feat(v3.13.0): settings live DB reads, remove Directus/Appwrite, admin stats
Settings fixes: - MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings table (DB > ENV > default), so dashboard/settings changes apply without restart. Sync cache refreshed on every save or delete. - /api/me reports the live DB value for max_sites_per_user. Admin improvements: - Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS). - Admin Overview now shows platform stats: registered users, new users (7d), total user sites, available tools. Plugin cleanup: - Appwrite and Directus plugins removed from the active registry (8 plugins now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase, OpenPanel, Coolify). Plugin code is retained for future re-enabling. - Settings page plugin visibility list updated to match. Mobile onboarding: - Stepper steps on narrow viewports stack vertically with correct full border and rounded corners on each step. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
185
wordpress-plugin/SUBMISSION.md
Normal file
185
wordpress-plugin/SUBMISSION.md
Normal file
@@ -0,0 +1,185 @@
|
||||
# Airano MCP Bridge — wp.org Submission Handoff
|
||||
|
||||
This document covers the full transition from the legacy `airano-mcp-seo-bridge` slug to the new `airano-mcp-bridge` slug on WordPress.org.
|
||||
|
||||
---
|
||||
|
||||
## Phase 1 — Local prep (DONE)
|
||||
|
||||
- [x] readme.txt header: `Stable tag: 2.10.1`, `Tested up to: 6.9` (major.minor only — Plugin Check rejects `6.9.4`)
|
||||
- [x] PHP header: `Plugin URI` (live site) and `Author URI` (GitHub org) are now distinct — Plugin Check rejected when both pointed to the same URL
|
||||
- [x] readme.txt: changelog entries for 2.10.0 and 2.10.1, matching upgrade notices
|
||||
- [x] readme.txt + main PHP: live-site link (`https://mcp.palebluedot.live`) added; GitHub source kept as secondary
|
||||
- [x] README.md version bumped to 2.10.1
|
||||
- [x] Plugin URI + Author URI in main PHP point to live site
|
||||
- [x] Submission zip rebuilt with POSIX paths: `wordpress-plugin/airano-mcp-bridge.zip` (33.9 KB, 3 files)
|
||||
- [x] SVN staging layout prepared at `wordpress-plugin/airano-mcp-bridge-svn/`:
|
||||
- `trunk/` — final files
|
||||
- `assets/icon.svg` — copied from `core/templates/static/logo.svg`
|
||||
- `tags/` — empty (release tags created in Phase 3)
|
||||
|
||||
---
|
||||
|
||||
## Phase 2 — Submit to wp.org (USER ACTION, in browser)
|
||||
|
||||
### Step 1 — Go to the submission form
|
||||
|
||||
https://wordpress.org/plugins/developers/add/
|
||||
|
||||
Sign in with the same wp.org account that owns `airano-mcp-seo-bridge` (`airano`).
|
||||
|
||||
### Step 2 — Upload the ZIP
|
||||
|
||||
The submission form has **one upload field** + **one "Additional Information" textbox**. The plugin name, slug, tags and full description all come from the `readme.txt` inside the ZIP — the form does NOT ask for them separately.
|
||||
|
||||
- **ZIP**: `wordpress-plugin/airano-mcp-bridge.zip`
|
||||
- **Additional Information**: paste the short message in Step 3 below
|
||||
|
||||
### Step 3 — "Additional Information" message (paste this)
|
||||
|
||||
This field is read by reviewers, not end users. Keep it short and give context they can't infer from the readme.
|
||||
|
||||
```
|
||||
Companion plugin for MCP Hub (https://mcp.palebluedot.live), a self-hosted
|
||||
hub that lets AI assistants manage WordPress, WooCommerce and other
|
||||
self-hosted services through the Model Context Protocol.
|
||||
|
||||
The plugin extends the WordPress REST API with a few routes the stock
|
||||
endpoints can't cover — raw-binary media uploads that bypass
|
||||
upload_max_filesize, bulk meta writes, cache purge, transient cleanup,
|
||||
unified site-health snapshot, HMAC-signed audit webhook, and SEO meta
|
||||
for Rank Math / Yoast. All routes are gated by WordPress capability
|
||||
checks and require Application Password authentication.
|
||||
|
||||
Submission notes for the review team:
|
||||
|
||||
- Same author account ("airano") previously published
|
||||
https://wordpress.org/plugins/airano-mcp-seo-bridge/ (1.3.0, 30+ active
|
||||
installs). That earlier plugin was SEO-only. Over the past two months
|
||||
it grew well beyond SEO, so we are submitting under a new slug
|
||||
(airano-mcp-bridge) that better reflects the broader scope. The old
|
||||
slug will get a final release with a migration notice and then be
|
||||
retired — we won't rename or replace its main file.
|
||||
|
||||
- All file I/O uses WP_Filesystem, not bare PHP file functions.
|
||||
- All output is escaped (esc_html, esc_url, wp_kses_post as appropriate).
|
||||
- Translations use the 'airano-mcp-bridge' text domain (36 strings).
|
||||
- No bundled binaries, no obfuscation, no remote calls except the
|
||||
user-configured audit-hook webhook (which is opt-in and fully disabled
|
||||
by default).
|
||||
```
|
||||
|
||||
### Step 4 — After submitting
|
||||
|
||||
You'll get an automated confirmation email. Reviewers may take **1-14 days** to respond. They might:
|
||||
|
||||
- **Approve immediately** (clean readme + standards-compliant code) → SVN credentials emailed
|
||||
- **Ask for fixes** (e.g. extra escaping, license clarifications) → reply with patches
|
||||
- **Reject** → reasons given; address and resubmit
|
||||
|
||||
**While you wait:** the old slug `airano-mcp-seo-bridge` stays live and untouched. If you need to push an urgent fix to the existing 30+ installs in the meantime, you can — see `Fallback` section below.
|
||||
|
||||
---
|
||||
|
||||
## Phase 3 — After approval (CLI commands, run from this repo)
|
||||
|
||||
When wp.org emails the SVN URL (`https://plugins.svn.wordpress.org/airano-mcp-bridge/`):
|
||||
|
||||
```bash
|
||||
# 1. Checkout the empty SVN repo
|
||||
svn co https://plugins.svn.wordpress.org/airano-mcp-bridge/ /tmp/airano-mcp-bridge-svn
|
||||
|
||||
# 2. Copy our prepared layout into it
|
||||
cp -r wordpress-plugin/airano-mcp-bridge-svn/trunk/* /tmp/airano-mcp-bridge-svn/trunk/
|
||||
cp -r wordpress-plugin/airano-mcp-bridge-svn/assets/* /tmp/airano-mcp-bridge-svn/assets/
|
||||
|
||||
# 3. Stage everything
|
||||
cd /tmp/airano-mcp-bridge-svn
|
||||
svn add trunk/* --force
|
||||
svn add assets/* --force
|
||||
|
||||
# 4. First commit to trunk
|
||||
svn ci -m "Initial release 2.10.1 — companion plugin for MCP Hub"
|
||||
|
||||
# 5. Tag the release (so wp.org indexes it as v2.10.1)
|
||||
svn cp trunk tags/2.10.1
|
||||
svn ci -m "Tag 2.10.1"
|
||||
```
|
||||
|
||||
### Asset checklist (Phase 3 polish — can be done after first release)
|
||||
|
||||
- [x] `assets/icon.svg` — staged
|
||||
- [ ] `assets/icon-256x256.png` — render the SVG at 256x256 (any online SVG-to-PNG tool, e.g. [cloudconvert](https://cloudconvert.com/svg-to-png))
|
||||
- [ ] `assets/banner-772x250.png` — needs design (logo + "Airano MCP Bridge" text + tagline on a #51b9f4 / #fec13d brand background)
|
||||
- [ ] `assets/banner-1544x500.png` — 2x retina version of the banner
|
||||
- [ ] `assets/screenshot-1.png` (optional) — could be a screenshot of MCP Hub dashboard showing the connected WP site, or skipped entirely
|
||||
|
||||
---
|
||||
|
||||
## Phase 4 — Deprecate old slug (LATER, weeks after Phase 3 is stable)
|
||||
|
||||
### Strategy: soft handover, then closure
|
||||
|
||||
1. **Wait** until the new plugin has its own organic traffic and a working install base (~2-4 weeks).
|
||||
2. **Push a final 1.x release** to the OLD slug (`airano-mcp-seo-bridge`) that does **two things**:
|
||||
- Adds a persistent admin notice: *"Airano MCP SEO Meta Bridge has been renamed and rebuilt as **Airano MCP Bridge**. Install the new plugin and deactivate this one. → \[Install link]"*
|
||||
- Keeps the old REST routes (`airano-mcp-seo-bridge/v1/*`) working so existing MCP Hub deployments don't break overnight.
|
||||
3. **Email closure** to `plugins@wordpress.org` from the author email **only after** the new plugin has been live for at least a month.
|
||||
|
||||
### Closure email template (use later, NOT NOW)
|
||||
|
||||
```
|
||||
To: plugins@wordpress.org
|
||||
Subject: Plugin closure request — airano-mcp-seo-bridge
|
||||
|
||||
Hello,
|
||||
|
||||
Please close the plugin with slug "airano-mcp-seo-bridge"
|
||||
(https://wordpress.org/plugins/airano-mcp-seo-bridge/).
|
||||
|
||||
Reason: The plugin has been rebuilt and rebranded as "Airano MCP Bridge"
|
||||
(slug: airano-mcp-bridge), available at
|
||||
https://wordpress.org/plugins/airano-mcp-bridge/. The old slug's name
|
||||
and SEO-only scope no longer reflect what the plugin does.
|
||||
|
||||
A migration notice has been published to the old slug since version 1.4.0
|
||||
directing users to the new plugin.
|
||||
|
||||
Author: airano
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Fallback — if wp.org rejects or you need to ship to old users first
|
||||
|
||||
The old slug still works. To push an urgent fix (e.g. critical bug) without waiting for the new plugin to be approved:
|
||||
|
||||
```bash
|
||||
# Checkout old slug SVN
|
||||
svn co https://plugins.svn.wordpress.org/airano-mcp-seo-bridge/ /tmp/old-svn
|
||||
|
||||
# Copy current code in (need to rename main file back to airano-mcp-seo-bridge.php
|
||||
# and adjust Plugin Name in the header to match the old display name)
|
||||
# ... then commit + tag as you would for a normal release
|
||||
|
||||
# Bump the version in trunk/readme.txt and trunk/airano-mcp-seo-bridge.php
|
||||
# svn ci -m "Bug fix release X.Y.Z"
|
||||
# svn cp trunk tags/X.Y.Z
|
||||
# svn ci -m "Tag X.Y.Z"
|
||||
```
|
||||
|
||||
⚠️ Don't push the new file `airano-mcp-bridge.php` directly to the old slug — wp.org tracks the main plugin file by name and renaming it breaks WordPress's auto-update.
|
||||
|
||||
---
|
||||
|
||||
## Files touched in Phase 1
|
||||
|
||||
- `wordpress-plugin/airano-mcp-bridge/readme.txt` — version, changelog, upgrade notice, live-site link
|
||||
- `wordpress-plugin/airano-mcp-bridge/README.md` — version, live-site link
|
||||
- `wordpress-plugin/airano-mcp-bridge/airano-mcp-bridge.php` — Plugin URI, Author URI
|
||||
- `wordpress-plugin/airano-mcp-bridge.zip` — rebuilt with POSIX paths
|
||||
|
||||
## New files (staging only — not yet committed anywhere)
|
||||
|
||||
- `wordpress-plugin/airano-mcp-bridge-svn/{trunk,assets,tags}/` — pre-built SVN layout
|
||||
- `wordpress-plugin/SUBMISSION.md` — this file
|
||||
80
wordpress-plugin/airano-mcp-bridge-wporg/README.md
Normal file
80
wordpress-plugin/airano-mcp-bridge-wporg/README.md
Normal file
@@ -0,0 +1,80 @@
|
||||
# airano-mcp-bridge — WordPress.org submission package
|
||||
|
||||
This folder is the **wp.org-bound** version of the companion plugin. It is
|
||||
deliberately the small surface (≈15 routes — SEO, media uploads, capability
|
||||
probe, cache/transient/site-health, audit-hook), **not** the full v2.18.x
|
||||
internal build.
