WordPress.org
Get WordPress

Plugin Directory

Changeset 3495168


Ignore:
Timestamp:
03/31/2026 06:11:11 AM (23 hours ago)
Author:
royalpluginsteam
Message:

Update to version 1.3.0

Location:
royal-mcp
Files:
49 added
3 edited

Legend:

Unmodified
Added
Removed

  • royal-mcp/trunk/includes/MCP/Server.php

    r3439404 r3495168  
    11<?php
    22namespace Royal_MCP\MCP;
     3
     4use Royal_MCP\Integrations\WooCommerce as WooIntegration;
     5use Royal_MCP\Integrations\GuardPress as GPIntegration;
     6use Royal_MCP\Integrations\SiteVault as SVIntegration;
    37
    48if (!defined('ABSPATH')) {
    … …  
    2024     */
    2125    private $sessions = [];
     26
     27    /**
     28     * Rate limit: max requests per window per IP
     29     */
     30    private $rate_limit_max = 60;
     31    private $rate_limit_window = 60; // seconds
    2232
    2333    /**
    … …  
    8191
    8292    /**
     93     * Validate API key for MCP authentication.
     94     * Required on initialize to create an authenticated session.
     95     *
     96     * @param \WP_REST_Request $request The request object
     97     * @return bool|WP_REST_Response True if valid, error response if invalid
     98     */
     99    private function validate_api_key($request) {
     100        $api_key = $request->get_header('X-Royal-MCP-API-Key');
     101
     102        if (empty($api_key)) {
     103            return new \WP_REST_Response([
     104                'jsonrpc' => '2.0',
     105                'error' => [
     106                    'code' => -32600,
     107                    'message' => 'Authentication required. Include X-Royal-MCP-API-Key header.',
     108                ],
     109            ], 401);
     110        }
     111
     112        $settings = get_option('royal_mcp_settings', []);
     113
     114        // Check plugin is enabled
     115        if (empty($settings['enabled'])) {
     116            return new \WP_REST_Response([
     117                'jsonrpc' => '2.0',
     118                'error' => [
     119                    'code' => -32600,
     120                    'message' => 'Royal MCP is currently disabled.',
     121                ],
     122            ], 403);
     123        }
     124
     125        // Validate key using timing-safe comparison
     126        if (empty($settings['api_key']) || !hash_equals($settings['api_key'], $api_key)) {
     127            return new \WP_REST_Response([
     128                'jsonrpc' => '2.0',
     129                'error' => [
     130                    'code' => -32600,
     131                    'message' => 'Invalid API key.',
     132                ],
     133            ], 403);
     134        }
     135
     136        return true;
     137    }
     138
     139    /**
     140     * Check rate limit for an IP address.
     141     *
     142     * @param string $ip Client IP address
     143     * @return bool|WP_REST_Response True if allowed, error response if rate limited
     144     */
     145    private function check_rate_limit($ip) {
     146        $transient_key = 'royal_mcp_rate_' . md5($ip);
     147        $data = get_transient($transient_key);
     148
     149        if ($data === false) {
     150            set_transient($transient_key, ['count' => 1, 'start' => time()], $this->rate_limit_window);
     151            return true;
     152        }
     153
     154        if (time() - $data['start'] > $this->rate_limit_window) {
     155            set_transient($transient_key, ['count' => 1, 'start' => time()], $this->rate_limit_window);
     156            return true;
     157        }
     158
     159        $data['count']++;
     160        set_transient($transient_key, $data, $this->rate_limit_window);
     161
     162        if ($data['count'] > $this->rate_limit_max) {
     163            return new \WP_REST_Response([
     164                'jsonrpc' => '2.0',
     165                'error' => [
     166                    'code' => -32600,
     167                    'message' => 'Rate limit exceeded. Maximum ' . $this->rate_limit_max . ' requests per minute.',
     168                ],
     169            ], 429);
     170        }
     171
     172        return true;
     173    }
     174
     175    /**
    83176     * Validate Accept header for POST requests
    84177     * Per MCP spec: Client MUST include Accept header with both application/json and text/event-stream
    … …  
    165258
    166259    private function get_tools() {
    167         return [
     260        $tools = [
    168261            // Posts
    169262            ['name' => 'wp_get_posts', 'description' => 'Get WordPress posts', 'inputSchema' => ['type' => 'object', 'properties' => ['per_page' => ['type' => 'integer', 'description' => 'Number of posts (max 100)'], 'search' => ['type' => 'string', 'description' => 'Search term'], 'status' => ['type' => 'string', 'description' => 'Post status (publish, draft, etc)']]]],
    … …  
    224317            ['name' => 'wp_get_themes', 'description' => 'Get installed themes', 'inputSchema' => ['type' => 'object', 'properties' => new \stdClass()]],
    225318        ];
     319
     320        // Conditionally add integration tools
     321        $tools = array_merge( $tools, WooIntegration::get_tools() );
     322        $tools = array_merge( $tools, GPIntegration::get_tools() );
