Developers · MCP server

Plugins, themes, and PHP scripts in your AI assistant

Connect Claude Code, Cursor or any MCP client to your GPLCoffee account. Your assistant searches the catalog, checks your sites for updates and queues the plugin installs you approve.

Create a token Setup guide

Endpoint

https://gplcoffee.dev/api/mcp

Works withClaude CodeCursorVS CodeCodex CLIWindsurfClineZed

Coming soon: Claude Desktop, claude.ai and ChatGPT.

What your assistant can do

Search and recommend

Find plugins, themes, and PHP scripts by need, brand or version, with recommendations in plain words.

Every account

Check your sites

See your plan and credits, and which plugins on your connected sites have a newer version.

Every account

Queue installs and updates

Plugin installs and updates wait on the site until someone clicks Install in wp-admin.

Any membership plan

Approved jobs

Approve an install or update and the site runs it within about 5 minutes, with no click in wp-admin.

Pro, Geek, Lifetime

Download links

A single-use link for a local project, valid for 10 minutes.

Pro, Geek, Lifetime

Try asking

“What is new in the catalog this week?”
“Which plugins on my sites have updates?”
“Find a form builder that works with WooCommerce and Elementor.”
“Update WPForms on my staging site.”

What each plan includes

Feature	Any account	Lite	Pro, Geek, Lifetime
Search, recommendations and product details	Included	Included	Included
Your account, connected sites and update checks	Included	Included	Included
Queued installs and updates, confirmed in wp-admin	Not included	Included	Included
Approved site jobs and Send to my site	Not included	Not included	Included
Download links (10 a day on Pro, 20 on Geek and Lifetime)	Not included	Not included	Included

Older plans count by their tier. Installs and links use credits like the website. See plans and pricing.

Set up in 3 steps

Create a token
Open AI assistant access, pick the permissions and how long it lasts (30, 90 or 365 days). The token is shown once, so copy it straight away.
- Catalog
  Search plugins, themes, and PHP scripts, product details, recent updates and brands.
- Account
  Your plan, credit balance, subscriptions and Connector allowance.
- Connected sites
  Your connected sites and update checks, as each site last reported itself.
- Install queueOff unless ticked
  Membership plans. Queue plugin installs and updates for your sites, confirmed in wp-admin or run as approved jobs (Pro and above). Uses credits like any Connector install.
- Download linksOff unless ticked
  Pro and above. Single-use download links for a local project, charged like a browser download. At most 3 tokens can hold this.
Up to 5 active tokens, 3 of them with download links. Revoke any of them at any time; changing your password stops all of them.
Save it as an environment variable
Most snippets below read GPLCOFFEE_MCP_TOKEN, so the token stays out of config files (VS Code asks for it once; Cline and Zed are the exceptions, see their notes). Restart your client after setting it.
macOS and Linux
```
# ~/.zshrc or ~/.bashrc
export GPLCOFFEE_MCP_TOKEN="gcf_mcp_..."
```
Windows
```
# PowerShell (new windows pick it up)
setx GPLCOFFEE_MCP_TOKEN "gcf_mcp_..."
```

Add the server to your client

Add this to .mcp.json in your project. Claude Code reads GPLCOFFEE_MCP_TOKEN from your environment, so the token never sits in the file.

.mcp.json

{
  "mcpServers": {
    "gplcoffee": {
      "type": "http",
      "url": "https://gplcoffee.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ${GPLCOFFEE_MCP_TOKEN}"
      }
    }
  }
}

Or in the terminal

claude mcp add --transport http --scope user gplcoffee https://gplcoffee.dev/api/mcp \
  --header "Authorization: Bearer $GPLCOFFEE_MCP_TOKEN"

The terminal command is quicker but saves the token itself in your Claude Code settings. After you rotate the token, run claude mcp remove gplcoffee and add it again.

Add this to .cursor/mcp.json in a project, or to ~/.cursor/mcp.json for every project.

mcp.json

{
  "mcpServers": {
    "gplcoffee": {
      "url": "https://gplcoffee.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:GPLCOFFEE_MCP_TOKEN}"
      }
    }
  }
}

Add this to .vscode/mcp.json. VS Code asks for the token once, as a password field, and stores it securely.

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "gplcoffee-mcp-token",
      "description": "GPLCoffee MCP token",
      "password": true
    }
  ],
  "servers": {
    "gplcoffee": {
      "type": "http",
      "url": "https://gplcoffee.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ${input:gplcoffee-mcp-token}"
      }
    }
  }
}

Add this to ~/.codex/config.toml, or run the command. Codex reads the token from GPLCOFFEE_MCP_TOKEN.

