{ "version": "3.10.2", "download_url": "https://updates.mcpwp.net/mcpwp-latest.zip", "requires": "5.0", "requires_php": "7.4", "tested": "7.0", "name": "MCPWP", "homepage": "https://mcpwp.net/", "author": "Mumega", "author_homepage": "https://mumega.com/", "changelog": "3.10.2 — fix: adversarial review findings — two defects already live in 3.10.1 (#736)

3.10.1

— fix: clear the open bug backlog — #717, #720, #678, and the honesty half of #729 (#734)

3.10.0

— feat: seo: market data via DataForSEO — visibility, opportunities, and an agent loop (#730)

3.9.3

— fix: security: granular tool-category gate on all auth paths, fail-closed OAuth scopes (#700)

Heads up: AI image and alt-text generation is now governed by the AI tool toggle rather than Admin. If you disabled Admin specifically to block /integrations/* generation, it becomes reachable again on upgrade — AI is on by default. Disable the AI toggle to restore that block. This aligns the REST routes with the tool taxonomy the MCP layer has always used. Tool-category toggles now hold on the REST entry point as well as the MCP one. A toggle you previously set expecting MCP-only enforcement — WooCommerce, LearnPress, Multisite, Staging, Forms, Elementor Theme — will now also block the matching REST routes.

3.9.2

— fix: **release:** publish and watch the Freemius channel like the self-hosted one ([#726](https://github.com/Mumega-com/mcpwp/issues/726))

3.9.1

— fix: **update:** guard Mcpwp_Updater use on builds that prune it ([#724](https://github.com/Mumega-com/mcpwp/issues/724))

3.9.0

— feat: **mupot:** read-first WordPress connector — status + task board in Control Room ([#715](https://github.com/Mumega-com/mcpwp/issues/715)) ([8a06c11](https://github.com/Mumega-com/mcpwp/commit/8a06c11593f62c7de1b873d4d79ed09f014ed71c)), closes [#689](https://github.com/Mumega-com/mcpwp/issues/689)

3.8.0

— feat: **updater:** make update-channel failures loud at every layer ([#719](https://github.com/Mumega-com/mcpwp/issues/719)); fix: tool schema item types ([#707](https://github.com/Mumega-com/mcpwp/issues/707)) and staging environment detection ([#710](https://github.com/Mumega-com/mcpwp/issues/710)) ([#713](https://github.com/Mumega-com/mcpwp/issues/713)); fix: **updater:** resolve updates from the plugin manifest, not the WP.org transient ([#718](https://github.com/Mumega-com/mcpwp/issues/718))

3.7.2

— fix: **security:** fold route case before every authorization decision ([#711](https://github.com/Mumega-com/mcpwp/issues/711))

