Skip to content

v1.31.0

Choose a tag to compare

View all tags
@BenKalsky BenKalsky released this 20 Aug 15:34
· 7 commits to main since this release
v1.31.0
fe17bfb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release. Recommended for every site, and important if you run this plugin without SiteAgent.

Sites on 1.30.0 are offered this automatically through the self-updater.

What 1.30.0 did not cover

1.30.0 closed the "second door" — this plugin's write tools being callable from any other MCP server installed on the same site — with two guards:

  • At registration, write tools declare meta.mcp.type = 'private', which a co-installed server reads and refuses to serve.
  • At execute, a governed write arriving from anywhere but this plugin's own MCP server must carry a valid approval grant.

The second of those lives in the SiteAgent governance wrapper, which does nothing when SiteAgent is absent. So on a standalone install, the metadata was the whole protection — and it depends on the other plugin continuing to honour that convention. That is a bet, not a posture.

What this release adds

A write-capable tool is now refused at the permission stage, on every site, when the caller is not on this plugin's own MCP server, WP-CLI, or a non-REST context. No other plugin has to cooperate for it to hold.

  • Presence, not verification. The gate checks that a grant is present and lets the governance layer verify it once. Verifying in both places would burn the grant's single-use nonce and reject the legitimate call on its own approval. Where no verifier is installed, a foreign write is refused outright rather than accepted on a header nothing can check.
  • It wraps, never replaces. The tool's own capability check still runs, and runs last — so this can only ever deny more than before.

What is unaffected

  • Read tools. An assistant on another server answering "what is on this page" from this plugin's data is the entire point of the read-only bridge.
  • Dry runs. A preview-capable tool called with apply falsy writes nothing, so there is nothing to approve — exempt here, as it already was at execute time.
  • elementor_mcp_expose_writes_to_foreign_mcp. The documented escape hatch works exactly as before: a write you open through it stays reachable, and server-info names the ones you opened.

Diagnostics

server-info reports the two guards separately, so a standalone site is described as closed rather than exposed — it says that no grant can be verified there and that foreign servers are refused outright, instead of implying a gap that no longer exists.

Verification

1145 tests. Each guard was confirmed by reverting it and watching its own tests fail.

Full detail in CHANGELOG.md.

Assets 3
Loading