     323        $tools = array_merge( $tools, SVIntegration::get_tools() );
     324
     325        return $tools;
    226326    }
    227327
    … …  
    242342        if ($origin_check !== true) {
    243343            return $origin_check;
     344        }
     345
     346        // Rate limiting
     347        $client_ip = isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '127.0.0.1';
     348        $rate_check = $this->check_rate_limit($client_ip);
     349        if ($rate_check !== true) {
     350            return $rate_check;
    244351        }
    245352
    … …  
    279386        $response->header('Access-Control-Allow-Origin', '*');
    280387        $response->header('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
    281         $response->header('Access-Control-Allow-Headers', 'Content-Type, Accept, Mcp-Session-Id');
     388        $response->header('Access-Control-Allow-Headers', 'Content-Type, Accept, Mcp-Session-Id, X-Royal-MCP-API-Key');
    282389        $response->header('Access-Control-Max-Age', '86400');
    283390        return $response;
    … …  
    379486        // Get session ID from header
    380487        $session_id = $request->get_header('Mcp-Session-Id');
     488
     489        // For initialize requests, require API key authentication
     490        if ($method === 'initialize') {
     491            $auth_check = $this->validate_api_key($request);
     492            if ($auth_check !== true) {
     493                return $auth_check;
     494            }
     495        }
    381496
    382497        // For non-initialize requests, validate session
    … …  
    825940                    'comment_author' => sanitize_text_field($args['author'] ?? 'Anonymous'),
    826941                    'comment_author_email' => sanitize_email($args['author_email'] ?? ''),
    827                     'comment_approved' => 1,
    828                 ];
     942                ];
     943                // Respect WordPress comment moderation settings
     944                $comment_data['comment_approved'] = wp_allow_comment($comment_data);
    829945                $comment_id = wp_insert_comment($comment_data);
    830946                if (!$comment_id) throw new \Exception('Failed to create comment');
    831                 return ['id' => $comment_id, 'message' => 'Comment created successfully'];
     947                $status = $comment_data['comment_approved'] === 1 ? 'approved' : 'pending moderation';
     948                return ['id' => $comment_id, 'message' => 'Comment created (' . $status . ')'];
    832949
    833950            case 'wp_delete_comment':
    … …  
    845962                    return [
    846963                        'id' => $u->ID,
    847                         'username' => $u->user_login,
    848                         'email' => $u->user_email,
    849964                        'display_name' => $u->display_name,
    850965                        'roles' => $u->roles,
    … …  
    857972                return [
    858973                    'id' => $user->ID,
    859                     'username' => $user->user_login,
    860                     'email' => $user->user_email,
    861974                    'display_name' => $user->display_name,
    862975                    'roles' => $user->roles,
    … …  
    874987
    875988            case 'wp_update_post_meta':
    876                 $result = update_post_meta(intval($args['post_id']), sanitize_text_field($args['key']), $args['value']);
     989                $meta_value = $args['value'];
     990                if (is_string($meta_value)) {
     991                    $meta_value = sanitize_text_field($meta_value);
     992                } elseif (is_array($meta_value)) {
     993                    $meta_value = array_map('sanitize_text_field', $meta_value);
     994                }
     995                $result = update_post_meta(intval($args['post_id']), sanitize_text_field($args['key']), $meta_value);
    877996                return ['message' => 'Post meta updated successfully', 'result' => $result];
    878997
    … …  
    8881007                    'description' => get_bloginfo('description'),
    8891008                    'url' => home_url(),
    890                     'admin_email' => get_bloginfo('admin_email'),
    8911009                    'language' => get_locale(),
    8921010                    'timezone' => wp_timezone_string(),
    8931011                    'wp_version' => get_bloginfo('version'),
    894                     'php_version' => phpversion(),
    8951012                ];
    8961013
    … …  
    9661083
    9671084            default:
     1085                // Route to integration handlers
     1086                if ( strpos( $name, 'wc_' ) === 0 ) {
     1087                    return WooIntegration::execute_tool( $name, $args );
     1088                }
     1089                if ( strpos( $name, 'gp_' ) === 0 ) {
     1090                    return GPIntegration::execute_tool( $name, $args );
     1091                }
     1092                if ( strpos( $name, 'sv_' ) === 0 ) {
     1093                    return SVIntegration::execute_tool( $name, $args );
     1094                }
    9681095                throw new \Exception('Unknown tool: ' . esc_html($name));
    9691096        }

