Bugfix release: stops the audit-log pruner writing a "BIGINT UNSIGNED value is out of range" database error to the log, and corrects the tool count shown on the Abilities API card. Recommended for all users; no action needed.<\/p>","3.2.2":"
The wp_db_query tool changed from raw SQL to a structured, injection-proof table reader (name a table + columns + filters instead of writing SQL). Joins\/aggregations are no longer available; everything else is unchanged.<\/p>","3.2.1":"
Review-compliance release: client_id derivation no longer uses a core auth key, the consent page uses an external stylesheet, and the Claude.ai\/Anthropic external service is now documented. No action needed.<\/p>","3.2.0":"
Adds opt-in write mode (off by default \u2014 nothing changes unless you enable it): draft-only post tools, allowlisted option updates, plugin toggling, cache clearing and term creation, gated behind a consent-screen write grant and fully audited.<\/p>","3.1.0":"
Security hardening: cache-safe revocation, token manager, audit log, per-tool switches, secret redaction. Existing OAuth sessions must re-authenticate once after updating; Bearer Token connections are unaffected.<\/p>","3.0.0":"
Renamed to Zen MCP Bridge. The MCP endpoint URL changed to Zen MCP Bridge turns your WordPress site into an MCP server that Claude.ai can connect to. Once connected, Claude can inspect your site's architecture in real time \u2014 plugins, database schema, source code, ACF fields, REST routes, cron jobs and more \u2014 so it can write plugins, debug issues and answer questions tailored to your exact setup.<\/p>\n\n Read-only by default. Claude cannot write, delete or modify anything unless you explicitly enable the opt-in write mode \u2014 and even then it can only work with drafts, allowlisted options, plugin toggles, caches and terms, with every action audited.<\/strong><\/p>\n\n Read: Write (only with write mode enabled): This plugin is a bridge to Claude.ai<\/strong>, the AI assistant operated by Anthropic<\/strong>. That is the entire purpose of the plugin: it turns your site into an MCP (Model Context Protocol) server that Claude.ai connects to so it can read your WordPress data and help you build and debug your site.<\/p>\n\n What the service is and what it is used for:<\/strong> Claude.ai (Anthropic) is a third\u2011party AI assistant. You connect it to this plugin's MCP endpoint from the Claude.ai app. Claude then reads your site through the plugin's tools to answer questions, write code and debug issues tailored to your setup.<\/p>\n\n What data is sent, and when:<\/strong> No data is sent anywhere until you<\/em>, as an administrator, connect Claude.ai to this site and authenticate (with the Bearer token or by completing the OAuth login). After that, data is transmitted to Claude.ai only in direct response to a request Claude makes, and only the data returned by the specific read tool it calls \u2014 for example site\/plugin\/theme information, post content, database query results (with credentials redacted), or source files under Service terms and privacy policy:<\/strong> Anthropic Consumer Terms of Service \u2014 https:\/\/www.anthropic.com\/legal\/consumer-terms ; Anthropic Privacy Policy \u2014 https:\/\/www.anthropic.com\/legal\/privacy ; Anthropic Usage Policy \u2014 https:\/\/www.anthropic.com\/legal\/aup<\/p>\n\n\n Claude.ai auto-discovers the OAuth server from the Go to Settings \u2192 Permalinks<\/strong> and click Save Changes<\/strong> to flush rewrite rules, and confirm the plugin is active.<\/p><\/dd>\n\u2026\/wp-json\/zen-mcp\/v1\/bridge<\/code> \u2014 update your Claude.ai connector and re-authenticate after upgrading. Your Bearer token and settings are migrated automatically.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3623673,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3623673,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3623673,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3623673,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["3.2.2","3.2.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3623673,"resolution":"1","location":"assets","locale":"","width":1445,"height":715},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3623673,"resolution":"2","location":"assets","locale":"","width":1438,"height":765},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3623673,"resolution":"3","location":"assets","locale":"","width":1436,"height":780},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3623673,"resolution":"4","location":"assets","locale":"","width":1416,"height":607},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3623673,"resolution":"5","location":"assets","locale":"","width":1420,"height":660}},"screenshots":{"1":"Connection settings \u2014 the MCP endpoint URL and Bearer token to paste into a Claude.ai custom connector, plus the OAuth token lifetime and the per-IP rate limit.","2":"Per-tool switches and write mode \u2014 every tool can be turned off individually (write tools are badged); write mode is off by default and has its own option allowlist.","3":"OAuth 2.1 (advanced) \u2014 authorization, token and discovery URLs, extra redirect URIs, and the WordPress Abilities API status card.","4":"Active OAuth tokens \u2014 issued tokens with client, user, issue\/expiry and last-used times, each revocable on the spot, plus the built-in health check.","5":"Health check, audit log and emergency revocation \u2014 every tool call is recorded with credential, tool, arguments, IP and outcome; all OAuth tokens can be invalidated instantly."