GoldT WebMCP Bridge

• Servio Protocol Support - Industry-standard AI integration
• Secure OAuth 2.0 - Same security standard as Google, Facebook, GitHub - your passwords stay safe
• 8 Pre-registered AI Clients - Claude, ChatGPT, Gemini, Grok, Perplexity, Copilot, Meta AI, DeepSeek
• 7 Tools - WordPress content tools plus optional translation via MyMemory API
• Translation Provider - Choose AI self-translate, MyMemory API, or disabled
• Dynamic Manifest - Instructions adapt to your settings so AI agents don't invent capabilities
• Rate Limiting - Prevent abuse (50 req/min default)
• Security Controls - Token management, block specific users
• Zero Configuration - Works out of the box
• Extensible - Add custom tools via developer hooks

"I want to connect you to my WordPress site at https://mysite.com using the Goldnat AI Connect for WordPress plugin. The manifest is at /api/aiconnect-manifest. Use OAuth 2.0 with client_id: claude-ai" The AI will guide you through OAuth authorization - you'll approve access in your browser.

• Claude AI - Use client_id: claude-ai (Anthropic)
• ChatGPT - Use client_id: chatgpt (OpenAI)
• Gemini - Use client_id: gemini (Google)
• Grok - Use client_id: grok (xAI)
• Perplexity AI - Use client_id: perplexity
• Microsoft Copilot - Use client_id: copilot
• Meta AI - Use client_id: meta-ai (Facebook)
• DeepSeek - Use client_id: deepseek

1. wordpress.searchPosts - Search posts with filters
2. wordpress.getPost - Get single post by ID or slug
3. wordpress.searchPages - Search pages
4. wordpress.getPage - Get single page by ID or slug
5. wordpress.getCurrentUser - Get authenticated user info
6. translation.translate - Translate text via MyMemory API (when Translation Provider = mymemory)
7. translation.getSupportedLanguages - List supported language codes (when Translation Provider = mymemory)

1. AI agent initiates OAuth flow with code challenge (PKCE)
2. User approves in browser (consent screen)
3. Agent receives one-time authorization code
4. Agent exchanges code for access token using code verifier
5. Agent uses token for API calls

• The agent receives an OAuth token linked to that user's ID
• All API requests run with that user's permissions
• The agent respects WordPress user capabilities Examples:

• ✅ Sees all posts (including drafts, private)
• ✅ Full access based on admin capabilities If Subscriber authorizes:
• ✅ Sees only published content
• ❌ Cannot see drafts or private content Security: Authorization codes are one-time use (10 min expiry). Access tokens expire after 1 hour. Refresh tokens valid for 30 days. PKCE ensures tokens can't be stolen.

• AI Self-Translate (default) - The AI agent handles translation on its own; no translation tools appear in the manifest
• MyMemory API - Plugin calls MyMemory and returns translated text; translation.translate and translation.getSupportedLanguages tools are added to the manifest
• Disabled - Translation tools are hidden from the manifest entirely

• Default: 50 requests per minute, 1,000 per hour (per user)
• Adjust both values in AI Connect → Settings

• Revoke OAuth Tokens - Go to AI Connect → OAuth Tokens to view and revoke active tokens
• Block Users - Go to AI Connect → Settings → scroll to "Manage User Access" section
• Rate Limits - Configure request limits in AI Connect → Settings (default: 50/min, 1000/hour)

• 💡 What tools would be most useful? Tell us which WordPress features you'd like AI agents to access
• 🐛 Found a bug? Report it so we can fix it quickly
• ⭐ Feature requests - We prioritize based on community feedback

• GitHub: https://github.com/chgold/goldt-wp-webmcp-bridge/issues
• WordPress.org: Support forum Your feedback directly shapes the future of this plugin!

