ByteCoreStack – MCP Connector for AI Tools

Log Perubahan

1.2.2

• Added 19 new WordPress AI tools, bringing the total to 335+: plugin/theme install-from-WordPress.org and update-to-latest (wp_install_plugin, wp_update_plugin, wp_install_theme, wp_update_theme), a WordPress core update tool (wp_update_core), WP-Cron event scheduling and deletion (wp_schedule_cron_event, wp_delete_cron_event), classic widget add/remove (wp_add_widget, wp_remove_widget), a Redirection update tool (redirection_update_redirect), a Gravity Forms entry delete tool (gf_delete_entry), bbPress reply posting and moderation (bbp_create_reply, bbp_moderate_reply), an Easy Digital Downloads refund tool (edd_refund_order), an AffiliateWP affiliate approve/reject tool (affwp_set_affiliate_status), GiveWP donation recording and refund tools (givewp_create_donation, givewp_refund_donation), a Code Snippets activate/deactivate tool (code_snippets_set_active), and a two-factor reset tool (wp_reset_2fa)
• Plugin and theme installs are restricted to the WordPress.org directory by slug — no tool accepts an arbitrary download URL
• Security: wp_add_widget runs string values in settings through wp_kses_post before saving. Writing directly to the widget option bypasses the widget’s own WP_Widget::update(), which is what normally sanitizes saved content, so this closes a path for unescaped markup to reach the public-facing site via a widget’s front-end render.
• Documentation: added an External Services disclosure for wp_install_plugin, wp_update_plugin, wp_install_theme, wp_update_theme, and wp_update_core, which contact the official WordPress.org API using WordPress core’s own installer/updater classes — the same servers and code path as wp-admin’s “Install Now”/”Update Now” — and documented that these tools accept a plugin/theme slug only, never an arbitrary download URL, per the WordPress.org Plugin Directory guideline on not installing code from third-party servers
• Redesigned the plugin’s admin UI: added a one-click light/dark theme switcher (light by default, remembered per browser) next to Settings on every screen, refreshed the color palette and typography, gave buttons and icon controls a consistent rounded style, and reworked the Tools browser’s category list into an animated, easier-to-scan accordion — all scoped to this plugin’s own admin pages, with no effect on the rest of wp-admin
• New optional safeguard: a “Require confirmation for destructive actions” toggle in Settings (off by default). When enabled, the ~28 delete-type tools (posts, pages, media, terms, comments, users, menus, cron events, widgets, transients, and the WooCommerce/ACF/Gravity Forms/Events Calendar/CPT UI equivalents) return a preview of what would happen instead of executing on their first call, and only run once the connecting AI client resubmits the identical call with an added "confirm": true argument