|
||||
|
||||
The internal build at [../airano-mcp-bridge/](../airano-mcp-bridge) carries
|
||||
the admin namespace (plugins/themes/files/db/elementor/etc.) which is too
|
||||
broad for wp.org's review bar and stays out of the public release.
|
||||
|
||||
## Layout
|
||||
|
||||
```
|
||||
airano-mcp-bridge-wporg/
|
||||
├── airano-mcp-bridge/ ← what goes in the zip
|
||||
│ ├── airano-mcp-bridge.php
|
||||
│ ├── readme.txt
|
||||
│ └── README.md
|
||||
├── tests/
|
||||
│ ├── check.sh ← static checks (headers, escaping, routes, etc.)
|
||||
│ └── test_permission_callback.php ← unit test for the new gate
|
||||
└── airano-mcp-bridge.zip ← ready-to-upload bundle (built from the folder)
|
||||
```
|
||||
|
||||
## Pre-submission checks
|
||||
|
||||
```bash
|
||||
# 1. Static / heuristic checks (no WordPress runtime required)
|
||||
bash wordpress-plugin/airano-mcp-bridge-wporg/tests/check.sh
|
||||
|
||||
# 2. Unit tests on the new permission_callback (PHP-only, no WP bootstrap)
|
||||
php wordpress-plugin/airano-mcp-bridge-wporg/tests/test_permission_callback.php
|
||||
```
|
||||
|
||||
Both must exit 0 before zipping or uploading.
|
||||
|
||||
## Building the zip
|
||||
|
||||
```bash
|
||||
python - <<'PY'
|
||||
import zipfile, os
|
||||
src = "wordpress-plugin/airano-mcp-bridge-wporg/airano-mcp-bridge"
|
||||
dst = "wordpress-plugin/airano-mcp-bridge-wporg/airano-mcp-bridge.zip"
|
||||
if os.path.exists(dst): os.remove(dst)
|
||||
with zipfile.ZipFile(dst, "w", zipfile.ZIP_DEFLATED, compresslevel=9) as z:
|
||||
for root, _, files in os.walk(src):
|
||||
for f in files:
|
||||
full = os.path.join(root, f)
|
||||
arc = os.path.relpath(full, "wordpress-plugin/airano-mcp-bridge-wporg").replace(os.sep, "/")
|
||||
z.write(full, arc)
|
||||
print("built:", dst, os.path.getsize(dst), "bytes")
|
||||
PY
|
||||
```
|
||||
|
||||
## Reply to the wp.org review email
|
||||
|
||||
Use the message in [SUBMISSION_REPLY.md](SUBMISSION_REPLY.md). Keep it
|
||||
short — the wp.org guidance is "be brief and direct".
|
||||
|
||||
## What the v2.10.2 release fixes (vs the v2.10.1 they reviewed)
|
||||
|
||||
1. **Direct core file include**
|
||||
`wp-admin/includes/media.php` was loaded inside the `/upload-chunk` and
|
||||
`/upload-and-attach` REST callbacks but never used (the code only calls
|
||||
helpers from `file.php` and `image.php`). The redundant `require_once`
|
||||
lines are removed.
|
||||
|
||||
2. **`/upload-and-attach` permission gate**
|
||||
The route now uses a dedicated `require_upload_and_attach_capability`
|
||||
method that runs `current_user_can('edit_post', $attach_to_post)` at
|
||||
the route gate when `attach_to_post` is supplied. The check is no
|
||||
longer hidden inside the callback body, so static analysis can see it.
|
||||
The method also rejects `set_featured` without a target post.
|
||||
|
||||
3. **Ownership verification**
|
||||
DNS TXT record `wordpressorg-airano-verification` is published at
|
||||
`mcp.example.com`, which is also the `Plugin URI`. This pairs the
|
||||
submission with the domain the plugin advertises and satisfies the
|
||||
wp.org review request for a non-gmail.com proof of identity.
|
||||
95
wordpress-plugin/airano-mcp-bridge-wporg/SUBMISSION_REPLY.md
Normal file
95
wordpress-plugin/airano-mcp-bridge-wporg/SUBMISSION_REPLY.md
Normal file
@@ -0,0 +1,95 @@
|
||||
# Reply to wp.org review email — paste into the email thread
|
||||
|
||||
Keep this short and direct. wp.org explicitly asks reviewers to skim, not read essays.
|
||||
|
||||
---
|
||||
|
||||
## Subject line (current round — class-prefix fix)
|
||||
|
||||
Re: It's time to move forward with the plugin review "airano" — airano-mcp-bridge
|
||||
|
||||
(Reply in the existing thread; don't open a new one.)
|
||||
|
||||
---
|
||||
|
||||
## Body — paste this for the SECOND review (class prefix fix)
|
||||
|
||||
```
|
||||
Hi,
|
||||
|
||||
Thanks. Addressed in v2.10.3:
|
||||
|
||||
- Main class renamed from generic `SEO_API_Bridge` to `Airano_MCP_Bridge`
|
||||
to use the plugin-specific prefix (your "unique prefixes" guideline).
|
||||
All other elements already used the `airano` prefix as you noted.
|
||||
This is an internal refactor — the class is only instantiated from the
|
||||
file's bootstrap line and is never referenced by callers, so there's no
|
||||
public-API impact.
|
||||
|
||||
Updated zip uploaded via "Add your plugin" while logged in as airano.
|
||||
|
||||
Thanks,
|
||||
airano
|
||||
```
|
||||
|
||||
### Reply for the FIRST review (already sent — kept here for reference)
|
||||
|
||||
This was the response to the initial pre-review email about ownership
|
||||
+ media.php/permission_callback. Already sent.
|
||||
|
||||
```
|
||||
Hi,
|
||||
|
||||
Thanks for the review. Two notes on the requested items:
|
||||
|
||||
1) Ownership / domain verification
|
||||
|
||||
The plugin's URI is https://mcp.example.com (the public site for
|
||||
MCP Hub, the project this companion plugin pairs with). I publish to
|
||||
both mcp.example.com and example.com; my account on
|
||||
wordpress.org is "airano".
|
||||
|
||||
I've published the requested DNS TXT record at the plugin's domain:
|
||||
|
||||
Host: mcp.example.com
|
||||
Type: TXT
|
||||
Value: wordpressorg-airano-verification
|
||||
|
||||
Please verify with `dig TXT mcp.example.com +short` (the value
|
||||
should appear within the TTL).
|
||||
|
||||
I have also already published https://wordpress.org/plugins/airano-mcp-seo-bridge/
|
||||
under the same airano account. That plugin is the SEO-only ancestor of
|
||||
this one. Once airano-mcp-bridge is approved I will release a final
|
||||
update there pointing users to the new slug.
|
||||
|
||||
2) Code review items
|
||||
|
||||
Both code points have been addressed in v2.10.2:
|
||||
|
||||
- The redundant `wp-admin/includes/media.php` requires inside
|
||||
/upload-chunk and /upload-and-attach are removed. Those callbacks
|
||||
only use helpers from file.php (wp_tempnam, wp_handle_sideload) and
|
||||
image.php (wp_generate_attachment_metadata).
|
||||
|
||||
- /upload-and-attach now has its own permission_callback,
|
||||
`require_upload_and_attach_capability`, which enforces
|
||||
`current_user_can('edit_post', $attach_to_post)` at the route gate
|
||||
when attach_to_post is supplied (no longer hidden inside the
|
||||
callback body), and rejects set_featured without a target post.
|
||||
|
||||
I've uploaded the corrected v2.10.2 zip via "Add your plugin" while
|
||||
logged in as airano.
|
||||
|
||||
Happy to make further changes if anything else turns up on a closer read.
|
||||
|
||||
Thanks,
|
||||
airano
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Before sending
|
||||
|
||||
- [ ] You've uploaded `airano-mcp-bridge.zip` (v2.10.3) via the same "Add your plugin" page while logged in as `airano`.
|
||||
- [ ] You're replying *in the existing thread* with the body shown above.
|
||||
132
wordpress-plugin/airano-mcp-bridge-wporg/SVN_RELEASE.md
Normal file
132
wordpress-plugin/airano-mcp-bridge-wporg/SVN_RELEASE.md
Normal file
@@ -0,0 +1,132 @@
|
||||
# Releasing v2.10.3 to wordpress.org via SVN — DONE 2026-05-10
|
||||
|
||||
**Status (2026-05-10):**
|
||||
- ✅ trunk committed at `r3527909` (`svn ci`-ed by maintainer)
|
||||
- ✅ assets committed at `r3527917` (icon-128/256, banner-772x250 / 1544x500)
|
||||
- ✅ tag `2.10.3` committed at `r3527918`
|
||||
- ✅ legacy slug `airano-mcp-seo-bridge` updated to v1.3.1 at
|
||||
`r3527927/r3527928` with migration notice pointing here
|
||||
|
||||
Live page: <https://wordpress.org/plugins/airano-mcp-bridge/>
|
||||
|
||||
The rest of this file is the original runbook, kept as reference for
|
||||
future releases.
|
||||
|
||||
---
|
||||
|
||||
---
|
||||
|
||||
## What is already staged for you
|
||||
|
||||
A working copy is checked out at
|
||||
`wordpress-plugin/airano-mcp-bridge-wporg-svn/` (gitignored). The three
|
||||
plugin files have been copied into `trunk/` and `svn add`-ed:
|
||||
|
||||
```
|
||||
A trunk/README.md
|
||||
A trunk/airano-mcp-bridge.php
|
||||
A trunk/readme.txt
|
||||
```
|
||||
|
||||
The files are byte-identical to
|
||||
`wordpress-plugin/airano-mcp-bridge-wporg/airano-mcp-bridge/`, which is
|
||||
the version that just passed review.
|
||||
|
||||
---
|
||||
|
||||
## Step 1 — confirm credentials
|
||||
|
||||
If the approval email landed less than an hour ago, wait until the hour
|
||||
is up. Then verify your SVN password at:
|
||||
|
||||
https://profiles.wordpress.org/me/profile/edit/group/3/?screen=svn-password
|
||||
|
||||
The SVN username is your wordpress.org login: `airano` (case-sensitive).
|
||||
|
||||
---
|
||||
|
||||
## Step 2 — commit the initial release to trunk
|
||||
|
||||
```bash
|
||||
cd wordpress-plugin/airano-mcp-bridge-wporg-svn
|
||||
|
||||
svn ci -m "Initial release v2.10.3"
|
||||
# → SVN will prompt for username (airano) and password the first time.
|
||||
# Tick "store password" if you trust the machine.
|
||||
```
|
||||
|
||||
Wait for the response. A successful commit ends with `Committed revision XXXXXXX.`
|
||||
|
||||
---
|
||||
|
||||
## Step 3 — tag the release
|
||||
|
||||
wp.org expects every released version to also exist as a tag under
|
||||
`tags/<version>/`. The Stable Tag in `readme.txt` already points to
|
||||
`2.10.3`, so this tag is what `wp.org` actually serves to users.
|
||||
|
||||
```bash
|
||||
# Still inside wordpress-plugin/airano-mcp-bridge-wporg-svn/
|
||||
svn cp trunk tags/2.10.3
|
||||
svn ci -m "Tag 2.10.3"
|
||||
```
|
||||
|
||||
After this, `https://wordpress.org/plugins/airano-mcp-bridge/` will start
|
||||
serving v2.10.3 within a few minutes.
|
||||
|
||||
---
|
||||
|
||||
## Step 4 — verify on wp.org
|
||||
|
||||
- Plugin page: <https://wordpress.org/plugins/airano-mcp-bridge/>
|
||||
- Latest tag: <https://plugins.svn.wordpress.org/airano-mcp-bridge/tags/2.10.3/>
|
||||
- Trunk: <https://plugins.svn.wordpress.org/airano-mcp-bridge/trunk/>
|
||||
|
||||
The "Tested up to" badge, version number, and changelog should all show
|
||||
2.10.3.