3.7.1

— feat: **admin:** redesign admin UI to Claude Design Control Room mockup (3.6.5); feat: allow extensions to raise custom MCP tool scope ([#654](https://github.com/Mumega-com/mcpwp/issues/654)); feat: **broker-plugin:** cached introspection validator (fail-closed, audience-checked, kill-switch); feat: **broker-plugin:** claude.ai/ChatGPT OAuth sign-in via mumcp.com broker (v3.7.0); feat: **broker-plugin:** enrollment callback + confirm endpoints (site-control proof); feat: **broker-plugin:** enrollment lifecycle — connect/state/confirm/store/disconnect + Connections UI; feat: **broker-plugin:** point .well-known/oauth-protected-resource at mumcp.com when enrolled; feat: **broker-plugin:** validate broker Bearer tokens in verify_api_key() (read|write, never admin) + 401 discovery header; feat: **cloudflare:** cloudflare integration — bot-fix, cache purge, speed/CWV signals ([#632](https://github.com/Mumega-com/mcpwp/issues/632)); feat: **elementor:** idempotent, named Kit CSS blocks ([#645](https://github.com/Mumega-com/mcpwp/issues/645)); feat: **elementor:** validate Atomic Elements props against real schema + document the feature; feat: **integrations:** self-service Cloudflare Bot Fight Mode fix in wp-admin; feat: **seo:** classify deprecated schema.org rich-result types ([#615](https://github.com/Mumega-com/mcpwp/issues/615)); feat: **seo:** experimental opt-in GEO/AI-citability score ([#617](https://github.com/Mumega-com/mcpwp/issues/617)); feat: **seo:** schema-placement check + explicit E-E-A-T rubric ([#616](https://github.com/Mumega-com/mcpwp/issues/616)); feat: support trusted custom tool callbacks ([#657](https://github.com/Mumega-com/mcpwp/issues/657)); fix: **broker-plugin:** host-lock enroll-store issuer/introspection_endpoint to mumcp.com (prevent credential-exfil poisoning); fix: **broker-plugin:** introspect only as fallback after local key + rate-limit anonymous bearer attempts (no key egress, no DoS); fix: **broker-plugin:** public state-gated enroll-callback + pin audience to home_url + pin introspection URL + no public log-amplification; fix: **ci:** scope proxy-worker audit to runtime deps + bump hono ([#692](https://github.com/Mumega-com/mcpwp/issues/692)); fix: **elementor:** accept create-side param names on archetype/part list tools ([#640](https://github.com/Mumega-com/mcpwp/issues/640)); fix: **elementor:** correct destructive annotations and elementor_data round-trip typing ([#642](https://github.com/Mumega-com/mcpwp/issues/642)); fix: **elementor:** stop silent data loss on section/container/atomic layout mismatches; fix: **freemius:** soft-gate first activation instead of hard license wall ([#646](https://github.com/Mumega-com/mcpwp/issues/646)); fix: **license:** close reconnect-link render-time gap + notify on blocked updates; fix: **license:** detect wrong-package downgrade + warn loudly ([#656](https://github.com/Mumega-com/mcpwp/issues/656)); fix: **license:** reconnect flow no longer forces skip-mode (found the actual bug); fix: **license:** reconnect Freemius when a site is stuck anonymous/pending ([#633](https://github.com/Mumega-com/mcpwp/issues/633)); fix: **license:** update vendored Freemius SDK 2.13.0 -> 2.13.4; fix: **license:** use Freemius's install-linked checkout URL, not marketing site; fix: **mcp:** draft rendered-copy 404/502 + expose unlicensed-reason code; fix: menu taxonomy contract, AIOSEO persistence, draft rendered-copy (3.6.2) ([#682](https://github.com/Mumega-com/mcpwp/issues/682)); fix: **oauth:** discovery docs broken on subdirectory installs + widen CF fix; fix: **oauth:** serve consent screen off the REST API so browser sign-in works ([#695](https://github.com/Mumega-com/mcpwp/issues/695)); fix: **pages:** support excerpt on wp_create_page/wp_update_page ([#697](https://github.com/Mumega-com/mcpwp/issues/697)); fix: **release:** release_freemius.sh never defined MCPWP_FREEMIUS_BUILD; fix: **rendered-html:** render draft/private Elementor content in-process, not via loopback ([#644](https://github.com/Mumega-com/mcpwp/issues/644)); fix: **security:** block secret option stores from /option and admin-gate /plugin-settings; fix: **security:** block secret option stores from /option and admin-gate /plugin-settings; fix: **security:** close draft/private content disclosure to read-scoped API keys ([#683](https://github.com/Mumega-com/mcpwp/issues/683)); fix: **security:** harden feedback-relay rate limiting and Figma OAuth callback ([#649](https://github.com/Mumega-com/mcpwp/issues/649)); fix: **security:** harden REST/MCP scope matrix and self-approval gate; fix: **security:** harden REST/MCP scope matrix and self-approval gate; fix: **security:** require admin scope to bypass content-approval gate; fix: **security:** require admin scope to bypass content-approval gate; fix: **security:** restrict Elementor globals writes to an allowlist and admin-gate kit CSS ([#603](https://github.com/Mumega-com/mcpwp/issues/603)); fix: **security:** restrict non-public content reads to write-scoped keys ([#601](https://github.com/Mumega-com/mcpwp/issues/601)); fix: **seo:** 3.6.4 — readiness false-positives, screenshot save_to_media, setup-page connect clarity ([#685](https://github.com/Mumega-com/mcpwp/issues/685)); fix: **seo:** stop /seo/audit fatal and per-post self-fetch storm; fix: **seo:** stop /seo/audit fatal and per-post self-fetch storm