1.2.1

• Fixed: uninstalling the plugin left the bcs_mcp_review_notice option behind instead of removing it along with the plugin’s other options, contradicting this readme’s “clean uninstall, no orphaned data” claim
• Hardened: the sensitive-value redaction list (used by the Activity Log and by generic postmeta/usermeta read tools) now also matches meta keys containing the bare substring pass — e.g. a third-party plugin storing a credential under a key like smtp_pass or ftp_pass is now redacted; previously only keys containing the full word password or passwd were caught
• Fixed: security plugins that ship a “restrict the REST API to logged-in users” toggle (Wordfence, All In One WP Security, and similar) could block AI clients entirely, since this plugin’s MCP/OAuth routes are intentionally anonymous at the WordPress-login level and authenticate the caller themselves via OAuth Bearer token. This plugin’s own routes are now automatically exempted from that kind of blanket lockdown set by another plugin.
• Diagnostics: the “OAuth discovery endpoint reachable” check now gives a specific, actionable message based on the actual HTTP status returned (401/403/406 now correctly points at a firewall/security-plugin block instead of the generic “rewrite rules” message) instead of one generic failure message for every cause
• Diagnostics: added a new check that detects active security plugins (Wordfence, All In One WP Security, iThemes/Solid Security, Sucuri Security, WP Cerber) and lists exactly which URLs and HTTP methods to allowlist in their firewall if a client still can’t connect
• Diagnostics: the discovery-endpoint check now also detects when a 404 response never actually reached WordPress at all (identified by the response missing any PHP/WordPress fingerprint). Previously this was misreported as “rewrite rules not flushed,” which sent people to the wrong settings screen; it now correctly says this needs a firewall/allowlist fix, and explicitly names any active security plugin that could be the cause (its own protection layer, e.g. Wordfence’s “Extended Protection” mode, can run before WordPress loads exactly like a host or CDN block would) rather than only pointing at the host/CDN
• Added a dedicated FAQ entry with step-by-step guidance for Wordfence/AIOS/firewall-blocked connections and for the server/CDN-level .well-known blocking case
• New: a proactive admin notice (shown on the Plugins screen and this plugin’s own screens, not just when you manually run Diagnostics) that detects OAuth discovery/registration problems automatically — a host or CDN blocking /.well-known/* before PHP runs, Sucuri/CloudProxy specifically, a response that’s HTML instead of JSON (another plugin or theme intercepting the request), Plain permalinks, or a host redirecting POST /register to /register/ with a 301 (which OAuth clients don’t follow, silently breaking registration even when discovery works). Each case gets its own specific fix, and the notice is dismissible and re-checkable per admin
• Fixed: clicking “Test Connection” on the Diagnostics page didn’t clear the separate cache the admin notice above uses, so the notice could keep reporting an already-fixed problem for up to its own refresh interval. Both now refresh together
• Fixed: a rejected connection attempt (an invalid/expired token, an IP-allowlist block, or a rate limit) never appeared in the Activity Log at all — only successful tool calls were recorded, so a failing connection looked like total silence with nothing to debug from. These rejections are now logged with a specific reason (e.g. “token was explicitly revoked” vs. “token expired at … UTC” vs. “no matching access token found — never issued, or issued by a different site/environment”) instead of the generic “invalid or expired” message alone. The routine unauthenticated request every OAuth client sends first (before it has a token) is deliberately not logged, since logging that would flood the log with noise rather than signal
• Documentation: identified SiteGround specifically (via its X-CDN-C: static free-CDN response header) as the most common cause of the “host/CDN blocking .well-known/” case — SiteGround’s nginx reserves that entire path prefix for its own SSL certificate validation, fleet-wide, and per multiple reports won’t adjust it per-site even on request. Added FAQ guidance covering how to identify it, the Cloudflare-edge-proxy workaround other SiteGround-hosted sites have used, and the tradeoffs of working around it by manually supplying an OAuth Client ID/Secret in your AI client instead of relying on automatic discovery
• Documentation: added an FAQ entry explaining “This connector has no tools available” on a first-time connection that resolves after disconnect/reconnect — confirmed via Anthropic’s own issue tracker to be a Claude Desktop client-side bug (zero traffic reaches the server during the failure), not something a server-side fix can address

1.2.0

• Added 96+ new WordPress AI tools, bringing the total to 316+ across all supported integrations
• New integrations: MonsterInsights, Sucuri Security, and TranslatePress, plus WP Mail SMTP configuration status
• Fixed: admin screens were loading DM Sans / DM Mono from Google’s font CDN on every page view even though local copies were already bundled; now fully self-hosted with no external requests

1.1.0

This release adds 56 new WordPress MCP tools (215+ total, up from 150+), six more SEO plugin integrations, two new community/events integrations, a dedicated connection diagnostics page, and a redesigned admin dashboard — plus security hardening and bug fixes. Fully backward compatible: existing OAuth connections, access tokens, Activity Log history, and settings are preserved automatically on update — no re-authorization, reconfiguration, or action of any kind is required from existing users. Full details below.

