Saddle – Control Your Site with AI (MCP Server)

Changelog

1.0.0

• Initial public release.
• Saddle’s screens have a look of their own now — a pink accent on a warm, near-white background, squarer corners and flatter surfaces. About 85% of it is still black, white and grey; the colour is saved for the few things worth pointing at.
• The sidebar is one plain list instead of three labelled sections, and two items say what they do rather than what they are called: Guidance is now Instructions, and Connections is now Apps. Your bookmarks and links still work.
• The Dashboard opens with a sentence telling you what your AI can do right now, instead of four boxes of numbers. The counts moved to one quiet line underneath, and the box that used to show a dash when there was nothing to report is gone.
• Removed the Cookbook screen.
• Security: read tools now check whether the connected account is actually allowed to see each item, not just that it is signed in. A connection made with a low-permission WordPress account could previously read any draft, private or password-protected post, any media item’s details and any post’s revision history — and could list and search all of it — even though the account could never see any of it in wp-admin. Nothing changes for the usual setup, where you connect as an administrator.
• Security: the list of recent changes — both the one an assistant can ask for and the one it reads when it connects — now hides entries about items the connected account cannot see. It was naming the titles of drafts and private posts to accounts that could never open them. Entries about something that has since been deleted stay visible to accounts that can delete content, so you do not lose that history.
• Fixed: on sites where another plugin checks who is signed in very early in the request — several SEO plugins do — every ChatGPT request crashed before Saddle could examine its token, so the connection failed with a sign-in error forever while the same build worked elsewhere. The token check now works no matter how early in the request it runs.
• Fixed: the connection check could report that sign-ins were working on a server that was actually blocking half of them. Apps you connect with a pasted key send one kind of sign-in header and apps that sign in through Saddle — ChatGPT is the one that can only connect that way — send another, and some servers pass the first and drop the second. The check now tests both, says which one is being blocked, and offers the same one-click fix, which always covered both.
• Connection details and health now shows how each request signed in, so “the key was rejected” and “no key ever arrived” stop looking identical. They are the same error message and they need opposite fixes — one is reconnecting the app, the other is a word with your host.
• Fixed: the request recorder was logging its own screen refreshing, which pushed the requests you were trying to capture out of the list within about two minutes. It now records only real app traffic, and keeps four times as much of it.
• Fixed: on sites that also run the separate MCP Adapter plugin, an app could finish connecting and then report that the site has no actions it can use. The piece that prevents that was missing from the plugin package, so the fix for it had never actually reached anyone. It now ships.
• Connection details and health now reports what it knows on every site, not only on sites running the separate MCP Adapter plugin. It previously opened with “No app has connected yet” no matter what had happened, which made the request recorder underneath it look broken — and that recorder is the thing that shows whether a connected app’s requests are arriving and what they got back.
• The guidance an assistant reads when it connects is now one document with one set of headings, however many PlugPress plugins are adding to it. Previously each plugin appended in its own style — one added a heading two levels down, another a bare sentence with no heading at all — and it read like four notes stapled together.
• Removed a second web address the plugin was serving without saying so. Saddle publishes one address for AI apps; a bundled library was quietly adding another with weaker checks around it. Nothing documented ever pointed at it, and your access levels and confirmations applied there too — but it should not have existed, and now it doesn’t.
• Permissions now tells you how many tools your connected apps are actually offered at the level you pick, how many are being held back, and that already-connected apps keep the old list until you refresh or reopen them.
• Fixed: an app that signs in through Saddle instead of using a pasted key — ChatGPT is the one that does — was always granted read-only access, whatever you had set on the Permissions screen, and nothing anywhere could change it afterwards. It would happily read your site and then be unable to save a single thing, and reconnecting made no difference. You now choose the access level on the approval screen, and you can change it later for an app that is already connected.
• Permissions now names any connected app that is sitting below the level you have chosen, instead of leaving you to work out why an app you granted full access still refuses to write anything.
• Fixed: on hosts that rewrite request bodies, saving your access level could report success and quietly change nothing.
• New: user directory read tools (list-users, get-user) — read-only, capability-gated, with personal details visible only to accounts that can manage users.
• New: first-party integration wrappers — abilities from PlugPress plugins (Waggle) surface as saddle/* tools behind Saddle’s full safety model (access levels, pause, per-tool switches, two-step confirmation, activity log).
• Security: confirmation tokens are now bound to the user who previewed the action, and wrapped destructive tools bind their full argument set into the token — a confirmation can never change what was previewed.
• Security: issued credentials are recognized by an internal marker instead of their display name, so renaming a key can no longer widen its access.
• Security: optional domain enforcement — write access can auto-suspend when the site’s domain changes (cloned or migrated database) until you re-confirm it.
