Secure MCP Server for WordPress
Release Notes

Onboarding UI improvements.

Minor bug fixes.

Added a guided onboarding checklist for new installs: register an agent, add the MCP URL to your AI client, and approve the connection, shown on the dashboard until setup is complete.

Redesigned the role & ability editor as a matrix: abilities are grouped by resource down the left, with every role shown as its own column, so you can compare what each role can do without switching roles one at a time. Includes quick select all / clear controls for an entire role or an entire resource category.

New ability — “Update Page”: edits the title and/or content of an existing page.

Added a bundled abilities library: 260+ ready-to-use, security-reviewed WordPress abilities exposed as MCP tools out of the box. Core content (posts, pages, categories, tags, media, revisions), users & roles, and comments are always available; ability sets for WooCommerce, Advanced Custom Fields, Yoast SEO, Contact Form 7 (with Flamingo), WPForms, and Gravity Forms activate automatically when those plugins are present.

Every bundled ability is capability-gated, carries explicit MCP tool annotations (read-only / destructive / idempotent / open-world), declares full input/output JSON schemas, and is reachable only through the governed MCP endpoint — never the public REST API.

Added a “Test Connection” check that confirms an AI client will actually be able to reach and sign in to your site, run from both your server and an outside vantage so it catches firewall, CDN, and reverse-proxy issues a same-server check would miss. Available on the Connect to AI page and beside Register Agent on the AI Agents screen.

Added a Troubleshooting guide, always available from the toolbar, that explains the common reasons an AI client can’t connect and gives copy-paste Apache/Nginx fixes for each. When a connection test finds an issue, the most likely cause is highlighted automatically.

Security hardening in the bundled abilities: reserved user-meta keys (capabilities, role level, session tokens) can never be read or written through an ability; role grants are limited to roles whose capabilities the caller already holds; and CSV entry exports are neutralized against spreadsheet formula injection.

Reliability on CDN/cached hosts: the OAuth and MCP endpoints (discovery, registration, the MCP transport, and the authentication challenge) now send “Cache-Control: no-store”, so an edge cache or CDN — such as Pantheon’s Varnish, Cloudflare, WP Engine, or Kinsta — can no longer cache and misdeliver these per-request responses, which could otherwise intermittently break AI-client connections.

Fixed the role & ability editor incorrectly flagging object-level abilities (those gated by per-object capabilities such as editing or deleting a specific post or page) as capability conflicts for every role, including Administrator. These capabilities are resolved per request against the target object, so they are no longer shown as conflicts; the runtime permission check is unchanged and was always correct.

Minor fixes and reliability improvements.

Added an execution activity log: a full audit trail of every tool call, filterable by agent, status, or time range, with per-event detail including latency and error context.

Added an activity timeline on the agent overview: the last 5 executions appear inline on each NHI’s overview tab.

Redesigned the dashboard with four focused metrics — Active Agents, Total Executions, Success Rate, and Average Latency — for an at-a-glance view of MCP server health.

Denied and unknown-tool calls are now correctly attributed to the responsible NHI, so the audit log is never missing an agent name.

Clearer role & ability editor: a single Select all / Clear all control (instead of separate All and None buttons), role names shown in each NHI’s summary, and a smoother role & ability layout.

Refined the admin/member view switcher to a clearer segmented control.

Fixed the support form’s country picker so it no longer shifts the page or scrolls unexpectedly when opened.

General UI polish across the NHI Registry and connection screens.

Added a “My AI Access” member view so any logged-in user can see the tools available to their role, with an admin/member view switcher for administrators.

Added a Settings link to the plugin’s row on the Plugins page.

NHI Registry is now role-based: grant abilities to each WordPress role, with live capability-conflict detection. A request receives the abilities its user’s role(s) are granted across all enabled NHIs.

Rebuilt NHI create/edit as full-screen pages (guided create wizard ending in a connection step); removed the cramped modal editor.

Existing NHIs are migrated automatically and keep working; review each one to scope its abilities per role.

Support and deactivation-feedback emails now include the customer’s email address in the subject line.

Added a floating Contact Support button, available throughout the admin app.

Added a Setup Guide link in the toolbar for quick access to the connection guide.

Redesigned the deactivation feedback prompt with a clearer, on-brand layout, guided reason selection, and the option to get help instead of deactivating.

Added NHI Registry: a new admin screen to view and manage all non-human identity (AI client) registrations, including OAuth client details and token status.

Added per-ability toggle to enable or disable individual abilities from being exposed as MCP tools.

Revamped the plugin UI.

Added in-plugin support form and deactivation feedback modal.

Added a remote MCP server endpoint that exposes registered abilities as MCP tools.

Added a self-hosted OAuth 2.1 authorization server with Dynamic Client Registration, PKCE, and discovery metadata so ChatGPT and Claude can connect.

Initial release: read-only viewer for abilities registered through the WordPress Abilities API.