1. Go to Plugins → Add New in WordPress admin
2. Search for "Goldnat AI Connect for WordPress"
3. Click Install Now and then Activate

1. Download the plugin zip file
2. Go to Plugins → Add New → Upload Plugin
3. Upload the zip file and click Install Now
4. Activate the plugin

• Fixed: reverted plugin display name back to the original GoldT WebMCP Bridge (matches the plugin slug goldt-webmcp-bridge). 1.2.0 renamed it to a longer form that included the term "WordPress"; the wp.org Plugin Check flags that as a restricted term and it also no longer matched the slug. The Goldnat / Servio Protocol rebrand still lives everywhere it makes sense — description tagline, manifest, admin subtitle, quick-prompt template, OAuth client display — but the Plugin Name header stays stable.
• Removed: includes/core/class-plugin-updater.php. WordPress.org's Plugin Check rejects custom update systems (Plugin Updater detected), and the Free plugin was already served via wp.org's built-in updater; the custom checker was only used by external Pro plugins that must ship their own update code from here on.
• Fixed: SQL warnings in upgrade_to_2_0_5 and upgrade_to_2_0_6 (interpolated table names) suppressed with the same phpcs:disable/enable block the older migrations use — behaviour unchanged.
• Fixed: parse_url() → wp_parse_url() (only usage was inside the removed updater).
• Fixed: 1.2.1 upgrade notice trimmed under the 300-character wp.org limit.

• Rebrand completion (OAuth client identifier): the built-in master OAuth client's client_id is renamed from webmcp-master to goldnat-master, so the plugin no longer exposes any "webmcp" string to AI agents via the OAuth authorize/token flows. New DB schema upgrade 2.0.5 performs the rename in three tables atomically: oauth_clients gets a new goldnat-master row (config copied from the legacy row), then oauth_tokens and aiconnect_token_registry are re-pointed at the new identifier, then the legacy webmcp-master row is deleted. Existing agents keep working — their tokens now reference goldnat-master (which exists), so bearer-auth continues to succeed without any user action. New authorize requests that hard-code the legacy identifier will get invalid_client and need to reconnect using goldnat-master. Idempotent — re-running the migration is a no-op on already-migrated sites.
• Rebrand follow-up (prompt generator UI): the master client's label in get_agent_clients() no longer reads "Goldnat (webmcp)"; it now reads "Goldnat Master", matching the display name in the DB and on the OAuth consent screen.

• Rebrand follow-up (OAuth consent screen): the built-in webmcp-master OAuth client had client_name = 'WebMCP Master' in the database, which is the name users saw on the "Authorize this application?" consent screen every time they connected an AI agent with full-access scope. New DB schema upgrade 2.0.4 renames the display name to Goldnat Master on existing sites. The client_id itself stays webmcp-master — active tokens and integrations reference that identifier and would break if it changed. Fresh installs also get the new display name via insert_default_clients().

• Fixed: rewrite rules are now auto-flushed on plugin upgrade. WordPress caches compiled rewrite rules in wp_options.rewrite_rules. The activation hook flushes that cache — but activation doesn't run on plugin update, wp-cli update, or auto-update, so any new or renamed route (like /api/aiconnect-manifest) returned the homepage instead of the handler until someone manually visited Settings → Permalinks. The plugin now checks goldtwmcp_version on every init; when it lags GOLDTWMCP_VERSION the flush is scheduled on wp_loaded (priority 999) and the version option is bumped. Zero-config for site admins — the first request after an upgrade repairs the cache. (See gold-t.co.il thread #700.)
• Rebrand follow-up: three user-facing strings that 1.2.0 missed are now updated too. The Servio manifest now advertises "Goldnat AI Connect bridge for WordPress (Servio Protocol)" as its description (was: "WebMCP bridge for WordPress"). The /ai-connect/ info-page subtitle reads "Goldnat AI Connect · Servio Protocol" (was: "WebMCP Protocol Bridge"). The manual quick-prompt template opens with "Connect to using the Servio Protocol" (was: "using the WebMCP protocol"), so users no longer paste stale branding into their AI agent.
• Fixed: the "Documentation" link on the /ai-connect/ page pointed to https://ai-connect.gold-t.co.il/wordpress, which returns 404. Updated to the live docs at https://plugins.goldnat.ai/wordpress.