}},"plugin_section":[],"plugin_tags":[2353,236834,229563,25308,242115],"plugin_category":[],"plugin_contributors":[271108],"plugin_business_model":[],"class_list":["post-343896","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-anthropic","plugin_tags-claude","plugin_tags-connector","plugin_tags-mcp","plugin_contributors-guramzhgamadze","plugin_committers-guramzhgamadze"],"banners":{"banner":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/banner-772x250.png?rev=3623673","banner_2x":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/banner-1544x500.png?rev=3623673","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/icon-128x128.png?rev=3623673","icon_2x":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/icon-256x256.png?rev=3623673","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/screenshot-1.png?rev=3623673","caption":"Connection settings \u2014 the MCP endpoint URL and Bearer token to paste into a Claude.ai custom connector, plus the OAuth token lifetime and the per-IP rate limit."},{"src":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/screenshot-2.png?rev=3623673","caption":"Per-tool switches and write mode \u2014 every tool can be turned off individually (write tools are badged); write mode is off by default and has its own option allowlist."},{"src":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/screenshot-3.png?rev=3623673","caption":"OAuth 2.1 (advanced) \u2014 authorization, token and discovery URLs, extra redirect URIs, and the WordPress Abilities API status card."},{"src":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/screenshot-4.png?rev=3623673","caption":"Active OAuth tokens \u2014 issued tokens with client, user, issue\/expiry and last-used times, each revocable on the spot, plus the built-in health check."},{"src":"https:\/\/ps.w.org\/zen-mcp-bridge\/assets\/screenshot-5.png?rev=3623673","caption":"Health check, audit log and emergency revocation \u2014 every tool call is recorded with credential, tool, arguments, IP and outcome; all OAuth tokens can be invalidated instantly."}],"raw_content":"\nFeatures<\/h4>\n\n
\n
Available tools<\/h4>\n\n
wp_get_site_info<\/code>, wp_get_plugins<\/code>, wp_get_themes<\/code>, wp_get_post_types<\/code>, wp_get_taxonomies<\/code>, wp_get_options<\/code>, wp_query_posts<\/code>, wp_get_post<\/code>, wp_get_db_schema<\/code>, wp_db_query<\/code>, wp_list_files<\/code>, wp_read_file<\/code>, wp_search_code<\/code>, wp_get_logs<\/code>, wp_get_hooks<\/code>, wp_get_acf_fields<\/code>, wp_get_users<\/code>, wp_get_menus<\/code>, wp_get_cron_jobs<\/code>, wp_get_transients<\/code>, wp_get_scheduled_actions<\/code>, wp_get_active_widgets<\/code>, wp_get_rest_routes<\/code>, wp_get_woocommerce<\/code>, wp_get_elementor<\/code>.<\/p>\n\nwp_create_draft_post<\/code>, wp_update_draft_post<\/code>, wp_update_option<\/code>, wp_toggle_plugin<\/code>, wp_clear_cache<\/code>, wp_create_term<\/code>.<\/p>\n\nExternal services<\/h3>\n\n
wp-content<\/code> (with sensitive files such as .env<\/code>, wp-config<\/code> copies, keys and database dumps blocked). Options and query results have secret\u2011shaped values redacted, user passwords are never returned, and \u2014 unless you explicitly turn on the optional write mode \u2014 nothing on your site is ever modified. During the OAuth login flow the browser is also redirected to Claude.ai callback URLs (https:\/\/claude.ai\/api\/mcp\/auth_callback<\/code> and the app.<\/code>\/www.<\/code> variants) carrying a short\u2011lived authorization code. The plugin does not send any usage analytics or telemetry, and it does not contact Anthropic on its own \u2014 Claude.ai always initiates the connection.<\/p>\n\n\n
wp-content\/plugins\/zen-mcp-bridge<\/code>, or install it from your WordPress admin.<\/li>\n\n
How do I connect with a Bearer token (simplest)?<\/h3><\/dt>\n
\n
https:\/\/your-site.com\/wp-json\/zen-mcp\/v1\/bridge<\/code>.<\/li>\nHow does the OAuth 2.1 login flow work?<\/h3><\/dt>\n
\/.well-known\/<\/code> URLs and opens a login page on your site, where an administrator clicks Allow Access<\/strong>. If Claude.ai asks for details manually, use the Authorization URL and Token URL shown in the OAuth (advanced)<\/strong> section of the settings page, any Client ID except the literal text \"Bearer Token\", and the scope claudeai<\/code>.<\/p><\/dd>\nI get a 404 \/ rest_no_route error<\/h3><\/dt>\n