WSP MCP – AI Agents Connector

Changelog

2.6.7

• Fixed: The “Copy” buttons on the MCP > Connection page did nothing on sites served over plain HTTP (such as local development hosts). The browser Clipboard API is only available in a secure context (HTTPS or localhost), so the copy now falls back to a hidden textarea when it is unavailable. All six client tabs are fixed.
• Changed: Each ability group header now shows a green “N Enabled” and a red “N Disabled” pill instead of a single “enabled / total” badge, so partially-enabled groups are obvious at a glance. Counts update live as you flip switches.
• New: Sidebar cards on the MCP > Settings and MCP > Connection pages linking to our video tutorials and the full abilities directory at freewordpressmcp.com.
• Compatibility: Verified against WordPress 7.0.3. No plugin changes were required — the kses and HTTP URL-validation fixes in that release are inherited through core APIs. Because this plugin exposes tools to AI agents, we recommend running WordPress 7.0.3 or 6.9.6+ so the SSRF and CSS-injection fixes are in place.

2.6.6

• New: Direct file upload for media. wsp_upload_media (Upload Media) now accepts base64 file content via a new data parameter — an MCP client can upload a file attached to the chat straight into the media library without first hosting it at a public URL. The url parameter still works as before; pass either one. An optional mime_type hint and data: URI prefixes are supported. Only image types (jpg, png, gif, webp) are allowed, decoded bytes are written through media_handle_sideload(), and the tool still requires upload_files. Fixes GitHub #17.

2.6.5

• New: Elementor Advanced Design Tools — 11 tools for high-fidelity design workflows: get/update active kit, regenerate CSS, get widget schema, duplicate/move element, convert CSS to Elementor settings, get/update page settings, copy styles, and get breakpoints. All off by default under the “Elementor” group. Security: write tools run settings through wsp_elementor_sanitize_settings() (strips custom_css, custom_attributes, and dynamic keys); update-active-kit and regenerate-css require manage_options, the rest require edit_posts.

2.6.4

• New: WPForms suite — 12 tools (Lite and Pro) covering forms (list, get, describe-schema, get-form-stats, create, update-settings, add-field, update-field, delete) and Pro entries (list, get, delete). All write tools off by default under the “WPForms” group; only registered when WPForms is active. Uses WPForms’ native capabilities: wpforms_view_forms / wpforms_edit_forms for forms and wpforms_view_entries / wpforms_edit_entries for entries.

2.6.3

• New: Contact Form 7 suite — 10 tools covering forms (list, get, create, update, delete), Flamingo entries (list, get, moderate), form validation, and integrations status. All write tools off by default under the “Contact Form 7” group; only registered when CF7 is active. Uses CF7’s native capabilities wpcf7_edit_contact_forms and wpcf7_delete_contact_forms; get-integrations requires manage_options.

2.6.2

• Docs: documented the complete 18-tool Gravity Forms suite (forms, entries, notifications, confirmations) across the readme, plugin docs, and changelog; the 2.6.1 notes under-reported it as 11 tools and omitted the notification, confirmation, and form-settings write tools. Corrected the capability name to gravityforms_create_form. No behavioral code changes.

2.6.1

• New: Gravity Forms suite — 18 tools covering forms (list, get, create, update, delete, update settings), entries (list, get, update, delete with trash/permanent), notifications (get, create, update, delete), and confirmations (get, create, update, delete). All write tools are off by default; list-forms and get-form are on by default. Uses Gravity Forms’ own granular capabilities (gravityforms_edit_forms, gravityforms_create_form, gravityforms_view_entries, etc.). Only registered when Gravity Forms is active (class_exists('GFAPI')).
• Docs: added a video tutorial to the plugin description and three connection walkthrough videos (OpenClaw, Google Antigravity 2.0, Codex) to the FAQ.

2.6.0

• New: Ultimate Addons for Elementor (UAE) tool suite — 45 tools covering widgets (list, check usage, activate, deactivate, bulk toggle), templates (list, get, create, duplicate, update, trash, restore Header/Footer/Blocks templates), layout building (add sections, add columns, move elements, build from JSON), and settings (UAE settings, theme info, extensions, design-system tokens). All off by default and only registered when UAE is active.
• Fixed: adding an Elementor column no longer creates a container instead — the type validation in the add-container handler now accepts the column type.
• Security: all UAE string inputs are sanitized with wp_kses_post(); each tool enforces a strict capability check (edit_posts, publish_posts, or manage_options).

