Early access · In testing now
SpeakEasy MCP
Your MCP doors, unlisted.
A small plugin that hides your WordPress MCP doors from strangers, so only the guests you invite even know they’re there.
The master switch
Speak easy, stranger.
Strangers get a 404. Invited guests know the knock.
The problem
Your site has new doors. Everyone can see them.
WordPress sites now open MCP endpoints (Model Context Protocol), doors that let AI assistants like Claude and Grok Bot work with your site, for example through the WordPress MCP Adapter and the Abilities API.
Those doors are publicly listed and easy to find, so bots and scanners come sniffing. Even with a login in place, a door that answers “login required” has just told them it exists.
“Login required.”
Polite, and exactly what a scanner was hoping to hear.
How it works
No sign on the door. Just a knock.
1
A stranger knocks
A bot or scanner tries one of your site’s MCP doors.
2
Nobody’s home
SpeakEasy answers with a standard “not found”, exactly like a page that doesn’t exist. The door is also gone from your site’s public list of API routes.
3
Guests walk right in
Addresses on your guest list, or clients that send your secret knock, get through as normal.
Three modes
Choose how each door behaves.
Open
Just like today. The door is listed and works as usual.
Unlisted
Hidden from the public list. It still works if you know the address and have a login.
Lights out
“Not found” for everyone, except your guest list and anyone with the secret knock.
Covers the WordPress MCP Adapter, the Abilities API, and the Astra theme’s MCP door.
Who gets in
Only the people you invite.
- The guest list. Trusted internet addresses, such as the published range Claude.ai connects from, or your own automation server.
- The secret knock. A private key your own connectors send with each request. Anyone who sends it gets in.
- You, in wp-admin. Logged-in admins work exactly as before.
A second lock, not a replacement
SpeakEasy doesn’t replace your logins. Once a guest is through the door, app passwords still apply. It simply keeps strangers from finding the door in the first place.
Light by design
Small, quiet, easy to leave.
- One small plugin. No extra server to run.
- No external calls. Nothing phones home.
- Nothing stored in your database.
- Works behind Cloudflare.
- Easy to turn off. Just click Deactivate on the Plugins screen.
Proof at the door
Try the door yourself.
This very site runs SpeakEasy. Knock on its WordPress MCP door without the word and see what answers.
Strangers get turned away at the curb. Invited guests, like Claude and Grok Bot, walk right in.
Questions at the door
Before you knock.
A few straight answers about SpeakEasy MCP and your WordPress MCP doors.
What does SpeakEasy MCP do?
It hides the WordPress MCP endpoints your site opens for AI assistants. Unless a request carries your secret knock or comes from an address on your guest list, it gets a plain 404, as if the door were never there. Pick how strict each door is with the three modes.
How do invited guests get in?
Two ways. Your own connectors, Grok Bot among them, can send the secret knock, an X-Speakeasy-Key header, with each request. Or you add their IP addresses to the guest list; presets cover Claude (Anthropic) and Cloudflare’s IP ranges.
Does it work with the WordPress MCP Adapter?
Yes. It covers the endpoints opened by the WordPress MCP Adapter and the Abilities API, plus the Astra theme’s MCP door.
Do I still need Application Passwords?
Yes. SpeakEasy is a second lock, not a replacement. Once a guest is through the door, every WordPress MCP request still has to log in with an Application Password.
Will it slow my site down?
No. It’s a lightweight plugin with no external calls, and uninstalling it cleans up after itself.
Can I try it?
SpeakEasy MCP is in early access, in beta testing now. To join the beta, write to [email protected].
Early access
Coming soon to the WordPress plugin directory.
SpeakEasy MCP is in testing now on its author’s own sites. Check back here for the release.
Until then, the door stays unmarked.
Inquiries or interested in beta testing? [email protected]