3.7.0

— new: **connect:** claude.ai/ChatGPT can now sign into your site over OAuth via the mumcp.com broker (WP Admin → MCPWP → Setup → Connect to mumcp.com) — no per-site OAuth server; tokens validated by cached introspection; new Connections UI with Disconnect kill-switch. security: broker tokens capped at read/write (**admin never grantable over OAuth**), fail-closed + audience-bound; per-site credential stored encrypted. Claude Desktop/Cursor unchanged (X-API-Key).

3.6.5

— new: **admin:** redesigned admin UI — warm cream/antique-gold palette, Newsreader/Instrument Sans/IBM Plex Mono typography, refreshed cards, stat tiles, badges, and buttons across all admin pages; new: **control-room:** pending approvals show a before/after diff disclosure

3.6.4

— fix: **seo:** robots.txt readiness no longer false-flags sub-path disallows (/wp-admin/, Woo cart) as a sitewide block ([#680](https://github.com/Mumega-com/mcpwp/issues/680)); fix: **seo:** template-page readiness sources from rendered output instead of false missing_h1/thin_content ([#681](https://github.com/Mumega-com/mcpwp/issues/681)); fix: **media:** wp_screenshot_url honors explicit save_to_media=false ([#677](https://github.com/Mumega-com/mcpwp/issues/677)); new: **setup:** clearer Claude Desktop connect methods (API key vs OAuth coming-soon) + secret-in-URL warning

3.6.3

— fix: **security:** close a content-disclosure gap where a read-scoped API key could read or enumerate non-public (draft/pending/private) content — titles, URLs, bodies, excerpts, and SEO/approval metadata — across the Elementor, blocks, pages, posts, SEO, content-graph, approvals, and signals read surfaces; non-public content now requires write scope, enforced at a shared model chokepoint ([#683](https://github.com/Mumega-com/mcpwp/issues/683))

3.6.2

— fix: **menus:** wp_add_menu_item/wp_create_menu now honor the documented taxonomy and post_type item types instead of silently storing a blank custom link ([#676](https://github.com/Mumega-com/mcpwp/issues/676)); fix: **seo:** wp_set_seo (AIOSEO) now persists the meta description and robots flags reliably instead of a false success ([#672](https://github.com/Mumega-com/mcpwp/issues/672)); fix: **content:** wp_get_rendered_copy renders unpublished drafts in-process instead of failing with a loopback fetch_error ([#675](https://github.com/Mumega-com/mcpwp/issues/675))

3.6.1

— fix: **oauth:** discovery documents now work on subdirectory-installed sites, not just domain-root installs; new: Cloudflare Fix MCP Access now also covers OAuth discovery paths.

3.6.0

— feat: allow extensions to raise custom MCP tool scope ([#654](https://github.com/Mumega-com/mcpwp/issues/654)); feat: **cloudflare:** cloudflare integration — bot-fix, cache purge, speed/CWV signals ([#632](https://github.com/Mumega-com/mcpwp/issues/632)); feat: **integrations:** self-service Cloudflare Bot Fight Mode fix in wp-admin; feat: support trusted custom tool callbacks ([#657](https://github.com/Mumega-com/mcpwp/issues/657)); fix: **freemius:** soft-gate first activation instead of hard license wall ([#646](https://github.com/Mumega-com/mcpwp/issues/646)); fix: **license:** close reconnect-link render-time gap + notify on blocked updates; fix: **license:** detect wrong-package downgrade + warn loudly ([#656](https://github.com/Mumega-com/mcpwp/issues/656)); fix: **license:** reconnect flow no longer forces skip-mode (found the actual bug); fix: **license:** update vendored Freemius SDK 2.13.0 -> 2.13.4; fix: **license:** use Freemius's install-linked checkout URL, not marketing site; fix: **mcp:** draft rendered-copy 404/502 + expose unlicensed-reason code; fix: **release:** release_freemius.sh never defined MCPWP_FREEMIUS_BUILD; fix: **security:** harden feedback-relay rate limiting and Figma OAuth callback ([#649](https://github.com/Mumega-com/mcpwp/issues/649))

