Site Agent 0.5.1

Site Agent 0.5.1 fixes issues found in the 0.5.0 bug sweep.

• Protect OAuth refresh and revocation from concurrent writes, bind credentials to the issuing site, and retain replay detection across refresh generations.
• Preserve omitted fields in staged edits, honor native metadata permissions and sanitizers, and run complete-save hooks after metadata and terms are applied.
• Coordinate file changes by pathname and preserve later edits during rollback.
• Keep Unicode output valid, preserve JSON object shapes and literal media metadata, and handle unavailable process termination safely.
• Preserve previous ZIPs and checksum files after interrupted package builds; require disposable fixture proof before HTTP mutation tests.

The WordPress plugin is site-agent-0.5.1.zip. The optional site-agent-companion-0.5.1.zip is for compatible AI clients and is not installed in WordPress. Features remain available without a license; licensing controls automatic updates only.

Validated with 134 PHP integration tests / 1,396 assertions, 37 JavaScript/Python tests, native package installation, HTTP MCP checks, coding standards and generated artifact checks. See the repository release receipt for CI and licensed delivery verification.

Site Agent 0.5.0

Site Agent now includes built-in workflow guides for MailerHive, Core Support, FluentCart, GT Extensions for FluentCart, Stackless for WooCommerce and GT Page Blocks Builder (PBB).

• Discover installed plugin versions, active state and matching skills through site-context.
• Read the six new guides through list-skills and get-skill; active plugins keep their more detailed workflow skills.
• Follow native APIs, module checks, content hashes, revisions and verification steps. Execution tools retain their existing explicit opt-ins.
• The updated companion directs compatible AI clients to these workflows.

WordPress installation: use site-agent-0.5.0.zip.

Optional AI-client package: site-agent-companion-0.5.0.zip contains the client workflow skill, icons and a credential-free MCP connection currently configured for gauravtiwari.org. It is not a WordPress plugin. Existing connected clients can use the bundled guides without this companion.

Validation: WordPress integration tests, JavaScript tests, coding standards, PHP syntax, Composer/runtime freshness, translation and skill validation, and both package builds. Plugin-specific external mail and payment providers were not exercised by the discovery tests.

Site Agent 0.4.2

• Fixed: OAuth sign-in failed with "Sorry, you are not allowed to access this page" in clients that add their parameters to the authorization address with a second ?, such as Grok. The advertised authorization endpoint is now /wp-json/site-agent/v1/oauth/authorize, which has no query string and forwards to the consent screen. The old consent address repairs such requests, for clients that saved it earlier.

Install site-agent-0.4.2.zip. site-agent-companion-0.4.2.zip is the optional ChatGPT/Codex companion.

Full changelog

Site Agent 0.4.1

• OAuth connections are on by default. Sites that never changed the setting get them as soon as Site Agent is enabled; a site that turned them off keeps its choice.
• Tools → Site Agent leads with connecting through OAuth and moves Application Passwords to a "not recommended" section with a warning. It also warns when OAuth is off, when URL authentication is on, and when Application Passwords made tool calls in the last 30 days.
• site-context reports how the connection authenticated. For an Application Password or an authenticated URL it carries a warning that agents pass on, asking the user to reconnect with OAuth.
• Tools → Site Agent lists the plugins that give agents their own skill (GT Extensions for FluentCart, GT Page Blocks Builder and GT Link Manager) and shows which are active here.
• Fixed: list-skills showed plugin skill descriptions with their YAML quotes.

Install site-agent-0.4.1.zip. site-agent-companion-0.4.1.zip is the optional ChatGPT/Codex companion.

Full changelog

Site Agent 0.4.0

Adds OAuth connections for MCP clients and lets other plugins add skills to Site Agent's skill tools.

