GoldT WebMCP Bridge

GoldT WebMCP Bridge enables AI agents to interact with your WordPress content through secure OAuth 2.0 authentication using the WebMCP protocol. Perfect for AI-powered customer support, automated content analysis, intelligent search, and custom AI integrations. ✨ Features

• WebMCP Protocol Support - Industry-standard AI integration
• Secure OAuth 2.0 - Same security standard as Google, Facebook, GitHub - your passwords stay safe
• 8 Pre-registered AI Clients - Claude, ChatGPT, Gemini, Grok, Perplexity, Copilot, Meta AI, DeepSeek
• 7 Tools - WordPress content tools plus optional translation via MyMemory API
• Translation Provider - Choose AI self-translate, MyMemory API, or disabled
• Dynamic Manifest - Instructions adapt to your settings so AI agents don't invent capabilities
• Rate Limiting - Prevent abuse (50 req/min default)
• Security Controls - Token management, block specific users
• Zero Configuration - Works out of the box
• Extensible - Add custom tools via developer hooks

🎯 Quick Start for AI Users Using ChatGPT or Claude? Tell your AI agent:

"I want to connect you to my WordPress site at https://mysite.com using GoldT WebMCP Bridge plugin. The manifest is at /wp-json/goldt-webmcp-bridge/v1/manifest. Use OAuth 2.0 with client_id: claude-ai" The AI will guide you through OAuth authorization - you'll approve access in your browser.

🤖 Supported AI Agents Pre-registered and ready to connect:

• Claude AI - Use client_id: claude-ai (Anthropic)
• ChatGPT - Use client_id: chatgpt (OpenAI)
• Gemini - Use client_id: gemini (Google)
• Grok - Use client_id: grok (xAI)
• Perplexity AI - Use client_id: perplexity
• Microsoft Copilot - Use client_id: copilot
• Meta AI - Use client_id: meta-ai (Facebook)
• DeepSeek - Use client_id: deepseek

All clients use OAuth 2.0 with PKCE and redirect_uri: urn:ietf:wg:oauth:2.0:oob (out-of-band). 🛠️ Available Tools

1. wordpress.searchPosts - Search posts with filters
2. wordpress.getPost - Get single post by ID or slug
3. wordpress.searchPages - Search pages
4. wordpress.getPage - Get single page by ID or slug
5. wordpress.getCurrentUser - Get authenticated user info
6. translation.translate - Translate text via MyMemory API (when Translation Provider = mymemory)
7. translation.getSupportedLanguages - List supported language codes (when Translation Provider = mymemory)

🔒 How Authentication Works Secure OAuth 2.0 Authentication: Uses the same security standard trusted by Google, Facebook, and GitHub:

1. AI agent initiates OAuth flow with code challenge (PKCE)
2. User approves in browser (consent screen)
3. Agent receives one-time authorization code
4. Agent exchanges code for access token using code verifier
5. Agent uses token for API calls

The AI agent operates as the user who authorized:

• The agent receives an OAuth token linked to that user's ID
• All API requests run with that user's permissions
• The agent respects WordPress user capabilities Examples:

If Administrator authorizes:

• ✅ Sees all posts (including drafts, private)
• ✅ Full access based on admin capabilities If Subscriber authorizes:
• ✅ Sees only published content
• ❌ Cannot see drafts or private content Security: Authorization codes are one-time use (10 min expiry). Access tokens expire after 1 hour. Refresh tokens valid for 30 days. PKCE ensures tokens can't be stolen.

⚙️ Admin Settings Configure the plugin at GoldT WebMCP → Settings: Translation Provider:

• AI Self-Translate (default) - The AI agent handles translation on its own; no translation tools appear in the manifest
• MyMemory API - Plugin calls MyMemory and returns translated text; translation.translate and translation.getSupportedLanguages tools are added to the manifest
• Disabled - Translation tools are hidden from the manifest entirely

Rate Limiting:

• Default: 50 requests per minute, 1,000 per hour (per user)
• Adjust both values in GoldT WebMCP → Settings

🔐 Admin Controls For Site Administrators: Manage security from the WordPress admin panel:

• Revoke OAuth Tokens - Go to GoldT WebMCP → OAuth Tokens to view and revoke active tokens
• Block Users - Go to GoldT WebMCP → Settings → scroll to "Manage User Access" section
• Rate Limits - Configure request limits in GoldT WebMCP → Settings (default: 50/min, 1000/hour)

💬 We Need Your Feedback! Help us build what YOU need:

• 💡 What tools would be most useful? Tell us which WordPress features you'd like AI agents to access
• 🐛 Found a bug? Report it so we can fix it quickly
• ⭐ Feature requests - We prioritize based on community feedback

How to provide feedback:

• GitHub: https://github.com/chgold/goldt-wp-webmcp-bridge/issues
• WordPress.org: Support forum Your feedback directly shapes the future of this plugin!

