Admit one trusted package without opening general code writes
One plugin package needs a narrow admission rule when general code writes must stay closed.
Devenia MCP Downloads Upload Gate lets the existing MCP plugin upload operation accept one package from the trusted Devenia downloads channel. The general plugin code-write gate remains closed, so the controlled upload does not become broad write access.
Make the package address qualify
The existing upload operation accepts a request only when its address stays inside these four checks.
01
Use the existing operation
Give the existing MCP plugin upload operation one package URL. The gate narrows that route; it does not create another endpoint.
02
Use HTTPS on the exact host
The URL must use HTTPS and the exact host downloads.devenia.com.
03
Put one ZIP at the root
Keep one ZIP filename directly under the host. The filename may use only letters, numbers, dots, underscores, and ASCII hyphens before .zip.
04
Keep the URL free of extras
Do not use nested directories, URL credentials, query parameters, or fragments.
Know what the gate decides
It makes a narrow admission decision for one URL request. These boundaries show what that decision does and does not cover.
It decides
Whether the existing URL-based plugin upload request matches the trusted Devenia address contract and may pass the code-write gate.
It does not validate
Package contents, signatures, checksums, or release authority. The gate makes only the URL request admission decision.
It does not open
Base64 uploads, local ZIP paths, plugin deletion, unrestricted plugin updates, or any other plugin code-write operation.
Dependencies
These runtime components provide the WordPress hooks, PHP runtime, and existing upload operation that the gate narrows.
Required runtime, WordPress 6.0 or later
WordPress 6.0+Provides the plugin runtime and filter system.
Required runtime, PHP 7.4 or later
PHP 7.4+Provides the minimum PHP runtime required by the plugin.
Required and active
MCP Expose AbilitiesOwns the existing plugin upload operation and its closed-by-default plugin code-write gate.
Use a qualifying address with the existing upload operation
If you already have a Devenia package address that passes the four checks, provide it to the existing MCP plugin upload operation. The gate decides whether that URL-based request may pass the code-write gate.
It adds no settings screen, separate upload endpoint, or WordPress account permission. It does not provide a package download or installation destination.