• New opt-in OAuth 2.1 connections. Turn on "OAuth connections" in Tools → Site Agent, then add the endpoint to an OAuth-capable client (Claude, ChatGPT and others) with no credentials. The client finds the sign-in through the endpoint's 401 response, registers itself, and sends you to a WordPress consent screen where you allow or deny it and pick the tool groups it may use. PKCE (S256) is required.
• OAuth clients get one-hour access tokens and rotating refresh tokens that end after 30 days without use. Only token hashes are stored, tokens authenticate only the MCP endpoint, reusing a rotated refresh token ends the connection, and connections stop when the approving account loses administrator rights. Revoke connections in Tools → Site Agent; audit history shows OAuth calls with the client name.
• Site Agent uses its own issuer, /wp-json/site-agent/v1/oauth, so it never takes over the site-root OAuth discovery documents that another plugin's OAuth server may serve (Rank Math's MCP server does). Each registered client is stored separately.
• Plugins can add read-only skills to list-skills and get-skill with the site_agent_skills filter. GT Extensions for FluentCart 2.8.3 uses it for its gtfc-invoice and gtfc-quote skills.
• Application Passwords in a header or the authenticated URL keep working unchanged.

Validation: 82 WordPress integration tests on the CI matrix (PHP 8.0, 8.3, 8.5), coding standards, runtime, skill and translation freshness; a 20-step HTTP OAuth run on a disposable site; and a 22-step OAuth run on gauravtiwari.org through Cloudflare: discovery, registration, PKCE token exchange, MCP calls limited to the approved group, refresh rotation, reuse detection and revocation.

The companion archive is separate from the installable WordPress ZIP and contains no credentials.

Site Agent 0.3.0

Serves Bricks Builder's own abilities on Site Agent's endpoint and makes the bundled builder skills work on real sites.

• New Bricks tools group, off by default. On Bricks 2.4 and later with AI/MCP enabled, Site Agent serves Bricks' fast-path abilities under their own tool names plus bricks-start-here, and site-agent-bricks-abilities and site-agent-run-bricks-ability cover the rest with the same ability_name and parameters Bricks' guidance uses. Per-password limits and the audit history apply; Bricks' switches, permissions and schemas stay in charge, and its PHP ability also needs Site Agent's PHP execution group.
• Bundled builder skills for Gutenberg, GenerateBlocks, Elementor, Bricks and Divi, read with list-skills and get-skill. site-context lists active builders and get-content reports the builder that stores a post's layout. Content writes refuse Elementor, Bricks and Divi layout meta.
• get-content returns the staged autosave text with autosave_content and flags whether it is newer, so edits to live posts can be verified and chained. Templates and template parts are edited with an explicit status instead of failing as autosaves.
• Bricks layouts without an editor mode, GenerateBlocks Pro blocks and GenerateBlocks global styles and conditions are detected. Bricks, Elementor and Divi recipes read outlines or chunks and send element-level patches, so large layouts fit the 64 KiB PHP limits.

Validation: 72 WordPress integration tests / 519 assertions on WordPress 6.9 with PHP 8.3 and 8.5 and on the CI matrix (PHP 8.0, 8.3, 8.5), plus a run on WordPress 7.1.2 with Bricks 2.4.2 and Elementor 4.3.4 active; coding standards, runtime, skill and translation freshness; the HTTP MCP smoke test with and without Bricks; every new builder recipe run over MCP; read-only MCP runs on gauravtiwari.org and anantamias.com.

The companion archive is separate from the installable WordPress ZIP. Site Agent does not implement OAuth.

Site Agent 0.2.0

Makes code changes recoverable, errors actionable and going live explicit, and adds the publishing and file tools agents were missing.

• PHP file writes, moves and deletes are syntax- and compile-checked, then the site is loaded with WordPress's edit-scrape check and a change that causes a fatal error is reverted.
• Tool errors include the real message and line. PHP execution rejects exit and die and reports wp_die(), indirect exits and fatal errors as tool errors.
• Edits to published, private or scheduled posts are saved as autosaves for review unless a status is passed. Scheduling requires a future date. Titles keep tag-like text and percent sequences.
• Content writes accept terms, featured images, slugs, publish dates and SEO meta. New tools list terms, import media with alt text, update media, and create, delete or move source files; must-use plugins are reachable and credential files are blocked by name.
• Each Application Password can be limited to some tool groups. The audit history records targets, the password used and denied calls. Diagnostics and a Test connection button explain connection failures.
• URL credentials are removed before dispatch, WP-CLI @Aliases are rejected, and SITE_AGENT_ALLOW_EXECUTION=false blocks source editing, PHP and WP-CLI.
• Updates use WordPress's Update URI hook, cache failed checks, and keep validated metadata when the store is unreachable during an upgrade. Signed-package verification ships without an enforcing key.

