Compatibility

Compatibility

This page states what the plugin declares, what the project tests, and what it explicitly does not support. Declared support and tested coverage are separate: a version inside the range is supported, but only the combinations in the CI matrix are exercised automatically.

Supported matrix

Component	Supported	Tested by the project
WordPress	6.9 or later; readme.txt declares "Tested up to: 7.1"	Single-site and multisite suites target 6.9 and 7.1.2; CI runs 6.9 and latest (README.md, readme.txt, .github/CI_GUIDE.md).
PHP	8.2 or later	Unit suite on 8.2, 8.3, 8.4 and 8.5; integration on 8.2 and 8.4, with PHP 8.3 and an experimental 8.5 leg on the default branch (.github/CI_GUIDE.md, docs/en/adr/0006-runtime-floors.md).
MCP Adapter	>=0.7.0 <0.8.0	CI integration legs pin adapter 0.7.0 and the latest published release; the runtime still refuses anything outside 0.7.x (.github/workflows/ci.yml, .github/CI_GUIDE.md).
Database	MySQL 8.0+ or MariaDB 10.6+, InnoDB	Key rotation depends on atomic row-level locking (docs/en/INSTALL.md).
Transport	HTTPS	Insecure HTTP is a local/development opt-in only (src/Http/TransportGuard.php).
PHP syntax floor	8.2 for the plugin; 7.2 for the bootstrap files	A real PHP 7.2 parser checks the entrypoint, uninstall.php and src/Bootstrap/*.php (.github/CI_GUIDE.md).

The plugin version at the time of writing is 1.0.0 (xnetvn-agent-hub-wp.php).

Single site and Multisite

Both are supported and both are exercised in CI. On Multisite, settings, keys, audit rows and the pepper are stored per site, so one subsite's policy cannot leak into another (readme.txt, docs/en/FAQ.md).

Operational differences worth knowing:

• Schema and pepper are created per site on activation or on that site's first request (docs/en/INSTALL.md).
• Network-wide deactivation clears the plugin's scheduled events on every site; keys, audit rows and settings are not deleted (CHANGELOG.md).
• Uninstall checks each site's Delete plugin data when uninstalled setting separately, and keeps shared per-user notification preferences while any site keeps its data (docs/user-guide.md).
• Super administrators keep default use and management, but an explicit site role matrix and a corrupt policy still deny delegated use (docs/en/architecture/overview.md).

What CI verifies

The source gate in .github/CI_GUIDE.md runs:

• quality — PHPCS/WPCS, PHPCompatibilityWP, PHPStan level 8 without a baseline, version consistency, settings-documentation drift and English/Vietnamese documentation parity.
• unit — the full unit suite on PHP 8.2–8.5.
• integration — PHP 8.2/8.4, WordPress 6.9/latest, MCP Adapter 0.7.0/latest, single-site and multisite. Pull requests run ten boundary legs; default-branch and manual runs execute sixteen, adding PHP 8.3, PHP 8.5 (experimental) and WordPress trunk (experimental).
• build — strict Composer manifest validation, packaging regressions, release ZIP build and structural verification.
• tooling — dependency contracts, workflow hardening and service-free Python regressions.

That evidence does not establish real MCP client compatibility, HTTP acceptance, load capacity, horizontal scaling, legal compliance, production readiness or WordPress.org directory acceptance (.github/CI_GUIDE.md). Implemented ability packs are recorded as implemented with runtime acceptance tracked separately (docs/en/architecture/ability-catalog.md).

Client compatibility

Any client that can send a bearer token in the Authorization header can connect. OAuth is not implemented, so a client that requires an OAuth flow cannot connect (readme.txt, docs/en/adr/0007-oauth-deferred.md).

The published client gate covers MCP Inspector 2.9.0 and FastMCP Slim 4.0.11 CLI. Desktop GUI clients are out of scope for that gate, and no claim is made for ChatGPT or cloud-connector compatibility (readme.txt, docs/en/development-real-clients.md).

Two practical consequences:

• A client that insists on interactive OAuth discovery will fail, even with a valid key.
• A host that strips the Authorization header produces 401 responses; use the Check Authorization header button on Overview, or enable the fallback header (docs/user-guide.md).

Known limits

• No OAuth — bearer keys only; OAuth is deferred to a later milestone (docs/en/adr/0007-oauth-deferred.md).
• No public abilities — every ability stays private, and a key only narrows its owner's existing permissions (readme.txt).
• Fixed scope — six toolsets and 62 abilities; blocks, appearance, settings, plugins and maintenance packs are planned, not shipped (README.md, docs/en/roadmap.md).
• No arbitrary execution — no SQL, PHP, shell, file editors, secret or key-management tools (docs/en/architecture/overview.md).
• No performance claim — the release makes no accessibility conformance or performance claim; benchmarks are evidence for specific lab runs, not capacity guarantees (readme.txt, docs/en/architecture/performance.md).
• Version range is exact — an adapter outside 0.7.x disables MCP rather than running unverified (docs/en/adr/0003-adapter-version-range.md).

Related pages

See Requirements for the runtime floor, Installation for setup, and Configuration for the settings that affect behaviour.