WPPilot 1.7.0 — Stock-image search over Openverse

This release adds one new ability: stock-image search over Openverse, WordPress.org's own openly-licensed media search. No API key and no account — an agent building a page can find a CC-licensed or public-domain image without the site owner signing up for anything.

New

• wppilot/search-images searches Openverse with licence, licence-type, orientation, extension and source filters. Every result carries the licence, the creator, and a ready-made attribution string, and the ability's own description tells the agent to carry that attribution into the caption when importing — attribution is a licence obligation for every CC licence except CC0 and the public domain mark, not a courtesy.
• Search and import stay separate abilities on purpose: search is read-only and costs nothing, and a failed import should not look like a failed search. Import a chosen result with the existing wppilot/import-media-url.

Honest limits

• The per-page cap is 20 because that is what Openverse grants an anonymous caller. Asking for more is not an error Openverse reports — it silently clamps — so the schema caps where the API actually caps.
• A rate-limited response is reported as exactly that, with an instruction to wait rather than retry.

What leaves your site

The search terms and filters go to api.openverse.org, only when the ability is called, and nothing else — nothing about your site, your users, or your content. Full disclosure in readme.txt under External services.

One new read-only ability gated on the upload_files capability. No permission changes to anything existing; connections keep working and do not need re-authorising.

WPPilot 1.6.4 — Preview, menu, queue and settings fixes

This maintenance release encrypts stored preview inputs and fixes preview lifecycle races, menu partial updates and ownership checks, queue discovery beyond the first fifty batches, front-page settings validation, and approval enforcement for Pro abilities on the modern MCP transport. No new abilities or permission changes; existing connections keep working.

WPPilot 1.6.3 — Stranded queue batches retry themselves

One fix, the other half of a problem 1.6.2 started on. No new abilities, no permission changes, and existing connections keep working.

A stranded batch retries itself. A tab that picked up a Block Editor Queue batch and then went away — closed, navigated off, or left in the background long enough for the browser to throttle it past the five-minute lease — left that batch marked running, with its item leased to a runtime that no longer existed. No other tab would take it, so it sat there until an administrator cancelled it and queued the work again.

The recovery for exactly that case was already in the plugin and already correct: it fails the batch with a message naming the abandoned tab, which makes it claimable again. Nothing ever reached it. The scan that calls it looked only at ready and failed batches, and a stranded batch is neither — so the one state the recovery exists for was the one state it could not see. Running batches are scanned now.

A batch another tab is actively working is still left alone: its lease is valid, so it is refused as not claimable and skipped, exactly as before.

1.6.2 stopped WPPilot putting a batch into that state from a malformed request. This is getting out of it when something else did.

---

Install wppilot.zip below, or update from wp-admin. Tested against WordPress 7.0.3 on PHP 8.3.

WPPilot 1.6.2 — Queue, connection slots and listings

Four fixes. No new abilities, no permission changes, and existing connections keep working.

Blocks kept the settings their editor assigns. The Block Editor Queue serialized blocks straight from createBlock(), which never renders a block's edit component — so the per-block style id and layout markers some libraries generate on mount were simply missing from what was saved. A Spectra block reached the database with no block_id and the class uagb-block-not_set, rendered unstyled, and the queue reported the item finished. Blocks now pass through the hidden editor's own block-editor store first, and what the editor made of them is what gets serialized.

That step waits for the editor to report a loaded post before touching the store, and checks that the blocks read back are still the ones that went in — otherwise it falls back to the old behaviour rather than writing something else. Autosave is switched off in that hidden frame, so it cannot store a draft nobody approved.

A batch no longer strands itself on a bad request. The queue's claim, complete and fail endpoints ended in a fatal error when a request carried no JSON body, or one that did not parse. Those endpoints run against an item that is already leased, so the process died mid-lease and left the batch running with nothing alive to complete or release it. They answer 400 now, saying what to send.

Revoking a connection frees its slot. A site allows fifty simultaneous OAuth connections, counted from each client's last use, so revoking one marked its tokens revoked and left the slot occupied until the refresh-token lifetime ran out — up to two weeks of Troubleshoot reporting the site full with nothing explaining why. The slot comes back in the same request now, once no account still holds a live grant through that client.