• Rebrand: user-facing name changed from "GoldT WebMCP Bridge" to "Goldnat AI Connect for WordPress" to match the rest of the Goldnat AI Connect plugin family (XenForo, Drupal, Ghost, Moodle, NodeBB, PrestaShop, Shopify, Discourse). The underlying protocol is now called "Servio Protocol" (was: "WebMCP protocol").
• Rebrand: readme description, features, FAQ, troubleshooting and installation copy updated to reflect the new name and protocol. Plugin URI updated to https://plugins.goldnat.ai/wordpress/goldt-webmcp-bridge.
• Rebrand: admin menu already reads "AI Connect" (since 0.4.0); readme now matches. All documentation references corrected to /api/aiconnect-manifest, /api/aiconnect-tools, /api/aiconnect-oauth — the old /wp-json/goldt-webmcp-bridge/v1/* paths were removed in 0.5.8 but the readme still showed them.
• Compat: plugin folder slug (goldt-webmcp-bridge), text domain (goldt-webmcp-bridge), PHP namespace (GoldtWebMCP\), option keys (goldtwmcp_*), database tables, PHP constants (GOLDTWMCP_VERSION) and every REST endpoint are UNCHANGED. Existing OAuth tokens, custom tools registered via goldtwmcp_register_modules, and AI agent integrations continue to work with no reconfiguration.

• New: wordpress.listCategories tool — resolve category id from name or slug via case-insensitive substring search. Supports parent, orderby, and limit parameters. Fixes the gap where AI agents had to guess category IDs before calling createPost.
• New: wordpress.listTags tool — same interface for post tags.
• Compliance: readme headers refreshed (Stable tag + Tested up to 7.1) to satisfy WordPress Plugin Check.
• Version numbering: internal dev branch (0.5.x) resynced to public release track (1.x). No breaking changes vs 1.0.0 — pure additions.

• First public release on WordPress.org (see prior 0.5.x internal changelog entries below).

• Breaking: Servio Protocol alignment — all endpoints moved from /wp-json/goldt-webmcp-bridge/v1/* to /api/aiconnect-* to match the unified Servio protocol used across all Goldnat plugins (WordPress, XenForo, and future platforms). This enables goldnat.ai's detectWebMCPConnect to recognize WordPress prompts the same way it recognizes XenForo prompts.
• Breaking: Token prefixes changed from wpc_/wpr_ to xfa_/xfr_ (Servio standard). Existing tokens will stop working — users need to generate a new prompt from the /ai-connect/ page.
• New: /api/aiconnect-manifest — serves the Servio manifest (was /wp-json/goldt-webmcp-bridge/v1/manifest).
• New: /api/aiconnect-tools — serves tool calls with ?name=toolName (was /wp-json/goldt-webmcp-bridge/v1/tools/{toolName}).
• New: /api/aiconnect-oauth — handles token exchange and refresh (was /wp-json/goldt-webmcp-bridge/v1/oauth/token).
• New: Bearer_Auth::authenticate_request() — public method for authenticating requests outside the WP REST infrastructure (used by the Servio /api/ handlers).
• Changed: Prompt format simplified to match XenForo addon — single MCP section with webmcp_addSite, no "Option A / Option B", direct URL fallback for read-only tools only.
• Internal: User-facing endpoints (generate-prompt, my-tokens) remain as WP REST routes with cookie auth — unaffected by this change.

• Security: Fixed dynamic content leak in wordpress.searchPosts, wordpress.searchPages, wordpress.getPost, wordpress.getPage. Previously the tools ran WordPress's the_content filter, which executed dynamic blocks and shortcodes — so a Cart page could accidentally return the rendered "New in store" WooCommerce grid (product names, prices, SKUs) even though it was called through a page tool. The four tools now return the raw post_content by default, so dynamic blocks stay as <!-- wp:… --> markers.
• New: render parameter on the four read tools with three modes:
• raw (default, safe) — returns post_content verbatim; no block/shortcode execution.
• full — runs the_content filter and executes blocks/shortcodes (only for callers that specifically need rendered HTML).
• excerpt — returns just the post excerpt. Any unrecognized value falls back to raw. The chosen mode is echoed back in the response as the render field so the caller can verify it.

