Corsen Context

Changelog

1.5.16 – 2026-09-03

• Agent conduct policy states what an agent may do, not only what it must not: for a product whose agentPurchase is allowed, an agent acting for its user may complete the store’s ordinary checkout, including creating the customer account it requires; everything outside those explicit per-product permissions stays human-only, and the agent is told to stop and report the page URL to its user. The same sentence is rendered in llms.txt, the [corsen_agent_policy] page, the machine-readable policy JSON, the get_product description, and the default per-product reason.

1.5.15 – 2026-09-03

• “Hide user enumeration” now flips anonymous author archives to 404 on pre_handle_404, inside WP::main() and before the wp action, instead of on template_redirect. The previous hook returned the right status but SEO plugins and wp_get_document_title() had already resolved the author, so the 404 page’s <title> and Open Graph tags still printed the author’s nicename and archive URL. The queried user is also dropped from the main query, and the integration test now asserts the document title, is_author(), and the queried object.

1.5.14 – 2026-09-02

• get_structured_data now uses WordPress’s safe HTTP transport, refuses redirects, and caps the loopback response while downloading it. Stored markup is capped before parsing, JSON-LD clips stay valid UTF-8, multi-type entities are counted correctly, duplicate blocks no longer create a false truncation flag, and every returned block now stays within the documented byte budget.
• WordPress Abilities output schemas now match the executor: search_site declares rank, sitemap fields reflect its actual payload, nullable product values are explicit, and the section and structured-data schemas include their real optional fields.
• All WordPress extension readers now honor the same membership and visibility veto filter as the four core tools. Section ids reserve the synthetic top entry and ignore heading-like lines inside fenced code. The expert handoff requires an owner-configured same-origin form URL, and uninstall/purge removes the complete private expert inbox (including trashed requests), agent-access snapshot, lock, and product policy metadata.
• Extension input schemas now match their validators (required URIs, exact slug-or-URI product selection, and bounded section offsets), including Unicode-aware string limits. The agent-access check validates real llms.txt/MCP response shapes and is described honestly as a same-site loopback using representative bot User-Agent strings, not a full external-agent test.
• Product purchase policy can be managed on every WooCommerce product edit screen as well as the first 50-product quick editor. Invalid stored states fail closed, policy summaries honor every owner visibility veto, and human-handoff copy no longer claims that Corsen Context intercepts browser form submissions.

1.5.13 – 2026-09-01

• Policy honesty + hardening (second independent review): the REST meta auth_callback no longer calls edit_post_meta (which re-entered itself for registered protected meta) and checks edit_post instead, as Core documents. The agent head banner renders only when the MCP channel is actually enabled — a disabled channel is never advertised. Long owner reasons are truncated without requiring mbstring. llms.txt opens with “START HERE for AI agents” and its policy block now distinguishes the server-enforced expert handoff (human_only) from the per-product agentPurchase contract instruction; the plugin exposes no purchase tool and never intercepts human checkout. The human-only form notice is generated from the same table ([corsen_human_only_notice]), so the form copy is the wire copy.

1.5.12 – 2026-09-01

• Governed-agent policy: one server-side policy table composes the relevant MCP/WebMCP descriptions, llms.txt, an HTML head banner for parsers, and the [corsen_agent_policy] page. request_expert_call becomes human-only by policy: it stays advertised so an agent can read the rule, but every schema-valid invocation is refused with error code human_only plus a handoff URL before any throttle or storage side effect. get_product output carries agentPurchase (allowed|forbidden) and agentPurchaseReason from owner-set product meta, and the tool description states that a forbidden product must be handed to a human, never checked out by the agent. OPTIONS preflight matching also tolerates rest_route and atypical permalink prefixes.