A directory listing survives an entry it cannot read. A subdirectory the web server has no permission to open, or a symlink whose target is gone, threw out of the iterator and took the whole recursive listing with it. Unreadable entries are skipped and the rest of the tree is returned.

---

Install wppilot.zip below, or update from wp-admin. Tested against WordPress 7.0.3 on PHP 8.3.

WPPilot 1.6.1 — Usage reporting is now opt-in

Anonymous usage reporting is off until you switch it on, and the notice 1.6.0 put on your dashboard is gone.

Nothing is sent unless you turn it on under WPPilot → Settings → Anonymous usage reporting. A feature that only runs when asked for has nothing to disclose on activation, so the notice had no job left to do.

A choice you already made is not overruled. Sites that pressed Keep it on in 1.6.0 keep reporting; sites that turned it off stay off. Every other site — including one that dismissed the notice without answering — stops reporting on update, and its daily scheduled event is cleared rather than left firing for a feature that is off.

Uninstalling now removes the reporting switch, the installation identifier and the daily event. None of them were listed for cleanup before.

No new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

Requires WordPress 6.9+ and PHP 8.0+.

WPPilot Pro requires this plugin installed and active.

Install wppilot-1.6.1.zip. The -org archive is the WordPress.org submission build, which has the updater and the usage reporting code removed entirely — it is not the one to install from here.

WPPilot 1.6.0 — WordPress MCP Server for Claude, Cursor, Codex and Copilot

Optional anonymous usage reporting, so decisions about which WordPress and PHP versions to keep supporting stop being guesswork.

A notice explains what is sent the first time you open wp-admin, and one click turns it off under WPPilot → Settings. Full detail is in the readme under External services.

No new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

Requires WordPress 6.9+ and PHP 8.0+.

WPPilot Pro requires this plugin installed and active.

WPPilot 1.5.1 — The tool surface a strict client sees

Three defects, one theme: WPPilot was unusable from any AI client that checks its calls against the schemas the server hands it. Claude is one of those. A more forgiving client saw none of this, which is how it survived a release.

The tool list was rejected outright

json_encode() renders an empty PHP array as [], and JSON Schema requires {}. WPPILOT_NO_INPUT_SCHEMA — which every no-input ability declares — is exactly that empty array, so the schema went out malformed:

tools.43.custom.input_schema.properties: Input should be an object

The API names only an index and rejects the whole payload, so one ability broke every tool on the connection rather than its own. The keyword maps are now coerced recursively, since a nested object property can declare an empty properties of its own, and the same correction is applied to responses leaving the bundled MCP adapter — a pinned composer package, where patching the source would be undone by the next update.

Abilities that take no input refused every call

Ability "wppilot/system-status" has invalid input. Reason: input is not of type object.

1.5.0 fixed the client sending {}. This fixes the server sending nothing at all. Passing null is right only for an ability declaring no schema; one declaring WPPILOT_NO_INPUT_SCHEMA validates with rest_is_object(), and rest_is_object(null) is false. Whichever single answer the transport picked, half the no-argument tools broke. It now asks the ability, reusing the decision the REST shim already makes so the two paths cannot drift apart.

Destructive tools demanded a confirmation they never advertised

Ability "wppilot/elementor-build-page" is destructive or critical.
Obtain explicit user approval, then retry with confirm=true.

confirm is a control field of the transport, not ability input, so it appeared in no schema — and abilities declare additionalProperties: false, so a validating client dropped the field before sending. The refusal then repeated identically however many times the model retried, with no way to comply. It is now declared, and required, on the 44 tools that are gated. The ability's own schema is untouched: the transport still strips confirm before execution by asking that schema, not the advertised one.

Upgrading

No new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

Install wppilot-1.5.1.zip — GitHub's auto-generated "Source code (zip)" unpacks to wppilot-1.5.1/ and is not installable, because Pro's Requires Plugins: wppilot header resolves against the directory name.

