v0.7.1

MCP Adapter 0.7.1

This maintenance release improves session reliability, fixes a plugin loading issue, and helps AI clients recover when they request an unavailable ability. It also adds a setup guide for site owners.

What’s Changed

• Session storage security fix. Initialization parameters stored per session are now limited to 4 KiB, preventing oversized data from causing repeated database failures and excessive logging. Existing oversized session data is automatically cleared; affected clients need to reconnect once. Client icons are excluded from storage so large inline icons do not prevent connections. (#386)
• Fix plugin loading alongside bundled copies. Register the installed plugin’s autoloader before checking for another copy, allowing version selection to run before an older bundled copy is loaded. (#366)
• Clearer errors for unavailable abilities. Unknown ability names now suggest relevant available abilities or point clients to discovery. Abilities that are not exposed through MCP receive the same response, and unknown names no longer generate WordPress developer notices. (#385)
• New site-owner setup guide. Step-by-step instructions cover connecting an AI client, creating an Application Password, testing the connection, and troubleshooting common problems. (#375)
• Release maintenance. Prevent releases below 0.7.0 from being deployed to WordPress.org. (#387)
• Development tooling updates. Update PHPStan, its PHP stubs, and @wordpress/env. (#372, #373)

Developer Notes

• Oversized HTTP session initialization returns JSON-RPC -32602 (Invalid params).
• clientInfo.icons is no longer retained for subsequent requests.
• An ability that is not exposed through MCP now returns ability_not_found instead of ability_not_public_mcp.

Contributors

Special thanks to Lauri Saarni (@saarnilauri) for discovering the security issue and helping review and test the fix in #386.

Thank you to everyone who contributed code, documentation, reviews, testing, bug reports, and feedback to this release:

@apeatling, @bacoords, @galatanovidiu, @gziolo, @jeffpaul, @justlevine, @lhero-org, @miriamschwab, @rebeccahum, @saarnilauri, and @webmyc.

Welcome to @webmyc, whose first contribution was the site-owner guide in #375!

Dependency updates were provided by @dependabot[bot].

Full changelog: v0.7.0…v0.7.1