Files

airano 85379ec36c fix(security): validate Bearer token value in MCP endpoints, not just presence

Previously any Bearer token (even invalid) passed the HTTP middleware and
got a session with access to tools/list and resources/list. Now the
OAuthRequiredMiddleware validates tokens against master key, API keys,
and OAuth JWT before allowing initialize.

Also fixes:
- WordPress Advanced env prefix: WORDPRESS_ → WORDPRESS_ADVANCED_ in docs
- Bump version to 3.0.1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-18 16:24:04 +03:30

3.1 KiB

Raw Blame History

MCP Hub

The AI-native management hub for WordPress, WooCommerce, and self-hosted services.

596 tools across 9 plugins. Connect your sites, stores, repos, and databases — manage them all through Claude, ChatGPT, Cursor, or any MCP client.

Quick Start

1. Create a `.env` file

# Required
MASTER_API_KEY=your-secure-key-here

# Add at least one WordPress site
WORDPRESS_SITE1_URL=https://your-site.com
WORDPRESS_SITE1_USERNAME=admin
WORDPRESS_SITE1_APP_PASSWORD=xxxx xxxx xxxx xxxx
WORDPRESS_SITE1_ALIAS=mysite

2. Run the container

docker run -d \
  --name mcphub \
  -p 8000:8000 \
  --env-file .env \
  airano/mcphub:latest

3. Verify it works

# Health check (wait ~30 seconds for startup)
curl http://localhost:8000/health

# Open the web dashboard
# http://localhost:8000/dashboard

4. Connect your AI client

In Claude Desktop's claude_desktop_config.json:

{
  "mcpServers": {
    "mcphub": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "Authorization": "Bearer your-secure-key-here"
      }
    }
  }
}

Using Docker Compose

services:
  mcphub:
    image: airano/mcphub:latest
    ports:
      - "8000:8000"
    env_file:
      - .env
    volumes:
      - mcphub-data:/app/data
      - mcphub-logs:/app/logs
    restart: unless-stopped

volumes:
  mcphub-data:
  mcphub-logs:

docker compose up -d

After Starting

URL	Description
`http://localhost:8000/health`	Health check & status
`http://localhost:8000/dashboard`	Web dashboard (manage API keys, view sites, health)
`http://localhost:8000/mcp`	MCP endpoint (connect AI clients here)

Environment Variables

Variable	Required	Description
`MASTER_API_KEY`	Yes	API key for authentication
`WORDPRESS_SITE1_URL`	For WP	WordPress site URL
`WORDPRESS_SITE1_USERNAME`	For WP	WordPress admin username
`WORDPRESS_SITE1_APP_PASSWORD`	For WP	WordPress Application Password
`WORDPRESS_SITE1_ALIAS`	Recommended	Friendly name (e.g., `myblog`)
`OAUTH_JWT_SECRET_KEY`	For OAuth	JWT secret for ChatGPT/Claude auto-registration
`OAUTH_BASE_URL`	For OAuth	Public URL of your server

Add more sites with SITE2, SITE3, etc. See full configuration guide.

Supported Plugins

Plugin	Tools	Env Prefix
WordPress	67	`WORDPRESS_`
WooCommerce	28	`WOOCOMMERCE_`
WordPress Advanced	22	`WORDPRESS_ADVANCED_`
Gitea	56	`GITEA_`
n8n	56	`N8N_`
Supabase	70	`SUPABASE_`
OpenPanel	73	`OPENPANEL_`
Appwrite	100	`APPWRITE_`
Directus	100	`DIRECTUS_`

3.1 KiB Raw Blame History