• New: Module_Base::check_scope() helper method — maps OAuth scopes (read / write / delete / admin / manage_users) to WordPress capabilities and returns whether the current user has the required capability. Used by Pro plugin's write handlers as a defense-in-depth check on top of the router's scope validation.

• New: Complete visual redesign of the /ai-connect/ page — Console Hero UI with Space Grotesk, Inter and JetBrains Mono fonts, all styles scoped under .aiconnect-app so they cannot leak into WP admin or other plugins.
• New: Simplified prompt generator — single "Generate AI prompt" button. Scopes are derived automatically from the logged-in user's WordPress capabilities (edit_posts, delete_posts, list_users, etc.), no scope / agent / template pickers.
• New: Universal prompt format — a single prompt body that contains both the MCP block (Claude Desktop / WebMCP-compatible) and the Direct HTTP block (curl / Gemini / Copilot / any REST client). One tool listing per tool, showing MCP name + HTTP path + description side by side.
• New: "My AI tokens" panel (modal) — shows every token you generated with prefix, scope, issued/expires/last-used timestamps and IP. Header pill shows the current active count.
• New: Personal token hard-delete. Delete removes both the registry row AND the underlying OAuth token — the AI agent that held it immediately loses access, and the record disappears from your history.
• New: REST endpoints GET/DELETE /goldt-webmcp-bridge/v1/my-tokens and DELETE /goldt-webmcp-bridge/v1/my-tokens/{id}, protected by WP cookie + REST nonce.
• Changed: Header now shows the user's WordPress role label (e.g. "Administrator", "Editor") instead of the display name.
• Fixed: The Bearer-auth REST filter was returning 401 for user-facing endpoints even when the user was logged in via cookie — now /generate-prompt and /my-tokens bypass the Bearer requirement when the WP session is valid.
• Fixed: OAuth Authorize URL field is no longer surfaced on the main info page — it confused end users. It's now hidden inside a "Manual setup" disclosure at the bottom.
• Fixed: PHPCS compliance across all changed files.

• Fixed: OAuth Authorize URL field restored on /ai-connect/ info page (was defined but not rendered).
• Fixed: register_module() now supports multiple module instances under the same module_name (was overwriting). Required for Pro plugin compatibility.
• Fixed: getCurrentUser / getSupportedLanguages input_schema now uses \stdClass instead of empty array() to ensure JSON Schema 2020-12 compliance (properties: {} not properties: []).
• Fixed: PHPCS compliance — short ternary + Yoda condition in tools endpoint.
• Internal: Capability tester (plugins-manager) rebranded to goldnat.ai.

• Fixed: Admin status page was displaying version 0.4.0 instead of the actual plugin version. Changed hardcoded $version = '0.4.0' class property to use GOLDTWMCP_VERSION constant.

• Fixed: Replaced deprecated mysql2date() calls with gmdate() in OAuth tokens admin view (deprecated since WordPress 5.3).

• Fixed: Settings link in plugins list pointed to non-existent page slug goldtwmcp — corrected to goldt-webmcp-bridge.
• Fixed: Two unescaped echo calls in admin status page wrapped with esc_html().
• Removed: Unnecessary WooCommerce recommendation notice (WooCommerce is not required by this plugin).

• Fixed (security): searchPosts and searchPages now hardcode post_status=publish instead of 'any'. WP_Query with 'any' bypasses WordPress capability checks entirely and returns all posts including other users' drafts — even to subscribers. Reverted to explicit 'publish'.

• Fixed: Copy Code button on the OAuth authorization code page (OOB) was silently failing — the copyCode() JavaScript function was missing. Added with navigator.clipboard API and execCommand fallback.
• Added: webmcp-master.ai added to the supported platforms list on the /ai-connect/ info page.

• Fixed: WordPress.org review — MyMemory external service URLs updated to working addresses.
• Fixed: WordPress.org review — searchPosts and searchPages now use native WordPress capability filtering (post_status => 'any'): subscribers see only published posts, authors see their own drafts, editors/admins see all. The status parameter has been removed from the tool schema since it is no longer needed.
• Fixed: WordPress.org review — getPost and getPage now enforce current_user_can('read_post') for non-published content, preventing unauthorized access to drafts/private pages by ID.

