Zavino 0.1.0

First release.

Install: download zavino-0.1.0.zip below → Plugins → Add New → Upload Plugin → Activate → open Zavino → Connect.

claude mcp add --transport http mysite https://example.com/wp-json/zavino/v1/mcp

What is in this release

• MCP server — Streamable HTTP + JSON-RPC 2.0, stateless, with resources and prompts as well as tools
• OAuth 2.1 — mandatory S256 PKCE, dynamic client registration, refresh-token rotation, audience binding (RFC 9728 / 8414 / 8707 / 9207); API keys and application passwords as fallbacks
• Reversible by construction — snapshot before every write, dry_run on every destructive tool, one-click revert on every logged change
• Elementor engine — reads your site live widget registry so generated layouts only use widgets that exist here; stable element paths for targeted edits
• Persian typography — ZWNJ, Arabic-to-Persian letterforms, digits, spacing, slug transliteration
• Bilingual EN/FA with real RTL, including the tool descriptions the model reads
• Ten-check connection self-test that names the failure and shows the fix
• Developer Mode — PHP, WP-CLI and file editing, off by default behind two gates, with automatic rollback if a write breaks the site
• Chat inside WordPress, an instruction store, and WP-Cron automation

Not shipped yet

WooCommerce tools, dedicated SEO write tools, block editor tools, and multilingual translation linking. The hooks are in place; see the README.

Verified and not verified

The code passes static validation and a full adversarial security audit (findings fixed before release). It has not yet been run against a live WordPress install — please report anything you hit.