AI agents are starting to talk to WordPress sites directly. Claude Desktop, ChatGPT custom GPTs, and a growing list of MCP clients can connect to your site, browse content, place orders, edit posts, or call any custom tool you expose. The Model Context Protocol (MCP) is the open standard that makes this possible.<\/p>\n\n
The problem: by default, you can't see any of it. Requests come in, things change, and there's no record of what an agent actually did, when it did it, or which user it acted as.<\/p>\n\n
Activity Log for MCP records every MCP request the moment it hits your site. You see the route, the ability that was called, the user it acted as, the request body, the response, and whether it succeeded. Everything is browsable in a clean React admin page that feels like the rest of WordPress.<\/p>\n\n
If you're running an AI integration, debugging a custom MCP server, or just want a paper trail before letting agents touch your data \u2014 this is the visibility layer.<\/p>\n\n
A real-time log of every MCP request, with filters for date range, ability name, and user. Click any row to inspect the full request and response, copy bodies to your clipboard, or trace a single agent session end-to-end. Sortable columns, configurable per-page counts (10 to 500), and full-text search across request and response bodies. Export to CSV when you need to share findings or feed them into another tool.<\/p>\n\n
The whole interface is built with If you're a site owner: install, activate, and click into Tools \u2192 MCP Logs. There's no setup screen and no configuration \u2014 the plugin starts logging the moment an MCP client makes a request.<\/p>\n\n If you're a developer: there's a full REST API for every admin feature, authenticated via WordPress Application Passwords or WooCommerce API keys. The plugin is also itself MCP-aware \u2014 it registers an MCP server with seven abilities, so an AI agent can introspect its own activity log programmatically. Source ships under Every admin feature is exposed under The plugin registers itself as an MCP server ( All data stays in your WordPress database \u2014 nothing is sent anywhere. Logs live in a custom table named Activity Log for MCP is not affiliated with, endorsed by, or sponsored any AI provider or the Model Context Protocol project. \"MCP\" and \"Model Context Protocol\" are referenced solely to describe the open protocol that this plugin observes.<\/p>\n\n Activity Log for MCP records REST API requests that contain the No configuration is required. The first MCP request to hit your site will appear in the log immediately.<\/p>\n\n\n If you don't have any AI agents connecting to your site, probably not. This plugin is for sites that expose MCP servers \u2014 either through custom code or via other plugins \u2014 and want visibility into how agents are using them. If you've started exploring AI integrations for WordPress, installing this before something goes wrong is much easier than reconstructing what happened afterward.<\/p><\/dd>\n No measurable impact on regular page loads. The logger only fires on MCP REST endpoints, writes a single row per request, and all subsequent reads are object-cached. There's no front-end JavaScript and no admin overhead outside the plugin's own page.<\/p><\/dd>\n No. The plugin only observes and records. Requests pass through untouched.<\/p><\/dd>\n In a custom database table named WordPress Application Passwords (Users \u2192 Your Profile \u2192 Application Passwords) work out of the box via HTTP Basic Auth. WooCommerce API keys are also supported when WooCommerce is active. Either method maps to a real WordPress user; the user must have the Route, HTTP method, request headers, request body, response status, response body, ability name, execution status (success \/ error \/ unknown), user ID, MCP session ID, and timestamp. Request and response bodies are stored in full so you can see exactly what was sent and returned.<\/p><\/dd>\n Yes. Hit the The plugin only logs requests that include the Yes. The plugin logs MCP requests regardless of which other plugins are active, and adds first-class support for WooCommerce API key authentication on top of Application Passwords.<\/p><\/dd>\n\n<\/dl>\n\n\n Initial release.<\/p>\n\n@wordpress\/components<\/code> so it inherits the WordPress design language \u2014 no jarring custom UI to learn.<\/p>\n\nBuilt for both halves of the audience<\/h4>\n\n
