What 1.7.6 changes: an OAuth token now works on the MCP route only
Before 1.7.6, an OAuth token for the MCP endpoint also signed its holder in on other parts of a WordPress site. What it reached, what changed, and what else shipped.
Read moreAbsent and unknown are not the same answer
WordPress hands back the same value for "there is nothing here" and "the question could not be asked". Nine review rounds on version 1.7.5 kept finding the same bug wearing a different costume, including one where a failed consent lookup read as consent granted.
Read moreWhat 1.7.2 adds: a consent screen that shows who is asking
The sign-in screen now identifies a connector by its verified redirect host rather than the name it sends, and the Activity Log records every MCP request that reaches WordPress.
Read moreWhat we fixed in the 1.7.2 connection release
A default of ours stopped ChatGPT connecting. Also fixed: a mangled redirect address, a session ID handed back for a session that was never written, and a tool list that could exhaust memory.
Read moreYour agent signs in, then nothing happens
A completed sign-in with no ability calls after it means the request never reached WordPress. How to read that signal in the Activity Log, confirm it at the CDN, and fix it.
Read moreWhat we fixed in the 1.7.0 correctness release
Version 1.7.0 closes an OAuth revocation race, stops a payment gateway credential leak, and fixes four ACF writes that were destroying content.
Read moreWhat we fixed in the 1.4.1 standards release
A user-reported OAuth bug and six related fixes bring error responses, discovery, and tool status codes in line with what MCP and OAuth clients expect.
Read moreQuick Connect: one-screen setup for a WordPress MCP server
Version 1.4.0 adds a one-screen Quick Connect wizard that gets an agent connected fast, without loosening the off by default governance underneath.
Read moreWhat we fixed in the 1.3.0 security release
In 1.3.0 we turned OAuth off by default and fixed real security gaps in our own plugin, patched in the open. Here is what changed.
Read moreOAuth or Application Password: how to connect an agent
Two honest ways to connect an AI agent to your WordPress site, what each one is good at, and how to pick the one that fits your setup.
Read more