What changed in every release

Eight WooCommerce abilities that move money or grant authority (refunds, order status, order updates, payment gateway settings, coupon creation and updates, and tax rate creation and updates) are now locked by default behind a single audited master switch on the Settings tab.

The activity log now records ability toggles and setting changes, not only ability calls, using a new event-type vocabulary and a detail column that names what changed.

Every ability you enable or disable is now recorded in the activity log. Before this release, that option was written with no audit trail at all.

Identifiers in the activity log's detail column now link to the object's edit screen.

The activity log can now be exported as a CSV, carrying whatever filter is currently applied.

A failed Application Password attempt against the MCP endpoint is now logged, and rate limited per source IP so a credential-stuffing run cannot flood the log.

Creating a WooCommerce customer used to require only the capability to manage WooCommerce. It now also requires the capability to create users, since the ability creates a real WordPress account.

Listing or reading a WooCommerce customer's details used to require only the capability to manage WooCommerce, which let a caller with just that one capability read any WordPress user's email, address, and phone, administrators included. Both abilities now also require the capability to list users, the same one WordPress itself requires to browse Users in wp-admin. A stock WooCommerce Shop Manager does not hold that capability, and is now denied both abilities where it was not before.

A high-risk ability could still be switched on and saved as an ordinary toggle from the Integrations tab, and the activity log recorded an enable that never actually took effect.

Payment gateway and shipping settings could return secrets under field names the redaction list did not match, such as passphrase and salt.

Deleting a WooCommerce product variation did not check the caller's capability on that specific product the way deleting a product does.

An identifier in the activity log could link to the wrong object when the detail text ahead of it contained an apostrophe.

The activity log's Event and Detail columns could misalign after filtering or paging.

Exporting a large activity log could produce a truncated file that still looked complete, and exporting while the log was being written could duplicate rows.

Integration and ability counts on the admin screens did not refresh after a save until the page was reloaded.

Bridge group headers counted destructive abilities as ordinary writes, and showed a plugin's raw slug instead of its name.

Turning the high-risk switch off left a stored value behind instead of clearing the setting.

Copy now says an Application Password is a whole-site credential bounded by the WordPress role it belongs to, and that this plugin's allowlist, high-risk floor, and audit log only govern calls made through its own MCP endpoint.

Copy now says uninstalling does not revoke an agent's access on its own, and names what survives.

Copy now says an OAuth grant's requested scope does not limit what the resulting token can do.

The rate limit setting now says it ships off by default, and suggests a starting value.

The listing description now leads with what the plugin is rather than how it works, and the tags swap seo for woocommerce.

Regenerated the translation template.

Media reads handed back the whole library to anyone who could upload a file or edit a post. An agent connected as an author now sees only what it uploaded, and the full library still goes to users who can edit other people's posts. The media count follows the same rule, so it can no longer report a total that disagrees with the list beside it.

Deleting a WooCommerce product only checked that you manage the store, not whether that particular product was yours to delete.

A duplicate product SKU or coupon code came back as an uncaught error rather than a message naming what it collided with.

An ability bridged from another plugin could answer with a bare list where the protocol asks for an object, and some strict clients reject that outright. Bridged results are now always shaped as an object before they reach the wire.

The OAuth pointer sent on a 401 compared the request path case-sensitively, so a request that differed only in casing got no pointer at all and the client had nowhere to start.

The OAuth authorization response left out the issuer that RFC 9207 requires, which is how a client confirms which server actually answered it. Error redirects carry it now as well.

Tightened the build checks that guard these tools, including one that quietly passed any ability whose code it could not read.

Asking for a post status when creating content did nothing. "Create a post as a draft" published it live instead, and reported success. Create post, page and draft now honour the status you ask for, and refuse it when your user lacks the capability to publish.

Scheduling was not treated as publishing, so a contributor who asked for a future status could put a post live without the capability to publish one. Scheduled and private now require the same permission as publishing.

Editing a post's status was checked against the wrong permission, which both let some users set a status they should not have and stopped a contributor changing their own draft. It now checks the capability that actually governs publishing, using the post type's own capability names.

Custom post types ignored every status except publish, so a request for pending or private silently became a draft.

Updating a WooCommerce order with line_items added new items rather than changing the existing ones, which quietly raised the order total. There is now an add_line_items field that says what it does. The old field keeps working exactly as before so nothing breaks.

The product type sent when updating a WooCommerce product was discarded without a word. Sending one that does not match the product now returns an error instead of pretending it worked.

A WooCommerce order request that mixed valid and invalid product ids reported failure after it had already written the valid items, leaving an order with items you were told had not been added. Every id is now checked before anything is written, so a bad one fails the whole request and changes nothing.

