Skip to content

v1.0.0 - First Stable Release

Latest
Latest

Choose a tag to compare

View all tags
@stephenfeather stephenfeather released this 28 Jan 19:32
· 4 commits to develop since this release
v1.0.0
e037f45
This commit was signed with the committer’s verified signature.
stephenfeather Stephen Feather
GPG key ID: 406E25A6D440B2E4
Verified
Learn about vigilant mode.

Release Notes: FA WPMCP v1.0.0

Release Date: 2026-01-28
Status: Stable Release (Production Ready)
Version: 1.0.0
Previous Version: 1.0.0-alpha.5

Summary

FA-WPMCP v1.0.0 is here - the first stable, production-ready release of the WordPress plugin that connects AI agents to WordPress via the Model Context Protocol (MCP).

This milestone release delivers 111+ abilities across 18 categories, providing comprehensive WordPress management capabilities to AI assistants like Claude, GPT, and Gemini. With 1,608 tests, 95% code coverage, and MEDIUM security risk (0 critical, 0 high severity issues), FA-WPMCP is ready for production deployment.

Key Highlights

  • Production Ready - First stable release after extensive alpha testing
  • Comprehensive Coverage - 111+ abilities across 18 categories
  • Extensive Testing - 1,608 tests with 95% code coverage
  • Security Hardened - Multi-layer security with rate limiting, PII redaction, and encrypted secrets
  • Standards Compliant - PSR-12, PHPStan level 8, PHP 8.1+ strict types
  • WordPress 6.9+ Compatible - Native Abilities API integration
  • MCP Standard - Full Model Context Protocol implementation

What's New in v1.0.0

Feature Complete

This stable release includes all features accumulated from the alpha series, delivering a complete WordPress management solution for AI agents.

WordPress Abilities (111+)

Posts & Pages (5 abilities)

  • Create, List, Get, Update, Delete operations
  • Universal post_type parameter supports pages, custom post types, WooCommerce products
  • Full metadata support, filtering, pagination, and search

Comments (11 abilities)

  • List, Get, Create, Update, Delete operations
  • Comment metadata management (get, set, delete, list)
  • Bulk moderation (approve, spam, trash)
  • Comment counts and reply threading
  • Full moderation workflow support

Media Library (5 abilities)

  • List, Get, Upload, Update, Delete operations
  • Base64 and URL upload support
  • Automatic thumbnail generation
  • MIME type filtering
  • SSRF protection for URL imports

Taxonomies (7 abilities)

  • List Terms, Get Term, Create Term, Update Term, Delete Term
  • List Taxonomies, Get Taxonomy
  • Hierarchical parent/child relationships
  • Works with categories, tags, and custom taxonomies

Post Types (2 abilities)

  • List Post Types, Get Post Type
  • Dynamic content type introspection
  • Discover custom post types at runtime

Users (5 abilities)

  • List, Get, Create, Update, Delete operations
  • Role filtering and assignment
  • User search (ID, username, email)
  • Avatar URLs and profile metadata
  • Content reassignment on deletion

Settings (4 abilities)

  • Get, Update, Delete, List Options
  • Protected options allowlist
  • Search filtering and pagination
  • Serialization handling

Plugins (7 abilities)

  • List, Get, Install, Activate, Deactivate, Update, Delete operations
  • Matches wp-cli plugin command conventions
  • Full plugin lifecycle management

Themes (7 abilities)

  • List, Get, Activate, Status, Install, Update, Delete operations
  • Matches wp-cli theme command conventions
  • Full theme lifecycle management

Privacy & GDPR (4 abilities)

  • Create Export Request, Create Erasure Request
  • List Privacy Requests, Get Privacy Request
  • WordPress privacy tools integration
  • Email confirmation workflow

Cache (3 abilities)

  • Flush Cache, Get Cache Status, Get Cache Type
  • Object cache management
  • Redis, Memcached detection

Maintenance Mode (3 abilities)

  • Activate Maintenance, Deactivate Maintenance, Get Status
  • Custom maintenance messages
  • Visitor-safe maintenance workflow

Transients (4 abilities)

  • Get, List, Set, Delete Transient
  • TTL management
  • Expiration tracking

Cron (6 abilities)

  • List, Get, Schedule, Unschedule, Run events
  • List Schedules
  • WP-Cron full management

Roles & Capabilities (5 abilities)

  • List, Get, Create, Update, Delete Roles
  • Add/remove capabilities per role
  • Custom role management
  • Default role protection

Menus (8 abilities)