3.5.8

— fix: **build:** release_freemius.sh never defined MCPWP_FREEMIUS_BUILD, so every Freemius zip since 3.5.1 had the SDK on disk but never actually loaded it — root cause of every unlicensed/no_freemius_sdk report this cycle.

3.5.7

— new: **integrations:** self-service \\\"Fix MCP Access (Bot Fight Mode)\\\" button on the Cloudflare integration card — no manual per-site Cloudflare dashboard work needed anymore.

3.5.6

— fix: **license:** closed a gap in the reconnect fix (the displayed link itself still got require_license=false baked in); new: admin notice when Freemius can't push an update to an anonymous/unlicensed site (read-only, no install action).

3.5.5

— fix: **license:** reconnect (\\\"Manage pricing and license\\\" after Skip) now actually lets you enter a license — the soft-gate default was leaking onto Freemius's own reconnect redirect too.

3.5.4

— fix: **license:** detect residual Freemius account data for this product with no SDK currently loaded (reason: freemius_removed_had_license) plus an admin notice pointing at the fix (#656).

3.5.3

— fix: **rendered-copy:** wp_get_rendered_copy now renders private/draft/pending Elementor content in-process instead of fetching the public/preview URL (#655); fix: **license:** expose a safe unlicensed-reason code without exposing the key (#656).

3.5.2

— fix: **license:** update vendored Freemius SDK 2.13.0 → 2.13.4 — includes an upstream checkout-context fix where raw request params could override computed checkout params.

3.5.1

— fix: **license:** Upgrade/pricing links now use Freemius's own install-linked checkout URL instead of a plain marketing-site link — a purchase made on the marketing site had no install context, so it never synced back to the plugin.

3.5.0

— feat: **elementor:** idempotent, named Kit CSS blocks ([#645](https://github.com/Mumega-com/mcpwp/issues/645)); feat: **elementor:** validate Atomic Elements props against real schema + document the feature; feat: **seo:** classify deprecated schema.org rich-result types ([#615](https://github.com/Mumega-com/mcpwp/issues/615)); feat: **seo:** experimental opt-in GEO/AI-citability score ([#617](https://github.com/Mumega-com/mcpwp/issues/617)); feat: **seo:** schema-placement check + explicit E-E-A-T rubric ([#616](https://github.com/Mumega-com/mcpwp/issues/616)); fix: **elementor:** accept create-side param names on archetype/part list tools ([#640](https://github.com/Mumega-com/mcpwp/issues/640)); fix: **elementor:** correct destructive annotations and elementor_data round-trip typing ([#642](https://github.com/Mumega-com/mcpwp/issues/642)); fix: **elementor:** stop silent data loss on section/container/atomic layout mismatches; fix: **license:** reconnect Freemius when a site is stuck anonymous/pending ([#633](https://github.com/Mumega-com/mcpwp/issues/633)); fix: **rendered-html:** render draft/private Elementor content in-process, not via loopback ([#644](https://github.com/Mumega-com/mcpwp/issues/644)); fix: **security:** block secret option stores from /option and admin-gate /plugin-settings; fix: **security:** block secret option stores from /option and admin-gate /plugin-settings; fix: **security:** harden REST/MCP scope matrix and self-approval gate; fix: **security:** harden REST/MCP scope matrix and self-approval gate; fix: **security:** require admin scope to bypass content-approval gate; fix: **security:** require admin scope to bypass content-approval gate; fix: **security:** restrict non-public content reads to write-scoped keys ([#601](https://github.com/Mumega-com/mcpwp/issues/601)); fix: **seo:** stop /seo/audit fatal and per-post self-fetch storm; fix: **seo:** stop /seo/audit fatal and per-post self-fetch storm

3.4.17

— new(seo): /seo/content-quality gains an optional geo_citability_experimental score (include_geo_experimental=true, off by default) — self-contained answer blocks, question-phrased headings, structured-data presence, explicitly labeled vendor-observed correlation not Google-confirmed, never mixed into the main score. Deliberately doesn't score total word count. Not building an llms.txt generator.

