Title: Neutrope Agent Bridge Author: Neutrope Inc. Published: September 18, 2026 Last modified: September 18, 2026 --- Search plugins ![](https://ps.w.org/neutrope-agent-bridge/assets/banner-772x250.png?rev=3702098) ![](https://ps.w.org/neutrope-agent-bridge/assets/icon-256x256.png?rev=3702098) # Neutrope Agent Bridge By [Neutrope Inc.](https://profiles.wordpress.org/neutropeinc/) [Download](https://downloads.wordpress.org/plugin/neutrope-agent-bridge.0.1.0.zip) * [Details](https://wordpress.org/plugins/neutrope-agent-bridge/#description) * [Reviews](https://wordpress.org/plugins/neutrope-agent-bridge/#reviews) * [Installation](https://wordpress.org/plugins/neutrope-agent-bridge/#installation) * [Development](https://wordpress.org/plugins/neutrope-agent-bridge/#developers) [Support](https://wordpress.org/support/plugin/neutrope-agent-bridge/) ## Description Neutrope Agent Bridge provides nine authenticated, read-only operations: health, site information, installed plugins, the active theme, scheduled-event metadata, allowlisted options, public posts/pages, a public post’s metadata, and allowlisted safe post meta. No post bodies, private posts, arbitrary options, editing, code execution or cron execution are exposed. The REST namespace remains `neutrope-wp-agent-bridge/v1` for existing connections. Requests use an HTTPS Authorization: Bearer or X-NWAB-Token header. Tokens in query strings or request bodies are rejected. Tokens authorize only this plugin’s endpoints; they do not log in as WordPress users. All active tokens have access to the same bounded information. Administrators manage tokens in Settings > Agent Bridge. Tokens can expire, be regenerated, revoked, and deleted after revocation. Successful requests are limited to 60 per token per minute; failed authentication is limited to 20 per hashed IP per ten minutes. Responses disable caching. The plugin changes only its own options, transients, access-log table and scheduled cleanup event. It makes no outbound HTTP requests and uses no external relay, CDN or paid service. The bundled JavaScript and CSS run locally on its settings screen. Administration text uses the standard WordPress translation system. Without an installed language pack it appears in English, including on Japanese sites. Translations are distributed separately through translate.wordpress.org when approved and available. ### Migrating from Neutrope WP Agent Bridge This is a folder/identity migration, not an automatic WordPress update of the old slug. Schedule a short interruption. Keep a private backup of the database and old plugin files, and retain the unchanged client configuration and credentials. 1. Deactivate the old Neutrope WP Agent Bridge on every site where it is active. Do not click Delete and do not run its uninstall.php: that would erase shared tokens and logs. 2. Through your hosting file manager or SFTP, move the entire `wp-content/plugins/ neutrope-wp-agent-bridge` folder into a private backup location outside `wp-content/ plugins`. Do not merely rename it within the plugins directory. Do not edit the database or tokens. 3. Install the new ZIP as `wp-content/plugins/neutrope-agent-bridge`, then activate it on each previously active site. The new copy refuses activation while the old folder remains. It also skips startup when another NWAB copy is loaded, avoiding duplicate classes and handlers. 4. Open Settings > Agent Bridge. Verify existing token labels, statuses and expiry dates, recent logs, and the administration language. The REST namespace, NWAB database keys, token format, API version 0.1.0, local credential IDs and MCP server names are unchanged. Do not regenerate tokens or register the client again for this rename. 5. In the existing trusted client, explicitly request site once with its existing credential. Confirm the expected home URL. Do not repeat a successful diagnostic automatically. If a custom language pack used the old text domain, keep its backup and convert its file/domain to `neutrope-agent-bridge` before installation; Japanese also requires a language pack. WordPress.org translation projects do not transfer automatically between slugs. For rollback, deactivate the new plugin, archive its directory outside `wp-content/ plugins` without uninstalling, restore the old directory, and activate the old plugin. Keep only one copy installed. Restore the private database backup only if data was changed or erased; a file-only rename needs no database conversion. ### Optional local AI clients The REST API works with a trusted HTTP client without an AI service. A separate Windows 10/11 x64 connector ZIP is prepared for local Codex and Claude Code. Extract it and open Install.cmd; it prepares a private Python and guides token registration and client settings without overwriting existing registrations. Updates preserve credentials and client settings. Release page: https://github.com/neutropeinc/neutrope- agent-bridge-connector/releases/tag/v0.1.0 . Download the attachment neutrope-agent- bridge-connector-0.1.0-windows-x64.zip and SHA256SUMS.txt, rather than the automatically generated Source code archive. If the release is not published, this URL is not yet a download source; obtain the candidate ZIP from the distributor. The connector source, GPL license, requirements, update and stop instructions are included in that separate ZIP. Python is fetched from python.org and hash-pinned dependencies from PyPI only after the user starts installation. Web clients, macOS, Linux, WSL and Windows ARM/32bit are unsupported. When an adapter has already been configured, specify the target site in each conversation, especially in another project’s conversation. Examples: * For https://example.com, use site once and report the site name and WordPress version. * For https://example.com, list up to 50 plugins