~/.codex/config.toml

[mcp_servers.gplcoffee]
url = "https://gplcoffee.dev/api/mcp"
bearer_token_env_var = "GPLCOFFEE_MCP_TOKEN"

Terminal

codex mcp add gplcoffee --url https://gplcoffee.dev/api/mcp --bearer-token-env-var GPLCOFFEE_MCP_TOKEN

Add this to Windsurf's mcp_config.json.

mcp_config.json

{
  "mcpServers": {
    "gplcoffee": {
      "serverUrl": "https://gplcoffee.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:GPLCOFFEE_MCP_TOKEN}"
      }
    }
  }
}

Add this to cline_mcp_settings.json and replace YOUR_GPLCOFFEE_TOKEN with your token. Keep "type": "streamableHttp".

cline_mcp_settings.json

{
  "mcpServers": {
    "gplcoffee": {
      "type": "streamableHttp",
      "url": "https://gplcoffee.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GPLCOFFEE_TOKEN"
      },
      "disabled": false
    }
  }
}

Cline does not read environment variables here, so the token is stored in this file. It lives in your user settings, not in a project, so it is never committed.

Add this to your Zed user settings.json and replace YOUR_GPLCOFFEE_TOKEN with your token.

settings.json

{
  "context_servers": {
    "gplcoffee": {
      "url": "https://gplcoffee.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_GPLCOFFEE_TOKEN"
      }
    }
  }
}

Put it in your user settings, not a project settings file, so the token is never committed.

Any client that supports remote MCP servers: send Authorization: Bearer <token> to the endpoint below (Streamable HTTP, POST only, no session).

Endpoint

https://gplcoffee.dev/api/mcp

Local-only (stdio) clients, via mcp-remote

{
  "mcpServers": {
    "gplcoffee": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://gplcoffee.dev/api/mcp",
        "--transport",
        "http-only",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer YOUR_GPLCOFFEE_TOKEN"
      }
    }
  }
}

With mcp-remote, keep Authorization:${AUTH_HEADER} without a space after the colon. Some clients on Windows split arguments on spaces.

Done. Restart the client and ask “What is new in the catalog this week?”

Reference

All 13 tools

Catalog search

Any GPLCoffee account

Search the GPLCoffee catalog of plugins, themes, and PHP scripts by keyword, type, tier, brand or tag.

gplcoffee_search_catalogRead

Recommendations

Any GPLCoffee account

Up to 10 picks for a need described in plain words, skipping what your site already has.

gplcoffee_recommendRead

Product details

Any GPLCoffee account

Version history, compatibility, scan status, credit cost and how each item is installed.

gplcoffee_get_productRead

Recent updates

Any GPLCoffee account

The most recently updated plugins, themes, and PHP scripts, newest first.

gplcoffee_list_recent_updatesRead

Brands

Any GPLCoffee account

The brands in the catalog with their item counts.

gplcoffee_list_brandsRead

Account

Any GPLCoffee account

Plan, credit balance and daily reset, subscriptions and Connector allowance.

gplcoffee_get_accountRead

Connected sites

Any GPLCoffee account

Sites connected with the GPLC Connector, read-only, as each site last reported itself.

gplcoffee_list_sitesRead

Update check

Any GPLCoffee account

Which Connector-tracked plugins on a site have a newer version, based on the last list the site reported.

gplcoffee_check_updatesRead

Install and update queue

Any membership plan

Queue plugin installs or updates for a connected site. Credits are charged when the site downloads.

gplcoffee_queue_installWrite
gplcoffee_queue_updateWrite

Approved jobs

Pro plans and above

List the jobs approved on your account with their results, and cancel one that has not run.

gplcoffee_list_jobsRead
gplcoffee_cancel_jobWrite

Download links

Pro plans and above

A single-use link to the latest version of an item, for a local project.

gplcoffee_request_downloadWrite

Your assistant can also read gplcoffee://docs/capabilities (this list) and gplcoffee://docs/credits (live credit costs).

How installs and approved jobs run

Ask your assistant to install or update plugins on a connected site.
It shows the plan first: what changes, the credit cost and your balance. Nothing is saved yet.
When you confirm, the items are queued for that site. Queuing is free.
On Lite, or on a site without approved jobs, someone clicks Install on each item in wp-admin (Connector 1.7.0 or later). Credits are charged at that moment.
On Pro, Geek and Lifetime, a site with approved jobs turned on (Connector 1.8.0 or later) runs it within about 5 minutes. Follow or cancel it on Site jobs.
Anything not run within 24 hours expires. You can cancel a queued install on AI assistant access.

What it never does

No direct file links: files reach a signed-in browser, the GPLC Connector, or a single-use link from gplcoffee_request_download that expires in 10 minutes.
No changes on a site unless the site owner confirms in wp-admin, or turned on approved jobs there and you confirmed the request.
Themes and PHP scripts are browser downloads from their page on gplcoffee.dev; only plugins can be queued.
No live connection to your sites: site data is whatever the Connector last reported.

