settings.schema.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://mainwp.com/schemas/mcp-settings.json",
  "title": "MainWP MCP Server Settings",
  "description": "Configuration file for MainWP MCP Server. All fields are optional. Environment variables take precedence over file settings.",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "_comment": {
      "type": "string",
      "description": "Optional comment field for documentation purposes. Ignored by the server."
    },
    "dashboardUrl": {
      "type": "string",
      "format": "uri",
      "description": "Base URL of the MainWP Dashboard (e.g., https://dashboard.example.com). Required unless set via MAINWP_URL environment variable."
    },
    "username": {
      "type": "string",
      "description": "WordPress username for Basic Auth. Used with appPassword for WordPress Application Password authentication. When both Basic Auth and apiToken are provided, Basic Auth takes precedence."
    },
    "appPassword": {
      "type": "string",
      "description": "WordPress Application Password for Basic Auth. Generate from WordPress Dashboard > Users > Profile > Application Passwords. When both Basic Auth and apiToken are provided, Basic Auth takes precedence."
    },
    "apiToken": {
      "type": "string",
      "description": "MainWP REST API Bearer token. Alternative to username+appPassword authentication. Only used if username+appPassword are not set (Basic Auth takes precedence when both are provided)."
    },
    "skipSslVerify": {
      "type": "boolean",
      "default": false,
      "description": "Skip SSL certificate verification. WARNING: Only use for local development with self-signed certificates. Enables man-in-the-middle attacks."
    },
    "allowHttp": {
      "type": "boolean",
      "default": false,
      "description": "Allow HTTP URLs (insecure). WARNING: Credentials will be transmitted in plain text. Use HTTPS in production."
    },
    "safeMode": {
      "type": "boolean",
      "default": false,
      "description": "Prevent destructive operations by stripping the 'confirm' parameter from tool calls. Useful for testing or read-only access."
    },
    "requireUserConfirmation": {
      "type": "boolean",
      "default": true,
      "description": "Require explicit user confirmation for destructive operations. When enabled, destructive tools require a two-phase flow: first call with confirm:true to get a preview, then call with user_confirmed:true to execute. Set to false for automation scripts."
    },
    "rateLimit": {
      "type": "integer",
      "minimum": 0,
      "default": 60,
      "description": "Maximum API requests per minute. Set to 0 to disable rate limiting."
    },
    "requestTimeout": {
      "type": "integer",
      "minimum": 1,
      "default": 30000,
      "description": "Request timeout in milliseconds. Default is 30000 (30 seconds)."
    },
    "maxResponseSize": {
      "type": "integer",
      "minimum": 1,
      "default": 10485760,
      "description": "Maximum response size in bytes. Default is 10485760 (10MB)."
    },
    "maxSessionData": {
      "type": "integer",
      "minimum": 1,
      "default": 52428800,
      "description": "Maximum cumulative response data per server session in bytes. Default is 52428800 (50MB)."
    },
    "allowedTools": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "uniqueItems": true,
      "description": "Whitelist of tool names to expose. If set, only these tools are available. Cannot conflict with blockedTools."
    },
    "blockedTools": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "uniqueItems": true,
      "description": "Blacklist of tool names to hide. These tools are never exposed. Cannot conflict with allowedTools."
    },
    "schemaVerbosity": {
      "type": "string",
      "enum": ["compact", "standard"],
      "default": "standard",
      "description": "Schema verbosity level. 'compact' reduces token usage by ~30% with shorter descriptions. 'standard' provides full descriptions with examples and safety information. Default is 'standard'."
    },
    "responseFormat": {
      "type": "string",
      "enum": ["compact", "pretty"],
      "default": "compact",
      "description": "Response JSON format. 'compact' omits whitespace to reduce token usage. 'pretty' uses 2-space indentation for human-readable output. Default is 'compact'."
    },
    "retryEnabled": {
      "type": "boolean",
      "default": true,
      "description": "Enable automatic retry for transient errors (network failures, HTTP 5xx, rate limits). Only retries read-only operations to preserve idempotency."
    },
    "maxRetries": {
      "type": "integer",
      "minimum": 1,
      "maximum": 5,
      "default": 2,
      "description": "Maximum retry attempts including the initial request. Must be between 1 and 5. Default is 2 (1 retry). Total time across all retries will not exceed requestTimeout."
    },
    "retryBaseDelay": {
      "type": "integer",
      "minimum": 500,
      "maximum": 10000,
      "default": 1000,
      "description": "Base delay between retries in milliseconds. Must be between 500ms and 10000ms. Actual delay uses exponential backoff with jitter. Default is 1000ms (1 second)."
    },
    "retryMaxDelay": {
      "type": "integer",
      "minimum": 500,
      "maximum": 30000,
      "default": 2000,
      "description": "Maximum delay between retries in milliseconds. Must be between 500ms and 30000ms and >= retryBaseDelay. Caps exponential backoff to prevent excessive waits. Default is 2000ms (2 seconds)."
    }
  }
}