Update/mcp actor by eoigal · Pull Request #47223 · Automattic/jetpack

eoigal · 2026-02-19T12:14:18Z

Related to https://linear.app/a8c/issue/AI-890/add-user-facing-activity-log-for-mcp-tool-executions

Proposed changes:

Enriches sync actor from X-WPCOM-MCP header by decoding base64 JSON, sanitizing client name/version, and marking is_mcp_agent when either is present.

Other information:

Have you written new tests for your changes, if applicable?
Have you checked the E2E test CI results, and verified that your changes do not break them?
Have you tested your changes on WordPress.com, if applicable (if so, you'll see a generated comment below with a script to run)?

Jetpack product discussion

Does this pull request change what data or activity we track or use?

Testing instructions:

Test on simple with 204134-ghe-Automattic/wpcom

Changelog

Generate changelog entries for this PR (using AI).

github-actions · 2026-02-19T12:15:20Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack or WordPress.com Site Helper), and enable the update/mcp-actor branch.
To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack update/mcp-actor

bin/jetpack-downloader test jetpack-mu-wpcom-plugin update/mcp-actor

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

github-actions · 2026-02-19T12:15:23Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add a "[Status]" label (In Progress, Needs Review, ...).
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
You can use GitHub's Reviewers functionality to request a review.
When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

Copilot

Pull request overview

This PR extends Jetpack Sync’s actor metadata to include MCP client details from a request header, so Sync events can be attributed to MCP-based clients when present.

Changes:

Parse HTTP_X_WPCOM_MCP (base64 JSON) and add mcp_client_name, mcp_client_version, and is_mcp_agent to the actor payload.
Add a Sync package changelog entry describing the new actor metadata.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`projects/packages/sync/src/class-listener.php`	Adds MCP header decoding and populates MCP-related fields on the Sync actor.
`projects/packages/sync/changelog/update-mcp-actor`	Adds a changelog entry for the MCP actor metadata change.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

projects/packages/sync/changelog/update-mcp-actor

jp-launch-control · 2026-02-19T12:29:49Z

Code Coverage Summary

Coverage changed in 1 file.

File	Coverage	Δ%	Δ Uncovered
projects/packages/sync/src/class-listener.php	32/176 (18.18%)	-1.57%	14 💔

Full summary · PHP report · JS report

_{Coverage check overridden by

I don't care about code coverage for this PR
Use this label to ignore the check for insufficient code coveage.
.}

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

projects/packages/sync/src/class-listener.php

sergeymitr

Works well 👍

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-19T17:09:27Z

projects/packages/sync/src/class-listener.php

+		$raw_mcp_header = '';
+		if ( isset( $_SERVER['HTTP_X_WPCOM_MCP'] ) && is_string( $_SERVER['HTTP_X_WPCOM_MCP'] ) ) {
+			$raw_mcp_header = trim( wp_unslash( $_SERVER['HTTP_X_WPCOM_MCP'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization happens below.
+		}
+
+		if ( ! empty( $raw_mcp_header ) && preg_match( '/^[A-Za-z0-9+\/=]+$/', $raw_mcp_header ) ) {
+			// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Decoding MCP header payload.
+			$decoded = base64_decode( $raw_mcp_header, true );
+			if ( false !== $decoded ) {
+				$mcp_data = json_decode( $decoded, true );


HTTP_X_WPCOM_MCP is fully user-controlled and currently gets preg_match/base64_decode/json_decode applied without any explicit size limit. Even with typical web server header limits, this can still be abused to increase CPU/memory usage during sync-triggering requests. Consider adding a conservative max length check on the raw header (and/or decoded JSON) before attempting regex/decode, and bail out early if it exceeds that limit.