src\/<\/code> and builds with npm run build<\/code>.<\/p>\n\nWhy you'd want this<\/h4>\n\n
\n
REST API<\/h4>\n\n
\/wp-json\/activity-log-for-mcp\/v1\/<\/code>:<\/p>\n\n\n
GET \/requests<\/code> \u2014 list with filters, sort, and pagination<\/li>\nGET \/stats<\/code> \u2014 totals, success rate, and calls per ability<\/li>\nGET \/sessions\/{id}<\/code> \u2014 every request in a session, in order<\/li>\nGET \/search<\/code> \u2014 full-text across routes, abilities, and bodies<\/li>\nGET \/errors<\/code> \u2014 recent failed executions and HTTP errors<\/li>\nGET \/tool-performance<\/code> \u2014 per-ability call count, error rate, and unique users<\/li>\nGET \/filters<\/code> \u2014 distinct ability names and users for dropdowns<\/li>\nGET \/export-csv<\/code> \u2014 server-side streamed CSV download<\/li>\nDELETE \/requests<\/code> \u2014 clear all logs<\/li>\nDELETE \/retention<\/code> \u2014 delete logs older than a given date<\/li>\n<\/ul>\n\nMCP abilities<\/h4>\n\n
activity-log-for-mcp-server<\/code>) with seven abilities agents can call directly:<\/p>\n\n\n
get-activity<\/code> \u2014 paginated log retrieval with filters<\/li>\nget-stats<\/code> \u2014 summary metrics with optional date range<\/li>\nget-activity-by-session<\/code> \u2014 full session trace, with optional body exclusion for lighter payloads<\/li>\nsearch-activity<\/code> \u2014 full-text search across stored requests and responses<\/li>\nanalyze-errors<\/code> \u2014 recent errors with full details<\/li>\nget-tool-performance<\/code> \u2014 per-ability performance metrics<\/li>\nclear-old-logs<\/code> \u2014 date-based retention cleanup<\/li>\n<\/ul>\n\nPrivacy and data handling<\/h4>\n\n
{prefix}alfmcp_requests<\/code>. You control retention and can clear everything from the admin UI or via REST. There's no telemetry, no third-party calls, no external dependencies at runtime.<\/p>\n\nDisclaimer<\/h4>\n\n
Privacy Policy<\/h3>\n\n
Mcp-Session-Id<\/code> header. Logged data includes request routes, methods, headers, bodies, response data, user IDs, and timestamps. All data is stored in your WordPress database and is never transmitted to external services.<\/p>\n\n\n\n
activity-log-for-mcp<\/code> folder to \/wp-content\/plugins\/<\/code>, or install through the WordPress plugin directory.<\/li>\n\n
I've never heard of MCP. Do I need this plugin?<\/h3><\/dt>\n
Does the plugin slow down my site?<\/h3><\/dt>\n
Will this modify or block requests?<\/h3><\/dt>\n
Where is the data stored?<\/h3><\/dt>\n
{prefix}alfmcp_requests<\/code>. Nothing is transmitted externally \u2014 not to Anthropic, not to any third party, not anywhere.<\/p><\/dd>\nHow do I authenticate API requests?<\/h3><\/dt>\n
manage_options<\/code> capability.<\/p><\/dd>\nWhat exactly gets logged?<\/h3><\/dt>\n
Can I delete old logs automatically?<\/h3><\/dt>\n
DELETE \/retention<\/code> endpoint or call the clear-old-logs<\/code> ability with a before_date<\/code>, either manually or from a scheduled cron job, to remove entries older than your chosen cutoff.<\/p><\/dd>\nMy MCP client doesn't appear in the logs \u2014 why?<\/h3><\/dt>\n
Mcp-Session-Id<\/code> header, which is part of the MCP transport spec. Most clients send it automatically. If yours doesn't, requests will pass through silently \u2014 that's a client-side configuration issue, not a plugin issue.<\/p><\/dd>\nDoes it work with WooCommerce?<\/h3><\/dt>\n
1.0.0<\/h4>\n\n
\n
@wordpress\/components<\/code><\/li>\nMcp-Session-Id<\/code> header<\/li>\n