WordPress Trac MCP server
A read-only Model Context Protocol server for the WordPress.org
Trac instances, starting with WordPress Core Trac. It runs as a
Cloudflare Worker and uses Trac's public HTML, CSV, RSS, and diff endpoints.
Live servers:
Production:
- Standard MCP:
https://wordpress-trac-mcp-server-prod.a8c-aiops.workers.dev/mcp
- Search/fetch compatibility:
https://wordpress-trac-mcp-server-prod.a8c-aiops.workers.dev/mcp/chatgpt
- Health check:
https://wordpress-trac-mcp-server-prod.a8c-aiops.workers.dev/health
Staging:
- Standard MCP:
https://mcp-server-wporg-trac-staging.a8c-aiops.workers.dev/mcp
- Search/fetch compatibility:
https://mcp-server-wporg-trac-staging.a8c-aiops.workers.dev/mcp/chatgpt
- Health check:
https://mcp-server-wporg-trac-staging.a8c-aiops.workers.dev/health
The former staging deployment at https://mcp-server-wporg-trac-staging.a8cai.workers.dev is
deprecated and runs older code. Its a8cai.workers.dev subdomain differs from the active staging
deployment's a8c-aiops.workers.dev subdomain.
Trac instances
Each Trac instance has its own endpoint. /mcp and /mcp/chatgpt serve Core.
The table is a discovery aid rather than an allowlist. Any <slug>.trac.wordpress.org resolves at
/mcp/<slug>, so a Trac added later needs no change here. An instance is bound to the connection
rather than chosen per tool call, so a client cannot read the wrong Trac by mistake.
Instances configure different fields. Themes has no components, and only some instances have
severities. getTracInfo reports a field the instance does not configure as unavailable instead of
failing. Ticket fields behave the same way: focuses exists only on Core and comes back empty
elsewhere.
Filtering is stricter, because Trac answers a filter on a field it does not configure with the
unfiltered result set rather than an error, and that reads as a real match count. searchTickets
rejects such a filter and names the fields the instance does have. This covers both the separate
arguments and the expressions inside query.
Connect to one instance per client entry. Use several entries to read several Tracs.
Tools
The standard /mcp endpoint provides:
| Tool | Purpose |
|---|
searchTickets | Search by keywords, ticket number, or structured filters |
getTicket | Read a ticket, its attachments, changesets, human discussion, and linked pull requests. commentLimit returns the newest comments, up to 500, and the result reports totalComments and returnedComments |
getChangeset | Read a changeset and an optional truncated diff |
getTimeline | Read Trac activity for recent days or a historical date range, with author filtering and day-granular coverage |
getTracInfo | List components, milestones, priorities, severities, types, or statuses |
getTicket leaves bot comments, cc-only changes, and entries with neither a change nor text out of
comments and lists each one under omittedComments with its ID, author, and reason (bot, cc,
or empty), so a gap in the comment numbering is explained rather than mistaken for truncation.
Every other field change a person makes is reported in changes with its values, including keyword
edits and description edits with their diff link.
getChangeset expects the numeric revision argument, not rev:
{
"revision": 58504,
"includeDiff": false
}
The /mcp/chatgpt compatibility endpoint provides search and fetch. Use a bare number for a
ticket and an r prefix for a changeset: 65739 and r58504.
No tool takes a Trac instance argument. The endpoint you connect to decides which Trac the tools
read.
Ticket and changeset text is plain text with one exception: links are kept as <a href="...">
with an absolute URL, because a comment that points at a pull request or another ticket loses its
point without one. Relative Trac links resolve against the instance you connected to.
Search filters
searchTickets accepts plain keywords, ticket numbers, or filter expressions joined with &.
Plain keywords match the ticket summary only; use description~=text to search ticket bodies.
{
"query": "milestone=6.9&status=closed&resolution=fixed",
"limit": 50,
"page": 2
}
Expressions can name summary, description, owner, reporter, type, status, priority,
milestone, component, version, severity, resolution, keywords, cc, or focuses, and
take four operators: = exact, ~= contains, != not equal, and !~= does not contain. Repeat
a field to OR its values (status=new&status=assigned), with the same operator each time. Add order=<column> and desc=1 to
sort, for example component=Editor&status!=closed&order=changetime&desc=1. Sortable columns are
the fields above plus time and changetime. Field values differ by instance: getTracInfo
lists the complete components, milestones, priorities, severities, types, and statuses each one configures, in Trac's order. Milestones include open and closed groups as one flat list.
It also accepts status, component, milestone, and resolution as separate arguments. Each
is an exact match on one value and overrides the same field in query; the expression form is
the one to use for substring, OR, or negation. Results include pagination metadata.
Timeline ranges, authors, and coverage
getTimeline reads the last days days (default 7, max 30) or an explicit from/to date range. Historical dates start at 2005-01-01, the start of the verified WordPress Core Trac timeline (younger instances have no events before their own first day), and may span at most 90 days per request because the upstream timeline caps its lookback. Dates are inclusive UTC calendar days: days counts whole days ending today, from on its own ends at today, and to on its own covers the seven days ending at to. A to in the future is rejected, and days cannot be combined with from/to:
{
"from": "2005-01-01",
"to": "2005-01-31",
"author": "saxmatt",
"limit": 20
}
author takes one Trac username or a list of up to ten. The server filters by author before the
event limit applies, so a contributor's events stay complete even inside a busy window.