  • List, Get, Create, Update, Delete Menus
  • Add, Update, Delete Menu Items
  • Hierarchical menu structures

Widgets (8 abilities)

  • List Sidebars, Get Sidebar, List Widget Types
  • List, Get, Add, Update, Delete, Move, Reset Widgets
  • Full sidebar and widget management

Dotenv (4 abilities)

  • List, Get, Set, Delete environment variables
  • .env file management
  • Sensitive key filtering

Config (3 abilities)

  • List, Get, Set configuration values
  • Dynamic config management
  • Read-only and protected options

Search & Replace (1 ability)

  • Search-Replace (dry-run only)
  • Database content search
  • Safe preview mode

Security Features

FA-WPMCP implements comprehensive security measures to protect WordPress sites while enabling AI agent access.

Access Control

Multi-Level Permission System

  • Global permissions (read/write)
  • Category-level permissions (posts, users, etc.)
  • Ability-level permissions (per-operation)
  • WordPress capability integration

Max API Role Configuration

  • Prevents high-privilege user creation via API
  • Configurable role ceiling (default: editor)
  • Enforced in CreateUser/UpdateUser abilities

Rate Limiting

Dual-Track Protection

  • Per-user limits (WordPress user ID)
  • Per-IP limits (anonymous requests)
  • Requests denied if EITHER limit exceeded
  • Prevents bypass via IP rotation
  • Configurable windows (minute, hour, day)
  • Transient storage with automatic expiration

Data Protection

PII Redaction in Activity Logs

  • 50+ sensitive field patterns redacted
  • Passwords, API keys, secrets protected
  • Email addresses, phone numbers masked
  • GDPR-compliant audit trail

IP Anonymization

  • IPv4: Last octet masked (192.168.1.100 → 192.168.1.0)
  • IPv6: Last 80 bits masked, /48 prefix preserved
  • Configurable via admin UI (default: enabled)
  • GDPR compliance

Webhook Secret Encryption

  • Secrets encrypted at rest
  • XChaCha20-Poly1305 (libsodium) encryption
  • AES-256-GCM fallback
  • Transparent decryption on delivery

Input Validation

SSRF Protection

  • Media URL import validates external URLs
  • Blocks localhost, loopback, private IP ranges
  • Validates URL scheme (http/https only)
  • Resolves hostname before IP validation

Option Name Validation

  • sanitize_key() enforcement
  • 191-character length limit
  • Prevents malformed option keys

Comment Content Sanitization

  • wp_kses_post() XSS protection
  • HTML filtering for safe content
  • Preserves formatting, removes scripts

Monitoring & Audit

Activity Logging

  • Correlation IDs for request tracking
  • User and anonymized IP logging
  • Input/output capture (with PII redaction)
  • Execution time tracking
  • Database-backed persistence

Webhook System

  • HMAC-SHA256 signature signing
  • Payload integrity verification
  • Before/after/failed execution hooks
  • Retry logic with exponential backoff

Security Warnings

Insecure Salt Warning

  • Admin notice for misconfigured salts
  • Detects empty or default salt values
  • Links to WordPress salt generator
  • Prevents webhook encryption failures

Requirements

Minimum Requirements

  • PHP: 8.1 or higher (8.2+ recommended)
  • WordPress: 6.9 or higher (Abilities API required)
  • Composer: For dependency management

PHP Extensions

  • sodium - For webhook secret encryption (preferred)
  • openssl - Fallback encryption support
  • json - JSON encoding/decoding
  • mbstring - Multibyte string handling

Server Requirements

  • Memory: 128MB+ PHP memory limit
  • Storage: 10MB+ for plugin files
  • Database: MySQL 5.7+ or MariaDB 10.3+

Installation

Fresh Installation

# 1. Clone into WordPress plugins directory
cd wp-content/plugins
git clone https://github.com/featherart/fa-wpmcp.git
cd fa-wpmcp

# 2. Install PHP dependencies
composer install --no-dev

# 3. Activate plugin
wp plugin activate fa-wpmcp

Configuration

1. Set WordPress Salts (Required)

Ensure your wp-config.php has unique salts. Generate at https://api.wordpress.org/secret-key/1.1/salt/

2. Configure Permissions (Settings > FA WPMCP)

  • Enable global read/write permissions
  • Configure category-level permissions
  • Set max API role (default: editor)

3. Configure Rate Limiting

Default limits:

  • 60 requests/minute per user
  • 60 requests/minute per IP

Customize via filter:

add_filter('fa_wpmcp_rate_limit_config', function($config) {
    $config['default']['per_minute'] = 120;
    return $config;
});

4. Enable MCP Server

Install MCP client (Claude Desktop, Continue, etc.) and configure WordPress server. See MCP Client Configuration.

