=== WPMCP ===
Contributors: wasiladev
Tags: mcp, claude, ai, elementor, woocommerce, automation, rest api
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 1.2.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Chat with your WordPress site. Connect Claude, Z.ai, Cursor, or any AI client to read and control your site via the Model Context Protocol.

== Description ==

WPMCP turns your WordPress site into an MCP (Model Context Protocol) server. Install the plugin, generate an API key, and connect any MCP-compatible AI client — Claude Desktop, Z.ai, Cursor, Windsurf, and more — to read and manage your site through natural conversation.

**Features (all free):**

* Posts — list, get, create, update, delete
* Pages — list, get, create, update, delete
* Media — list, get, upload from URL
* Comments — list, approve, delete
* Categories & terms — list, create
* Users — list
* Search — full-content search across posts and pages
* Navigation menus — full CRUD (9 tools)
* Site info & active plugins

**31 tools total**, all free and open source.

= Extend with WPMCP Pro =

For Elementor and WooCommerce tools (34 additional tools), install [WPMCP Pro](https://wasiladev.com/wpmcp) — a separate add-on plugin.

= Security =

* API keys are bcrypt-hashed — never stored in plaintext
* IP-based rate limiting (20 failures → 15-minute lockout)
* Self-hosted — no data leaves your server
* Administrator-only access

== Installation ==

1. In WordPress: Plugins → Add New → Upload Plugin → choose the zip.
2. Activate the plugin.
3. Go to Settings → WPMCP.
4. Click "Generate API key" and copy the key.
5. Connect your AI client using the MCP Server URL and key shown on the settings page.

== Frequently Asked Questions ==

= Which AI clients are supported? =

Any client that supports the Model Context Protocol over Streamable HTTP: Claude Desktop, Z.ai, Cursor, Windsurf, and any future MCP-compatible tool.

= Does my data leave my server? =

No. The plugin runs entirely on your WordPress site. AI clients connect directly to your site's REST API. No intermediary servers, no cloud relay.

= Is there a Pro version? =

Yes. [WPMCP Pro](https://wasiladev.com/wpmcp) adds 34 tools for Elementor (9) and WooCommerce (25), plus automatic updates and priority support.

== Upgrade Notice ==

= 1.2.2 =
Registration release. New installs now require a free, domain-locked registration
token to activate WPMCP. EXISTING installs are grandfathered on upgrade — they keep
working with no token. On activation and update checks the plugin reports only your
site URL and token to updates.wasiladev.com to deliver updates and validate the
registration; nothing else. If the license server is unreachable your site is never
blocked.

= 1.2.0 =
Security hardening release. The plaintext API-key copy from older versions is
deleted on upgrade; every tool call is now recorded in an admin Activity log.
Review the new Activity tab after upgrading.

= 1.1.0 =
Interactive tool cards and a redesigned settings page. On upgrade, any
plaintext API-key copy left by older versions is removed automatically.

== Changelog ==

= 1.2.2 =
* New: registration gate. New installs require a free registration token to run WPMCP; the token is locked to the single domain you register it for. Get one from the WP-MCP download/registration page.
* Existing installs are grandfathered on upgrade — they keep working with no token; the gate applies only to brand-new installs.
* Privacy: on activation and on update checks the plugin reports only your site URL and registration token to updates.wasiladev.com (to deliver updates and validate the registration) — nothing else, and never any tool arguments or content.
* Reliability: if the license server is unreachable or TLS fails, your site is never blocked — the plugin shows a clear retry state, and an already-validated site keeps working.

= 1.2.1 =
* Fix: third-party admin notices (Forminator, etc.) no longer overlap the WPMCP settings header.
* Fix: the "Extend with Pro" upsell (tab, card, and footer link) is hidden when WPMCP Pro is active, and all "Get Pro" links point to the correct page.
* Fix: the admin menu icon is now the WasilaDev logo mark.
* Fix: on the free tier the Activity tab shows the 5 most recent tool calls with an upgrade prompt (Pro shows full history).

= 1.2.0 =
* Security: API key is never stored in readable form — only the bcrypt hash is kept; the key is shown once at generation. Any plaintext copy from earlier versions is deleted on upgrade.
* Security: new Activity log records every tool call (tool, arguments, source IP, outcome) with the key material redacted; readable under WPMCP → Activity. Free keeps the most recent 100 calls; Pro retains full history.
* Security: removed the opt-in `?key=` query-parameter authentication (keys could leak into logs); header auth only (Authorization / X-WP-MCP-Key).
* Security: CORS is locked down to an allowlist (default: none) instead of reflecting any origin.
* Security: proxy-aware rate limiting — behind Cloudflare the real client IP is used, so one client can't lock out others.
* Security: `wp_upload_media` blocks internal/loopback/private-network URLs (SSRF guard).
* Security: post meta writes respect protected/underscore meta keys.
* Reliability: unhandled server errors are logged instead of silently swallowed; JSON-RPC notifications no longer receive a response (spec-correct).
* Internationalization: all admin strings are translatable (text domain: wpmcp); .pot template included.
* Requires PHP 8.1.

= 1.1.0 =
* Redesigned settings page: top-level menu, vertical tabs, copy-paste-ready client config.
* Interactive tool cards with example prompts.
* Security: on upgrade, any plaintext API-key copy stored by earlier versions is deleted; only the bcrypt hash is kept.
* Internationalization: all admin strings are translatable (text domain: wpmcp).

= 1.0.0 =
* First public release.
* 31 MCP tools for core WordPress: posts, pages, media, comments, menus, users, search, site info.
* MCP protocol 2025-06-18 over Streamable HTTP.
* API key auth with bcrypt hashing and rate limiting.
* Extension hooks for add-on plugins (wpmcp_register_tools, wpmcp_capabilities).