WPPilot 1.5.0 — Preview before write

WPPilot could already undo a change. It could not show you one first — and those are different guarantees. Rollback helps once damage is visible; preview stops it.

Preview before write

wppilot/preview-ability returns a field-by-field diff plus a URL you open in wp-admin. wppilot/apply-preview performs the write once you agree. Nothing is written in between.

A new Preview screen lists what an agent has proposed but not made, naming the AI client and the WordPress user behind each one — several clients usually connect as the same administrator, so the user alone cannot tell you who proposed a change.

Computed, not performed

Each supported write has a projector deriving the after-state from the current state and your input. The site is never touched to produce a preview.

Executing inside a transaction and rolling back was rejected for a specific reason: wp_update_post() calls clean_post_cache(), which re-primes the object cache from the uncommitted row. ROLLBACK restores MySQL and leaves Redis serving the previewed content — a readonly ability that permanently changed the site.

It never invents a diff

An ability with no projector is refused by name with a reason: writes_files for a plugin install, arbitrary_effect for PHP execution, already_staged for the Gutenberg queue, which is itself a review mechanism. A call that would be rejected is reported as would_fail with the error, rather than shown as a change that was never going to land.

Applying checks the target has not moved

Scoped to the fields in the diff plus the fields the projection read — not the whole record, which would trip on any plugin touching an unrelated meta key between preview and apply. A change elsewhere is reported as a warning and the write proceeds. A change to what you reviewed refuses with wppilot_preview_drifted and writes nothing, permanently: your approval described a state that no longer exists.

Applying also re-runs the safety profile check and the ability's own confirmation requirement, so it is not a route around either.

Optional enforcement

A new Settings option — off by default, never enabled by an upgrade — requires a reviewed preview before agent writes over MCP and REST. Abilities WPPilot cannot preview are exempt rather than blocked, because "you must preview this" plus "this cannot be previewed" removes an ability rather than reviewing it.

Two fixes found by testing every ability against a real install

wppilot/import-media-url could never run. It requires three WordPress core files before downloading, and one was named wp-admin/includes/wppilot-media.php — a rebrand find-and-replace that renamed a core path. Every call died on require_once before reaching the download. Importing an image from a URL now works end to end.

Abilities that take no input rejected the call that says so. WordPress refuses any non-null input when an ability declares no input schema, so sending {} — what MCP clients send rather than omitting the field — returned HTTP 400 while omitting it succeeded. Six abilities were affected, including the site-settings read and all three diagnostics reports.

Notes

Existing connections keep working and do not need re-authorising. No permission changes.

Install wppilot-1.5.0.zip below — the GitHub "Source code" archive is not installable.

If you run WPPilot Pro, update it to 1.1.2 alongside this release.

---

447 unit tests. All 99 Free abilities invoked against WordPress 7.0.3 / PHP 8.3.31 with zero problems, verified against this artifact installed via wp plugin install.

WPPilot 1.4.1

Three defects, two of which let an agent report success for a change nobody could see. Recommended for everyone, and required if you also run WPPilot Pro.

Silent no-op on builder-owned pages

Elementor, Bricks and Beaver Builder keep their element tree in postmeta and render that instead of post_content, and they leave post_content looking like ordinary content. The existing marker guard only recognises proprietary syntax, so it never saw them.

Reproduced on Elementor 4.2.2 / WordPress 7.0.3 before the fix:

ability_returned : SUCCESS
updated_fields   : content
warnings         : (none)
canary_in_db               : YES
canary_VISIBLE_on_frontend : NO   <-- silent no-op

The write is now refused, naming the builder and — when installed — the ability that owns that builder's content. post_content still feeds RSS and search, so allow_raw_content_on_builder_post: true performs the write and returns an audit note recording that the rendered page did not change.

Ownership is value-exact rather than truthy, because both builders store a disabled state instead of deleting it: _elementor_edit_mode must equal builder, and a "0" flag is not ownership.

Divi, Etch and WPBakery needed no change — they store markup in post_content, where the markers already catch it. Breakdance keeps its own gate.