3.4.16

— new(seo): /seo/structured-data flags schema_placement_mismatch when FAQPage/HowTo/QAPage schema describes content not found on the page (Google's March 2026 eligibility rule); /seo/content-quality returns an explicit eeat field with Google's 4-factor E-E-A-T rubric (Experience/Expertise/Authoritativeness/Trustworthiness), each with its own sub-score and evidence, not one aggregate number.

3.4.15

— new(seo): /seo/structured-data classifies each schema @type as active or deprecated_no_rich_result (HowTo, FAQPage, ClaimReview, EstimatedSalary, LearningVideo, SpecialAnnouncement, VehicleListing — confirmed via Google Search Central), without recommending deletion. Book/Course deliberately excluded to avoid false positives.

3.4.14

— new(elementor): dry_run/wp_set_elementor validates Atomic Elements props against their real schema instead of skipping validation, flagging unknown props and the missing {\\\"$$type\\\",\\\"value\\\"} wrapper before writing; wp_add_section/replace_section/edit_section/edit_widget already work with Atomic Elements as-is. new(docs): wp_get_guide(topic=\\\"elementor\\\") documents Atomic Elements — layout modes, structure, prop format, worked example (#618/#622/#623).

3.4.13

— new(elementor): wp_get_widget_schema returns a real deep schema for Atomic Elements (props/types/enums/defaults) built from Elementor's own get_props_schema(), instead of an empty tabs list; covers both atomic leaf widgets and container elements (two different Elementor managers, both now resolve).

3.4.12

— fix(elementor): wp_get_elementor_summary/preview stats were blind to Atomic content elements (no widgetType wrapper), now counted + unwrapped correctly; wp_edit_widget can now edit Atomic elements; found + fixed a real silent-data-loss bug where Elementor's own HTML-cache-rebuild save was stripping nested Atomic elements past a top-level-only integrity check — now a full recursive check that restores verified data (#618/#620).

3.4.11

— fix(elementor): wp_site_info detects Elementor Atomic Elements (Editor V4) — elementor_layout_mode reports \\\"atomic\\\" + new elementor_atomic_active flag; wp_set_elementor rejects atomic payloads up front on non-atomic sites instead of a false success + silent data loss (#618/#619); added missing \\\"e-grid\\\" atomic type.

3.4.10

— fix(elementor): wp_set_elementor rejects \\\"container\\\" elements up front with a clear error when the site's Elementor Container experiment is inactive, instead of a false success followed by an empty page; also restores verified data if Elementor's internal HTML-cache rebuild ever corrupts it. Root cause of #612.

3.4.9

— diagnostic(elementor): every write/delete of _elementor_data now logs post ID, element count, and a full backtrace via error_log() — tracking down #612.

3.4.8

— fix(admin ui): sidebar menu icon was invisible (background square nearly matched WP admin's dark theme); Permissions checkboxes on Create API Key form could overflow off-screen, now wraps. hardening(elementor): wp_set_elementor post-write verification now reads the raw DB row directly, bypassing any persistent object cache, and surfaces the real MySQL error on silent write failures (#612).

3.4.7

— fix(auth): Create API Key form was missing scope checkboxes — every scoped key (including Admin role) silently saved read-only, blocking all write tools. Form now defaults to read+write (+admin for Admin role).

3.4.6

— fix(security): restrict non-public content reads to write-scoped keys (#601).

3.4.5

— fix(security): require admin scope to bypass content-approval gate.