  • royal-mcp/trunk/readme.txt

    r3479831 r3495168  
    22Contributors: royalpluginsteam
    33Donate link: https://www.royalplugins.com
    4 Tags: wordpress mcp, ai integration, claude wordpress, model context protocol, chatgpt wordpress
     4Tags: mcp, ai wordpress, claude wordpress, woocommerce ai, wordpress ai integration
    55Requires at least: 5.8
    6 Tested up to: 6.9.3
    7 Stable tag: 1.2.3
     6Tested up to: 6.9
     7Stable tag: 1.3.0
    88Requires PHP: 7.4
    99License: GPLv2 or later
    1010License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1111
    12 WordPress MCP plugin that connects AI platforms like Claude, ChatGPT, and Gemini to your site using Model Context Protocol for secure content access.
     12The security-first MCP server for WordPress. Connect Claude, ChatGPT, and Gemini with API key auth, rate limiting, and activity logging.
    1313
    1414== Description ==
    1515
    16 Royal MCP enables AI platforms like Claude, OpenAI, and Google Gemini to securely interact with your WordPress content through the Model Context Protocol (MCP).
    17 
    18 **Key Features:**
    19 
    20 * **Multi-Platform Support** - Connect Claude, OpenAI, Google Gemini, Mistral, Perplexity, Groq, and more
    21 * **REST API Access** - Expose posts, pages, media, and users to AI platforms
    22 * **Secure Authentication** - API key authentication protects your endpoints
    23 * **Activity Logging** - Track all AI interactions with your site
    24 * **Claude Desktop Integration** - Native MCP connector for Claude Desktop app
    25 
    26 **Supported AI Platforms:**
    27 
    28 * Claude (Anthropic)
    29 * OpenAI (GPT-4, GPT-3.5)
    30 * Google Gemini
    31 * Mistral AI
    32 * Perplexity
    33 * Groq
    34 * Cohere
    35 * Together AI
    36 * DeepSeek
    37 * And more...
    38 
    39 **API Endpoints:**
    40 
    41 * `/wp-json/royal-mcp/v1/posts` - Access posts
    42 * `/wp-json/royal-mcp/v1/pages` - Access pages
    43 * `/wp-json/royal-mcp/v1/media` - Access media library
    44 * `/wp-json/royal-mcp/v1/users` - Access user data (public info only)
     16Royal MCP is a security-first Model Context Protocol (MCP) server for WordPress. It gives AI platforms like Claude, ChatGPT, and Google Gemini structured access to your WordPress content — with authentication, rate limiting, and audit logging that most MCP implementations skip entirely.
     17
     18According to [recent security research](https://mcpplaygroundonline.com/blog/mcp-server-security-complete-guide-2026), 41% of public MCP servers have no authentication and respond to tool calls without any credentials. Royal MCP takes the opposite approach: every MCP session requires an API key, every request is rate-limited, and every interaction is logged.
     19
     20= Why Security Matters for MCP =
     21
     22MCP gives AI agents the ability to read, create, update, and delete your WordPress content. Without proper authentication, anyone who discovers your MCP endpoint can:
     23
     24* Read all your posts, pages, and media
     25* Create or delete content
     26* Access user data and plugin information
     27* Overwhelm your server with rapid-fire requests
     28
     29Royal MCP prevents all of this with API key authentication on session initialization, timing-safe key comparison, per-IP rate limiting (60 requests/minute), and a full activity log of every MCP interaction.
     30
     31= 37+ MCP Tools Built In =
     32
     33**WordPress Core (37 tools):**
     34
     35* Posts — create, read, update, delete, search, count
     36* Pages — full CRUD with parent page support
     37* Media — library browsing, metadata, deletion
     38* Comments — create (respects moderation settings), read, delete
     39* Users — display names and roles (emails and usernames are not exposed)
     40* Categories & Tags — create, assign, delete, count
     41* Menus — list menus and menu items
     42* Post Meta — read, update, delete custom fields
     43* Site Info — site name, description, WordPress version, timezone
     44* Plugins & Themes — list installed plugins and themes with active status
     45* Search — full-text content search across post types
     46* Options — read allowlisted safe options only
     47
     48= Plugin Integrations (Conditional) =
     49
     50Royal MCP automatically detects compatible plugins and adds specialized MCP tools. No configuration needed — if the plugin is active, the tools appear.
     51
