37 bridged tools from eight plugins worked when called but never appeared in the tool list. 1.7.8 lists them, names the source namespace in bridged errors, and fixes three result bugs.
Read moreThe Abilities tab had a main Save button and four more on its cards, and pressing only the main one lost edits to exposed meta keys and content types. 1.7.7 has one button.
Read moreBefore 1.7.6, an OAuth token for the MCP endpoint also signed its holder in on other parts of a WordPress site. What it reached, what changed, and what else shipped.
Read moreOn sites with a persistent object cache, read-only mode and the high-risk lock could refuse to change, and the activity log recorded the change as done anyway.
Read moreThe sign-in screen now identifies a connector by its verified redirect host rather than the name it sends, and the Activity Log records every MCP request that reaches WordPress.
Read moreA completed sign-in with no ability calls after it means the request never reached WordPress. How to read that signal in the Activity Log, confirm it at the CDN, and fix it.
Read moreA fix-only release: WPML sweeps now read every configured language, tool discovery matches permission, and a broken discovery route resolves again.
Read moreVersion 1.7.0 adds a one-click way to enable a section's ordinary writes, deliberately leaving deletes and high-risk abilities locked, plus a fuller audit log.
Read moreThree 1.6.2 fixes make the plugin's audit log worth trusting: it records the true cause of a block, covers every path that changes state, and stays readable.
Read moreIn 1.6.2 we corrected a claim about the audit log. It keeps identifier-only values by design, never free-text content, and here is why that line matters.
Read moreVersion 1.6.2 corrects a claim about our own audit log, tightens who can edit customer data, and closes gaps in what the plugin records and sanitizes.
Read more