1.5.11 – 2026-09-01

• tools/list now emits WebMCP annotations (readOnlyHint per tool; request_expert_call is explicitly readOnlyHint: false) on the MCP transport, so SECURITY.md’s claim is backed on the wire and not only in the in-page bridge. get_sections documents "top" and now always lists and resolves it, even as a zero-byte intro. When “Hide user enumeration” is on, /?author=N and /author/{login} archives also answer 404 to anonymous visitors instead of leaking logins through the classic doors. The MCP route’s OPTIONS preflight is answered by the plugin (POST, OPTIONS, no credentials) instead of core advertising every verb.

1.5.10 – 2026-09-01

• get_product(slug) integrity: slug lookups verify the stored post_name and apply the same owner exposure policy as URL lookups. A stale or excluded slug now returns not-found instead of silently serving a different product (found by external live audit).
• get_sections outline integrity: outline entries are an index (id, level, heading, bytes) and no longer embed each section’s markdown, which had made the “cheap” outline larger than get_page_content of the same page. Section ids are collision-free even against literal -N suffixes, and byte-budget chunks never split a UTF-8 codepoint.
• Control Center save integrity: the form now posts hide_user_enumeration and credit explicitly (they were silently switched off by every Control Center save), and a deliberately empty content-type selection persists as “expose nothing” instead of silently reverting to post,page.

1.5.9 – 2026-09-01

• MCP route Allow header: the 405 GET answer now advertises POST only. WordPress Core was overwriting it with the route’s registered methods (POST, GET, OPTIONS); a rest_post_dispatch filter at priority 20 now wins after core’s own filter.

1.5.8 – 2026-09-01

• Agent-access self-test: the MCP probe now really sends JSON-RPC headers (Content-Type: application/json, Accept, MCP-Protocol-Version) so the endpoint answers 200 instead of 415; a test asserts the probe’s own headers so the fix cannot silently vanish again.

1.5.7 – 2026-09-01

• check_agent_access routing fix: the MCP server’s tool-call switch now dispatches the tool (it was advertised by tools/list but returned “Tool not found” on call); a server-level regression test covers end-to-end routing for the tool.

1.5.6 – 2026-09-01

• Control Center now carries a card for every registered tool. Previously get_sections and get_structured_data had no card, so saving the Control Center form dropped them from the enabled set – a real owner-footgun, now covered by a regression test that fails if any tool lacks its card.

1.5.5 – 2026-09-01

• Version bump only in practice: the probe-header fix announced here did not make it into that build (the edit silently failed to apply and no test covered it); it actually ships in 1.5.8 with a header-assertion test.

1.5.4 – 2026-09-01

• New opt-in tool check_agent_access: agents read the owner’s latest same-site loopback result using representative ClaudeBot, ChatGPT-User and GPTBot User-Agent strings. A pass requires the expected llms.txt marker or a valid MCP tools/list response. It is a read-only snapshot with zero arguments and never triggers egress itself.
• Control Center “Agent surface loopback check”: one nonce-protected action re-fetches the public llms.txt and MCP endpoint. It can reveal User-Agent-based CDN/WAF rules, but does not reproduce an external agent’s IP, TLS fingerprint or full headers. No credentials are sent, only bounded result metadata is stored, and runs are limited to one per five minutes.

1.5.3 – 2026-09-01

• New owner-toggled extension tools, outside the cross-runtime contract and
  fail-closed by default: get_sections (a flat outline with byte sizes, then
  one 8192-byte section per call with byte-offset pagination, so a large page
  no longer blows an agent’s budget or gets truncated mid-answer) and
  get_structured_data (the page’s own JSON-LD typed blocks, sanitized and
  size-bounded; empty means “no schema”, as a fact, not an error).
• The markdown converter now renders HTML tables as GitHub-flavored pipe
  tables instead of flattened text soup.