     52**WooCommerce Integration (9 tools):**
     53When WooCommerce is active, AI agents can manage your store:
     54
     55* Browse and search products by category, status, or type
     56* Create and update products with prices, SKUs, stock levels
     57* View orders, order details, and update order status
     58* List customers with order count and total spent
     59* Get store statistics — revenue, order count, average order value by period
     60
     61**GuardPress Integration (7 tools):**
     62When GuardPress is active, AI agents can monitor your site security:
     63
     64* Get current security score and grade with factor breakdown
     65* View security statistics — failed logins, blocked IPs, alerts
     66* Run vulnerability scans and review results
     67* List blocked IP addresses and failed login attempts
     68* Browse the security audit log filtered by severity
     69
     70**SiteVault Integration (6 tools):**
     71When SiteVault is active, AI agents can manage your backups:
     72
     73* List available backups filtered by status or type
     74* Trigger new backups (full, database, files, plugins, themes)
     75* Check backup progress in real time
     76* View backup statistics — total size, last backup, counts
     77* List and review backup schedules
     78
     79= Works Alongside WordPress Core MCP =
     80
     81WordPress is building MCP support into core via the Abilities API. Royal MCP complements this by providing security controls that the core implementation does not include — API key authentication, rate limiting, activity logging, and sensitive data filtering. When the Abilities API ships, Royal MCP will continue to provide the security layer, plugin integrations, and WooCommerce tools that core does not cover.
     82
     83= Supported AI Platforms =
     84
     85* **Claude (Anthropic)** — Full MCP support via Claude Desktop, Claude Code, and VS Code
     86* **OpenAI / ChatGPT** — GPT-4o, GPT-4 Turbo, GPT-3.5 Turbo
     87* **Google Gemini** — Gemini 1.5 Pro, 1.5 Flash
     88* **Groq** — Llama 3.3, Mixtral, Gemma 2
     89* **Azure OpenAI** — Azure-hosted OpenAI deployments
     90* **AWS Bedrock** — Claude, Llama, Titan models
     91* **Ollama / LM Studio** — Local self-hosted models (no external data transmission)
     92* **Custom MCP Servers** — Connect to any MCP-compatible endpoint
     93
     94= MCP Spec Compliance =
     95
     96Royal MCP implements the [MCP 2025-03-26 Streamable HTTP transport specification](https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#streamable-http):
     97
     98* Single `/mcp` endpoint for all JSON-RPC communication
     99* POST for client messages, GET for server-sent events, DELETE for session termination
     100* Cryptographically secure session IDs with transient-based storage
     101* Origin header validation to prevent DNS rebinding attacks
     102* Proper CORS handling for browser-based MCP clients
    45103
    46104== External Services ==
    … …  
    48106This plugin connects to third-party AI services to enable AI platforms to interact with your WordPress content. **No data is transmitted until you explicitly configure and enable a platform connection.**
    49107
    50 **What data is sent:** Your WordPress content (posts, pages, media metadata) as requested by the connected AI platform.
    51 
    52 **When data is sent:** Only when you have configured a platform with API credentials AND enabled that platform connection AND the AI platform makes a request.
     108**What data is sent:** Your WordPress content (posts, pages, media metadata) as requested by the connected AI platform through authenticated MCP tool calls.
     109
     110**When data is sent:** Only when you have configured a platform with API credentials AND enabled that platform connection AND the AI platform makes an authenticated request.
    53111
    54112**Supported services and their policies:**
    55113
    56 * **Anthropic Claude** - Used for Claude AI integration
     114* **Anthropic Claude** — Used for Claude AI integration
    57115  [Terms of Service](https://www.anthropic.com/legal/consumer-terms) | [Privacy Policy](https://www.anthropic.com/legal/privacy)
    58116
    59 * **OpenAI** - Used for ChatGPT/GPT-4 integration
     117* **OpenAI** — Used for ChatGPT/GPT-4 integration
    60118  [Terms of Use](https://openai.com/policies/terms-of-use) | [Privacy Policy](https://openai.com/policies/privacy-policy)
    61119
