Skip to content

1.3.0

Latest
Latest

Choose a tag to compare

View all tags
@BobyKW BobyKW released this 24 Apr 20:08
1.3.0
266c3ef

WPGPT MCP Bridge v1.3.0

Overview

WPGPT MCP Bridge v1.3.0 builds on the standalone MCP and secure sandbox work from v1.2.0. The main goal of this release is to make the plugin easier to use with ChatGPT and other MCP clients when many abilities are enabled, while keeping the detailed internal security model intact.

Instead of exposing every detailed query, inspect and apply ability separately, WPGPT now exposes compact grouped abilities such as wpgpt/posts, wpgpt/media, wpgpt/settings and wpgpt/danger. This reduces discovery noise and helps avoid excessive MCP requests on hosting environments that rate-limit aggressively.

Highlights since v1.2.0

  • Added compact MCP ability discovery.
  • ChatGPT now sees one grouped ability per module instead of many detailed abilities.
  • Added action routing through action=query, action=inspect and action=apply.
  • Kept detailed abilities as the real internal security boundary.
  • Added compact wpgpt/danger facade for filesystem, sandbox and PHP actions.
  • Hardened compact execution so every action revalidates:
    • detailed ability allowlist;
    • WordPress user permissions;
    • Safe mode / read-only state;
    • filesystem read/write/delete permissions;
    • explicit deletion confirmation settings.
  • Improved the settings page with a compact discovery preview.
  • Compact preview now separates actions that are available from actions blocked by current permissions.
  • Aligned detailed ability category names with compact module names.
  • Moved the compact discovery preview into a collapsed-by-default section to reduce visual clutter.
  • Renamed confusing counters from “active” to “selected” where appropriate.
  • Improved delete exposure policy so deletion requires both the filesystem delete permission and explicit deletion confirmation.

Compact abilities

Examples of compact abilities exposed to MCP clients:

wpgpt/posts
wpgpt/drafts
wpgpt/terms
wpgpt/media
wpgpt/plugins
wpgpt/settings
wpgpt/users
wpgpt/database
wpgpt/danger

A compact ability accepts an action and parameters:

{
  "action": "query",
  "parameters": {}
}

Internally, WPGPT routes the request to the corresponding detailed ability, for example:

wpgpt/posts + action=query   -> wpgpt/posts-query
wpgpt/posts + action=inspect -> wpgpt/posts-inspect
wpgpt/posts + action=apply   -> wpgpt/posts-apply

Danger module

The wpgpt/danger compact ability groups advanced filesystem, sandbox and PHP actions.

Possible internal actions include:

list_directory
read_file
write_file
edit_file
delete_file
execute_php
disable_file
enable_file

These actions remain permission-controlled. For example, write/edit actions require filesystem write permission, deletion requires both delete permission and explicit deletion confirmation, and PHP execution remains a high-risk capability that should only be enabled for controlled maintenance.

Security notes

The compact discovery layer does not bypass security. It is a presentation and routing layer. The detailed allowlist and permission checks remain authoritative.

Dangerous operations should remain disabled unless needed. PHP execution is powerful and runs in WordPress context, not in a true OS-level sandbox.

Upgrade notes

  1. Upload and activate the plugin normally.
  2. Open WPGPT MCP in the WordPress admin sidebar.
  3. Review the MCP user.
  4. Review global permissions.
  5. Review selected detailed abilities.
  6. Open the compact discovery preview to confirm what ChatGPT will see.
  7. Reuse the existing MCP token; normal updates and ability changes do not require regenerating it.

Compatibility

  • WordPress 6.6+
  • PHP 8.1+
  • MCP Adapter is not required for the ChatGPT connection.
Assets 3
Loading