security model. The write path is off unless enabled, OAuth-gated, draft-only by default, and scoped to allowed post types. See the host theme's SECURITY.md.

License

MIT © Legend Has It