|
||||
|
||||
---
|
||||
|
||||
## Optional but recommended — plugin assets
|
||||
|
||||
Plugin assets (icon, banner, screenshots) live in the SVN `assets/`
|
||||
directory at the same level as `trunk/` — NOT inside `trunk/assets/`.
|
||||
|
||||
Required filenames (any of):
|
||||
```
|
||||
assets/icon-128x128.png (or .jpg / icon.svg)
|
||||
assets/icon-256x256.png (high-DPI)
|
||||
assets/banner-772x250.png (header image, listing card)
|
||||
assets/banner-1544x500.png (high-DPI header)
|
||||
assets/screenshot-1.png (matched by readme.txt "== Screenshots ==" entries)
|
||||
assets/screenshot-2.png
|
||||
```
|
||||
|
||||
To upload after creating them locally:
|
||||
```bash
|
||||
cd wordpress-plugin/airano-mcp-bridge-wporg-svn
|
||||
cp /path/to/icon-256x256.png assets/
|
||||
cp /path/to/banner-1544x500.png assets/
|
||||
svn add assets/icon-256x256.png assets/banner-1544x500.png
|
||||
svn ci -m "Add plugin assets — icon + banner"
|
||||
```
|
||||
|
||||
Spec: <https://developer.wordpress.org/plugins/wordpress-org/plugin-assets/>
|
||||
|
||||
---
|
||||
|
||||
## Optional — close the old slug
|
||||
|
||||
The old slug `airano-mcp-seo-bridge` (the SEO-only ancestor) is still
|
||||
live. After v2.10.3 of the new slug is on the directory, you have two
|
||||
options:
|
||||
|
||||
**(a) Push a final 1.x release to the old slug** that simply prints an
|
||||
admin notice ("This plugin is now Airano MCP Bridge — please install
|
||||
that and deactivate this one"). Less disruptive for existing users.
|
||||
|
||||
**(b) Email `plugins@wordpress.org`** asking to close the old slug as
|
||||
"author request — superseded by airano-mcp-bridge". Faster.
|
||||
|
||||
Either is fine. Do this *after* the new slug is live and you've
|
||||
confirmed at least one install path works.
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 629 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 161 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
BIN
wordpress-plugin/airano-mcp-bridge-wporg/airano-mcp-bridge.zip
Normal file
BIN
wordpress-plugin/airano-mcp-bridge-wporg/airano-mcp-bridge.zip
Normal file
Binary file not shown.
@@ -0,0 +1,193 @@
|
||||
# Airano MCP Bridge
|
||||
|
||||
**Version:** 2.10.3
|
||||
**Requires WordPress:** 5.0+
|
||||
**Tested up to:** 6.9
|
||||
**Requires PHP:** 7.4+
|
||||
**License:** GPLv2 or later
|
||||
**Plugin slug:** `airano-mcp-bridge` (permanent)
|
||||
|
||||
> Companion plugin for [MCP Hub](https://mcp.example.com) — the AI-native management hub for WordPress, WooCommerce, and self-hosted services. Source: [github.com/airano-ir/mcphub](https://github.com/airano-ir/mcphub).
|
||||
|
||||
## What this plugin does
|
||||
|
||||
MCP Hub lets AI assistants (Claude, ChatGPT, Cursor, VS Code Copilot, …) manage your WordPress site through the Model Context Protocol. The core features work against the stock `/wp-json/wp/v2/` REST endpoints — **you do not need this plugin to use MCP Hub**.
|
||||
|
||||
Installing **Airano MCP Bridge** unlocks a second tier of capabilities that WordPress's built-in REST API can't reach on its own:
|
||||
|
||||
- **Large-file uploads** that bypass `upload_max_filesize`
|
||||
- **One-round-trip upload + metadata + attach + set-featured** (v2.9.0)
|
||||
- **Thumbnail regeneration** (no WP-CLI / SSH)
|
||||
- **Cache purge** for 6 major cache plugins (LiteSpeed, WP Rocket, W3TC, WP Super Cache, WP Fastest Cache, SG Optimizer)
|
||||
- **Transient cleanup** (expired / all / pattern)
|
||||
- **Bulk post-meta writes** in a single REST round-trip
|
||||
- **Unified site-health snapshot** (5+ stock calls → 1)
|
||||
- **Structured JSON export** (posts / pages / products + media + terms + meta)
|
||||
- **Capability probe** — tells MCP Hub what the calling application password can actually do
|
||||
- **Audit hook** — forwards WordPress action events to MCP Hub with HMAC-signed webhooks
|
||||
- **SEO meta routes** for Rank Math and Yoast
|
||||
|
||||
All operations remain guarded by WordPress's own capability system — this plugin never bypasses auth.
|
||||
|
||||
## Installation
|
||||
|
||||
1. Download `airano-mcp-bridge.zip` from the MCP Hub release page.
|
||||
2. In WP Admin → **Plugins → Add New → Upload Plugin**, choose the zip and **Activate**.
|
||||
3. Generate an **Application Password** under Users → Profile (scroll to bottom).
|
||||
4. In MCP Hub dashboard → **My Sites**, add your WordPress site using that Application Password.
|
||||
|
||||
The plugin works out of the box. There are no settings pages to configure; behavior is controlled entirely through the REST API.
|
||||
|
||||
## REST API endpoints
|
||||
|
||||
### SEO meta (namespace `airano-mcp-bridge/v1`)
|
||||
|
||||
- `GET / POST /posts/{id}/seo` — Post SEO data (Rank Math or Yoast, auto-detected)
|
||||
- `GET / POST /pages/{id}/seo` — Page SEO data
|
||||
- `GET / POST /products/{id}/seo` — WooCommerce product SEO data
|
||||
- `GET /status` — Plugin status + active SEO plugins list
|
||||
|
||||
### MCP Bridge helpers (namespace `airano-mcp/v1`)
|
||||
|
||||
| Route | Method | Introduced | Purpose |
|
||||
|---|---|---|---|
|
||||
| `/upload-limits` | GET | 2.0.0 | Returns effective PHP + WP upload limits so MCP Hub can pick the right upload path |
|
||||
| `/upload-chunk` | POST | 2.0.0 | Raw-body upload that bypasses `upload_max_filesize` (still bounded by `post_max_size`) |
|
||||
| `/upload-and-attach` | POST | 2.9.0 | Same as `/upload-chunk` plus query-param metadata (`attach_to_post`, `set_featured`, `title`, `alt_text`, `caption`, `description`) — collapses 3 REST round-trips into 1 |
|
||||
| `/capabilities` | GET | 2.1.0 | Effective capabilities of the calling Application Password + feature flags + available routes |
|
||||
| `/bulk-meta` | POST | 2.2.0 | Batch `post_meta` writes in one request (max 500 items, per-item permission check) |
|
||||
| `/export` | GET | 2.3.0 | Structured JSON export of posts / pages / products + media + terms + meta, with `post_type` / `status` / `since` / `limit` / `offset` paging |
|
||||
| `/cache-purge` | POST | 2.4.0 | Auto-detects LiteSpeed, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround Optimizer and triggers each one's purge API; always flushes object cache |
|
||||
| `/transient-flush` | POST | 2.5.0 | Native transient cleanup with `expired` / `all` / `pattern` scopes; optional site-transient handling for multisite |
|
||||
| `/site-health` | GET | 2.6.0 | Single-envelope health snapshot: WP/PHP/MySQL versions, disk free, active plugins, theme, writability, SSL — replaces 5+ stock calls |
|
||||
| `/audit-hook` | GET / POST / DELETE | 2.7.0 | Configure a webhook that forwards WP action events to MCP Hub. HMAC-SHA256-signed, non-blocking |
|
||||
| `/regenerate-thumbnails` | POST | 2.8.0 | Rebuild attachment sub-sizes via `wp_generate_attachment_metadata()` for a list of IDs or in paged batch mode |
|
||||
|
||||
### Authentication
|
||||
|
||||
All routes require **HTTP Basic** authentication with a WordPress **Application Password** (Users → Profile → Application Passwords). Per-route capability requirements:
|
||||
|
||||
| Route family | Required capability |
|
||||
|---|---|
|
||||
| SEO meta (read/write) | `edit_posts` |
|
||||
| Upload helpers | `upload_files` or `manage_options` |
|
||||
| Capabilities probe | `read` (any logged-in user) |
|
||||
| Bulk meta, Export | `edit_posts` (per-item `edit_post` check) |
|
||||
| Cache purge, Transient flush, Site health, Audit hook, Regenerate thumbnails | `manage_options` |
|
||||
|
||||
## Privacy
|
||||
|
||||
This plugin makes **no outbound network calls** on its own. It exposes authenticated REST API endpoints that your MCP Hub instance calls into. The audit-hook route **only** sends webhooks when you explicitly configure it (POST to `/audit-hook` with an endpoint URL + secret); without that configuration, zero telemetry leaves your WordPress.
|
||||
|
||||
No analytics, no phone-home, no cloud relay.
|
||||
|
||||
## Security notes
|
||||
|
||||
- All write routes enforce capability checks.
|
||||
- Raw-body uploads go through `wp_handle_sideload()` which respects WordPress's allowed-MIME list.
|
||||
- Bulk meta writes check `current_user_can('edit_post', $post_id)` per item, not just per batch.
|
||||
- Audit-hook secrets are stored in `wp_options` and never echoed in responses (only the last 4 characters are returned on read).
|
||||
- Audit-hook webhooks are signed with HMAC-SHA256 so MCP Hub can verify the message came from your site and hasn't been tampered with.
|
||||
|
||||
If you find a security issue, please report it privately to the maintainers at the [GitHub issues page](https://github.com/airano-ir/mcphub/issues) rather than filing a public issue.
|
||||
|
||||
## Frequently asked questions
|
||||
|
||||
### Do I need MCP Hub to use this plugin?
|
||||
|
||||
No. Every route is a standard authenticated WordPress REST endpoint and can be called from any HTTP client (curl, Postman, a custom integration). MCP Hub is the reference consumer but not a requirement.
|
||||
|
||||
### Which SEO plugins are supported?
|
||||
|
||||
**Rank Math SEO** and **Yoast SEO**. The plugin auto-detects which is active and routes SEO-meta calls accordingly.
|
||||
|
||||
### Does this plugin work on multisite?
|
||||
|
||||
Yes. Route registration, capability checks, and transient flushing all respect multisite boundaries. The optional `include_site_transients` flag on `/transient-flush` handles site transients on multisite setups.
|
||||
|
||||
### Why keep the folder name `airano-mcp-bridge` even though the plugin now does much more than SEO?
|
||||
|
||||
Plugin slugs on WordPress.org are permanent once registered. Existing installs keep working; display name, description, and feature surface are what we can update.
|
||||
|
||||
### What happens if I uninstall?
|
||||
|
||||
Uninstall removes plugin options including the audit-hook secret and endpoint. Media uploaded via the plugin stays in your media library (it's regular WordPress attachments — the plugin just provides the upload pipeline).
|
||||
|
||||
### How large a file can I upload?
|
||||
|
||||
The `/upload-chunk` route bypasses PHP's `upload_max_filesize` (typically 2–64 MB on shared hosting), but is still bounded by `post_max_size` and `memory_limit`. For files larger than `post_max_size`, MCP Hub falls back to its own server-side chunked session pipeline that reassembles chunks before handing the full file to this route.
|
||||
|
||||
## Changelog
|
||||
|
||||
### 2.9.0 — 2026-04-16
|
||||
|
||||
- New: `POST /airano-mcp/v1/upload-and-attach` — raw-body upload + metadata (title / alt / caption / description) + attach-to-post + set-featured in a single REST round-trip. Saves 2–3 calls for every hero-image or product-image workflow. Per-target permission enforced via `current_user_can('edit_post', attach_to_post)`.
|
||||
- Status + capabilities payloads now advertise `upload_and_attach: true` + `regenerate_thumbnails: true`.
|
||||
|
||||
### 2.8.0 — 2026-04-15
|
||||
|
||||
- New: `POST /airano-mcp/v1/regenerate-thumbnails` — rebuild attachment sub-sizes via `wp_generate_attachment_metadata()` after uploads, theme switches, or format conversions. Two modes: `{ "ids": [...] }` for targeted regeneration (max 50/call) or `{ "all": true, "offset": N, "limit": M }` for paged batches.