    62 * **Google Gemini** - Used for Gemini AI integration
     120* **Google Gemini** — Used for Gemini AI integration
    63121  [Terms of Service](https://ai.google.dev/terms) | [Privacy Policy](https://policies.google.com/privacy)
    64122
    65 * **Groq** - Used for Groq LPU inference
     123* **Groq** — Used for Groq LPU inference
    66124  [Terms of Service](https://groq.com/terms-of-use/) | [Privacy Policy](https://groq.com/privacy-policy/)
    67125
    68 * **Microsoft Azure OpenAI** - Used for Azure-hosted OpenAI models
     126* **Microsoft Azure OpenAI** — Used for Azure-hosted OpenAI models
    69127  [Terms of Service](https://azure.microsoft.com/en-us/support/legal/) | [Privacy Policy](https://privacy.microsoft.com/en-us/privacystatement)
    70128
    71 * **AWS Bedrock** - Used for AWS-hosted AI models
     129* **AWS Bedrock** — Used for AWS-hosted AI models
    72130  [Terms of Service](https://aws.amazon.com/service-terms/) | [Privacy Policy](https://aws.amazon.com/privacy/)
    73131
    74 * **Ollama / LM Studio** - Local self-hosted models (no external data transmission)
    75 
    76 * **Custom MCP Servers** - User-configured servers (data sent to user-specified endpoints only)
     132* **Ollama / LM Studio** — Local self-hosted models (no external data transmission)
     133
     134* **Custom MCP Servers** — User-configured servers (data sent to user-specified endpoints only)
    77135
    78136== Installation ==
    … …  
    811392. Activate the plugin through the 'Plugins' menu in WordPress
    821403. Go to Royal MCP → Settings to configure
    83 4. Add your AI platform(s) and enter API keys
    84 5. Copy your WordPress API key and REST URL for use in AI clients
     1414. Copy your API key — you will need this to authenticate MCP connections
     1425. Add your AI platform(s) and enter their API keys
     1436. In your AI client (Claude Desktop, VS Code, etc.), configure the MCP server URL and API key
     144
     145Full setup guides for each platform are available at [royalplugins.com/support/royal-mcp/](https://royalplugins.com/support/royal-mcp/).
    85146
    86147== Frequently Asked Questions ==
    87148
    88 = What is MCP? =
    89 
    90 Model Context Protocol (MCP) is a standard for connecting AI assistants to external data sources. It allows AI platforms to securely access your WordPress content.
    91 
    92 = Is my data secure? =
    93 
    94 Yes. All API endpoints require authentication via API key. Activity logging tracks all requests. No data is sent to external servers without your explicit configuration.
    95 
    96 = Which AI platforms are supported? =
    97 
    98 Claude, OpenAI, Google Gemini, Mistral, Perplexity, Groq, Cohere, Together AI, DeepSeek, and any platform supporting REST API connections.
    99 
    100 = How do I connect Claude to WordPress? =
    101 
    102 Install Royal MCP, go to Royal MCP → Settings, select Claude as your platform, and enter your Anthropic API key. The plugin provides a REST API endpoint URL and authentication key that you paste into Claude Desktop's MCP configuration. Full setup guide at royalplugins.com/support/royal-mcp/.
    103 
    104 = Can I use ChatGPT with WordPress? =
    105 
    106 Yes! Royal MCP supports OpenAI's GPT-4 and GPT-3.5 models. Configure your OpenAI API key in the plugin settings, and ChatGPT can access your WordPress posts, pages, and media through the Model Context Protocol.
    107 
    108 = What is Model Context Protocol for WordPress? =
    109 
    110 Model Context Protocol (MCP) is an open standard that lets AI assistants securely read and interact with external data sources. Royal MCP implements this protocol for WordPress, giving AI platforms like Claude, ChatGPT, and Gemini structured access to your site content through authenticated REST API endpoints.
    111 
    112 = Does this work with Claude Desktop? =
    113 
    114 Yes! Royal MCP includes native Claude Desktop MCP connector settings for easy integration.
     149= What is MCP and why does my WordPress site need it? =
     150
     151Model Context Protocol (MCP) is an open standard created by Anthropic that lets AI assistants interact with external data sources. Without MCP, AI tools like Claude or ChatGPT can only work with content you copy and paste into them. With Royal MCP installed, these AI platforms can directly read your WordPress posts, create new content, manage your WooCommerce products, check your security status, and trigger backups — all through a structured, authenticated protocol.