Automatic Installation

1. Go to Plugins → Add New in WordPress admin
2. Search for "GoldT WebMCP Bridge"
3. Click Install Now and then Activate

Manual Installation

1. Download the plugin zip file
2. Go to Plugins → Add New → Upload Plugin
3. Upload the zip file and click Install Now
4. Activate the plugin

Note: All required dependencies are included. No manual setup required! Setup No setup required! The plugin works immediately after activation. Optional: Configure rate limits in GoldT WebMCP → Settings For detailed setup and testing examples, see the plugin documentation on GitHub.

1.1.0 - 2026-08-21

• New: wordpress.listCategories tool — resolve category id from name or slug via case-insensitive substring search. Supports parent, orderby, and limit parameters. Fixes the gap where AI agents had to guess category IDs before calling createPost.
• New: wordpress.listTags tool — same interface for post tags.
• Compliance: readme headers refreshed (Stable tag + Tested up to 7.1) to satisfy WordPress Plugin Check.
• Version numbering: internal dev branch (0.5.x) resynced to public release track (1.x). No breaking changes vs 1.0.0 — pure additions.

1.0.0 - 2026-06-28

• First public release on WordPress.org (see prior 0.5.x internal changelog entries below).

0.5.8 - 2026-07-02

• Breaking: Servio Protocol alignment — all endpoints moved from /wp-json/goldt-webmcp-bridge/v1/* to /api/aiconnect-* to match the unified Servio protocol used across all Goldnat plugins (WordPress, XenForo, and future platforms). This enables goldnat.ai's detectWebMCPConnect to recognize WordPress prompts the same way it recognizes XenForo prompts.
• Breaking: Token prefixes changed from wpc_/wpr_ to xfa_/xfr_ (Servio standard). Existing tokens will stop working — users need to generate a new prompt from the /ai-connect/ page.
• New: /api/aiconnect-manifest — serves the Servio manifest (was /wp-json/goldt-webmcp-bridge/v1/manifest).
• New: /api/aiconnect-tools — serves tool calls with ?name=toolName (was /wp-json/goldt-webmcp-bridge/v1/tools/{toolName}).
• New: /api/aiconnect-oauth — handles token exchange and refresh (was /wp-json/goldt-webmcp-bridge/v1/oauth/token).
• New: Bearer_Auth::authenticate_request() — public method for authenticating requests outside the WP REST infrastructure (used by the Servio /api/ handlers).
• Changed: Prompt format simplified to match XenForo addon — single MCP section with webmcp_addSite, no "Option A / Option B", direct URL fallback for read-only tools only.
• Internal: User-facing endpoints (generate-prompt, my-tokens) remain as WP REST routes with cookie auth — unaffected by this change.

0.5.7 - 2026-07-01

• Security: Fixed dynamic content leak in wordpress.searchPosts, wordpress.searchPages, wordpress.getPost, wordpress.getPage. Previously the tools ran WordPress's the_content filter, which executed dynamic blocks and shortcodes — so a Cart page could accidentally return the rendered "New in store" WooCommerce grid (product names, prices, SKUs) even though it was called through a page tool. The four tools now return the raw post_content by default, so dynamic blocks stay as <!-- wp:… --> markers.
• New: render parameter on the four read tools with three modes:
• raw (default, safe) — returns post_content verbatim; no block/shortcode execution.
• full — runs the_content filter and executes blocks/shortcodes (only for callers that specifically need rendered HTML).
• excerpt — returns just the post excerpt. Any unrecognized value falls back to raw. The chosen mode is echoed back in the response as the render field so the caller can verify it.

0.5.6 - 2026-07-01

• New: Module_Base::check_scope() helper method — maps OAuth scopes (read / write / delete / admin / manage_users) to WordPress capabilities and returns whether the current user has the required capability. Used by Pro plugin's write handlers as a defense-in-depth check on top of the router's scope validation.