|
||||
|
||||
### 2.7.0
|
||||
|
||||
- New: `GET|POST|DELETE /airano-mcp/v1/audit-hook` — configure a webhook that forwards WP action events (`transition_post_status`, `deleted_post`, `user_register`, `profile_update`, `deleted_user`, `activated_plugin`, `deactivated_plugin`, `switch_theme`) to MCP Hub. HMAC-SHA256-signed, non-blocking `wp_remote_post`. Permission: `manage_options`.
|
||||
|
||||
### 2.6.0
|
||||
|
||||
- New: `GET /airano-mcp/v1/site-health` — single-envelope snapshot: WP version / multisite / locale, PHP version + extensions, server software + disk free, MySQL/MariaDB version + charset, active plugins + theme, writability checks (wp-content, uploads) + SSL.
|
||||
|
||||
### 2.5.0
|
||||
|
||||
- New: `POST /airano-mcp/v1/transient-flush` — native transient cleanup. Scopes: `expired` (default), `all`, or `pattern` (glob match, e.g. `rank_math_*`). Optional `include_site_transients` for multisite.
|
||||
|
||||
### 2.4.0
|
||||
|
||||
- New: `POST /airano-mcp/v1/cache-purge` — auto-detects active page-cache plugins (LiteSpeed, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround Optimizer) and invokes each one's purge API. Always calls `wp_cache_flush()` for object caches.
|
||||
|
||||
### 2.3.0
|
||||
|
||||
- New: `GET /airano-mcp/v1/export` — structured JSON export (not WXR). Query params: `post_type`, `status`, `since`, `limit` (max 500), `offset`, `include_media`, `include_terms`, `include_meta`.
|
||||
|
||||
### 2.2.0
|
||||
|
||||
- New: `POST /airano-mcp/v1/bulk-meta` — batch post-meta writes (max 500 items per call). Per-item permission check via `current_user_can('edit_post', $post_id)`. Null meta values delete the key.
|
||||
|
||||
### 2.1.0
|
||||
|
||||
- New: `GET /airano-mcp/v1/capabilities` — reports the effective capabilities of the calling Application Password plus feature flags (Rank Math / Yoast / WooCommerce / multisite) and the list of companion routes this version ships. Consumed by MCP Hub's F.7e capability probe.
|
||||
|
||||
### 2.0.0
|
||||
|
||||
- **Rebrand**: "Airano MCP SEO Meta Bridge" → "Airano MCP Bridge". No longer SEO-only.
|
||||
- New: `GET /airano-mcp/v1/upload-limits` — returns effective PHP + WP upload limits.
|
||||
- New: `POST /airano-mcp/v1/upload-chunk` — raw-body upload route that bypasses `upload_max_filesize`.
|
||||
|
||||
### 1.3.0
|
||||
|
||||
- Added REST API endpoints for posts, pages, and products (GET/POST operations).
|
||||
- Added authentication requirement for all endpoints (edit_posts).
|
||||
- Fixed `rank_math_title` meta key registration.
|
||||
|
||||
### 1.2.0
|
||||
|
||||
- Enhanced WooCommerce product support.
|
||||
- Improved MariaDB compatibility.
|
||||
|
||||
### 1.1.0
|
||||
|
||||
- Added status endpoint for plugin detection.
|
||||
- Improved error handling.
|
||||
|
||||
### 1.0.0
|
||||
|
||||
- Initial release with Rank Math and Yoast SEO support.
|
||||
|
||||
## Upgrade notice
|
||||
|
||||
### 2.9.0
|
||||
|
||||
Adds `POST /airano-mcp/v1/upload-and-attach` — upload + metadata + attach + featured in one REST round-trip. No breaking changes to existing routes.
|
||||
|
||||
## Credits
|
||||
|
||||
Built by the [MCP Hub](https://github.com/airano-ir/mcphub) project. Contributions welcome — see the parent repository for contribution guidelines.
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,207 @@
|
||||
=== Airano MCP Bridge ===
|
||||
Contributors: airano
|
||||
Tags: mcp, ai, rest-api, seo, media
|
||||
Requires at least: 5.0
|
||||
Tested up to: 6.9
|
||||
Requires PHP: 7.4
|
||||
Stable tag: 2.10.3
|
||||
License: GPLv2 or later
|
||||
License URI: https://www.gnu.org/licenses/gpl-2.0.html
|
||||
|
||||
Companion plugin for MCP Hub. REST API routes for SEO meta and raw-binary media uploads that bypass upload_max_filesize.
|
||||
|
||||
== Description ==
|
||||
|
||||
**Airano MCP Bridge** is the official companion plugin for [MCP Hub](https://mcp.palebluedot.live) ([source](https://github.com/airano-ir/mcphub)) — the AI-native management hub for WordPress, WooCommerce, and self-hosted services. It extends the WordPress REST API with dedicated routes that AI agents (Claude, ChatGPT, Cursor, VS Code Copilot) and the MCP Hub server rely on:
|
||||
|
||||
* **SEO meta routes** — read and write Rank Math SEO and Yoast SEO metadata for posts, pages, and WooCommerce products.
|
||||
* **Media upload helper routes** — accept raw-binary uploads via `php://input`, which bypasses the `upload_max_filesize` PHP limit (still bounded by `post_max_size`). Unlocks reliable hero-image and large-asset uploads for AI-agent workflows.
|
||||
* **Capability probe** — reports the effective PHP + WordPress upload limits so MCP Hub can pick the right upload path automatically.
|
||||
|
||||
**Features:**
|
||||
|
||||
* **Rank Math SEO Support** — Full access to all Rank Math meta fields
|
||||
* **Yoast SEO Support** — Full access to all Yoast SEO meta fields
|
||||
* **WooCommerce Compatible** — Works with product post types
|
||||
* **MCP Hub media pipeline** — bypasses `upload_max_filesize` for AI-agent uploads
|
||||
* **Secure** — Requires WordPress Application Password + capability checks on every route
|
||||
* **Auto-Detection** — Automatically detects active SEO plugin and advertises capabilities
|
||||
* **Zero Configuration** — Works out of the box after activation
|
||||
|
||||
**REST API Endpoints:**
|
||||
|
||||
*SEO meta (namespace `airano-mcp-bridge/v1`)*
|
||||
|
||||
* `GET/POST /wp-json/airano-mcp-bridge/v1/posts/{id}/seo` — Post SEO data
|
||||
* `GET/POST /wp-json/airano-mcp-bridge/v1/pages/{id}/seo` — Page SEO data
|
||||
* `GET/POST /wp-json/airano-mcp-bridge/v1/products/{id}/seo` — Product SEO data (WooCommerce)
|
||||
* `GET /wp-json/airano-mcp-bridge/v1/status` — Plugin status + active SEO plugins
|
||||
|
||||
*MCP Bridge helpers (namespace `airano-mcp/v1`, added in 2.0.0)*
|
||||
|
||||
* `GET /wp-json/airano-mcp/v1/upload-limits` — Effective PHP + WP upload limits
|
||||
* `POST /wp-json/airano-mcp/v1/upload-chunk` — Raw-body media upload (bypasses `upload_max_filesize`)
|
||||
* `GET /wp-json/airano-mcp/v1/capabilities` — Effective capabilities + feature flags + available routes (added in 2.1.0)
|
||||
* `POST /wp-json/airano-mcp/v1/bulk-meta` — Batch post/product meta writes in a single HTTP round-trip (added in 2.2.0)
|
||||
* `GET /wp-json/airano-mcp/v1/export` — Structured JSON export: posts, pages, products + media + terms + meta, with post_type/status/since/limit/offset paging (added in 2.3.0)
|
||||
* `POST /wp-json/airano-mcp/v1/cache-purge` — Auto-detects active cache plugins (LiteSpeed, WP Rocket, W3TC, Super Cache, Fastest Cache, SG Optimizer) and invokes their purge API; always flushes object cache (added in 2.4.0)
|
||||
* `POST /wp-json/airano-mcp/v1/transient-flush` — Native transient cleanup with scope=expired/all/pattern (glob); optional site-transient handling on multisite (added in 2.5.0)
|
||||
* `GET /wp-json/airano-mcp/v1/site-health` — Unified site-health snapshot: PHP/MySQL/WP versions, extensions, disk free, active plugins + theme, writability checks (added in 2.6.0)
|
||||
* `GET|POST|DELETE /wp-json/airano-mcp/v1/audit-hook` — Configure + query a webhook that forwards WordPress action events to MCP Hub (HMAC-SHA256 signed, non-blocking) (added in 2.7.0)
|
||||
* `POST /wp-json/airano-mcp/v1/regenerate-thumbnails` — Regenerate attachment sub-sizes via `wp_generate_attachment_metadata` for a list of IDs or in paged batch mode (added in 2.8.0)
|
||||
* `POST /wp-json/airano-mcp/v1/upload-and-attach` — Raw-body upload + metadata + attach-to-post + set-featured in a single REST call (added in 2.9.0). Query params: `attach_to_post`, `set_featured`, `title`, `alt_text`, `caption`, `description`. Permission: `upload_files` + `edit_post` on the target post.
|
||||
|
||||
**Designed for [MCP Hub](https://mcp.palebluedot.live)** — the AI-native management hub for WordPress and self-hosted services. [Try the live platform](https://mcp.palebluedot.live) · [Source on GitHub](https://github.com/airano-ir/mcphub).
|
||||
|
||||
== Installation ==
|
||||
|
||||
1. Upload the `airano-mcp-bridge` folder to `/wp-content/plugins/`
|
||||
2. Activate the plugin through the 'Plugins' menu in WordPress
|
||||
3. For SEO meta routes: ensure either Rank Math SEO or Yoast SEO is active
|
||||
4. The REST API endpoints are now available
|
||||
|
||||
== Frequently Asked Questions ==
|
||||
|
||||
= Which SEO plugins are supported? =
|
||||
|
||||
Rank Math SEO and Yoast SEO. The plugin auto-detects which one is active.
|
||||
|
||||
= Does it work with WooCommerce? =
|
||||
|
||||
Yes. Product SEO endpoints are available when WooCommerce is active.
|
||||
|
||||
= How is authentication handled? =
|
||||
|
||||
All endpoints require WordPress Application Password authentication. SEO routes require `edit_posts`. Upload helper routes require `upload_files` or `manage_options`.
|
||||
|
||||
= Do I need MCP Hub to use the upload helper routes? =
|
||||
|
||||
No. The `/airano-mcp/v1/upload-chunk` route is a standard authenticated REST endpoint and can be used from any client that can send a raw-binary `POST` with `Content-Disposition` and `Content-Type` headers.
|
||||
|
||||
= Is there a size cap on the upload helper? =
|
||||
|
||||
The helper reads the request body via `php://input`, which is **not** subject to PHP's `upload_max_filesize` limit — but it is still bounded by `post_max_size` and `memory_limit`. For files larger than `post_max_size`, MCP Hub falls back to its own server-side chunked session pipeline.
|
||||
|
||||
= Why keep the folder name "airano-mcp-bridge" even though the plugin now does more than SEO? =
|
||||
|
||||
Plugin slugs on wordpress.org are permanent. Existing installs keep working; the display name and feature set are updated in 2.0.0.
|
||||
|
||||
= Can I use this without MCP Hub? =
|
||||
|
||||
Yes. All REST API endpoints work with any application that can make authenticated HTTP requests.
|
||||
|
||||
== Changelog ==
|
||||
|
||||
= 2.10.3 =
|
||||
* WordPress.org review fix: rename main class from the generic `SEO_API_Bridge` to `Airano_MCP_Bridge` per the wp.org "unique prefixes" guideline. The class is only instantiated from this file's bootstrap line and is never referenced by callers (the plugin's public surface is its REST routes, not its PHP class), so this is an internal refactor with no behaviour change.
|
||||
|
||||
= 2.10.2 =
|
||||
* WordPress.org review fixes:
|
||||
* Drop the unused `wp-admin/includes/media.php` includes from `/upload-chunk` and `/upload-and-attach`. The code only uses helpers from `file.php` (`wp_tempnam`, `wp_handle_sideload`) and `image.php` (`wp_generate_attachment_metadata`) — `media.php` was a needless direct core include.