Copilot · 2026-02-19T17:09:28Z

projects/packages/sync/src/class-listener.php

+					if ( isset( $mcp_data['mcp_client_name'] ) && is_string( $mcp_data['mcp_client_name'] ) ) {
+						$actor['mcp_client_name'] = sanitize_text_field( $mcp_data['mcp_client_name'] );
+					}
+					if ( isset( $mcp_data['mcp_client_version'] ) && is_string( $mcp_data['mcp_client_version'] ) ) {
+						$actor['mcp_client_version'] = sanitize_text_field( $mcp_data['mcp_client_version'] );
+					}
+					if ( ! empty( $actor['mcp_client_name'] ) || ! empty( $actor['mcp_client_version'] ) ) {
+						$actor['is_mcp_agent'] = true;
+					}


sanitize_text_field() removes unsafe characters but doesn’t enforce a maximum length. Since these values are added to every actor payload, a long mcp_client_name/mcp_client_version could bloat sync data and activity logs. Consider truncating these sanitized strings to a reasonable max length before assigning them into $actor.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

eoigal requested a review from a team as a code owner February 19, 2026 12:14

Copilot AI review requested due to automatic review settings February 19, 2026 12:14

Copilot started reviewing on behalf of eoigal February 19, 2026 12:14 View session

github-actions bot added the [Package] Sync label Feb 19, 2026

github-actions bot added the [Status] Needs Author Reply We need more details from you. This label will be auto-added until the PR meets all requirements. label Feb 19, 2026

Copilot AI reviewed Feb 19, 2026

View reviewed changes

projects/packages/sync/changelog/update-mcp-actor Outdated Show resolved Hide resolved

eoigal added [Status] Needs Review This PR is ready for review. and removed [Status] Needs Author Reply We need more details from you. This label will be auto-added until the PR meets all requirements. labels Feb 19, 2026

Copilot AI review requested due to automatic review settings February 19, 2026 13:18

Copilot started reviewing on behalf of eoigal February 19, 2026 13:18 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

projects/packages/sync/src/class-listener.php Outdated Show resolved Hide resolved

sergeymitr previously approved these changes Feb 19, 2026

View reviewed changes

eoigal dismissed sergeymitr’s stale review via ea2712c February 19, 2026 17:05

Copilot AI review requested due to automatic review settings February 19, 2026 17:05

Copilot started reviewing on behalf of eoigal February 19, 2026 17:05 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

eoigal and others added 4 commits February 19, 2026 22:09

MCP: enrich actor

fef4a16

Add changelog entries.

d8b6049

Update projects/packages/sync/changelog/update-mcp-actor

b33d3b8

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update projects/packages/sync/src/class-listener.php

f103263

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

eoigal force-pushed the update/mcp-actor branch from ea2712c to f103263 Compare February 19, 2026 22:10

eoigal added the I don't care about code coverage for this PR Use this label to ignore the check for insufficient code coveage. label Feb 19, 2026

eoigal merged commit e228211 into trunk Feb 19, 2026
93 checks passed

eoigal deleted the update/mcp-actor branch February 19, 2026 22:40

github-actions bot removed the [Status] Needs Review This PR is ready for review. label Feb 19, 2026

fgiannar mentioned this pull request Feb 20, 2026

Sync: Minor fix for get_actor #47244

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update/mcp actor#47223

Update/mcp actor#47223
eoigal merged 4 commits intotrunkfrom
update/mcp-actor

eoigal commented Feb 19, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 19, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

jp-launch-control bot commented Feb 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

sergeymitr left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 19, 2026

Uh oh!

Copilot AI Feb 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

eoigal commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes:

Other information:

Jetpack product discussion

Does this pull request change what data or activity we track or use?

Testing instructions:

Changelog

Uh oh!

github-actions bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

jp-launch-control bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

sergeymitr left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eoigal commented Feb 19, 2026 •

edited

Loading

github-actions bot commented Feb 19, 2026 •

edited

Loading

github-actions bot commented Feb 19, 2026 •

edited

Loading

jp-launch-control bot commented Feb 19, 2026 •

edited

Loading