0.5.5 - 2026-07-01

• New: Complete visual redesign of the /ai-connect/ page — Console Hero UI with Space Grotesk, Inter and JetBrains Mono fonts, all styles scoped under .aiconnect-app so they cannot leak into WP admin or other plugins.
• New: Simplified prompt generator — single "Generate AI prompt" button. Scopes are derived automatically from the logged-in user's WordPress capabilities (edit_posts, delete_posts, list_users, etc.), no scope / agent / template pickers.
• New: Universal prompt format — a single prompt body that contains both the MCP block (Claude Desktop / WebMCP-compatible) and the Direct HTTP block (curl / Gemini / Copilot / any REST client). One tool listing per tool, showing MCP name + HTTP path + description side by side.
• New: "My AI tokens" panel (modal) — shows every token you generated with prefix, scope, issued/expires/last-used timestamps and IP. Header pill shows the current active count.
• New: Personal token hard-delete. Delete removes both the registry row AND the underlying OAuth token — the AI agent that held it immediately loses access, and the record disappears from your history.
• New: REST endpoints GET/DELETE /goldt-webmcp-bridge/v1/my-tokens and DELETE /goldt-webmcp-bridge/v1/my-tokens/{id}, protected by WP cookie + REST nonce.
• Changed: Header now shows the user's WordPress role label (e.g. "Administrator", "Editor") instead of the display name.
• Fixed: The Bearer-auth REST filter was returning 401 for user-facing endpoints even when the user was logged in via cookie — now /generate-prompt and /my-tokens bypass the Bearer requirement when the WP session is valid.
• Fixed: OAuth Authorize URL field is no longer surfaced on the main info page — it confused end users. It's now hidden inside a "Manual setup" disclosure at the bottom.
• Fixed: PHPCS compliance across all changed files.

0.5.4 - 2026-06-30

• Fixed: OAuth Authorize URL field restored on /ai-connect/ info page (was defined but not rendered).
• Fixed: register_module() now supports multiple module instances under the same module_name (was overwriting). Required for Pro plugin compatibility.
• Fixed: getCurrentUser / getSupportedLanguages input_schema now uses \stdClass instead of empty array() to ensure JSON Schema 2020-12 compliance (properties: {} not properties: []).
• Fixed: PHPCS compliance — short ternary + Yoda condition in tools endpoint.
• Internal: Capability tester (plugins-manager) rebranded to goldnat.ai.

0.5.3 - 2026-06-01

• Fixed: Admin status page was displaying version 0.4.0 instead of the actual plugin version. Changed hardcoded $version = '0.4.0' class property to use GOLDTWMCP_VERSION constant.

0.5.2 - 2026-06-01

• Fixed: Replaced deprecated mysql2date() calls with gmdate() in OAuth tokens admin view (deprecated since WordPress 5.3).

0.5.1 - 2026-06-01

• Fixed: Settings link in plugins list pointed to non-existent page slug goldtwmcp — corrected to goldt-webmcp-bridge.
• Fixed: Two unescaped echo calls in admin status page wrapped with esc_html().
• Removed: Unnecessary WooCommerce recommendation notice (WooCommerce is not required by this plugin).

0.4.6 - 2026-05-20

• Fixed (security): searchPosts and searchPages now hardcode post_status=publish instead of 'any'. WP_Query with 'any' bypasses WordPress capability checks entirely and returns all posts including other users' drafts — even to subscribers. Reverted to explicit 'publish'.

0.4.5 - 2026-05-19

• Fixed: Copy Code button on the OAuth authorization code page (OOB) was silently failing — the copyCode() JavaScript function was missing. Added with navigator.clipboard API and execCommand fallback.
• Added: webmcp-master.ai added to the supported platforms list on the /ai-connect/ info page.

0.4.4 - 2026-05-19

• Fixed: WordPress.org review — MyMemory external service URLs updated to working addresses.
• Fixed: WordPress.org review — searchPosts and searchPages now use native WordPress capability filtering (post_status => 'any'): subscribers see only published posts, authors see their own drafts, editors/admins see all. The status parameter has been removed from the tool schema since it is no longer needed.
• Fixed: WordPress.org review — getPost and getPage now enforce current_user_can('read_post') for non-published content, preventing unauthorized access to drafts/private pages by ID.