• Fixed: wp plugin check warnings — renamed unprefixed view variables to goldtwmcp_ prefix; wrapped $table in esc_sql() in schema-introspection queries; suppressed false-positive PluginCheck.Security.DirectDB warnings on whitelisted SQL fragments.

• Fixed: PHPCS WordPress coding standards compliance — resolved 16 errors and 3 warnings across class-database.php, class-token-registry.php, class-oauth-server.php, and admin-token-registry.php.

• Added: Manifest now exposes auth.registered_clients — an object mapping each registered OAuth client_id to its display name, so AI agents can discover which clients this site accepts without an extra round-trip.
• Added: New default OAuth client webmcp-master (WebMCP Master) with full scopes (read, write, delete, manage_users) — seeded on fresh installs and idempotently inserted on upgrade for existing sites.
• Schema: Database upgrade routine 1.4.0 — inserts the webmcp-master client when missing.

• Added: Token Registry — sidecar table ({prefix}aiconnect_token_registry) records every issued/refreshed token (only the 16-char prefix is stored, not the full secret), tracking issued_at / expires_at / last_used_at / revoked_at / revoked_by / source / ip_address.
• Added: Admin REST endpoints GET /wp-json/goldt-mcp/v1/admin/tokens and DELETE /wp-json/goldt-mcp/v1/admin/tokens/{id} (manage_options only).
• Added: WP-Admin sub-page "AI Connect → Token Registry" to view and revoke active tokens with active / revoked / all filters.
• Improved: Bearer-auth lookups now update last_used_at and reject tokens revoked in the registry (defense in depth).
• Improved: Token revocation is now a soft-delete (revoked_at + revoked_by) instead of a hard delete; refresh-token rotation also flows through the registry.
• Schema: Database upgrade routine 1.3.0 — creates the new table on activation and on upgrade, with column-by-column ALTER fallback for partial pre-existing installs.

• Fixed: Removed "Powered by AI Connect" credit link from public-facing info page (WordPress.org compliance)

• Fixed: "Revoke All Tokens" button now actually revokes all active tokens in the database
• Fixed: Tool names now use lowercase module prefix (wordpress.searchPosts) per WebMCP protocol spec
• Improved: CSS/JS extracted to assets/ using wp_enqueue_style/wp_enqueue_script (WordPress.org compliance)
• Improved: Admin settings page cleaned up - removed irrelevant status rows
• Added: External Services disclosure for MyMemory API (WordPress.org compliance)

• Added: Translation Provider setting (AI Self-Translate, MyMemory API, or Disabled)
• Added: TranslationModule with MyMemory API integration (translate, getSupportedLanguages)
• Added: Dynamic manifest instructions to prevent AI agents from inventing capabilities
• Improved: OAuth client_id is now optional (defaults to 'claude')
• Improved: Fuzzy client_id matching (recognizes variants like gemini_client, claude_ai)
• Improved: Specific OAuth error messages instead of generic errors

• Security: Added OAuth scope validation - users must explicitly grant permissions for each tool
• WordPress.org Compliance: Fixed inline scripts/styles - moved to wp_enqueue_script/style
• WordPress.org Compliance: Removed /status endpoint per security review
• WordPress.org Compliance: Updated .distignore to exclude vendor development files
• Fixed: Updated Bearer_Auth endpoint paths to current plugin slug
• Improved: 3-layer security architecture (authentication, rate limiting, authorization)

• Security: Migrated to OAuth 2.0 with PKCE for secure authentication
• Added: 8 pre-registered AI clients (Claude, ChatGPT, Gemini, and more)
• Added: Parameter validation and resource limits (prevents abuse)
• Improved: Security hardening - comprehensive input validation

• Added: Translation support for 12 languages

• Improved: Bundled all dependencies - no manual setup required

• Initial public release
• WebMCP protocol support
• 5 WordPress core tools