     152
     153= How is Royal MCP different from other WordPress MCP plugins? =
     154
     155Security. Most MCP plugins — and 41% of all public MCP servers — have no authentication at all. Royal MCP requires an API key for every session, rate-limits requests to prevent abuse, logs every interaction for audit purposes, and filters sensitive data (emails, PHP version, admin credentials) from responses. We built this plugin with the same security standards we apply to GuardPress, our WordPress security plugin used on thousands of sites.
     156
     157= Will WordPress core make this plugin unnecessary? =
     158
     159No. WordPress is adding MCP support through the Abilities API, which will allow plugins to register "abilities" that AI agents can call. Royal MCP complements this by adding security controls (API key auth, rate limiting, activity logging), plugin-specific integrations (WooCommerce, GuardPress, SiteVault), and sensitive data filtering that the core implementation does not include.
     160
     161= Does Royal MCP work with WooCommerce? =
     162
     163Yes. When WooCommerce is active, Royal MCP automatically adds 9 additional MCP tools for product management (create, update, search), order management (view, update status), customer data, and store statistics. No additional configuration is needed — the tools appear automatically in the MCP tools list.
     164
     165= How do I connect Claude Desktop to WordPress? =
     166
     167Install Royal MCP, go to Royal MCP → Settings, and copy your API key and MCP server URL. In Claude Desktop, add a new MCP server configuration with the URL and include the `X-Royal-MCP-API-Key` header with your API key. Full step-by-step guide at [royalplugins.com/support/royal-mcp/](https://royalplugins.com/support/royal-mcp/).
     168
     169= Is my content safe? =
     170
     171Royal MCP is designed with defense in depth. API key authentication is required for all MCP sessions. Rate limiting prevents abuse (60 requests per minute per IP). Activity logging records every tool call. Sensitive data is filtered — user emails, usernames, admin email, and PHP version are never exposed through MCP. Comment creation respects your WordPress moderation settings. Post meta values are sanitized before storage. And the plugin starts disabled by default — nothing is accessible until you explicitly enable it.
     172
     173= Can I use local AI models instead of cloud services? =
     174
     175Yes. Royal MCP supports Ollama and LM Studio for fully local AI inference. When using local models, no data leaves your server — the AI model runs on your own hardware and communicates with WordPress through the MCP protocol on localhost.
     176
     177= What happens if I uninstall Royal MCP? =
     178
     179Royal MCP performs a clean uninstall. All plugin options, database tables (activity logs), transients, and user meta are removed. No orphaned data is left behind.
    115180
    116181== Screenshots ==
    117182
    118 1. Main settings page with plugin overview
    119 2. AI platform settings and API key configuration
    120 3. Activity log showing API requests
    121 4. Claude Desktop MCP connector configuration
    122 5. Claude MCP connection verification
     1831. Main settings page with API key and platform overview
     1842. AI platform configuration with connection testing
     1853. Activity log showing authenticated MCP requests
     1864. Claude Desktop MCP connector setup
     1875. WooCommerce product management via Claude
    123188
    124189== Changelog ==
    125190
     191= 1.3.0 =
     192* New: WooCommerce integration — 9 MCP tools for products, orders, customers, and store stats (auto-detected)
     193* New: GuardPress integration — 7 MCP tools for security score, scans, firewall logs, and audit trail (auto-detected)
     194* New: SiteVault integration — 6 MCP tools for backup management, scheduling, and progress tracking (auto-detected)
     195* Security: MCP endpoint now requires API key authentication via X-Royal-MCP-API-Key header
     196* Security: Added rate limiting (60 requests/minute per IP) to prevent abuse and accidental DoS
     197* Security: API key comparison uses timing-safe hash_equals() to prevent timing attacks
     198* Security: Sanitized wp_update_post_meta values before storage
     199* Security: Comments created via MCP now respect WordPress moderation settings