New: SEO tools now support 6 plugins (was 2)
* SEO meta tools (per-post title/description/focus keyword/noindex, bulk SEO audit, site-wide title separator and homepage settings) now auto-detect and support Yoast SEO, Rank Math, All in One SEO (AIOSEO), SEOPress, Slim SEO, and The SEO Framework
* AIOSEO is read and written directly through its own database table (not postmeta), matching how AIOSEO v4+ actually stores data

New: Community & Events integrations
* BuddyPress — list members, read extended profile (xProfile) fields, read and post to the activity stream, list and create groups, list group members, list friend connections
* The Events Calendar — full event CRUD (create, read, update, delete), plus venues, organizers, and event categories

New: Forms, LMS & e-commerce integrations
* Contact Form 7 — list forms, read form fields and mail settings
* WPForms — list forms, read entries (requires WPForms Pro or entry storage enabled)
* Ninja Forms — list forms, read submissions
* MemberPress — list memberships and members, get a member’s subscriptions and transaction history
* LearnDash — list courses, get a user’s course progress, enroll/unenroll a user
* Easy Digital Downloads — products, orders, single order detail, customers, store stats
* WooCommerce Subscriptions & Bookings — list subscriptions, cancel a subscription, list bookings (added to the existing WooCommerce category)

New: Page builder & site management integrations
* Bricks Builder — read a page’s element tree, clone a page with its Bricks content
* Divi Builder — read a page’s shortcode content, clone a page with its Divi content
* Redirection — list, create, and delete URL redirects
* UpdraftPlus (Backup & Migration) — list backup sets, trigger a new backup, check job status
* FluentCRM (Email / CRM) — list contacts, create or update a contact by email, list email campaigns

New: Core WordPress tools
* Cache status detection — reports which page-caching and object-caching plugins are active
* Users CSV export
* Full Site Health diagnostics — runs the same tests shown under Tools → Site Health and summarizes critical/recommended/passed counts
* wp_bulk_delete_comments — delete or trash multiple comments by ID in one call
* wp_duplicate_menu — duplicate a nav menu including all of its items
* wp_get_multisite_info — check multisite status and list network sites

New: Admin dashboard & setup experience
* Dedicated “Connection Test” page (between Settings and Activity Log) — checks HTTPS, permalinks, and live MCP/OAuth-discovery endpoint reachability, and reports the specific reason a connection would fail instead of a generic error
* “Setup Health” checklist on the Dashboard — at-a-glance status for server enabled, HTTPS, pretty permalinks, and whether an AI client is connected, with a “Fix now →” shortcut
* In-admin review prompt (shown only on this plugin’s own screens, only after real successful tool calls) with “Remind me later” and “No thanks” options — never shown on first activation

Improved: Dashboard & Settings UI
* The “Enable MCP Server” toggle is now a full-width, color-coded banner at the top of Settings instead of a small switch buried inside a card
* Removed the “Quick Connect” card from the Dashboard (it duplicated the per-client setup steps already on Settings); the “WordPress Tools” browser now spans the full page width
* Dashboard pairs “Setup Health” on the left with the stat cards on the right (3 per row, 2 rows), matched to equal height
* Setup Health checklist rows show a check/warning icon and a “Ready” / “Needs attention” status tag, and are noticeably more compact
* “Recent Activity” and “Most Used Tools” are now always shown side by side (2/3 + 1/3 columns) instead of “Most Used Tools” being hidden entirely until there’s data — it now shows an empty state like Recent Activity does
* Activity Log pagination now truncates to “1 2 3 … 8 9 10” style instead of listing every page number when there are many pages
* Fixed excess vertical spacing between the tool name and its usage bar in “Most Used Tools” (Dashboard and Settings)

Improved: Connection Test & Activity Log
* Redesigned the “Connected AI Clients” list on Connection Test: branded per-client color and avatar, total calls, calls today, and a session-expiry countdown, plus a “View activity” button that jumps straight to the Activity Log pre-filtered to that client
* Activity Log table no longer scrolls inside its own box — it now scrolls with the page like the rest of the admin screen
* Activity Log gained a “Show ⌄ per page” control (10 / 20 / 50 / 100, default 20); pagination now sits to the right of it instead of centered alone
* “Last tested” timestamp on Connection Test now displays in the site’s configured local timezone (Settings → General → Timezone) instead of the server’s UTC time
* Removed the redundant per-client “connected X ago” breakdown from the Dashboard’s Setup Health card — the full detail now lives on the Connection Test page
* Removed the “No test run yet” placeholder that could stay visible after a test had actually completed