Validation: 59 WordPress integration tests / 383 assertions on PHP 8.3 and 8.5 locally and on the CI matrix, 9 converter tests, PHP syntax and coding standards, runtime and translation freshness, an HTTP MCP smoke test on disposable WordPress including a real fatal-change rollback, and both release ZIPs.

The companion archive is separate from the installable WordPress ZIP. Site Agent does not implement OAuth.

Site Agent 0.1.5

Adds inline documentation to Tools > Site Agent for connecting with an authenticated MCP URL. The guide covers enabling URL authentication, creating a dedicated Application Password, generating and copying the endpoint, credential privacy, revocation, and client compatibility. It shows a site-specific placeholder URL without displaying real credentials.

Validation: 33 WordPress integration tests / 144 assertions, 7 converter tests, PHP syntax and coding standards, runtime and translation freshness, disposable WordPress rendering, and both release ZIPs.

The companion archive is separate from the installable WordPress ZIP. Site Agent does not implement OAuth. ChatGPT web compatibility with credential-bearing URLs has not been verified.

Site Agent 0.1.4

Adds opt-in URL authentication to the Site Agent MCP endpoint for compatible clients that cannot send custom Authorization headers.

Enable URL authentication under Tools > Site Agent, save, then use the converter's new Copy authenticated endpoint button. The URL's auth query parameter contains Base64-encoded username and Application Password credentials. Standard and URL-safe Base64 are accepted; the copy action handles URL encoding and existing plain-permalink query parameters.

Authentication uses WordPress's native Application Password validator on every request. Administrator and enabled-tool checks remain enforced; account passwords, invalid/revoked credentials, conflicting identities and unrelated REST routes are rejected. The mode defaults off, respects emergency disable and HTTPS requirements, and marks MCP responses private/no-store.

Base64 is reversible. Credential-bearing URLs may appear in browser history, proxy/server logs or client configuration. Use a dedicated, revocable Application Password and keep the complete URL private. The client must support Streamable HTTP/MCP and preserve the query on each request. This is not an OAuth implementation or a guarantee of compatibility with every client.

Validation: 33 WordPress integration tests / 144 assertions, 7 converter tests, real headerless local HTTP initialization and tool discovery, route isolation, invalid-credential rejection, cache headers, session termination, coding standards and package checks.

Site Agent 0.1.3

Adds the optional Site Agent companion package from PR #1, with WordPress workflow instructions, the approved icon and a credential-free MCP connection. The companion covers site inspection, raw-content audits, draft preparation, hash-checked edits and the developer tools enabled on the connected WordPress site.

Two separate ZIPs are provided:

• site-agent-0.1.3.zip: installable WordPress plugin, also delivered through FluentCart automatic updates.
• site-agent-companion-0.1.3.zip: companion package for compatible ChatGPT/Codex hosts. Do not upload this ZIP to WordPress.

Both companion manifests now use version 0.1.3. The compatibility manifest points to the included mcp.json; the standalone ZIP includes the complete GPL license. Packaging validation is part of CI.

Authentication still requires a compatible private connection using a WordPress Application Password and Basic Authorization header. This release does not add OAuth or claim authenticated ChatGPT web connectivity. Existing WordPress functionality, runtime dependencies and access controls are unchanged.

Validation: 24 WordPress integration tests / 106 assertions, 6 converter tests, PHP/JavaScript syntax, coding standards, translation and generated-runtime freshness, companion metadata/reference checks and ZIP verification.