Migration from Alpha

Upgrading from v1.0.0-alpha.5

cd wp-content/plugins/fa-wpmcp

# 1. Pull latest code
git fetch origin
git checkout v1.0.0

# 2. Update dependencies
composer install --no-dev

# 3. Clear object cache (if using persistent cache)
wp cache flush

No database migrations required - existing configurations preserved.

Breaking Changes

None - v1.0.0 is fully backward compatible with all alpha releases.

Deprecations

None - all alpha features remain supported.

New Features Since Alpha.5

  • Insecure salt warning system
  • Menu abilities (8 abilities)
  • Widget abilities (8 abilities)
  • Config abilities (3 abilities)
  • Search-replace ability (dry-run)
  • Comment metadata abilities (4 abilities)
  • Enhanced comment moderation

Testing & Quality

Test Coverage

composer test

Overall Results:

  • Total Tests: 1,608
  • Passing: 1,608 (100%)
  • Failures: 0
  • Assertions: 3,500+
  • Line Coverage: 95%

Code Coverage

composer test:coverage
# View at tests/coverage/index.html

Coverage Metrics:

  • Lines: 95%
  • Methods: 97%
  • Classes: 98%

Code Quality

# PSR-12 compliance check
composer phpcs

# Static analysis (PHPStan level 8)
composer phpstan

Results:

  • ✅ PSR-12: 100% compliant
  • ✅ PHPStan: Level 8 passing (no errors)
  • ✅ Strict Types: All files have declare(strict_types=1)
  • ✅ Type Coverage: 100% parameter and return types

Security Audit

Overall Risk Level: MEDIUM
Findings: 0 critical, 0 high, 3 medium (mitigated), 4 low

MEDIUM Severity Issues (All Mitigated):

  1. ✅ Webhook secret storage - Encrypted at rest
  2. ✅ IP address anonymization - GDPR-compliant masking
  3. ✅ Rate limit bypass - Dual-track (IP + user) protection

LOW Severity Issues (Planned for v1.1.0):

  • HTTPS enforcement for webhook URLs (warning issued)
  • Enhanced webhook URL validation
  • User password strength validation
  • IP geolocation for anomaly detection

Documentation

Quick Links

Document Purpose
Quick Start Guide Get connected in 5 minutes
MCP Client Configuration Claude, GPT, Gemini setup
Configuration Options, filters, constants
Architecture System design and components
Development Adding abilities, testing
Security Security guidelines
REST API Complete API reference
MCP Documentation MCP integration reference

Getting Started

  1. Install FA-WPMCP - Follow installation instructions above
  2. Configure MCP Client - See MCP Client Configuration
  3. Set Permissions - Configure in Settings > FA WPMCP
  4. Test Connection - Try listing posts via your AI assistant
  5. Explore Abilities - See MCP Ability Tests for examples

Roadmap

v1.0 Complete ✅

  • ✅ 111+ abilities across 18 categories
  • ✅ Multi-level permission system
  • ✅ Dual-track rate limiting
  • ✅ PII redaction and IP anonymization
  • ✅ Webhook secret encryption
  • ✅ Comprehensive testing (1,608 tests)
  • ✅ Production-ready security posture

v1.1.0 (Planned Q1 2026)

Security Enhancements:

  • HTTPS enforcement for webhook URLs
  • Enhanced webhook URL validation
  • User password strength validation
  • IP geolocation for anomaly detection

Performance:

  • Bulk operations (batch create/update/delete)
  • Query optimization for large datasets
  • Cache warming strategies

Observability:

  • Prometheus metrics endpoint
  • Enhanced activity log search UI
  • Webhook retry dashboard
  • Real-time monitoring integration

v1.2.0 (Planned Q2 2026)

Features:

  • Multisite support
  • GraphQL endpoint (optional)
  • Advanced permission templates
  • Custom post type scaffolding abilities

Developer Experience:

  • REST API v2 with improved pagination
  • WebSocket support for real-time events
  • Enhanced error messages
  • CLI commands for testing

Contributors

This release was developed through AI-assisted pair programming using:

  • Claude Sonnet 4.5 - Primary development assistant
  • Test-Driven Development (TDD) - All features test-first
  • Professional Standards - PSR-12, PHPStan level 8, strict types
  • Security-First - Comprehensive audit with documented findings
  • SonarQube Integration - Code quality metrics and compliance