3.4.4

— fix: **seo:** stop /seo/audit fatal and per-post self-fetch storm; fix: **seo:** stop /seo/audit fatal and per-post self-fetch storm

3.4.1

— security: require admin scope for plugin self-update and update-control options; restrict update package URLs to HTTPS + trusted hosts (fixes write-scope→RCE chain)

3.4.0

— feat: GET /openapi.json — OpenAPI 3.0 schema from free-tools registry; ChatGPT GPT Actions support

3.3.9

— fix(ux): staging tools now visible in tools/list on all plans (non-Pro calls return upgrade prompt); MCP server instructions note Pro-gated features when unlicensed

3.3.8

— feat(staging): Pro staging — WP Engine/Kinsta/Pressable adapters + Generic WP-CLI fallback; REST /staging GET/POST/status; 4 MCP tools (wp_get_staging_info, wp_push_to_staging, wp_push_to_live, wp_get_staging_status); push-to-live gated by approval workflow; three new integration providers; SSRF mitigated

3.3.7

— feat(T50): MCP resources/list returns 6 real site resources (site-info, context, pages, posts, design-refs, elementor-status); resources/read proxies to mcpwp/v1 REST with API key forwarding; feat(T51): MCP prompts/list returns 5 named templates (audit-seo, build-page, refresh-content, onboard, design-match); prompts/get fills arguments and returns messages[]; both declared in initialize capabilities

3.3.6

— fix(#575): wp_upload_media_b64 now exposes mime_type in MCP schema; fix(#576): wp_update_menu_item errors include actionable ID-lookup hints; feat(#577): wp_list_media search param + image-reuse guidance; fix(#578): design-reference retry guidance in tool description and missing_image error

3.3.5

— feat: before/after change summary on wp_update_page/wp_update_post (changes[], unchanged[]); structural_changes on wp_set_elementor (sections/widgets before+after); fix(security): sslverify=false in CSS-prime loopback

3.3.4

— Fix(security): SSRF redirect bypass in wp_get_rendered_copy fetcher — redirection=0 was missing; redirect chains could bypass same-host allowlist

3.3.3

— Mutation tool schema docs: wp_create/update_page now documents parent/template/menu_order; wp_create/update_post documents categories and tags; fix(security): SSRF redirect bypass closed — fetchers pass redirection=0 to prevent redirect chains bypassing same-host allowlist

3.3.2

— New: wp_get_rendered_copy tool returns structured visible text from live rendered page (headings, paragraphs, button labels, list items, link text, image alts) — ground truth for copy audits (#569); Fix(security): sslverify=false in wp_get_rendered_html fixed

3.3.1

— New: wp_flush_cache tool flushes WP page cache (W3TC, WP Super Cache, LiteSpeed, WP Rocket, Breeze, Cloudflare) after bulk edits (#568); Elementor write tools surface validation_warnings in response (#571); Fix(security): batch sub-request rate-limit bypass via static flag, not HTTP header (#573); /onboard adds suggested_first_tools + quick_start (#574)

3.3.0

—

3.3.0

— Render-truth validation: every validator now has validation_basis + note; validate_structured_data fetches live JSON-LD from rendered page; validate_internal_links covers Elementor widget links; validate_blocks notes dynamic-render caveat; audit_seo_site shows per-URL basis (#569)

3.2.9

— New: validate_seo_readiness fetches live rendered <head> for published pages; issues reconciled against ground truth; rendered_head + validation_basis in response (#569)

3.2.8

— Fix: SEO readiness detects AIOSEO excerpt fallback (no false 'missing meta description'); apply_internal_link now checks Elementor data for existing links before inserting (#569)

3.2.7

— New: wp_bulk_upload_media tool for migrations (up to 20 URLs, one rate-limit count) (#566)

3.2.6

— REST Pro gate enforced (#564), dead hostname routing removed (#547), rate status identifier fix (#533)

3.2.5

3.2.4

3.2.3

3.2.2

3.2.1

3.2.0

3.1.0

3.0.1

3.0.0

2.8.56

2.8.55

2.8.54

2.8.53

2.8.52

2.8.51

2.8.50

2.8.49

2.8.48

2.8.47

2.8.46

2.8.45

2.8.44

2.8.43

2.8.42

2.8.41

2.8.40

2.8.38

2.8.37

2.8.36

" }