Skip to content

Releases: nipun-arora/wordpress-mcp-agent-bridge

Agent Bridge 1.0.6

Choose a tag to compare

@nipun-arora nipun-arora released this 31 Aug 16:29

Message and tooling release.

  • The additive-only gate's refusal message is now transport-aware: REST callers are told to send the hash in the X-Agent-Bridge-Confirm header, Abilities/MCP callers are told to send the confirm_hash input field. The gate's behavior is unchanged; only the wording a caller sees differs.
  • New docker/ demo: a single self-contained image that boots WordPress with the plugin and the official MCP Adapter and answers anonymous MCP introspection, so directory-listing checks can verify the server starts and responds.

Full changes in CHANGELOG.md.

Agent Bridge 1.0.5

Choose a tag to compare

@nipun-arora nipun-arora released this 31 Aug 15:19

Field-validation release. All eight MCP abilities are now validated end to end on a live production WordPress site through the official MCP Adapter, including the additive-only gate refusing an unconfirmed write over MCP. Fixes found live: registration hooks attach regardless of plugin load order, the nested meta.mcp.public flag is set for adapter builds that read only that key, a pre-0.4.0 hook-name fallback, and a registration diagnostics block in /health. See CHANGELOG.md.

Agent Bridge 1.0.0

Choose a tag to compare

@nipun-arora nipun-arora released this 31 Aug 14:07

Agent Bridge 1.0.0 is the first public release: a WordPress plugin that gives
Claude Code and other MCP agents a verified way to manage Rank Math SEO
fields, JSON-LD schema, content snapshots, and cache purges on self-hosted
WordPress, without ever touching Elementor layout data (pair it with EMCP
for that).

What you get:

  • Verified writes: every SEO and schema write is read back from the
    database before it is reported saved.
  • Stable content hashes on every snapshot-eligible post, and a restore that
    proves it converged instead of just claiming a snapshot existed.
  • An additive-only gate: content that predates the plugin's activation
    cannot be overwritten unless the caller proves it just captured the
    post's current state.
  • Kill switches in wp-config.php: disable everything, force read-only, or
    turn off just the MCP surface.
  • Abilities API registration: eight operations surface as MCP tools through
    the official WordPress MCP Adapter. Restore is deliberately excluded.

Before this release the plugin went through an adversarial security review
(four lenses, every finding challenged by two independent refuters). The
four consolidated fixes that came out of it ship in this version and are
listed in the CHANGELOG.

Known limits, stated plainly: Rank Math only for now, LiteSpeed-only cache
purge, and the MCP surface is contract-checked but awaiting first live
field validation. docs/COMPARISON.md holds a dated, sourced comparison
with the other tools in this space.