1.3.0 – Public read-only endpoint, no authentication

1.3.0

The MCP endpoint is now public and strictly read-only, and it returns only what a shop visitor can already see on the storefront. This release answers the WordPress.org plugin review.

Breaking change

• JWT and OAuth authentication were removed. The plugin no longer issues tokens and never signs in as a WordPress user. Reconnect clients with the endpoint URL alone: https://your-site.com/wp-json/wp/v2/wpmcp/streamable. Clients that still send an Authorization header keep working; the header is ignored.
• To stop access, switch off Enable MCP functionality, or switch individual tools off on the Tools tab.

Security

• Posts and pages tools no longer accept a status filter, so draft, private and password-protected content can no longer be requested.
• Reviews no longer include the reviewer's e-mail address; posts and pages no longer include the author's login or e-mail address.
• Unpublished products, and products hidden from the catalogue, are no longer returned by ID.
• Payment and shipping tools return only what checkout shows, not gateway or shipping method settings.
• Removed the system status tools and the public OpenAPI document (it included the admin e-mail address).

Removed

• Tool code that was implemented but never registered (custom post types, media, users, settings, site info, orders and reports, generic REST CRUD, WordPress Features adapter) and the create/update/delete switches.
• The generated mcp-proxy.js in the uploads directory; an existing copy and the old token options are deleted once on update.
• The firebase/php-jwt dependency.

Fixes

• wc_get_shipping_zones and wc_get_tax_classes failed with a class-not-found error.
• Tools reporting "not found" broke the JSON-RPC response; they now return an MCP result flagged isError.

The attached ZIP is the same 61 files as tags/1.3.0 on WordPress.org SVN (r3733282). It passes Plugin Check 2.1.0 with 0 errors and 0 warnings.