Calls that use only days and limit keep the original recent-activity contract: limit is the maximum number of upstream events, and the response contains results, totalEvents, daysBack, and timelineUrl.
For a date-range or author-filtered call, limit (1 to 100, default 20) is advisory. A response covers whole calendar days: results are rounded down to a day boundary, and the newest complete day of the window comes back in full even when it holds more events than limit.
Each coverage response lists events newest first in results and reports requested, the window that was
asked for, and covered, the part of it this response covers completely. complete says whether
the response covered all of it. When it is false, continueWith is a ready-made arguments object
for the remainder: it preserves the effective limit and the accepted author input when present,
so send it back to getTimeline unchanged and repeat until a response reports complete as true,
or until a response arrives without a continueWith. A continuation window always ends on a day already past, so walking one cannot produce gaps or duplicates. note states the coverage in plain language, and coverage that includes today is accurate as of the request. If one day fills the 500-event upstream fetch, that incomplete day is not included in covered: covered is null, complete is false, and terminalTruncation states that the tool cannot continue within that day.
docs/timeline-pagination.md records why the timeline reports day
coverage instead of page numbers.
Tool errors
A failed tool call returns an MCP result with isError: true. Its JSON payload carries a
machine-readable code alongside the human-readable error message. not_found errors also name
the resource and id that were requested:
{
"code": "not_found",
"error": "Ticket 99999999 not found",
"resource": "ticket",
"id": 99999999
}
code | Meaning |
|---|
not_found | The requested ticket or changeset does not exist |
invalid_argument | An argument passed schema validation but cannot be used, such as an unsupported search filter field |
rate_limited | Trac throttled the request and bounded retries did not clear it |
upstream_error | Trac or a supporting service failed or returned unexpected content |
Codes are stable API surface: branch on code, never on error wording. An existing code keeps
its meaning and is only removed or renamed with a major version bump, while messages can change
freely. New codes may be added over time, so treat an unrecognized code as upstream_error.
Arguments that fail the advertised input schema also return isError: true, but as the MCP SDK's
plain-text message beginning Input validation error: rather than a JSON payload, so a model can
read it and retry. An unknown tool name is a JSON-RPC -32602 error.
Connect
Remote-capable MCP clients can connect directly to the standard endpoint. Clients that need a local
bridge can use mcp-remote:
{
"mcpServers": {
"wordpress-trac": {
"command": "npx",
"args": [
"mcp-remote",
"https://wordpress-trac-mcp-server-prod.a8c-aiops.workers.dev/mcp"
]
},
"wordpress-meta-trac": {
"command": "npx",
"args": [
"mcp-remote",
"https://wordpress-trac-mcp-server-prod.a8c-aiops.workers.dev/mcp/meta"
]
}
}
}
For ChatGPT, add the compatibility endpoint as a custom app. See
OpenAI's current MCP help
because product labels and setup steps change.
After changing a configured server URL, reconnect the MCP server or restart the client once. Future
deployments to the same URL do not require a client configuration change.
Develop
Requirements: Node.js 22 or later and pnpm 10.
pnpm install
pnpm dev
Open http://localhost:8787/ to view the local landing page. See
docs/local-development.md for the full browser-preview workflow and
troubleshooting.
Run the complete local quality gate:
pnpm check
This runs TypeScript, Biome, Vitest, and a Cloudflare Worker dry-run build. See
docs/testing.md for manual protocol and live-data checks.
Deployment requires a configured Cloudflare account:
# Staging
pnpm run deploy
# Production
pnpm run deploy:production
Design and safety
- The server is read-only and has no Trac credentials.
- The MCP protocol layer is the official TypeScript SDK. Each endpoint serves stateless 2026-07-28
clients and handshake-era clients (2024-10-07 through 2025-11-25), answering the latter with plain
JSON. The advertised input schemas are generated from the same Zod schemas that validate calls.
- Tool inputs receive runtime validation before any upstream request.
- Upstream requests stay on
*.trac.wordpress.org and the official linked-PR endpoint on
api.wordpress.org. The instance slug comes from the URL path, is validated against a strict
pattern before it reaches a request, and every request is checked against the resolved origin.
- Upstream redirects are never followed.
*.trac.wordpress.org has wildcard DNS and redirects
unknown subdomains to Core, so following one would answer for one instance with another's data.
A redirect that leaves the instance origin is reported as an unknown instance; one that stays on
it is reported as an upstream failure.
- Transient transport failures, rate limits, server errors, and Trac bot challenges receive bounded
retries. Permanent 403 and 404 responses return immediately.
- Responses are parsed from public Trac pages and machine-readable formats.
- The Worker keeps no ticket cache or durable state.
Contribute
Keep tool schemas, runtime validation, tests, and documentation aligned. Run pnpm check before
opening a pull request.
License
GPL-2.0-or-later.
