Skip to content

WPPilot 1.4.0

Choose a tag to compare

View all tags
@wppilot-labs wppilot-labs released this 16 Aug 11:02
· 34 commits to main since this release
v1.4.0
aef5f49

A large release, all of it about getting connected.

Access tokens — a third way in

A long-lived Authorization: Bearer wpp_… credential for callers that cannot sign in through a browser: the Claude Messages API MCP connector, the OpenAI Responses API mcp tool, cron jobs, automation platforms, curl. Neither existing method reaches those — OAuth needs a browser sign-in and expires in an hour, and several of those callers cannot send HTTP Basic at all.

  • 256 bits from the CSPRNG, stored only as a SHA-256 digest, shown once
  • Optional expiry (30 days, 90 days, a year, or never), revocable one at a time
  • Borrows the capabilities of the account that created it, re-checked on every request — demoting or deleting that user closes the token in the same moment
  • Authenticates on the canonical /wp-json/mcp/wppilot endpoint, the same URL every other snippet uses

OAuth and application passwords are unchanged, and existing connections keep working.

Web apps get their own route

Pick the app, not the credential. Real walkthroughs for Claude on the web, ChatGPT, Perplexity, Mistral Le Chat and Manus, each with its own menu path, plan requirement, and the enable-in-chat step people miss. Three of the five can take an access token instead of signing in; the other two say why they cannot, rather than showing instructions that cannot be followed.

Seven new clients

Kimi Code CLI, Qwen Code, Gemini CLI, ZCode (GLM), plus Mistral Le Chat, Perplexity and ChatGPT as first-class registry entries. The registry now knows 29 clients: 24 access-token snippets, 23 OAuth entries, 20 application-password entries.

Every client's snippet is written in the shape that client actually parses. Qwen Code and Gemini CLI name a remote URL httpUrl, not url — a snippet carrying url parses there and then connects to nothing, no error and no tools.

Instructions rewritten for August 2026

Several interfaces had moved. ChatGPT's developer mode is now Settings → Apps → Advanced settings, and Claude's connectors live under Customize, not Settings. Both now also say to switch the connector on in the chat, which is off by default and is the usual reason a correctly-added server appears to do nothing. Roo Code was discontinued in May 2026 and its entry says so.

Let your AI coder do it

Every method offers its setup as a copy-paste prompt for an agent: the server name, the URL, the exact snippet, the file it belongs in, rules that stop an agent inventing a transport, a verification step, and the quirks that would otherwise have it "fix" a working connection into a broken one.

Connect screen

Setup now comes before the status panels. A method is selected on load and each panel opens on its first client — step 2 used to stay hidden, so the page read 1, 3, 4 and the part that actually connects a client was the part nobody found. Enable AI Abilities stays last.

Install

Use wppilot-1.4.0.zip. The GitHub "Source code" archives are not installable — they have no vendor/ directory. wppilot-1.4.0-org.zip is the WordPress.org build, with the self-hosted updater removed.

No new abilities and no permission changes. 416 unit tests pass.

Assets 4
Loading