Zen MCP Bridge

Changelog

3.2.3

• Fixed a database error written to the log on every site with fewer than 5,000 audit entries. Audit-log retention pruning computed its cutoff as MAX(id) - 5000 inside the query; because id is BIGINT UNSIGNED, that underflowed and raised “BIGINT UNSIGNED value is out of range”. The cutoff is now calculated in PHP and the delete is skipped entirely until the table actually exceeds the retention limit. No audit data was ever lost — the failing statement deleted nothing.
• The Abilities API status card now reports the tools it actually registers. It previously counted the full 31-tool registry and described them all as read-only, ignoring per-tool switches and counting the six write tools even when write mode was off.

3.2.2

• wp_db_query no longer accepts raw SQL. It is now a structured, injection-proof table reader: you name a table, columns, WHERE conditions, ordering and a limit, and the plugin builds the query — table/column names are validated against the live schema and every value is bound through $wpdb->prepare(). Credential columns stay blocked and secret values redacted. Joins and aggregate expressions are no longer supported (use wp_query_posts or the dedicated inspector tools).

3.2.1

• Dynamic client registration now derives client_id from a dedicated plugin secret instead of the WordPress AUTH_KEY, keeping core authentication secrets scoped to authentication.
• The OAuth consent page loads its styles from an external stylesheet (no inline <style>).
• Documented the Claude.ai / Anthropic external service in the readme.
• Added X-Content-Type-Options: nosniff to all plugin responses (MCP endpoint, OAuth token/discovery endpoints, consent page) — hardening surfaced by an OWASP ZAP scan.

3.2.0

• Opt-in write mode (off by default) with six scoped write tools: wp_create_draft_post / wp_update_draft_post (status locked to draft/pending — publishing always needs a human), wp_update_option (admin-managed allowlist with hard denies for site identity, code-execution and secret options), wp_toggle_plugin (cannot touch Zen MCP Bridge itself), wp_clear_cache and wp_create_term.
• Consent-screen write grant: OAuth sessions receive write access only when “Allow write access” is explicitly ticked during authorization (claudeai:write scope); the static Bearer token has write access only while write mode is on.
• MCP tool annotations: all tools now declare readOnlyHint (and write tools destructiveHint: false) per the 2025-11-25 specification.
• Write tools are hidden from tools/list for credentials without write access, individually toggleable, registered as Abilities only in write mode, and fully audited.

3.1.0

• Cache-safe token revocation: “Revoke all” now bumps a token-generation counter instead of deleting options-table rows, so it works instantly under Redis/Memcached object caches too. Existing OAuth sessions must re-authenticate once after this update.
• Token manager: active OAuth tokens are listed in the admin (client, user, issued, expires, last used) with per-token revocation.
• Secret-exfiltration hardening: wp_db_query now rejects queries referencing the plugin’s own credentials and redacts secret-bearing values (API keys, session tokens, consumer secrets) from results; wp_get_options applies the same secret-name heuristic; sensitive files (.env, wp-config copies, SQL dumps, keys/certificates) cannot be read or searched, and credential-like lines are masked in code-search results.
• Audit log: every tool call is recorded (credential, tool, arguments, IP, outcome) with an admin viewer, filtering and automatic retention.
• Per-tool switches: any of the 25 tools can be disabled entirely from the settings page — hidden from tools/list, rejected by tools/call, and excluded from Abilities.
• Configurable rate limit (10–1000 tool calls per minute per IP) and an in-admin health check that runs the same initialize/tools/discovery checks a Claude.ai connection performs.
• Developer: PHPUnit test suite with GitHub Actions CI, phpcs.xml ruleset.

3.0.0

• Renamed from “WordPress MCP Bridge” to Zen MCP Bridge (new slug, zenmcp_ code prefix, text domain and REST namespace zen-mcp/v1). Existing installs keep their Bearer token, redirect URIs and token lifetime via a one-time migration on activation. The MCP endpoint URL changed — reconnect Claude.ai to …/wp-json/zen-mcp/v1/bridge.
• Rebuilt the admin settings page to the Zen family theme: card layout, external stylesheet/script (no inline styles or handlers), and setup/troubleshooting docs moved into a Help tab. Settings consolidated into a single option.
• Six new read-only tools: wp_search_code, wp_get_post, wp_get_transients (auth/secret values redacted), wp_get_scheduled_actions, wp_get_woocommerce (no customer data or credentials) and wp_get_elementor — 25 tools total.
• MCP resources (site snapshots at wordpress:// URIs) and prompts (site analysis, error debugging, plugin writing) capabilities.
• WordPress Abilities API bridge (WP 6.9+): tools registered as admin-only abilities; stands down automatically when AI Provider for Anthropic is active.
• Added uninstall.php (removes options and transients on delete) and internationalization.

2.8.0

• Configurable OAuth token lifetime (1 hour / 24 hours / 7 days / 30 days) and an emergency “Revoke all tokens” button.
• MCP specification 2025-11-25 support: latest protocol version, client_id_metadata_document_supported, scope in WWW-Authenticate, and description in serverInfo.
• Hardened a SQL-injection vector in the DB-schema tool and corrected the OAuth consent nonce sanitizer (2.7.0).

2.6.0

• Fixed an OAuth consent 403 (two-nonce form) and blocked the plugin’s own Bearer token from the options tool. Crash-hardened the cron tool and added transient cleanup on deactivation.

2.5.0

• Added dynamic client registration (RFC 7591), corrected the required PHP version, and closed path-containment and OAuth parameter-handling gaps.

2.2.0 – 2.4.0

• Implemented the full OAuth 2.1 PKCE authorization server with discovery endpoints, plus CORS, clickjacking, path-traversal and Apache/FastCGI fixes.

2.1.0

• Initial hardened release: GET/OPTIONS handling, CORS headers and the read-only tool suite.