1.5.2 – 2026-09-01

• Successful tool results now carry MCP structuredContent (typed JSON; list
  results wrapped under items) and the in-page bridge returns the object
  instead of a JSON string. The legacy text part is kept for compatibility.
• MCP-Protocol-Version: missing header now falls back to 2025-03-26 as the
  Streamable HTTP spec requires; released revisions are accepted.
• Unknown tools no longer default to readOnlyHint true: unregistered means
  treat-as-writable until declared.
• search_site reports an honest positional rank instead of a fake score of 1.
• WooCommerce cart/checkout/account/terms pages are excluded from every
  machine surface automatically, even when the page post type is selected.
• New opt-in REST hardening: hide /wp/v2/users enumeration from anonymous
  agents (logged-in requests unaffected).
• HTTP Link rel=”mcp” discovery header on frontend responses.
• Control Center can now purge the private expert-request inbox (the pruning
  promise is finally wired to a button).

1.5.1 – 2026-09-01

• Product lists (list_content type=product) now carry compact commercial fields
  (slug, price, currency, inStock, image) when get_product is exposed: one call
  replaces one-per-product round-trips.
• get_product images are structured objects {url, width, height, alt} so agents
  can reason about photos without downloading them.
• Machine-readable error codes (invalid_params, not_found, rate_limited,
  not_configured, inbox_full) in structuredContent on every MCP tool error.
• Rate-limited expert submissions return retry_after seconds and a Retry-After
  HTTP header instead of a blind “try again later”.

1.5.0 – 2026-09-01

• Feature: Control Center page (Settings > Corsen Context Control) — one card per surface and tool with exposed / needs-config / off badges, a what-agents-see preview built from the actually exposed tool list, and one-click audit log purge.
• Feature: WordPress Abilities API integration — on WordPress 6.9+ each enabled tool is registered as an ability sharing the exact MCP input schemas and the single server-side executor; inert on older WordPress.
• Feature: opt-in get_product extension tool — live price, sale, stock status/quantity, images, categories and up to 20 variants via WooCommerce APIs, behind the site’s post-type policy and publish/password checks. Off by default; not part of the cross-runtime manifest contract.
• Feature as originally introduced: opt-in request_expert_call accepted private owner-side submissions. Since 1.5.12, MCP and WebMCP execution is human-only and every schema-valid call is refused with human_only plus a handoff URL before any side effect.
• Feature: bounded local audit log — one row per tool call (name, argument fingerprint, hashed IP, outcome, duration), with a hard 500-row cap. Entries older than 30 days are pruned when WP-Cron runs; the site admin can purge at any time. Raw arguments and raw IPs are never stored.
• Security: settings sanitization falls back to the four core tools — a request that omits the tool selection can never enable extension tools implicitly.
• Quality: 116 PHP unit tests (499 assertions) covering the extension gates, throttle, secret rejection, private filing, and manifest parity; WordPress coding standards pass clean.

1.4.1 – 2026-08-30

• Security: tool inputs now reject wrong types, unknown properties, fractions, and out-of-range values instead of coercing them; the published JSON Schemas carry the same explicit bounds.
• Security: the in-page WebMCP bridge rejects invalid or cross-origin endpoints before registration or fetch and handles both synchronous and Promise-based registration failures.
• Privacy: removed the experimental declarative form renderer, submission handler, and stored-submission module. Legacy shortcodes render nothing and are removed from public snippets.
• Control: saving an explicitly empty Agent Tools selection now keeps all four tools disabled instead of silently restoring them.

1.4.0 – not released – 2026-08-30

• Experimental: prototyped declarative WebMCP forms and bounded submission storage. This write surface was withdrawn before release and removed in 1.4.1, leaving four read-only public-content tools.

1.3.1 – 2026-08-30

• Fix: when a browser supplies an AbortSignal to execute(), the WebMCP bridge forwards it so cancellation can abort the in-flight MCP request.

1.3.0 – 2026-08-30

• Feature: WebMCP support (opt-in) – registers enabled read-only tools through document.modelContext, with an optional Chrome origin-trial token field. The in-page bridge forwards calls to the existing MCP endpoint, sends no credentials, stays same-origin, and refuses to register inside frames.
• Feature: Agent Tools setting – choose which tools are advertised and callable over MCP and registered through WebMCP.
• Feature: Agent Access panel – the settings page now states at a glance which surfaces are on, which tools and content types agents can see, which paths are hidden, and that agents are read-only.
• Quality: WebMCP tool annotations (read-only, untrusted content) are kept in sync with the repository-wide tool manifest by automated parity tests.