0.4.3 - 2026-05-19

• Fixed: wp plugin check warnings — renamed unprefixed view variables to goldtwmcp_ prefix; wrapped $table in esc_sql() in schema-introspection queries; suppressed false-positive PluginCheck.Security.DirectDB warnings on whitelisted SQL fragments.

0.4.2 - 2026-05-18

• Fixed: PHPCS WordPress coding standards compliance — resolved 16 errors and 3 warnings across class-database.php, class-token-registry.php, class-oauth-server.php, and admin-token-registry.php.

0.4.1 - 2026-05-13

• Added: Manifest now exposes auth.registered_clients — an object mapping each registered OAuth client_id to its display name, so AI agents can discover which clients this site accepts without an extra round-trip.
• Added: New default OAuth client webmcp-master (WebMCP Master) with full scopes (read, write, delete, manage_users) — seeded on fresh installs and idempotently inserted on upgrade for existing sites.
• Schema: Database upgrade routine 1.4.0 — inserts the webmcp-master client when missing.

0.4.0 - 2026-05-11

• Added: Token Registry — sidecar table ({prefix}aiconnect_token_registry) records every issued/refreshed token (only the 16-char prefix is stored, not the full secret), tracking issued_at / expires_at / last_used_at / revoked_at / revoked_by / source / ip_address.
• Added: Admin REST endpoints GET /wp-json/goldt-mcp/v1/admin/tokens and DELETE /wp-json/goldt-mcp/v1/admin/tokens/{id} (manage_options only).
• Added: WP-Admin sub-page "AI Connect → Token Registry" to view and revoke active tokens with active / revoked / all filters.
• Improved: Bearer-auth lookups now update last_used_at and reject tokens revoked in the registry (defense in depth).
• Improved: Token revocation is now a soft-delete (revoked_at + revoked_by) instead of a hard delete; refresh-token rotation also flows through the registry.
• Schema: Database upgrade routine 1.3.0 — creates the new table on activation and on upgrade, with column-by-column ALTER fallback for partial pre-existing installs.

0.3.3 - 2026-05-06

• Fixed: Removed "Powered by AI Connect" credit link from public-facing info page (WordPress.org compliance)

0.3.2 - 2026-04-12

• Fixed: "Revoke All Tokens" button now actually revokes all active tokens in the database
• Fixed: Tool names now use lowercase module prefix (wordpress.searchPosts) per WebMCP protocol spec
• Improved: CSS/JS extracted to assets/ using wp_enqueue_style/wp_enqueue_script (WordPress.org compliance)
• Improved: Admin settings page cleaned up - removed irrelevant status rows
• Added: External Services disclosure for MyMemory API (WordPress.org compliance)

0.3.0

• Added: Translation Provider setting (AI Self-Translate, MyMemory API, or Disabled)
• Added: TranslationModule with MyMemory API integration (translate, getSupportedLanguages)
• Added: Dynamic manifest instructions to prevent AI agents from inventing capabilities
• Improved: OAuth client_id is now optional (defaults to 'claude')
• Improved: Fuzzy client_id matching (recognizes variants like gemini_client, claude_ai)
• Improved: Specific OAuth error messages instead of generic errors

0.2.1 - 2026-03-06

• Security: Added OAuth scope validation - users must explicitly grant permissions for each tool
• WordPress.org Compliance: Fixed inline scripts/styles - moved to wp_enqueue_script/style
• WordPress.org Compliance: Removed /status endpoint per security review
• WordPress.org Compliance: Updated .distignore to exclude vendor development files
• Fixed: Updated Bearer_Auth endpoint paths to current plugin slug
• Improved: 3-layer security architecture (authentication, rate limiting, authorization)

0.2.0 - 2026-02-23

• Security: Migrated to OAuth 2.0 with PKCE for secure authentication
• Added: 8 pre-registered AI clients (Claude, ChatGPT, Gemini, and more)
• Added: Parameter validation and resource limits (prevents abuse)
• Improved: Security hardening - comprehensive input validation

0.1.2 - 2026-02-19

• Added: Translation support for 12 languages

0.1.1 - 2026-02-16

• Improved: Bundled all dependencies - no manual setup required

0.1.0 - 2025-02-13

• Initial public release
• WebMCP protocol support
• 5 WordPress core tools