Every input on every tool now explains itself. All 505 of them, where only three abilities were fully documented before. Agents were guessing at things like which fields replace rather than merge, that prices are plain decimal strings, that country and state want two-letter codes, and that a meta key outside your allowlist is refused rather than returned empty.

Added a build check that fails when any tool input goes undocumented, so this cannot drift back.

OAuth errors came back in WordPress's own {code, message, data} shape instead of the {error, error_description} shape RFC 6749 requires, so no standard OAuth client could read what went wrong. Reported by an external user as issue #68, and wrong since the first release.

A malformed JSON body sent to an OAuth route was rejected by WordPress before the plugin ever saw it, so it escaped with the same wrong shape and no cache headers at all.

Responses that carry a credential were missing Pragma: no-cache next to Cache-Control: no-store, including the response that hands out the token.

Calling a tool that does not exist, or one you have switched off, returned HTTP 404. The MCP spec reserves that status for "this session is dead, start over", so clients were being told to reconnect after an ordinary mistake. A session that really has expired still returns 404.

The OAuth discovery document advertised a client-registration endpoint even when dynamic client registration was off, which is the default. A fresh install was pointing connectors at a URL that does not answer.

No tool declared openWorldHint, and the MCP schema reads an absent value as "this tool may reach the open internet". Every ability this plugin provides now declares it false, which is what the plugin has always actually done.

Rate-limited OAuth responses now send Retry-After.

A first-run Quick Connect wizard gets a new admin connected on one screen. Turn on OAuth and copy the endpoint, or create a dedicated agent user and generate an application password, then switch on content reads and, if you want, content writes.

A pointer on the admin menu greets a brand-new install and points to the plugin page so setup is easy to find.

The onboarding "Connect your agent" step and the "Agent users" count no longer read any application password as a connected agent. They now track the agent users this plugin created, or an approved OAuth connection, so an unrelated application password stops showing a false "done" or padding the count.

Content reads (posts, pages, search, terms, media, and products) now take an optional language argument and report which language they returned, and a single-item read can fetch a specific translation. Sites without WPML are unaffected.

On a WPML site the content lists returned only the default language while the counters reported every language, so an agent was told more items existed than it could actually read. The counts now match the language the list returns.

The menu-item tools reported failure on a multilingual site even when the item was created, because WPML's language filter hid it from the re-read. They now resolve the item by id and work correctly.

Added a real-WPML contract test and a guard that fails the build if a read-only ability ever starts writing, and kept tooling directories out of the deployed package.

wc-list-customers can now filter by role, so a customer using a role other than "customer" (for example a subscriber on an LMS or membership store) is no longer invisible to the list.

wc-list-order-notes now correctly detects which notes were written by a person versus WooCommerce itself.

A payment gateway's display order now reflects its real position in WooCommerce's own list instead of always reporting zero.

Saving a payment gateway is now verified against the value WooCommerce actually stored, instead of assuming the write took effect.

The refund executor no longer crashes on a gateway that has no tax method.

Updating a WooCommerce product attribute now works the same way across WooCommerce versions instead of assuming a single schema.

WooCommerce abilities now require WooCommerce 9.1 or newer. Below that, the WooCommerce tools simply do not register, with a clear reason shown on the Integrations screen, never a fatal error.

rankmath-get-head now returns a clear error instead of an empty success when Rank Math's own head renderer is not available.

AIOSEO write verification no longer reports failure when AIOSEO makes its own benign normalization to a saved value.

A term's parent must now belong to the same hierarchical taxonomy as the term itself.

Force-deleting a page no longer reports success when another plugin vetoed the delete.

count-media no longer counts items sitting in the trash.

upload-media now fails with a clear error instead of a fatal one when the server is missing the fileinfo PHP extension.

update-site-settings now reports failure when WordPress silently reverts a value it considers invalid, instead of reporting success on a change that never took effect.

Abilities from an inactive integration are no longer wiped out when the abilities form is saved.

The agent-user picker now finds every user with an application password, not just the first page of users.

A filtered-out ability row is now actually hidden instead of staying on screen.

Corrected the reset dialog, the rate-limit help, and the privacy disclosures to match what the plugin actually does.

The activity log now attributes each call to its OAuth client, shows a result count for list and read calls, and leaves a marker behind when the log is cleared.

Denied OAuth bearer authentication attempts are now logged, and only when they match a real, if invalid, token.

The OAuth consent screen and the authorization code redirect are never cached.

The release zip no longer ships the mcp-adapter's Node package metadata, making it smaller.

Added a real-vendor contract test suite that runs against pinned WooCommerce, Rank Math, AIOSEO, and ACF plugin code, to catch API-shape regressions like several of the fixes above before release instead of after.

New installs now ship with OAuth off by default instead of on. Sites that already had OAuth on keep it on after updating, so existing connections keep working.

The OAuth consent grant could be phished into getting an administrator to approve a malicious client.