Fixed
* tools/list now actually filters out addon-gated tools whose required plugin isn’t active, instead of advertising all 215+ tools regardless of what’s installed — a connected AI client only ever sees tools that will work on the site
* Removed the “REST endpoint reachable” check from Connection Test — a self-request through some caching/security-plugin setups could return HTTP 200 with a body that didn’t parse as expected, producing a false failure on connections that were actually working fine. The remaining 4 checks (server enabled, HTTPS, permalinks, OAuth discovery) cover the same ground without the false positive
* The “Enable MCP Server” toggle’s label text was never actually rendered bold, and the switch itself blended into the banner background — both now have proper contrast
* Activity Log’s built-in connection-test entries were being mislabeled after the plugin rename
* A missing translators: comment on the OAuth authorization screen was breaking automatic .pot generation
* wc_create_variation / wc_update_variation — attribute values passed as {name, option} could silently save as an empty string instead of the intended value; the variation’s postmeta key was being double-prefixed, and a brand-new attribute or term was never registered on the parent product as usable for variations. Both are now handled automatically
* wp_get_site_health_tests could hang the whole request (“connector’s server isn’t responding”) if a network-dependent Site Health test wasn’t already excluded, or if a single test threw a fatal error; hardened with a wider skip list for network-calling tests, a 3-second HTTP timeout clamp for the duration of the run, and per-test error isolation so one broken test can’t take down the whole diagnostic
* A tool call that hit an uncaught PHP fatal error (as opposed to a caught Exception) was left stuck at status = pending in the Activity Log forever instead of being recorded as error

Security
* wp_export_users_csv now neutralizes spreadsheet formula-injection characters (=, +, -, @) and escapes embedded quotes in exported fields
* Dynamic database table names in the WPForms, MemberPress, and Redirection queries now use $wpdb->prepare()‘s %i identifier placeholder instead of raw string interpolation

Changed
* Plugin renamed to “ByteCoreStack – MCP Connector for AI Tools” (previously “AI Connector – MCP for Claude, ChatGPT, Gemini & More”)
* Readme tags updated for search discoverability (mcp, ai, claude, chatgpt, mcp-server)
* All new integrations activate automatically when their corresponding plugin is detected, matching the existing WooCommerce/ACF/Elementor/Gravity Forms behavior — no configuration required
* 215+ WordPress MCP tools across 30 categories (215 verified at release)

1.0.0

• Initial release
• 150+ WordPress MCP tools across 20 categories (159 verified at release)
• OAuth 2.0 with PKCE (authorization code flow, Dynamic Client Registration, refresh tokens)
• Discovery endpoints: /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server
• Streamable HTTP transport (MCP 2025-11-25) as primary transport
• Legacy SSE transport (/sse + /messages) for older client versions — compatible with all clients, not restricted by User-Agent
• Mcp-Session-Id response header on initialize for session tracking (required by Cursor)
• X-Accel-Buffering: no on SSE responses for nginx compatibility
• Auth validation on session termination (DELETE /mcp)
• Activity logging with client detection (Claude, ChatGPT, Gemini, Cursor, Windsurf, and others), storing each call’s parameters/result locally for audit purposes with sensitive-looking values redacted automatically
• IP allowlist support
• Admin dashboard with today’s success/fail stat cards, settings page, and activity log with CSV export
• WP Dashboard widget (7-day activity bar chart)
• WooCommerce (33 tools), ACF (3 tools), Elementor (6 tools), and Gravity Forms (2 tools) integrations — activate automatically when those plugins are present
• Developer API: bcs_mcp_register_tool() helper and bcs_mcp_tools filter for custom tools
• No tool creates new WordPress users; wp_update_user no longer accepts a role parameter — use wp_assign_user_role (requires promote_users) for role changes
• Clean uninstall: removes all plugin tables, options, and transients with no orphaned data
• Translation-ready: full .pot file included in /languages for translators