|
||||
* Split `/upload-and-attach` permission_callback into its own method (`require_upload_and_attach_capability`) that explicitly enforces `current_user_can('edit_post', $attach_to_post)` at the route gate when `attach_to_post` is supplied (no longer hidden inside the callback body), and rejects `set_featured` requests that don't include a target post.
|
||||
* No behaviour changes for clients sending well-formed requests.
|
||||
|
||||
= 2.10.1 =
|
||||
* Fix: `capabilities` and `site-health` routes now share a single source of truth for the `routes` bitmap (previously duplicated with conflicting values for `audit_hook` and missing `upload_and_attach`). Both endpoints now read from the shared route-map constant.
|
||||
|
||||
= 2.10.0 =
|
||||
* `POST /wp-json/airano-mcp/v1/upload-and-attach` now honours an `Idempotency-Key` request header. A retry within 24 hours with the same key returns the already-created attachment (`_idempotent_replay: true`) rather than creating a duplicate `-2.webp` orphan. Protects against client-timeout regressions where a successful upload was retried because the response was lost.
|
||||
|
||||
= 2.9.0 =
|
||||
* Added `POST /wp-json/airano-mcp/v1/upload-and-attach` — same raw-body semantics as `/upload-chunk`, but accepts query params (`attach_to_post`, `set_featured`, `title`, `alt_text`, `caption`, `description`) and applies them in one PHP round-trip. Saves 2-3 REST calls per upload. Per-target permission enforced via `current_user_can('edit_post', attach_to_post)`.
|
||||
* `status` + `capabilities` routes now advertise `upload_and_attach: true` alongside the existing capability flags.
|
||||
|
||||
= 2.8.0 =
|
||||
* Added `POST /wp-json/airano-mcp/v1/regenerate-thumbnails` — rebuild attachment sub-sizes via `wp_generate_attachment_metadata()` after an upload or format conversion changes source pixels. Supports two modes: `{ "ids": [...] }` for targeted regeneration (up to 50 per call) and `{ "all": true, "offset": N, "limit": M }` for paged batches (max 50 per page, with `has_more` + `next_offset` for pagination). Non-image attachments are skipped; per-item permission check via `current_user_can('edit_post', $attachment_id)`. Permission: `upload_files` or `manage_options`.
|
||||
|
||||
= 2.7.0 =
|
||||
* Added `GET|POST|DELETE /wp-json/airano-mcp/v1/audit-hook` — configure a webhook that forwards WordPress action events (post transitions, deletions, user events, plugin activations, theme switches) to MCP Hub for unified auditing. Each event is signed with HMAC-SHA256 using a shared secret and posted non-blocking via `wp_remote_post` so the admin UI stays snappy. Secret is stored in `wp_options` and never echoed back in GET responses (only the last 4 characters are returned). Permission: `manage_options`.
|
||||
|
||||
= 2.6.0 =
|
||||
* Added `GET /wp-json/airano-mcp/v1/site-health` — single-envelope health snapshot: WordPress version/multisite/locale, PHP version + critical extensions, server software + disk free, MySQL/MariaDB version + charset, active plugins list (with versions), active + parent theme, writability checks (wp-content, uploads) and SSL status. Replaces 5+ separate REST calls with a single request. Permission: `manage_options`.
|
||||
|
||||
= 2.5.0 =
|
||||
* Added `POST /wp-json/airano-mcp/v1/transient-flush` — native PHP transient cleanup. Scopes: `expired` (default, calls `delete_expired_transients()`), `all` (delete every `_transient_%` row), or `pattern` (glob match, e.g. `rank_math_*`). Optional `include_site_transients` for multisite. Response includes `deleted_count` + capped `deleted_sample` for observability. Permission: `manage_options`.
|
||||
|
||||
= 2.4.0 =
|
||||
* Added `POST /wp-json/airano-mcp/v1/cache-purge` — auto-detects active page-cache plugins (LiteSpeed Cache, WP Rocket, W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround Optimizer) and triggers their purge API. Always calls `wp_cache_flush()` for object caches. Permission: `manage_options`. Removes the need for Docker-socket + WP-CLI to flush caches on managed hosts.
|
||||
|
||||
= 2.3.0 =
|
||||
* Added `GET /wp-json/airano-mcp/v1/export` — structured JSON export of posts, pages, and WooCommerce products (not WXR). Query params: `post_type`, `status`, `since`, `limit` (max 500), `offset`, `include_media`, `include_terms`, `include_meta`. Response includes posts + referenced media + taxonomy terms + post meta in a single envelope, plus `has_more` / `next_offset` for pagination. Permission: `edit_posts`.
|
||||
|
||||
= 2.2.0 =
|
||||
* Added `POST /wp-json/airano-mcp/v1/bulk-meta` — writes many `post_meta` / `product_meta` entries in a single REST request. Capped at 500 items per call; each item is permission-checked via `current_user_can('edit_post', $post_id)`. Null meta values delete the key. Status endpoint now advertises `capabilities.bulk_meta = true` and the capabilities probe reports `routes.bulk_meta = true`.
|
||||
|
||||
= 2.1.0 =
|
||||
* Added `GET /wp-json/airano-mcp/v1/capabilities` — reports the effective capabilities of the calling application password, plus feature flags (Rank Math / Yoast / WooCommerce / multisite) and the list of companion routes this version actually ships. Consumed by MCP Hub's capability probe so per-user clients only see tools they're actually authorised to use.
|
||||
* Status endpoint now advertises `capabilities.capabilities = true`.
|
||||
|
||||
= 2.0.0 =
|
||||
* **Rebrand**: "Airano MCP SEO Meta Bridge" → "Airano MCP Bridge". The companion plugin is no longer SEO-only.
|
||||
* Added `GET /wp-json/airano-mcp/v1/upload-limits` — returns effective PHP + WP upload limits for MCP Hub probes.
|
||||
* Added `POST /wp-json/airano-mcp/v1/upload-chunk` — raw-body upload route that bypasses `upload_max_filesize`.
|
||||
* Status endpoint now includes `capabilities: { seo_meta, upload_limits, upload_chunk }`.
|
||||
* Plugin folder / slug unchanged: `airano-mcp-bridge` (permanent on wordpress.org).
|
||||
|
||||
= 1.3.0 =
|
||||
* Added REST API endpoints for posts, pages, and products (GET/POST operations)
|
||||
* Added authentication requirement for all endpoints
|
||||
* Fixed rank_math_title meta key registration
|
||||
|
||||
= 1.2.0 =
|
||||
* Enhanced WooCommerce product support
|
||||
* Improved MariaDB compatibility
|
||||
|
||||
= 1.1.0 =
|
||||
* Added status endpoint for plugin detection
|
||||
* Improved error handling
|
||||
|
||||
= 1.0.0 =
|
||||
* Initial release with Rank Math and Yoast SEO support
|
||||
|
||||
== Upgrade Notice ==
|
||||
|
||||
= 2.10.3 =
|
||||
Internal refactor only — main class renamed from `SEO_API_Bridge` to `Airano_MCP_Bridge` to satisfy wp.org's prefix guideline. No behaviour or REST API changes.
|
||||
|
||||
= 2.10.2 =
|
||||
WordPress.org review fixes only — no behaviour changes. Drops a redundant core file include and tightens the `/upload-and-attach` permission gate so the per-target `edit_post` check runs before the callback (visible to static analysis).
|
||||
|
||||
= 2.10.1 =
|
||||
Internal fix: capabilities and site-health now share a single route map. No breaking changes.
|
||||
|
||||
= 2.10.0 =
|
||||
`/upload-and-attach` now supports `Idempotency-Key` header to safely retry uploads after client timeouts without creating duplicates. No breaking changes.
|
||||
|
||||
= 2.9.0 =
|
||||
Adds `POST /airano-mcp/v1/upload-and-attach` — upload + metadata + attach + featured in one REST round-trip. No breaking changes.
|
||||
|
||||
= 2.8.0 =
|
||||
Adds `POST /airano-mcp/v1/regenerate-thumbnails` for rebuilding attachment sub-sizes after uploads or format changes. No breaking changes.
|
||||
|
||||
= 2.7.0 =
|
||||
Adds `GET|POST|DELETE /airano-mcp/v1/audit-hook` to forward WordPress action events to MCP Hub. Disabled until configured. No breaking changes.
|
||||
|
||||
= 2.6.0 =
|
||||
Adds `GET /airano-mcp/v1/site-health` for a unified site-health snapshot. No breaking changes.
|
||||
|
||||
= 2.5.0 =
|
||||
Adds `POST /airano-mcp/v1/transient-flush` for native transient cleanup. No breaking changes.
|
||||
|
||||
= 2.4.0 =
|
||||
Adds `POST /airano-mcp/v1/cache-purge` for native cache flushing. No breaking changes.
|
||||
|
||||
= 2.3.0 =
|
||||
Adds `GET /airano-mcp/v1/export` for offline backups and migrations. No breaking changes.
|
||||
|
||||
= 2.2.0 =
|
||||
Adds `POST /airano-mcp/v1/bulk-meta` so MCP Hub can write many post meta values in one request. No breaking changes.
|
||||
|
||||
= 2.1.0 =
|
||||
Adds `GET /airano-mcp/v1/capabilities` so MCP Hub can probe which tools the current application password can actually use. No breaking changes; existing routes unchanged.
|
||||
|
||||
= 2.0.0 =
|
||||
Rebranded to "Airano MCP Bridge". Adds new `airano-mcp/v1` namespace with upload-helper routes. All existing 1.x REST endpoints keep working unchanged.
|
||||
|
||||
= 1.3.0 =
|
||||
GET endpoints now require authentication (edit_posts capability). Update your API clients if needed.