2.5.0

• New: Full media library tool suite. Adds six media tools — List Media (browse/search by type, keyword, or date), Count Media (counts grouped by MIME type plus a total), Update Media (title, alt text, caption, description), Delete Media (permanent), Upload Media (from a URL), and Upload Media From URL — and repurposes Get Media to return the full metadata of a single attachment by ID. Every tool is off by default and toggled from MCP > Settings.

2.4.1

• Security: ACF field-value write tools no longer accept raw code. Every value written via update_field() — for posts, users, terms, and options — is now recursively sanitized (arrays walked; each string run through wp_kses_post()) so <script>/<style> and inline event handlers can no longer be stored through the MCP tools. Legitimate WYSIWYG/HTML field content still works. Addresses the WordPress.org “arbitrary code insertion” review finding.

2.4.0

• New: OpenCode connection tab on the MCP > Connection page — a sixth copy-paste config snippet joining Claude Desktop, Cursor, Codex, Antigravity, and OpenClaw. OpenCode connects natively over remote HTTP (no Node.js bridge); the snippet is a full ~/.config/opencode/opencode.json file with the API key inlined in the header, ready to create and paste.

2.3.1

• Security: Elementor write tools no longer accept raw code. Code-bearing widget types (HTML, Shortcode, Code) are rejected, code-bearing settings (Custom CSS, Custom Attributes) are stripped, and all text settings are sanitized with wp_kses_post() so scripts cannot be injected via _elementor_data.
• Security: ACF options-page value reads now require manage_options (was edit_posts), matching the admin-level nature of global options.
• Removed: unused legacy wsp_register_acf_abilities() dual-mode registration helper (dead code, not hooked).
• Changed: Requires at least now uses the major-only WordPress version format (6.9).

2.3.0

• New: 27 Advanced Custom Fields tools — field groups (list, get, create, update, delete, import), fields (list, get, create, update, delete, duplicate, sync), values with dot-notation deep get/set (delete, get-all, bulk-update, field object), custom post types, taxonomies, and options pages.
• All ACF tools are off by default and only registered when ACF is active. Structural changes (groups, fields, CPTs, taxonomies, options pages) require manage_options; value reads/writes enforce per-object capabilities (edit_post, edit_user, list_users, manage_categories, manage_options).
• Changed: plugin slug renamed to wsp-mcp-ai-agents-connector (folder, main file, and text domain) to match the public name ahead of WordPress.org submission.
• Breaking: the plugin folder name changed — on existing installs, remove the old copy and activate the renamed plugin. Saved settings, the sessions table, and the API key are preserved.

2.2.0

• Removed: the MCP > Config Files page and the legacy dual-mode Abilities-API / mcp-adapter registration path. The plugin is now native-only.
• Changed: bookmarks to the old Config Files page now redirect to MCP > Connection.
• Breaking: connections made before v2.0 through the WordPress MCP Adapter must be re-created using the native endpoint on MCP > Connection.

2.1.0

• New: 15 WooCommerce tools — products (list, get, create, create variation, update), orders (list, update status, refund), coupons (create, list), order notes, customers, sales report, low-stock alerts, and review moderation.
• All WooCommerce tools are off by default and only registered when WooCommerce is active.
• Financial and PII tools (refund, customers, coupons) require the manage_woocommerce capability.
• Product/variation image URLs are sideloaded safely; SSL bypass is scoped to the single request and environment-gated.

2.0.0

• New: built-in native MCP server — no companion plugin or WordPress MCP Adapter required.
• New: MCP > Connection page with endpoint URL, API key, and per-client config tabs for Claude Desktop, Cursor, Codex, Antigravity, and OpenClaw (native, no adapter).
• New: Application Password + API key authentication; per-tool capability enforcement.
• New: DB-backed session store with daily cleanup.
• Improved: MCP > Settings groups are now collapsible accordions with live enabled/total counts.
• Dual-mode: existing Abilities-API connections keep working when that transport is present.

1.3.0

• Added Yoast SEO abilities (read/update SEO title, meta description, focus keyphrase).

1.2.1

• Added OpenClaw tab to the Config Files page.

1.2.0

• Elementor abilities, modular architecture, auto config generator.