     200* Security: Removed admin_email and php_version from wp_get_site_info response
     201* Security: Removed user_login and user_email from wp_get_users/wp_get_user responses
     202* Improved: CORS headers include X-Royal-MCP-API-Key for cross-origin MCP clients
     203
    126204= 1.2.3 =
    127 * Security: Added SSRF protection — validates all outbound URLs against private/reserved IP ranges and unsafe schemes
     205* Security: Added SSRF protection — validates all outbound URLs against private/reserved IP ranges
    128206* Fixed: Text domain changed from 'wp-royal-mcp' to 'royal-mcp' to match plugin slug
    129 * Fixed: Menu slugs updated from 'wp-royal-mcp' to 'royal-mcp' for WP.org compliance
    130 * Fixed: Installation instructions updated to reference correct folder name
    131 * Improved: REST API permission callbacks now include explanatory comments for reviewers
    132 * Improved: Custom MCP server placeholder text clarified
    133 * Compatibility: Tested up to WordPress 6.9.3
     207* Fixed: Menu slugs updated for WP.org compliance
     208* Improved: REST API permission callbacks include explanatory comments for reviewers
     209* Compatibility: Tested up to WordPress 6.9
    134210
    135211= 1.2.2 =
    136212* Added: Documentation link on Plugins page (Settings | Documentation)
    137 * Added: Documentation banner on settings page with link to support docs
     213* Added: Documentation banner on settings page
    138214
    139215= 1.2.1 =
    140 * Fixed: Claude Connector setup guide link displaying raw HTML instead of clickable link
     216* Fixed: Claude Connector setup guide link displaying raw HTML
    141217
    142218= 1.2.0 =
    143 * Security: Added Origin header validation to prevent DNS rebinding attacks
    144 * Security: Added session ID format validation (ASCII visible characters only)
    145 * Improved: MCP 2025-03-26 spec compliance for Streamable HTTP transport
    146 * Improved: Proper Accept header validation on POST requests
    147 * Improved: Session management with proper 400/404 responses per MCP spec
    148 * Improved: GET stream handler with proper SSE headers
    149 * Improved: DELETE session handler for explicit session termination
    150 * Fixed: Platform model selector not retaining saved value in admin settings
     219* Security: Origin header validation to prevent DNS rebinding attacks
     220* Security: Session ID format validation (ASCII visible characters only)
     221* Improved: MCP 2025-03-26 Streamable HTTP spec compliance
    151222* Added: Filter hook `royal_mcp_allowed_origins` for custom origin allowlist
    152223
    153224= 1.1.0 =
    154 * Added multi-platform AI support
     225* Added multi-platform AI support (Claude, OpenAI, Gemini, Groq, Azure, Bedrock)
    155226* Added Claude Desktop MCP connector
    156227* Added activity logging
    157 * Improved admin interface
    158228* Added connection testing
    159229
    … …  
    163233== Upgrade Notice ==
    164234
     235= 1.3.0 =
     236Major security and feature update. MCP endpoint now requires API key authentication. Added WooCommerce, GuardPress, and SiteVault integrations (22 new tools). Rate limiting added. Recommended update for all users.
     237
    165238= 1.2.3 =
    166 Security: SSRF protection for outbound requests. WordPress.org compliance fixes. Tested with WordPress 6.9.3.
    167 
    168 = 1.2.2 =
    169 Added documentation links for easier access to setup guides and support.
     239Security: SSRF protection for outbound requests. WordPress.org compliance fixes.
    170240
    171241= 1.2.0 =
    172242Security hardening and MCP spec compliance improvements. Recommended update for all users.
    173 
    174 = 1.1.0 =
    175 Major update with multi-platform support and Claude Desktop integration.

  • royal-mcp/trunk/royal-mcp.php

    r3479831 r3495168  
    44 * Plugin URI: https://royalplugins.com/support/royal-mcp/
    55 * Description: Integrate Model Context Protocol (MCP) servers with WordPress to enable LLM interactions with your site
    6  * Version: 1.2.3
     6 * Version: 1.3.0
    77 * Author: Royal Plugins
    88 * Author URI: https://www.royalplugins.com
    … …  
    2121
    2222// Define plugin constants
    23 define('ROYAL_MCP_VERSION', '1.2.3');
     23define('ROYAL_MCP_VERSION', '1.3.0');
    2424define('ROYAL_MCP_PLUGIN_DIR', plugin_dir_path(__FILE__));
    2525define('ROYAL_MCP_PLUGIN_URL', plugin_dir_url(__FILE__));
Note: See TracChangeset for help on using the changeset viewer.