|
||||
170
wordpress-plugin/airano-mcp-bridge-wporg/tests/check.sh
Normal file
170
wordpress-plugin/airano-mcp-bridge-wporg/tests/check.sh
Normal file
@@ -0,0 +1,170 @@
|
||||
#!/usr/bin/env bash
|
||||
# Pre-submission checks for airano-mcp-bridge (wp.org-bound version).
|
||||
#
|
||||
# Run from the repo root or from this directory:
|
||||
# bash wordpress-plugin/airano-mcp-bridge-wporg/tests/check.sh
|
||||
#
|
||||
# Exit code is non-zero on any FAIL. Prints a one-line summary at the end.
|
||||
set -u
|
||||
|
||||
PLUGIN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/airano-mcp-bridge"
|
||||
PHP_FILE="${PLUGIN_DIR}/airano-mcp-bridge.php"
|
||||
README_TXT="${PLUGIN_DIR}/readme.txt"
|
||||
|
||||
fail=0
|
||||
pass() { printf ' \033[32mPASS\033[0m %s\n' "$1"; }
|
||||
fail() { printf ' \033[31mFAIL\033[0m %s\n' "$1"; fail=$((fail+1)); }
|
||||
section() { printf '\n\033[1m%s\033[0m\n' "$1"; }
|
||||
|
||||
[ -f "$PHP_FILE" ] || { echo "main PHP file not found: $PHP_FILE"; exit 2; }
|
||||
[ -f "$README_TXT" ] || { echo "readme.txt not found: $README_TXT"; exit 2; }
|
||||
|
||||
section "1. PHP syntax (php -l)"
|
||||
if php -l "$PHP_FILE" > /tmp/phplint.out 2>&1; then
|
||||
pass "syntax clean"
|
||||
else
|
||||
fail "php -l reported errors:"
|
||||
cat /tmp/phplint.out
|
||||
fi
|
||||
|
||||
section "2. Plugin headers"
|
||||
ver_php=$(grep -oE '^\s*\*\s*Version:\s*\S+' "$PHP_FILE" | head -1 | awk '{print $NF}')
|
||||
ver_const=$(grep -oE "const VERSION\s*=\s*'[^']+'" "$PHP_FILE" | head -1 | grep -oE "'[^']+'" | tr -d "'")
|
||||
stable=$(grep -oE '^Stable tag:\s*\S+' "$README_TXT" | awk '{print $NF}')
|
||||
tested=$(grep -oE '^Tested up to:\s*\S+' "$README_TXT" | awk '{print $NF}')
|
||||
plugin_uri=$(grep -oE '^\s*\*\s*Plugin URI:\s*\S+' "$PHP_FILE" | head -1 | awk '{print $NF}')
|
||||
author_uri=$(grep -oE '^\s*\*\s*Author URI:\s*\S+' "$PHP_FILE" | head -1 | awk '{print $NF}')
|
||||
|
||||
[ "$ver_php" = "$ver_const" ] && pass "Version header == const VERSION ($ver_php)" || fail "Version mismatch: header=$ver_php const=$ver_const"
|
||||
[ "$ver_php" = "$stable" ] && pass "Version header == readme.txt Stable tag ($ver_php)" || fail "Stable tag mismatch: $ver_php vs $stable"
|
||||
case "$tested" in
|
||||
*.*.*) fail "Tested up to has minor version ($tested) — wp.org rejects this. Use major.minor only." ;;
|
||||
*.*) pass "Tested up to is major.minor ($tested)" ;;
|
||||
*) fail "Tested up to has unexpected format: $tested" ;;
|
||||
esac
|
||||
[ -n "$plugin_uri" ] && [ -n "$author_uri" ] && [ "$plugin_uri" != "$author_uri" ] \
|
||||
&& pass "Plugin URI ($plugin_uri) and Author URI ($author_uri) are distinct" \
|
||||
|| fail "Plugin URI and Author URI are the same or missing"
|
||||
|
||||
section "3. wp.org review issues from review email"
|
||||
# Class name must use the Airano_MCP_ prefix (no generic SEO_API_Bridge)
|
||||
if grep -q "^class SEO_API_Bridge" "$PHP_FILE"; then
|
||||
fail "main class still named SEO_API_Bridge — wp.org rejects generic prefixes"
|
||||
else
|
||||
pass "main class is not the generic SEO_API_Bridge"
|
||||
fi
|
||||
if grep -q "^class Airano_MCP_Bridge" "$PHP_FILE"; then
|
||||
pass "main class uses the Airano_MCP_ prefix"
|
||||
else
|
||||
fail "main class is not Airano_MCP_Bridge"
|
||||
fi
|
||||
# (a) media.php must NOT be loaded directly outside of the comment/changelog
|
||||
includes=$(grep -nE "^\s*require(_once)?\s*\(?\s*ABSPATH\s*\.\s*['\"]wp-admin/includes/media\.php" "$PHP_FILE" | wc -l)
|
||||
if [ "$includes" -eq 0 ]; then
|
||||
pass "no direct require of wp-admin/includes/media.php"
|
||||
else
|
||||
fail "found $includes direct require(_once) of wp-admin/includes/media.php"
|
||||
grep -nE "^\s*require(_once)?\s*\(?\s*ABSPATH\s*\.\s*['\"]wp-admin/includes/media\.php" "$PHP_FILE"
|
||||
fi
|
||||
|
||||
# (b) /upload-and-attach must use the new dedicated permission_callback
|
||||
if grep -q "'permission_callback' => \[\$this, 'require_upload_and_attach_capability'\]" "$PHP_FILE"; then
|
||||
pass "/upload-and-attach is gated by require_upload_and_attach_capability"
|
||||
else
|
||||
fail "/upload-and-attach does not use require_upload_and_attach_capability"
|
||||
fi
|
||||
if grep -q "function require_upload_and_attach_capability" "$PHP_FILE"; then
|
||||
pass "require_upload_and_attach_capability method is defined"
|
||||
else
|
||||
fail "require_upload_and_attach_capability method is missing"
|
||||
fi
|
||||
# It must call current_user_can('edit_post', $attach_to_post)
|
||||
if grep -q "current_user_can('edit_post', \$attach_to_post)" "$PHP_FILE"; then
|
||||
pass "edit_post per-target check is enforced at the route gate"
|
||||
else
|
||||
fail "edit_post per-target check is missing"
|
||||
fi
|
||||
|
||||
section "4. REST routes — every register_rest_route has a permission_callback"
|
||||
# Walk the file and check each register_rest_route(...) block individually.
|
||||
# A block runs from its register_rest_route line up to the matching closing
|
||||
# `]);` at the same brace depth. We check each block contains
|
||||
# `permission_callback`.
|
||||
audit=$(php -r '
|
||||
$src = file_get_contents($argv[1]);
|
||||
$lines = preg_split("/\r?\n/", $src);
|
||||
$total = 0; $missing = 0; $missing_lines = [];
|
||||
$inBlock = false; $depth = 0; $hasPerm = false; $startLine = 0;
|
||||
foreach ($lines as $i => $line) {
|
||||
$lineNo = $i + 1;
|
||||
if (!$inBlock && preg_match("/register_rest_route\s*\(/", $line)) {
|
||||
$inBlock = true; $depth = 0; $hasPerm = false; $startLine = $lineNo; $total++;
|
||||
}
|
||||
if ($inBlock) {
|
||||
if (strpos($line, "permission_callback") !== false) $hasPerm = true;
|
||||
$depth += substr_count($line, "[") + substr_count($line, "(");
|
||||
$depth -= substr_count($line, "]") + substr_count($line, ")");
|
||||
if ($depth <= 0 && $lineNo > $startLine) {
|
||||
if (!$hasPerm) { $missing++; $missing_lines[] = $startLine; }
|
||||
$inBlock = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
echo "$total $missing " . implode(",", $missing_lines);
|
||||
' "$PHP_FILE")
|
||||
total=$(echo "$audit" | awk '{print $1}')
|
||||
missing=$(echo "$audit" | awk '{print $2}')
|
||||
missing_lines=$(echo "$audit" | awk '{print $3}')
|
||||
if [ "$missing" -eq 0 ]; then
|
||||
pass "all $total REST routes have a permission_callback"
|
||||
else
|
||||
fail "$missing of $total REST routes are missing permission_callback (lines: $missing_lines)"
|
||||
fi
|
||||
|
||||
# No __return_true on routes that change state (POST/PUT/DELETE)
|
||||
public_writes=$(awk '/register_rest_route/,/\]\s*\)\s*;/' "$PHP_FILE" \
|
||||
| grep -B2 "__return_true" \
|
||||
| grep -E "'methods'\s*=>\s*'(POST|PUT|DELETE|PATCH)'" \
|
||||
| wc -l)
|
||||
if [ "$public_writes" -eq 0 ]; then
|
||||
pass "no public (__return_true) callbacks on POST/PUT/DELETE routes"
|
||||
else
|
||||
fail "$public_writes write routes use __return_true (public) — review needed"
|
||||
fi
|
||||
|
||||
section "5. Output escaping & sanitisation (heuristic — manual review still required)"
|
||||
# Find raw echo/print of REST request params
|
||||
raw_echo=$(grep -nE "echo\s+\\\$request->|print\s+\\\$request->" "$PHP_FILE" | wc -l)
|
||||
[ "$raw_echo" -eq 0 ] && pass "no raw echo of \$request-> values" || fail "$raw_echo raw echoes of \$request->"
|
||||
# Reject sql concatenation patterns
|
||||
sql_concat=$(grep -nE '\$wpdb->(query|get_results|get_var|get_row).*\.\s*\$' "$PHP_FILE" | wc -l)
|
||||
[ "$sql_concat" -eq 0 ] && pass "no obvious SQL concatenation (no \$wpdb-> ... . \$var)" || fail "$sql_concat possible SQL concatenations — manual review"
|
||||
# eval / system / exec must NOT appear
|
||||
dangerous=$(grep -nE "\b(eval|exec|system|passthru|popen|shell_exec|proc_open)\s*\(" "$PHP_FILE" | grep -v "^\s*\*" | wc -l)
|
||||
[ "$dangerous" -eq 0 ] && pass "no eval/exec/system/passthru/popen calls" || fail "$dangerous dangerous function calls"
|
||||
|
||||
section "6. Text domain"
|
||||
td_count=$(grep -cE "(__|_e|_x|_n|esc_html__|esc_attr__|esc_html_e|esc_attr_e)\(\s*['\"]" "$PHP_FILE")
|
||||
non_plugin_td=$(grep -oE "(__|_e|_x|_n|esc_html__|esc_attr__|esc_html_e|esc_attr_e)\(\s*['\"][^'\"]*['\"]\s*,\s*['\"][^'\"]+['\"]" "$PHP_FILE" \
|
||||
| grep -oE "['\"][^'\"]+['\"]\s*\)\s*$" | grep -vc "airano-mcp-bridge" || true)
|
||||
if [ "$non_plugin_td" -eq 0 ]; then
|
||||
pass "$td_count translation calls all use 'airano-mcp-bridge' domain"
|
||||
else
|
||||
fail "$non_plugin_td translation calls use a non-plugin text domain"
|
||||
fi
|
||||
|
||||
section "7. Direct file access guard"
|
||||
if grep -q "if (!defined('ABSPATH'))" "$PHP_FILE" && grep -q "exit;" "$PHP_FILE"; then
|
||||
pass "ABSPATH guard present"
|
||||
else
|
||||
fail "missing 'if (!defined(ABSPATH)) exit;' guard"
|
||||
fi
|
||||
|
||||
section "Summary"
|
||||
if [ "$fail" -eq 0 ]; then
|
||||
printf '\033[32m✓ all checks passed\033[0m — version %s ready for wp.org review reply\n' "$ver_php"
|
||||
exit 0
|
||||
else
|
||||
printf '\033[31m✗ %d check(s) failed\033[0m\n' "$fail"
|
||||
exit 1
|
||||
fi
|
||||
@@ -0,0 +1,183 @@
|
||||
<?php
|
||||
/**
|
||||
* Standalone tests for require_upload_and_attach_capability without a
|
||||
* full WordPress bootstrap. Stubs the few WP globals/functions the
|
||||
* permission method touches and walks every gate.
|
||||
*
|
||||
* Run from the repo root:
|
||||
* php wordpress-plugin/airano-mcp-bridge-wporg/tests/test_permission_callback.php
|
||||
*
|
||||
* Exit code is non-zero on any FAIL.
|
||||
*/
|
||||
|
||||
// --- Minimal WP shims ----------------------------------------------------
|
||||
if (!class_exists('WP_Error')) {
|
||||
class WP_Error {
|
||||
public $code; public $message; public $data;
|
||||
public function __construct($code = '', $message = '', $data = '') {
|
||||
$this->code = $code; $this->message = $message; $this->data = $data;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!function_exists('rest_authorization_required_code')) {
|
||||
function rest_authorization_required_code() { return 401; }
|
||||
}
|
||||
|
||||
// __() / esc_html__ / etc. just return the string unchanged.
|
||||
foreach (['__', '_e', '_x', 'esc_html__', 'esc_attr__', 'esc_html_e', 'esc_attr_e'] as $fn) {
|
||||
if (!function_exists($fn)) {
|
||||
eval("function $fn(\$s, \$d = '') { return \$s; }");
|
||||
}
|
||||
}
|
||||
|
||||
// Capability + post-edit lookup is driven by globals so each test can
|
||||
// configure the scenario.
|
||||
$GLOBALS['__caps'] = []; // ['upload_files' => true, 'manage_options' => false, ...]
|
||||
$GLOBALS['__edits'] = []; // [42 => true, 99 => false]
|
||||
|
||||
if (!function_exists('current_user_can')) {
|
||||
function current_user_can($cap, $object_id = null) {
|
||||
if ($cap === 'edit_post' && $object_id !== null) {
|
||||
return !empty($GLOBALS['__edits'][$object_id]);
|
||||
}
|
||||
return !empty($GLOBALS['__caps'][$cap]);
|
||||
}
|
||||
}
|
||||
|
||||
// Tiny WP_REST_Request stub — only ->get_param() is used by the gate.