• Improved: denial explanations now mirror the enforced checks exactly (including missing-capability denials); the activity log keeps separate caps for changes and denials so denials can never crowd out change history; failed confirmed destructive actions are logged too.
• Internal: one shared integration engine, unified builder detection, and a stricter validation contract for page-tree profiles.
• Fixed: some connected apps signed in, reported the connection as healthy, and then said the site had no actions they could use — while the same site worked perfectly from another app. Saddle was answering one step of the connection handshake in a way the stricter apps refuse, so they stopped before ever asking what tools exist. Saddle now answers that step, and the two others it was getting wrong, exactly as the Model Context Protocol requires.
• Connected apps are now offered only the tools your access level and switches actually allow. A read-only site no longer advertises tools that would be refused on every call — the assistant is told how many are being held back and that only you can unlock them, so it can point you at the setting instead of reporting that your site cannot do it. Raising the access level widens the list again; reconnect the app if it caches what it was told at sign-in.
• Fixed: a destructive tool from a connected PlugPress plugin could be confirmed with different details than the preview showed. The confirmation now covers everything the preview showed, not just which item it was about.
• A refused call caused by the WordPress account being short a permission now says so, instead of pointing at Saddle settings that would not have changed anything.
• An assistant now starts a session already knowing your palette, what wraps your pages, and how many ready-made patterns your theme has — and is pointed at the single call that fetches the rest, instead of the four or five it used to make.
• Repeated edits to the same page no longer fill the “recent changes” an assistant sees with the same line over and over; a run of them reads as one entry with a count.
• The bundled build-a-page playbook now ships on classic themes too, not only block themes — a classic site editing its pages in the block editor was the one case that got no guidance at all. It adapts its “go look at the site first” step to what your theme actually has.
• A second bundled playbook, fix-page: how to work a page-verification report down to nothing, which findings to fix first, and why block positions move under you after a structural change.
• See the whole site, not just one page: list and read block templates and template parts, read the global styles the owner set, and list their saved patterns.
• Set up a design system on a block theme: bootstrap-design-system now writes the palette, type scale and spacing into your global styles, so it appears in Appearance > Editor > Styles and stays yours to edit. Existing values are never overwritten.
• Orient in one call: context-bundle returns the design system, the blocks worth using, the theme’s patterns, the site’s templates and the section recipes together, instead of five separate calls per session.
• A bundled build-page playbook on block themes: the order to work in, the rules the plugin enforces, and what separates a designed page from a generated one.
• MCP server on your own site: content tools (posts, pages, media, taxonomies, search), Gutenberg block design tools with schema validation and theme design tokens, opt-in site management (settings, plugins, themes, cache), Skills, memory, and an activity log.
• Safety model: three access levels defaulting to read-only, per-tool switches, two-step confirmation on every destructive action, a master pause switch, and credentials confined to Saddle’s endpoint.
• Optional Unsplash integration (bring your own API key): search and import stock photos with automatic photographer attribution.
• Design quality tools: page verification with a scored report, design lint, section recipes, and a design-system reader/seeder.
• Works on hosts whose security layer strips custom request headers: the dashboard sends its sign-in token in the address as well as the header, and reports plainly when a host is blocking something it cannot work around.
• Optional OAuth 2.1 sign-in (off by default) for apps that can’t be given a sign-in key by hand, such as ChatGPT connectors — self-hosted, administrator-approved, and never able to grant more than the access level you chose.
• Fixed: some connected apps — ChatGPT connectors in particular — signed in successfully but then reported that the site had no actions they could use. Saddle now serves apps that don’t hold on to a session between requests, and no longer turns away an app for naming a protocol revision it hadn’t seen. Apps that do hold a session are unaffected, and no access level or approval step changes.
• Tools now tell connected apps what they do before they run: each carries a readable name and flags for whether it only reads, whether it can destroy anything, and whether repeating it is safe.
• A refused tool call now returns its reason to the app as a readable answer rather than a protocol error, so the assistant can tell you which control to change instead of reporting a generic failure.
• The list of plugins active on your site, and your theme’s name, are now shared with an AI assistant only at the Admin access level — matching the access level already required to list them as a tool. The connection handshake also respects the pause switch.
• Client traffic: a new panel under Connections → Connection details & health records what a connected app asked for and what it got back, so “it says it can’t see any tools” can be answered without guesswork. Off by default, stops on its own after an hour, and records no keys or content.
• Fixed: some connected apps — ChatGPT connectors in particular — signed in successfully but then reported that the site had no actions they could use. Saddle now serves apps that don’t hold on to a session between requests, and no longer turns away an app for naming a protocol revision it hadn’t seen. Apps that do hold a session are unaffected, and no access level or approval step changes.