Neutrope Agent Bridge

Description

Neutrope Agent Bridge provides nine authenticated, read-only operations: health, site information, installed plugins, the active theme, scheduled-event metadata, allowlisted options, public posts/pages, a public post’s metadata, and allowlisted safe post meta. No post bodies, private posts, arbitrary options, editing, code execution or cron execution are exposed.

The REST namespace remains neutrope-wp-agent-bridge/v1 for existing connections. Requests use an HTTPS Authorization: Bearer or X-NWAB-Token header. Tokens in query strings or request bodies are rejected. Tokens authorize only this plugin’s endpoints; they do not log in as WordPress users. All active tokens have access to the same bounded information.

Administrators manage tokens in Settings > Agent Bridge. Tokens can expire, be regenerated, revoked, and deleted after revocation. Successful requests are limited to 60 per token per minute; failed authentication is limited to 20 per hashed IP per ten minutes. Responses disable caching.

The plugin changes only its own options, transients, access-log table and scheduled cleanup event. It makes no outbound HTTP requests and uses no external relay, CDN or paid service. The bundled JavaScript and CSS run locally on its settings screen. Administration text uses the standard WordPress translation system. Without an installed language pack it appears in English, including on Japanese sites. Translations are distributed separately through translate.wordpress.org when approved and available.

Migrating from Neutrope WP Agent Bridge

This is a folder/identity migration, not an automatic WordPress update of the old slug. Schedule a short interruption. Keep a private backup of the database and old plugin files, and retain the unchanged client configuration and credentials.

1. Deactivate the old Neutrope WP Agent Bridge on every site where it is active. Do not click Delete and do not run its uninstall.php: that would erase shared tokens and logs.
2. Through your hosting file manager or SFTP, move the entire wp-content/plugins/neutrope-wp-agent-bridge folder into a private backup location outside wp-content/plugins. Do not merely rename it within the plugins directory. Do not edit the database or tokens.
3. Install the new ZIP as wp-content/plugins/neutrope-agent-bridge, then activate it on each previously active site. The new copy refuses activation while the old folder remains. It also skips startup when another NWAB copy is loaded, avoiding duplicate classes and handlers.
4. Open Settings > Agent Bridge. Verify existing token labels, statuses and expiry dates, recent logs, and the administration language. The REST namespace, NWAB database keys, token format, API version 0.1.0, local credential IDs and MCP server names are unchanged. Do not regenerate tokens or register the client again for this rename.
5. In the existing trusted client, explicitly request site once with its existing credential. Confirm the expected home URL. Do not repeat a successful diagnostic automatically.

If a custom language pack used the old text domain, keep its backup and convert its file/domain to neutrope-agent-bridge before installation; Japanese also requires a language pack. WordPress.org translation projects do not transfer automatically between slugs.

For rollback, deactivate the new plugin, archive its directory outside wp-content/plugins without uninstalling, restore the old directory, and activate the old plugin. Keep only one copy installed. Restore the private database backup only if data was changed or erased; a file-only rename needs no database conversion.

Optional local AI clients

The REST API works with a trusted HTTP client without an AI service. A separate Windows 10/11 x64 connector ZIP is prepared for local Codex and Claude Code. Extract it and open Install.cmd; it prepares a private Python and guides token registration and client settings without overwriting existing registrations. Updates preserve credentials and client settings. Release page: https://github.com/neutropeinc/neutrope-agent-bridge-connector/releases/tag/v0.1.0 . Download the attachment neutrope-agent-bridge-connector-0.1.0-windows-x64.zip and SHA256SUMS.txt, rather than the automatically generated Source code archive. If the release is not published, this URL is not yet a download source; obtain the candidate ZIP from the distributor. The connector source, GPL license, requirements, update and stop instructions are included in that separate ZIP. Python is fetched from python.org and hash-pinned dependencies from PyPI only after the user starts installation. Web clients, macOS, Linux, WSL and Windows ARM/32bit are unsupported.

When an adapter has already been configured, specify the target site in each conversation, especially in another project’s conversation. Examples:

• For https://example.com, use site once and report the site name and WordPress version.
• For https://example.com, list up to 50 plugins with their versions and active status.
• For https://example.com, list the first 20 public posts/pages with IDs, titles and modification dates.

Daily use needs no token re-entry or WordPress login. To renew an expired token, Regenerate it in WordPress and Update the local registration. To stop access, Revoke it on the server before deleting local credentials/registration. Clearing a token display does not revoke it or erase copies. Website text returned to an AI client is data, not instructions.

Privacy

This plugin does not contact external services. Only a client explicitly configured by the administrator can request information using its dedicated token. If an AI client is used, returned site data may be sent by that client to its provider according to that client’s configuration and terms. Review those terms before enabling the connection.

Token secrets are stored as SHA-256 hashes. Temporary displays use authenticated encryption. Logs contain timestamps, token IDs, methods, normalized routes, status/results, HMAC-hashed IPs, redacted and truncated user agents, and duration. Raw IPs, tokens, query values, request/response bodies are not logged. Hashed IPs may still be personal data. Token records include the creating WordPress user ID and usage timestamps.

Daily WP-Cron pruning keeps 30 days and at most the newest 10,000 log entries after each run. Counts may temporarily exceed this between runs. Administrators can view the most recent 50 entries. The site operator is responsible for its access, retention and privacy policies.