v0.5.0 — Pass-through proxy and 2026-07-28 support

The proxy now forwards MCP traffic between the client and WordPress unchanged, instead of running its own MCP server in between. The client and WordPress negotiate the protocol version directly, so newer clients, including 2026-07-28, work through the proxy. This release also fixes OAuth with a dynamically selected callback port, bounds OAuth and PAC waits, and identifies the client in the User-Agent.

Breaking changes

• Only standard MCP Adapter endpoints are supported. The simple-format protocol of the archived wordpress-mcp plugin, and the automatic fallback to it, are removed. A bare-domain WP_API_URL (for example https://example.com) now resolves to /?rest_route=/mcp/mcp-adapter-default-server instead of /wp/v2/wpmcp. A full endpoint URL is still used exactly as given. (#121)
• Expired sessions are passed to the client. If WordPress rejects the session, the client gets the error instead of the proxy re-running initialize on its own. (#121)
• /lib: the useJsonRpc argument of wpRequest is ignored, because every request is now JSON-RPC. While the proxy runs, wpRequest and tool-call hooks use the proxy's own connection. (#121)
• /lib: the minimum @modelcontextprotocol/sdk version is now ^1.26.0. (#121)

Upgrade notes

• The token store is namespaced by package version, so upgrading from 0.4.x to 0.5.0 requires users to authenticate again.
• With the implicit OAuth flow, the browser login must now finish within OAUTH_TIMEOUT_MS (default 30 seconds), the same limit the PKCE flow already used. Before, the implicit flow waited up to 5 minutes. (#104)

Changed

• Pass-through forwarding. Messages, _meta, request ID 0, unknown methods and server-to-client requests reach the other side unchanged. The proxy reads the initialize response only to send the negotiated MCP-Protocol-Version and the session ID on later requests. This fixes requests failing after initialize against MCP Adapter 0.7.0 because of a fixed MCP-Protocol-Version: 2025-06-18 header (#120). (#121)
• 2026-07-28 HTTP headers. For 2026-07-28 requests, the proxy builds MCP-Protocol-Version, Mcp-Method, Mcp-Name and Mcp-Param-* from the message body. It learns x-mcp-header tool annotations from the tools/list results it forwards. A notifications/cancelled for a pending 2026-07-28 request closes that request's HTTP stream. (#121)
• User-Agent. Requests to WordPress and the OAuth endpoints now send User-Agent: <client>/<version> mcp-wordpress-remote/<version>, with the client taken from its MCP clientInfo, instead of Node's default node. A User-Agent in CUSTOM_HEADERS still takes precedence. (#128, closes #111)

Fixed

• OAuth with a dynamic callback port. Client registration and the token exchange now use the port the callback server actually listens on, instead of a :0 placeholder that authorization servers rejected. A failed authorization attempt now releases the callback port, so the next attempt can start. (#108)
• Implicit OAuth no longer blocks initialize for 5 minutes when the browser callback never arrives, for example in a headless environment. The client gets the connectionFailed fallback response within OAUTH_TIMEOUT_MS. Waiting behind another process's auth lock uses the same limit. (#104, closes #103)
• PAC loading is bounded. On macOS, an unreachable PAC URL no longer stalls startup. The download gives up after PROXY_PAC_TIMEOUT_MS (default 5000) and the proxy falls back to the system SOCKS proxy or a direct connection. (#129)
• JSON-RPC errors that WordPress returns with a non-2xx HTTP status now reach the client as normal error responses. (#121)

New configuration

• OAUTH_TIMEOUT_MS: time to wait for the browser OAuth login (default 30000). (#104, #127)
• PROXY_PAC_TIMEOUT_MS: timeout for the PAC download and resolver setup (default 5000). (#129)

Dependencies were updated through Dependabot (#110, #112, #113, #114, #117, #118, #119, #122, #123, #124, #125, #126).

Contributors

Thanks to everyone who contributed to this release:

• @galatanovidiu: pass-through proxy (#121), User-Agent (#128), follow-ups (#127, #129)
• @lezama: OAuth callback port fix (#108)
• @erikiva: callback port selection before client registration and tests (#108)
• @chubes4: bounded implicit OAuth waits (#104) and the report in #103
• @Michelleeby: PAC timeout (#129, from #116)

And to the people who reported issues fixed here: @lhero-org (#120) and @alisadiq90 (#111).

Full changelog: v0.4.0...v0.5.0