The OAuth consent screen now warns when the account approving a connection is an administrator.

The settings screen now warns you before a REST API lockdown would cut off your OAuth connections.

The MCP capability gate could quietly stop enforcing when another adapter copy loaded first. The plugin now checks that the running adapter still applies the filter, and matches it as a real call rather than a text match.

The update-user ability did not require edit_users, so an agent could change its own account beyond its own capabilities.

A bridged ability from another plugin with no destructive annotation is now treated as destructive rather than assumed safe.

The Abilities Bridge directory now shows each bridged ability's effective permission, not just its name.

WooCommerce customer listing returned zero customers on every real store, because it called a function WooCommerce does not have.

WooCommerce shipping zones came back empty on every real store.

WooCommerce order paging was ignored on stores using legacy (non-HPOS) order storage.

WooCommerce product attributes were dropped when creating a product and wiped when updating one.

Yoast's robots_noindex setting was inverted in the tool contract, so an agent wrote the opposite of what it asked for.

Rank Math social and Twitter images set by an agent now render, because the plugin writes the attachment ID instead of a URL.

AIOSEO social and Twitter images set by an agent now render. This corrects the image type, the Open Graph fallback, and a reset that was clearing a valid image.

ACF field writes reported failure on numeric and boolean values even when the value saved.

Partially updating a menu item wiped any field you did not pass instead of leaving it alone.

The page-publish permission check did not recognize custom public statuses from other plugins, blocking valid publishes.

The plugin's website link now points to agentabilitieswp.com instead of the GitHub repository.

Refreshed the documentation so the supported-client list matches what actually works: ChatGPT, Claude (the claude.ai web app and Claude Desktop), and Manus all connect by URL over OAuth, while Claude Code, Cursor, VS Code, Windsurf, and Gemini CLI connect from your own machine.

Logged-out visitors could see "There has been a critical error" on every page. It happened when another active plugin checked the current user very early in the WordPress load (The Events Calendar is one example). The plugin now waits until it has finished loading before doing that work.

Added ChatGPT as a connection option, plus a single Claude entry that covers both the Claude web app and Claude Desktop. Hosted apps like these connect by URL over OAuth, so they no longer show the application-password steps.

Manus now connects the same way, by URL over OAuth, instead of the local-bridge config it could never run as a cloud agent.

The Settings screen now saves the Enable OAuth, Dynamic Client Registration, and strict block-validation switches correctly. They were being switched off on save.

No more white screen when the standalone MCP Adapter plugin is active alongside this one.

The operating-system tabs in the connection guide now show the right instructions when you switch between them.

Tightened up the connection snippet helpers.

Tightened OAuth token scoping so an MCP access token can only authenticate the MCP endpoint and never another REST route, and closed a rare condition that could exhaust memory during connection setup.

Publishing through the write abilities now always requires publish permission, including for custom public post statuses added by other plugins.

Valid Cover and Media & Text blocks are no longer flagged as invalid by the block-safety check.

AI agents that write pages, posts, or templates are now steered to keep block styling in the block attributes instead of inline CSS, the mistake that made blocks show "unexpected or invalid content" in the editor.

Block markup is checked before it is saved, and anything that would break in the editor is flagged back to the agent to fix on its next try.

A new strict option under Safety controls rejects a write outright when its block markup would be invalid, off by default so existing sites are unchanged.

Bridge abilities from your other plugins: any active plugin that registers abilities through the WordPress Abilities API can now be exposed as a governed MCP tool, opt-in per ability and off by default, on a new "Abilities from other plugins" screen grouped by the source plugin.

Turn a whole plugin's abilities on or off at once, with each source plugin's name shown in title case.

Bridged abilities run under the full governance layer: a capability re-check on every call, rate limiting, and the same audit log as the built-in catalog.

Added a WP-CLI catalog exporter, wp aafm catalog export, that lists a site's discoverable abilities as JSON.

Refreshed the branding with a new icon, banner, and a matching admin menu mark.

Added a WordPress Playground blueprint so the plugin page can offer a one-click live preview.

Initial release.

153 governed abilities: 83 across WordPress core (reads and guarded writes for posts, pages, terms, comments, media, users, post meta, revisions, blocks, templates, and site structure, plus a search that spans every post type) and 70 from auto-detected integrations for WooCommerce, Advanced Custom Fields, Yoast, Rank Math, and All in One SEO.

Built on the WordPress Abilities API and the official MCP Adapter, with no custom transport.

Connect over OAuth in the browser, or with a least-privilege Application Password user.

Everything off by default, with two-layer capability gating and per-connection tool filtering.

Optional safety controls: rate limit, IP allowlist, force-to-draft, and title-length cap.

Audit log that records every call, denied attempts included.

Guided connection screen with endpoint diagnostics.