Builder storage-meta refusal named an ability that may not exist

It hardcoded "use the Elementor-specific abilities instead", which on a site without Pro points at an ability that is not registered there. It now routes through the same remedy helper the post_content refusal already used.

Version constant

WPPILOT_VERSION read 1.3.0 for the whole of the 1.4.0 release while the plugin header read 1.4.0. It drives the update check, admin asset cache-busting, and Pro's wppilot_min_version_satisfied().

Update WPPilot Pro to 1.1.2 alongside this

Pro shipped its own copies of 23 WordPress-core abilities before Free had them. Registration order follows plugin load order, which follows active_plugins — activation order, not alphabetical. On any site where Pro was activated first, Pro's copies registered first and won, so every fix Free shipped to those abilities since 1.1.0 was inert there, including this one.

Pro 1.1.2 stands aside when Free is 1.1.0 or newer. A site on an older Pro is unaffected.

Notes

No new abilities. No permission changes. Existing connections keep working and do not need re-authorising.

Install wppilot-1.4.1.zip below. The GitHub "Source code" archive is not installable.

---

430 unit tests, 686 assertions. Verified end-to-end on WordPress 7.0.3 / PHP 8.3.31 with Elementor 4.2.2, against the built artifact installed via wp plugin install.

WPPilot 1.4.0

A large release, all of it about getting connected.

Access tokens — a third way in

A long-lived Authorization: Bearer wpp_… credential for callers that cannot sign in through a browser: the Claude Messages API MCP connector, the OpenAI Responses API mcp tool, cron jobs, automation platforms, curl. Neither existing method reaches those — OAuth needs a browser sign-in and expires in an hour, and several of those callers cannot send HTTP Basic at all.

• 256 bits from the CSPRNG, stored only as a SHA-256 digest, shown once
• Optional expiry (30 days, 90 days, a year, or never), revocable one at a time
• Borrows the capabilities of the account that created it, re-checked on every request — demoting or deleting that user closes the token in the same moment
• Authenticates on the canonical /wp-json/mcp/wppilot endpoint, the same URL every other snippet uses

OAuth and application passwords are unchanged, and existing connections keep working.

Web apps get their own route

Pick the app, not the credential. Real walkthroughs for Claude on the web, ChatGPT, Perplexity, Mistral Le Chat and Manus, each with its own menu path, plan requirement, and the enable-in-chat step people miss. Three of the five can take an access token instead of signing in; the other two say why they cannot, rather than showing instructions that cannot be followed.

Seven new clients

Kimi Code CLI, Qwen Code, Gemini CLI, ZCode (GLM), plus Mistral Le Chat, Perplexity and ChatGPT as first-class registry entries. The registry now knows 29 clients: 24 access-token snippets, 23 OAuth entries, 20 application-password entries.

Every client's snippet is written in the shape that client actually parses. Qwen Code and Gemini CLI name a remote URL httpUrl, not url — a snippet carrying url parses there and then connects to nothing, no error and no tools.

Instructions rewritten for August 2026

Several interfaces had moved. ChatGPT's developer mode is now Settings → Apps → Advanced settings, and Claude's connectors live under Customize, not Settings. Both now also say to switch the connector on in the chat, which is off by default and is the usual reason a correctly-added server appears to do nothing. Roo Code was discontinued in May 2026 and its entry says so.

Let your AI coder do it

Every method offers its setup as a copy-paste prompt for an agent: the server name, the URL, the exact snippet, the file it belongs in, rules that stop an agent inventing a transport, a verification step, and the quirks that would otherwise have it "fix" a working connection into a broken one.

Connect screen

Setup now comes before the status panels. A method is selected on load and each panel opens on its first client — step 2 used to stay hidden, so the page read 1, 3, 4 and the part that actually connects a client was the part nobody found. Enable AI Abilities stays last.

Install

Use wppilot-1.4.0.zip. The GitHub "Source code" archives are not installable — they have no vendor/ directory. wppilot-1.4.0-org.zip is the WordPress.org build, with the self-hosted updater removed.

No new abilities and no permission changes. 416 unit tests pass.