|
||||
if (!class_exists('WP_REST_Request')) {
|
||||
class WP_REST_Request {
|
||||
private $params;
|
||||
public function __construct(array $params = []) { $this->params = $params; }
|
||||
public function get_param($k) { return $this->params[$k] ?? null; }
|
||||
}
|
||||
}
|
||||
|
||||
// --- Load just the Airano_MCP_Bridge class -------------------------------
|
||||
// We can't require the whole plugin (it calls add_action()/add_filter() in
|
||||
// the global scope on load), so we extract the class body and eval it.
|
||||
// Strip the two add_action() lines at the bottom.
|
||||
$src = file_get_contents(__DIR__ . '/../airano-mcp-bridge/airano-mcp-bridge.php');
|
||||
$src = preg_replace('/<\?php/', '', $src, 1);
|
||||
$src = preg_replace('/^.*?(if\s*\(!\s*defined.*?ABSPATH.*?\)\s*\{[^}]*\})/s', '', $src, 1);
|
||||
// Remove any add_action / add_filter calls outside the class.
|
||||
$src = preg_replace('/^\s*(add_action|add_filter)\s*\([^;]+;\s*$/m', '', $src);
|
||||
// Remove `new Airano_MCP_Bridge();` invocation.
|
||||
$src = preg_replace('/^\s*new\s+Airano_MCP_Bridge\s*\(\s*\)\s*;\s*$/m', '', $src);
|
||||
|
||||
// WP function shims so the class file can be loaded without bootstrapping
|
||||
// WordPress. Each returns a benign default — the tests only exercise the
|
||||
// permission method, not the rest of the plugin.
|
||||
$_wp_voids = [
|
||||
'add_action', 'add_filter', 'do_action', 'register_activation_hook',
|
||||
'register_deactivation_hook', 'register_uninstall_hook',
|
||||
'load_plugin_textdomain', 'wp_schedule_event', 'wp_clear_scheduled_hook',
|
||||
];
|
||||
foreach ($_wp_voids as $fn) {
|
||||
if (!function_exists($fn)) {
|
||||
eval("function $fn() { return true; }");
|
||||
}
|
||||
}
|
||||
$_wp_returns_first = ['apply_filters', 'sanitize_text_field', 'sanitize_key', 'wp_unslash'];
|
||||
foreach ($_wp_returns_first as $fn) {
|
||||
if (!function_exists($fn)) {
|
||||
eval("function $fn(\$a) { return \$a; }");
|
||||
}
|
||||
}
|
||||
if (!function_exists('get_option')) { function get_option($k, $d = false) { return $d; } }
|
||||
if (!function_exists('update_option')) { function update_option() { return true; } }
|
||||
if (!function_exists('add_option')) { function add_option() { return true; } }
|
||||
if (!function_exists('delete_option')) { function delete_option() { return true; } }
|
||||
if (!function_exists('wp_next_scheduled')) { function wp_next_scheduled() { return false; } }
|
||||
if (!function_exists('plugin_dir_path')) { function plugin_dir_path($f) { return dirname($f); } }
|
||||
if (!function_exists('plugin_basename')) { function plugin_basename($f) { return basename($f); } }
|
||||
if (!function_exists('untrailingslashit')) { function untrailingslashit($s) { return rtrim($s, '/\\'); } }
|
||||
if (!function_exists('trailingslashit')) { function trailingslashit($s) { return rtrim($s, '/\\') . '/'; } }
|
||||
if (!function_exists('wp_parse_url')) { function wp_parse_url($u, $c = -1) { return $c === -1 ? parse_url($u) : parse_url($u, $c); } }
|
||||
|
||||
eval($src);
|
||||
|
||||
// --- Tests ---------------------------------------------------------------
|
||||
$pass = 0; $fail = 0;
|
||||
function check($label, $ok, $detail = '') {
|
||||
global $pass, $fail;
|
||||
if ($ok) { echo " \033[32mPASS\033[0m $label\n"; $pass++; }
|
||||
else { echo " \033[31mFAIL\033[0m $label" . ($detail ? " — $detail" : '') . "\n"; $fail++; }
|
||||
}
|
||||
|
||||
$bridge = new Airano_MCP_Bridge();
|
||||
|
||||
echo "\n\033[1mrequire_upload_and_attach_capability — gate semantics\033[0m\n";
|
||||
|
||||
// 1. No upload_files + no manage_options → forbidden
|
||||
$GLOBALS['__caps'] = ['upload_files' => false, 'manage_options' => false];
|
||||
$GLOBALS['__edits'] = [];
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request([]));
|
||||
check('caller without upload_files/manage_options is rejected',
|
||||
$res instanceof WP_Error && $res->code === 'rest_forbidden');
|
||||
|
||||
// 2. Has upload_files, no attach_to_post → allowed (no per-target check)
|
||||
$GLOBALS['__caps'] = ['upload_files' => true];
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request([]));
|
||||
check('upload_files alone, no attach_to_post → true', $res === true,
|
||||
is_object($res) ? "got " . $res->code : "got " . var_export($res, true));
|
||||
|
||||
// 3. Has upload_files, attach_to_post=42, no edit_post → forbidden
|
||||
$GLOBALS['__caps'] = ['upload_files' => true];
|
||||
$GLOBALS['__edits'] = [42 => false];
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request(['attach_to_post' => 42]));
|
||||
check('attach_to_post supplied, edit_post denied → rest_cannot_edit',
|
||||
$res instanceof WP_Error && $res->code === 'rest_cannot_edit',
|
||||
is_object($res) ? "got code: " . $res->code : "got: " . var_export($res, true));
|
||||
|
||||
// 4. Has upload_files, attach_to_post=42, edit_post granted → allowed
|
||||
$GLOBALS['__caps'] = ['upload_files' => true];
|
||||
$GLOBALS['__edits'] = [42 => true];
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request(['attach_to_post' => 42]));
|
||||
check('attach_to_post + edit_post → true', $res === true,
|
||||
is_object($res) ? "got " . $res->code : "got " . var_export($res, true));
|
||||
|
||||
// 5. set_featured=true without attach_to_post → invalid_param
|
||||
$GLOBALS['__caps'] = ['upload_files' => true];
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request(['set_featured' => 'true']));
|
||||
check('set_featured without attach_to_post → rest_invalid_param',
|
||||
$res instanceof WP_Error && $res->code === 'rest_invalid_param');
|
||||
|
||||
// 6. set_featured=1 without attach_to_post → invalid_param (numeric string)
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request(['set_featured' => '1']));
|
||||
check("set_featured='1' without attach_to_post → rest_invalid_param",
|
||||
$res instanceof WP_Error && $res->code === 'rest_invalid_param');
|
||||
|
||||
// 7. set_featured=false → does NOT trigger the invalid_param branch
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request(['set_featured' => 'false']));
|
||||
check("set_featured='false' (no attach_to_post) → allowed",
|
||||
$res === true,
|
||||
is_object($res) ? "got " . $res->code : "got " . var_export($res, true));
|
||||
|
||||
// 8. set_featured=true + attach_to_post=42 + edit_post=true → allowed
|
||||
$GLOBALS['__edits'] = [42 => true];
|
||||
$res = $bridge->require_upload_and_attach_capability(
|
||||
new WP_REST_Request(['attach_to_post' => 42, 'set_featured' => 'true']));
|
||||
check('set_featured=true + attach_to_post + edit_post → true', $res === true);
|
||||
|
||||
// 9. manage_options-only caller (no upload_files) is allowed (admins still pass)
|
||||
$GLOBALS['__caps'] = ['upload_files' => false, 'manage_options' => true];
|
||||
$GLOBALS['__edits'] = [];
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request([]));
|
||||
check('manage_options without upload_files → true', $res === true);
|
||||
|
||||
// 10. attach_to_post=0 (defaulted/missing) is treated as "not supplied" — no
|
||||
// per-target check needed.
|
||||
$GLOBALS['__caps'] = ['upload_files' => true];
|
||||
$res = $bridge->require_upload_and_attach_capability(new WP_REST_Request(['attach_to_post' => 0]));
|
||||
check('attach_to_post=0 → no per-target check, allowed', $res === true);
|
||||
|
||||
echo "\n";
|
||||
if ($fail === 0) {
|
||||
echo "\033[32m✓ $pass tests passed\033[0m\n";
|
||||
exit(0);
|
||||
} else {
|
||||
echo "\033[31m✗ $fail of " . ($pass + $fail) . " tests failed\033[0m\n";
|
||||
exit(1);
|
||||
}
|
||||
Binary file not shown.
@@ -1,6 +1,6 @@
|
||||
# Airano MCP Bridge
|
||||
|
||||
**Version:** 2.9.0
|
||||
**Version:** 2.18.0
|
||||
**Requires WordPress:** 5.0+
|
||||
**Tested up to:** 6.9
|
||||
**Requires PHP:** 7.4+
|
||||
@@ -26,6 +26,14 @@ Installing **Airano MCP Bridge** unlocks a second tier of capabilities that Word
|
||||
- **Capability probe** — tells MCP Hub what the calling application password can actually do
|
||||
- **Audit hook** — forwards WordPress action events to MCP Hub with HMAC-signed webhooks
|
||||
- **SEO meta routes** for Rank Math and Yoast
|
||||
- **WordPress Specialist admin namespace** (v2.11.0+) — read-only inventory of plugins, themes, users, options, cron, maintenance status. Powers the `wordpress_specialist` MCP plugin so admins on shared hosting can use the same tools that previously required Docker socket + WP-CLI.
|
||||
- **System diagnostics** (v2.12.0) — `system-info`, `phpinfo` (curated, not the full HTML dump), `disk-usage` (bounded directory walks).
|
||||
- **Page editing** (v2.13.0) — Gutenberg block read/replace/insert/remove, Elementor detect/get/set/regen-css/template-list/template-apply, Classic-editor html replace. Writes are double-gated: `manage_options` route-level + per-post `edit_post` enforcement; raw HTML requires `unfiltered_html`; Elementor JSON capped at 5,000 nodes per call.
|
||||
- **Theme dev surface** (v2.14.0) — install (from URL or base64 zip) / activate / delete + theme file CRUD (list, read, write, delete). All theme paths canonicalise via `realpath()` and reject any escape from the slug directory. PHP file writes additionally require `!DISALLOW_FILE_EDIT`. Optimistic concurrency via `expected_sha256` on writes. Per-call caps 5 MB/file, 1000 files/list, 50 MB/install zip. Refuses to delete the active theme (or its parent) and `style.css` of the active theme.
|
||||
- **Plugin write management** (v2.15.0) — install (from wp.org slug, URL, or base64 zip) / activate / deactivate / update / delete. Per-route capability checks (`install_plugins`, `activate_plugins`, `delete_plugins`). Refuses to deactivate or delete the companion plugin itself (would brick the MCP connection) and refuses to delete active plugins. Update route returns `up_to_date:true` cleanly when no update is available.
|
||||
- **Site config** (v2.16.0) — Settings → General + Reading + Permalinks panels via typed REST. `GET/POST /admin/site/identity` (title / tagline / site_icon / custom_logo), `GET/POST /admin/site/reading` (show_on_front / page_on_front / page_for_posts / posts_per_page / blog_public), `GET/POST /admin/permalinks` (structure + category_base + tag_base, with `flush_rewrite_rules()` after each write).
|
||||
- **Site layout** (v2.17.0) — Settings → Menus + Appearance → Widgets + Customizer surfaces. Menus: `GET /admin/menus`, `GET /admin/menus/{id}`, `PUT /admin/menus/{id}` (full-replace items + optional rename, slug stays frozen, S-22 per-item cap dispatch). Widgets: `GET /admin/widgets/areas`, `GET /admin/widgets/{area_id}`, `PUT /admin/widgets/{area_id}` (block-kind areas accept any block raw HTML; legacy areas accept `text` widget settings only this round). Customizer: `POST /admin/customizer/changeset` with `{action: get|apply|discard}` — single-tool wrapper around the changeset queue; `apply` requires the `customize` cap (S-24).