with their versions and active status. * For https://example.com, list the first 20 public posts/pages with IDs, titles and modification dates. Daily use needs no token re-entry or WordPress login. To renew an expired token, Regenerate it in WordPress and Update the local registration. To stop access, Revoke it on the server before deleting local credentials/registration. Clearing a token display does not revoke it or erase copies. Website text returned to an AI client is data, not instructions. ### Privacy This plugin does not contact external services. Only a client explicitly configured by the administrator can request information using its dedicated token. If an AI client is used, returned site data may be sent by that client to its provider according to that client’s configuration and terms. Review those terms before enabling the connection. Token secrets are stored as SHA-256 hashes. Temporary displays use authenticated encryption. Logs contain timestamps, token IDs, methods, normalized routes, status/ results, HMAC-hashed IPs, redacted and truncated user agents, and duration. Raw IPs, tokens, query values, request/response bodies are not logged. Hashed IPs may still be personal data. Token records include the creating WordPress user ID and usage timestamps. Daily WP-Cron pruning keeps 30 days and at most the newest 10,000 log entries after each run. Counts may temporarily exceed this between runs. Administrators can view the most recent 50 entries. The site operator is responsible for its access, retention and privacy policies. ## Screenshots [⌊Follow the three-step guide to connect your local AI client.⌉⌊Follow the three- step guide to connect your local AI client.⌉[ Follow the three-step guide to connect your local AI client. [⌊Manage access tokens and review the private access log.⌉⌊Manage access tokens and review the private access log.⌉[ Manage access tokens and review the private access log. ## Installation 1. Upload this ZIP through Plugins > Add New > Upload Plugin, or place its `neutrope- agent-bridge` folder in `wp-content/plugins`. 2. Activate Neutrope Agent Bridge separately on each site. Network-wide activation is not supported. 3. Open Settings > Agent Bridge as an administrator. Confirm the connection site and the API address shown under Advanced. 4. Prepare a trusted HTTP client with secure credential storage. Issue a labelled, expiring token, then copy its temporary display into that client. Never put tokens in chat messages, URLs, command history or screenshots. 5. Send an authenticated GET to the displayed API base followed by `/site`. Confirm the intended site. Routine read-only requests need no WordPress login. PHP Sodium or OpenSSL AES-256-GCM is required for encrypted temporary token display. The MySQL/MariaDB connection must support advisory locks. Serve the site over HTTPS and forward the Authorization header, or use X-NWAB-Token. Exclude this REST namespace from page caches. ## FAQ ### What if Authorization is missing? Ask your host to forward the Authorization header, or use X-NWAB-Token. A present but invalid Authorization header cannot be bypassed with a second header. ### Can I see a token again? No. The encrypted user-specific display expires after 60 seconds and is removed on the first read. Regenerate if needed; the old secret becomes invalid immediately. Existing copies outside the page are not erased. ### What is removed on uninstall? A normal uninstall removes NWAB token/version options, display transients, rate counters, logs and the cleanup event across the network. Deactivation only removes the scheduled event. The new uninstall preserves shared data if the legacy folder is still present; the old uninstall has no such protection. Never use either plugin’s Delete action during migration or rollback. ### What about caches and security plugins? Exclude the namespace from caching and permit intended HTTPS requests. Errors that terminate before WordPress reaches this plugin cannot be logged by it. Compatibility with every host, cache and security plugin is not established. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Neutrope Agent Bridge” is open source software. The following people have contributed to this plugin. Contributors * [ Neutrope Inc. ](https://profiles.wordpress.org/neutropeinc/) [Translate “Neutrope Agent Bridge” into your language.](https://translate.wordpress.org/projects/wp-plugins/neutrope-agent-bridge) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/neutrope-agent-bridge/), check out the [SVN repository](https://plugins.svn.wordpress.org/neutrope-agent-bridge/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/neutrope-agent-bridge/) by [RSS](https://plugins.trac.wordpress.org/log/neutrope-agent-bridge/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.1.0 * Initial WordPress.org submission candidate under Neutrope Agent Bridge. * Nine bounded read-only operations, token management, rate limits and private logs. * English/Japanese onboarding and bundled gettext translations. * Legacy-folder activation guard and documented data-preserving migration. ## Meta * Version **0.1.0** * Last updated **23 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.1.1** * PHP version ** 8.1 or higher ** * Tags * [authentication](https://wordpress.org/plugins/tags/authentication/)[monitoring](https://wordpress.org/plugins/tags/monitoring/) [rest-api](https://wordpress.org/plugins/tags/rest-api/) * [Advanced View](https://wordpress.org/plugins/neutrope-agent-bridge/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/neutrope-agent-bridge/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/neutrope-agent-bridge/reviews/) ## Contributors * [ Neutrope Inc. ](https://profiles.wordpress.org/neutropeinc/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/neutrope-agent-bridge/)