1.2.1 – 2026-07-21

• Security: Enforced the global kill switch across llms.txt, llms-full.txt, MCP routes, discovery tags, and dashboard state.
• Security: Safe rendering no longer executes the_content, dynamic blocks, or shortcodes by default; full rendering is explicit opt-in and never shared-cacheable.
• Security: Added same-origin browser checks, HMAC cache/rate-limit keys, conservative path normalization, Markdown URL neutralization, and an exposure veto filter.
• Security: Disabled llms-full.txt by default and added global item, byte, cache-safety, regeneration-lock, and background-generation controls.
• Privacy: Author display names are omitted by default and can be enabled separately.
• MCP: Added protocol-version validation, 202 notification responses, GET/POST transport handling, bounded resources pagination, signed cursors, and prompt-injection trust-boundary notices.
• Quality: Added PHP unit/integration tests and made WordPress coding standards blocking in CI.
• Documentation: Replaced unsupported universal-discovery, zero-overhead, page-builder, and full-compliance claims with precise behavior and limitations.
• Routing: Keeps /llms.txt and /llms-full.txt free of canonical trailing-slash redirects and refreshes rewrite rules once per plugin version.

1.2.0 – 2026-07-13

• Security: Rate limiter now uses REMOTE_ADDR by default; forwarding headers (X-Forwarded-For/X-Real-IP) are only trusted behind a proxy you opt into via CORSEN_CONTEXT_TRUST_PROXY. Closes a spoofable rate-limit bypass.
• Security: Rate limiter uses the object cache’s atomic INCR when a persistent cache (Redis/Memcached) is present, preventing burst overshoot.
• Security: Rate limiting now runs before authentication, so the API key can’t be brute-forced unthrottled.
• Security: resources/read and get_page_content now validate the URI resolves to a same-site, non-excluded, http(s) URL before returning content.
• Security: Settings sanitization restricts post types to publicly-registered types.
• Performance: MCP tool responses are cached (transients) and invalidated when content changes — bounds compute on the public endpoint.
• Fix: resources/list preserves query strings in resource URIs (parity with the core library).
• Improvement: Configurable enabled tool set via the corsen_context_enabled_tools filter.
• Improvement: Loads the plugin text domain so strings are translatable.
• Improvement: Uninstall now also clears cached MCP response transients.

1.1.0 – 2026-04-12

• Security: SSRF protection now fails closed when DNS resolution fails
• Security: Fixed PHP ReDoS crash on large HTML payloads (preg_replace null safety)
• Security: Fixed rate limiter TTL renewal bug that converted per-minute into per-session limits
• Fix: Added max_pages setting to admin UI (was only configurable in code)
• Fix: Uninstall now cleans up all rate-limit transients from database
• Improvement: Added hourly WP-Cron garbage collector for expired rate-limit transients
• Improvement: Better rate limit window tracking with remaining TTL preservation

1.0.0 – 2026-04-08

• Initial release
• Read-only MCP-style JSON-RPC endpoint with 4 tools
• initialize, ping, notifications/initialized support
• tools/list, tools/call, resources/list, resources/read
• llms.txt and llms-full.txt generation with auto-caching
• Admin settings page with post type selection and path exclusion
• Dashboard widget showing AI context status
• Yoast SEO and Rank Math metadata integration
• Rate limiting (configurable, default 100 req/min)
• Private-address checks for URL validation helpers
• Defensive security headers on MCP responses
• Optional API key authentication (timing-safe comparison)
• Cache invalidation on post save/delete
• <link rel="mcp"> link element in HTML head
• Clean uninstall (removes all options and transients)