GPLC Connector versions

Connected sites and update checks	Any version
Queued installs confirmed in wp-admin	1.7.0 or later
Approved jobs	1.8.0 or later, with approved jobs turned on in wp-admin

The GPLC Connector updates from wp-admin > Plugins, or download the latest version. Connected sites shows the version each site runs.

Limits

Every request, per token	60 per minute
Catalog and account tools, per tool	60 per minute
Site and job tools, per tool	30 per minute
Installs, updates, cancels and links, per tool	10 per minute
All your tokens together	2000 per day
Install queue	5 plugins per request, 10 waiting per site, 25 per account, 50 a day
Download links	10 a day on Pro, 20 on Geek and Lifetime, 10 minutes each

Over a limit, the tool answers RATE_LIMITED (or the server HTTP 429 MCP_RATE_LIMITED with Retry-After), with the seconds to wait.

Security

Keep tool approval on in your client, so you see each call before it runs.
Text in a web page or file can try to make your assistant call tools (prompt injection). Take care when it reads untrusted content.
Keep the token in GPLCOFFEE_MCP_TOKEN or your client's secret input, never in a file you commit.
Use one token per device or client, with only the permissions it needs.
If a token leaks, revoke it on AI assistant access. That also cancels the installs it queued. Changing your password stops every token.

Troubleshooting

401 Unauthorized on every call: The header is empty or not expanded. Check that GPLCOFFEE_MCP_TOKEN is set where your client starts (restart it after setting), and that the header does not literally contain ${...}. Copy the snippet for your client.
401 invalid_token after it worked before: The token was revoked, expired, or stopped by a password change. Create a new one.
Your client opens a browser sign-in window: It did not send the Authorization header and fell back to OAuth sign-in, which is coming soon. Fix the header as above.
SCOPE_MISSING: The token lacks the permission this tool needs. Create a new token with it ticked.
PLAN_REQUIRED: Queued installs need a membership plan; approved jobs and download links need Pro, Geek or Lifetime. See plans.
RATE_LIMITED or HTTP 429: Too many calls in a short time. The answer says how many seconds to wait; your assistant can retry after that.
The site cannot receive installs or jobs: Queued installs need Connector 1.7.0 or later; approved jobs need 1.8.0 or later plus the opt-in in wp-admin. Update it from wp-admin > Plugins.
An approved job has not run after 5 minutes: The site picks jobs up through WordPress cron. If WP-Cron is off (DISABLE_WP_CRON, common on staging copies), jobs run when the server cron next calls wp-cron.php.
mcp-remote fails on Windows: Some clients split arguments on spaces. Write the header as Authorization:${AUTH_HEADER} with no space after the colon, and put "Bearer ..." in the env block.

Questions

Can I use GPLCoffee from an AI assistant like Claude Code or Cursor?

Yes. Create a personal access token on the AI assistant access page and add it to Claude Code, Cursor, VS Code, Codex or another MCP client. Your assistant can then search plugins, themes, and PHP scripts and check your sites for updates. Setup for each client is in the MCP guide; Claude Desktop, claude.ai and ChatGPT are coming soon.

What can my AI assistant do on my sites?

With a membership plan it can queue plugin installs and updates; each waits for your click in wp-admin and uses credits like any Connector install. On Pro, Geek and Lifetime, sites with approved jobs turned on (Connector 1.8 or newer) run the installs you approve within about 5 minutes. Jobs never activate or delete plugins.

Can my AI assistant download files for a local project?

Yes, on Pro, Geek and Lifetime plans. Your assistant can request a single-use download link that works once and expires after 10 minutes, charged like a browser download, with a daily limit of 10 links on Pro and 20 on Geek and Lifetime. Tick the Download links permission when you create the token.

Does it cost extra?

No. Browsing, searching, recommendations and update checks are free. Installs and download links use credits exactly like the website and the Connector.

Can my assistant change a site without me?

No. Every install or update is either confirmed by a person in wp-admin, or runs as a job you approved on a site that turned on approved jobs itself.

Can it install themes or PHP scripts?

Not yet. Only plugins can be queued for a site. Themes and PHP scripts download from their page on gplcoffee.dev, or through a download link on Pro, Geek and Lifetime.

Can my assistant see my sites live?

No. It sees what the Connector last reported for each site, and it never connects to your sites directly.

Ready to start?

Create a token, add the server and ask what is new this week.

Create a token

What your assistant can do

What each plan includes

Set up in 3 steps

Create a token

Save it as an environment variable

Add the server to your client

Reference

Questions