Development Methodology:

  • Write tests first, then implementation
  • 100% type coverage with PHP 8.1+ features
  • Static analysis (PHPStan level 8)
  • Code standards enforcement (PSR-12)
  • Security audit on every release

Special Thanks:

  • WordPress Abilities API team for the extensible framework
  • Model Context Protocol (MCP) specification authors
  • Action Scheduler by Automattic
  • Brain\Monkey testing library maintainers
  • SonarQube for code quality analysis

Support

Getting Help

Documentation:

  • Check docs/ directory first
  • Search GitHub issues
  • Review test files for usage examples

Community:

Reporting Issues

For Bugs:

  • Open GitHub issue with bug label
  • Include WordPress version, PHP version, error logs
  • Provide steps to reproduce

For Feature Requests:

  • Open GitHub issue with enhancement label
  • Describe use case and expected behavior
  • Consider contributing a PR

For Security Vulnerabilities:

  • DO NOT open public GitHub issues
  • Email: stephen@feather.us with "SECURITY" in subject
  • PGP key available on request
  • Responsible disclosure: 90-day window

Changelog

Added (Cumulative from Alpha Series)

Abilities:

  • Posts & Pages (5 abilities)
  • Comments (11 abilities including metadata)
  • Media (5 abilities)
  • Taxonomies (7 abilities)
  • Post Types (2 abilities)
  • Users (5 abilities)
  • Settings (4 abilities)
  • Plugins (7 abilities)
  • Themes (7 abilities)
  • Privacy (4 abilities)
  • Cache (3 abilities)
  • Maintenance (3 abilities)
  • Transients (4 abilities)
  • Cron (6 abilities)
  • Roles (5 abilities)
  • Menus (8 abilities)
  • Widgets (8 abilities)
  • Dotenv (4 abilities)
  • Config (3 abilities)
  • Search-Replace (1 ability)

Security:

  • Multi-level permission system
  • Dual-track rate limiting (IP + user)
  • PII redaction (50+ fields)
  • IP anonymization (GDPR)
  • Webhook secret encryption
  • SSRF protection
  • Max API role configuration
  • Insecure salt warning

Monitoring:

  • Activity logging with correlation IDs
  • Webhook system with HMAC signing
  • File error logging (optional)
  • MCP observability handler

Quality:

  • 1,608 tests with 95% coverage
  • PSR-12 coding standards
  • PHPStan level 8 static analysis
  • Comprehensive documentation

Changed

  • README restructured for user focus (791→237 lines)
  • Applied 63,796+ PSR-12 formatting fixes
  • Reduced cognitive complexity across codebase
  • Domain-specific exception hierarchy
  • MCP adapter auto-installed in Docker test environment

Fixed

  • 9 risky tests: added explicit assertions
  • PHPCS errors in Config abilities
  • Comment content XSS protection
  • Type errors in ListPrivacyRequests, ListUsers
  • Schema type mismatches in 4 abilities
  • Webhook event naming consistency

Security

  • Risk Level: MEDIUM (0 critical, 0 high, 3 medium mitigated, 4 low)
  • All HIGH and MEDIUM severity issues resolved
  • Production-ready security posture
  • Comprehensive audit documentation

Acknowledgments

  • WordPress Abilities API Team - For the extensible framework
  • Model Context Protocol (MCP) - For the standardized interface
  • Anthropic - For Claude Sonnet 4.5 AI assistant
  • Action Scheduler - For reliable webhook queue processing
  • Brain\Monkey - For WordPress testing framework
  • PHPStan - For static analysis excellence
  • SonarQube - For code quality analysis

License

GPL v2 or later
https://www.gnu.org/licenses/gpl-2.0.html

Thank you for using FA WPMCP v1.0.0!

This stable release delivers production-ready WordPress management for AI agents. With 111+ abilities, 1,608 tests, 95% coverage, and comprehensive security, FA-WPMCP is ready for production deployment.

Next Steps

  1. Install v1.0.0 - Follow installation instructions above
  2. Configure MCP - Set up your AI assistant
  3. Explore Abilities - Try the 111+ WordPress operations
  4. Join Community - Report bugs, request features, contribute

For questions, suggestions, or contributions, please open a GitHub issue or contact stephen@feather.us.

Version: 1.0.0 | Abilities: 111+ | Test Coverage: 95% | Security Risk: MEDIUM | Status: Stable (Production Ready)

Assets 3
Loading