|
||||
- **Database inspection** (v2.18.0) — read-only DB introspection via typed routes that NEVER expose raw SQL. `GET /admin/db/size` (single `information_schema.TABLES` aggregation: database_bytes + table_count + row_count_estimate), `GET /admin/db/tables` (per-table breakdown), `POST /admin/db/search` (`WP_Query` wrapper with `s=$query`; sanitised + length-capped at 200 chars; S-25 keeps non-readable posts out via `WP_Query`'s own `posts_clauses`). Bundled with the wordpress_advanced sunset on the MCP Hub side: the deprecated WP-CLI/Docker-socket plugin was removed in F.19.3.2-.3; `wordpress_specialist` is now the only WP-management surface and has no Docker socket dependency.
|
||||
|
||||
All operations remain guarded by WordPress's own capability system — this plugin never bypasses auth.
|
||||
|
||||
@@ -63,6 +71,66 @@ The plugin works out of the box. There are no settings pages to configure; behav
|
||||
| `/audit-hook` | GET / POST / DELETE | 2.7.0 | Configure a webhook that forwards WP action events to MCP Hub. HMAC-SHA256-signed, non-blocking |
|
||||
| `/regenerate-thumbnails` | POST | 2.8.0 | Rebuild attachment sub-sizes via `wp_generate_attachment_metadata()` for a list of IDs or in paged batch mode |
|
||||
|
||||
### WordPress Specialist admin namespace (`airano-mcp/v1/admin/*`)
|
||||
|
||||
All routes require `manage_options`. They power the `wordpress_specialist` MCP plugin (companion-backed advanced WordPress management — no Docker socket required).
|
||||
|
||||
| Route | Method | Introduced | Purpose |
|
||||
|---|---|---|---|
|
||||
| `/admin/plugins` | GET | 2.11.0 | Every plugin known to WP with active/network-active/version/author/update flags |
|
||||
| `/admin/themes` | GET | 2.11.0 | Installed themes with stylesheet/template/parent/block-theme/active flags |
|
||||
| `/admin/users` | GET | 2.11.0 | Paginated user list (cap 200/call) with optional `role` and `search` filters |
|
||||
| `/admin/options/{name}` | GET | 2.11.0 | Single option fetch with deny-list of credential-shaped keys (`*_secret`, `*_password`, `*_api_key`, `*_token`, `auth_*_key`, `auth_*_salt`) |
|
||||
| `/admin/cron` | GET | 2.11.0 | Full cron table with epoch + ISO 8601 next_run, schedule slug, interval, args |
|
||||
| `/admin/maintenance` | GET | 2.11.0 | `.maintenance` sentinel inspection (`enabled` / `started_at` / `stale`, 10-min stale threshold matches WP) |
|
||||
| `/admin/system-info` | GET | 2.12.0 | WP/PHP/MySQL/server versions + memory + paths in one envelope |
|
||||
| `/admin/phpinfo` | GET | 2.12.0 | Sorted extension list + curated ini whitelist + disabled functions + opcache state (structured JSON, not the full HTML dump) |
|
||||
| `/admin/disk-usage` | GET | 2.12.0 | Bytes for uploads/plugins/themes + filesystem `disk_total/free/used` (bounded 200k files / 5s per tree, with `truncated:true` flag) |
|
||||
| `/admin/blocks/replace` | POST | 2.13.0 | Replace post block tree (companion runs `serialize_blocks()`; max 200 blocks; `wp_kses_post` unless caller has `unfiltered_html`) |
|
||||
| `/admin/blocks/insert` | POST | 2.13.0 | Insert one block at index N |
|
||||
| `/admin/blocks/remove` | POST | 2.13.0 | Remove block at index N (returns the removed block for rollback) |
|
||||
| `/admin/elementor/status` | GET | 2.13.0 | Elementor presence + version + Pro flag + supported post types; `installed:false` cleanly when absent |
|
||||
| `/admin/elementor/{post_id}` | GET | 2.13.0 | Parsed `_elementor_data` (slash-stripped, JSON-decoded) |
|
||||
| `/admin/elementor/{post_id}` | POST | 2.13.0 | Replace `_elementor_data`; validates id/elType/settings; capped at 5,000 nodes; fires `elementor/document/after_save` |
|
||||
| `/admin/elementor/{post_id}/regen-css` | POST | 2.13.0 | Trigger per-post Elementor CSS regeneration |
|
||||
| `/admin/elementor/templates` | GET | 2.13.0 | Saved Elementor templates (id/title/type/modified) |
|
||||
| `/admin/elementor/templates/apply` | POST | 2.13.0 | Copy a saved template's `_elementor_data` into a target post |
|
||||
| `/admin/classic/{post_id}/replace` | POST | 2.13.0 | Pure post_content swap for classic-editor sites (`wp_kses_post` unless caller has `unfiltered_html`) |
|
||||
| `/admin/themes/install` | POST | 2.14.0 | Install theme from `zip_url` or base64 `zip_base64`; supports `activate`, `overwrite`. Runs WP core's `Theme_Upgrader`. Requires `install_themes` (+ `switch_themes` if `activate`). 50 MB cap. |
|
||||
| `/admin/themes/{slug}/activate` | POST | 2.14.0 | Switch the active theme. Requires `switch_themes`. |
|
||||
| `/admin/themes/{slug}` | DELETE | 2.14.0 | Delete an installed theme. Refuses if active or active parent. Requires `delete_themes`. |
|
||||
| `/admin/themes/files/{slug}` | GET | 2.14.0 | Theme directory walk: each file's relative path, size, mime, sha256, modified_at. Optional `glob` + `max_files` (cap 1000). |
|
||||
| `/admin/themes/files/{slug}/{path}` | GET | 2.14.0 | Read a theme file as base64 + sha256 + mime + modified_at. 5 MB cap. |
|
||||
| `/admin/themes/files/{slug}/{path}` | PUT | 2.14.0 | Write a theme file (base64). Optional `expected_sha256` for optimistic concurrency. PHP writes require `!DISALLOW_FILE_EDIT`. Requires `edit_themes`. 5 MB cap. |
|
||||
| `/admin/themes/files/{slug}/{path}` | DELETE | 2.14.0 | Delete a theme file. Refuses to delete `style.css` of the active theme. Requires `edit_themes`. |
|
||||
| `/admin/plugins/install` | POST | 2.15.0 | Install via wp.org `slug`, OR via `zip_url`, OR via inline `zip_base64`. Supports `activate` + `overwrite`. Runs WP core's `Plugin_Upgrader`. Requires `install_plugins`. 50 MB zip cap. |
|
||||
| `/admin/plugins/{slug}/activate` | POST | 2.15.0 | Activate an installed plugin. Optional `network_wide` for multisite. Requires `activate_plugins`. |
|
||||
| `/admin/plugins/{slug}/deactivate` | POST | 2.15.0 | Deactivate. Refuses companion (S-20) and `Required` plugins (S-21). Requires `activate_plugins`. |
|
||||
| `/admin/plugins/{slug}/update` | POST | 2.15.0 | Update to latest wp.org version. Returns `up_to_date:true` cleanly when no update available. Requires `update_plugins`. |
|
||||
| `/admin/plugins/{slug}` | DELETE | 2.15.0 | Delete an installed plugin. Refuses active plugins, the companion, and `Required` plugins. Requires `delete_plugins`. |
|
||||
| `/admin/site/identity` | GET | 2.16.0 | Site title / tagline / site_icon / custom_logo / charset / WP version / admin_email / language / siteurl. |
|
||||
| `/admin/site/identity` | POST | 2.16.0 | Update title / tagline / site_icon_id / custom_logo_id (any subset). Attachment ids validated against the media library. |
|
||||
| `/admin/site/reading` | GET | 2.16.0 | show_on_front / page_on_front / page_for_posts / posts_per_page / posts_per_rss / blog_public. |
|
||||
| `/admin/site/reading` | POST | 2.16.0 | Update reading settings; page_on_front + page_for_posts must reference published Pages. |
|
||||
| `/admin/permalinks` | GET | 2.16.0 | permalink_structure + category_base + tag_base. |
|
||||
| `/admin/permalinks` | POST | 2.16.0 | Update permalink structure (empty string = plain). Calls `flush_rewrite_rules()` after the write. |
|
||||
| `/admin/menus` | GET | 2.17.0 | Every nav menu with id / name / slug / theme locations / item count. |
|
||||
| `/admin/menus/{menu_id}` | GET | 2.17.0 | One menu's items: `{id, title, type, object, object_id, parent, order, url, target, classes, xfn}`. |
|
||||
| `/admin/menus/{menu_id}` | PUT | 2.17.0 | Full-replace items + optional rename. Slug frozen. Two-pass: every item validated against S-22 before any mutation; refusals return `forbidden_object_id` 403/404 and leave the menu untouched. |
|
||||
| `/admin/widgets/areas` | GET | 2.17.0 | Every registered sidebar with id / name / theme_location / widget_count / kind (`block` or `legacy`). |
|
||||
| `/admin/widgets/{area_id}` | GET | 2.17.0 | One area's widgets. Block-kind: `{id, type:'block', blocks:[parsed], raw}`. Legacy-kind: `{id, type, settings}`. |
|
||||
| `/admin/widgets/{area_id}` | PUT | 2.17.0 | Full replace. Block areas accept any block raw HTML; legacy areas accept `text` widget settings only this round (other legacy types remain read-only). HTML sanitised via `wp_kses_post` unless caller has `unfiltered_html` (S-23). |
|
||||
| `/admin/customizer/changeset` | POST | 2.17.0 | `{action: get|apply|discard}`. `apply` requires the `customize` cap on top of `manage_options` (S-24). Empty changeset returns `{status:'empty'}` 200. |
|
||||
| `/admin/db/size` | GET | 2.18.0 | Aggregate database size from `information_schema.TABLES`: `{database_bytes, table_count, row_count_estimate, database_name, table_prefix}`. No SQL exposure. |
|
||||
| `/admin/db/tables` | GET | 2.18.0 | Per-table breakdown: `{name, engine, rows, data_bytes, index_bytes, total_bytes, collation}` ordered by total_bytes desc. |
|
||||
| `/admin/db/search` | POST | 2.18.0 | `WP_Query` wrapper. Body `{query, post_type?, status?, limit?}` (limit default 20, max 100). Sanitises + length-caps query at 200 chars (S-25). Non-readable posts filtered out via WP's own `posts_clauses`. Never raw SQL. |
|
||||
|
||||
Writes added in 2.13.0 require **two** capabilities: route-level `manage_options` AND per-post `edit_post` on the target (S-12 in MCP Hub's security ruleset). Raw-HTML pass-through requires the calling user to also hold `unfiltered_html`. Elementor JSON node count is capped at 5,000 per call (S-14); oversized payloads return `elementor_too_large` — switch to `/admin/elementor/templates/apply` instead.
|
||||
|
||||
Theme dev routes added in 2.14.0 layer per-route capability checks on top of `manage_options`: `install_themes`, `switch_themes`, `delete_themes`, `edit_themes`. PHP file writes additionally require `!DISALLOW_FILE_EDIT` (S-17). All file paths canonicalise via `realpath()` and must resolve under `wp-content/themes/{slug}` (S-16); attempts to escape return `path_invalid`. Optimistic concurrency via `expected_sha256` returns `sha_mismatch` (409) if the on-disk sha256 differs (S-19).
|
||||
|
||||
Plugin write routes added in 2.15.0 layer per-route capability checks on `manage_options`: `install_plugins` (install / update), `activate_plugins` (activate / deactivate), `delete_plugins` (delete). New rules: S-20 refuses to deactivate / delete the Airano MCP Bridge companion itself (returns `companion_self` 409 — would brick the MCP connection); S-21 refuses to deactivate / delete plugins whose header sets `Required: yes`. The single `POST /admin/plugins/install` route accepts three mutually-exclusive body shapes — `{slug}` for wp.org install, `{zip_url}` for download, `{zip_base64}` for inline — with the same 50 MB cap (S-18) on zip payloads. Delete refuses any plugin currently active (`plugin_active` 409 — caller must deactivate first).
|
||||
|
||||
### Authentication
|
||||
|
||||
All routes require **HTTP Basic** authentication with a WordPress **Application Password** (Users → Profile → Application Passwords). Per-route capability requirements:
|
||||
@@ -74,6 +142,7 @@ All routes require **HTTP Basic** authentication with a WordPress **Application
|
||||
| Capabilities probe | `read` (any logged-in user) |
|
||||
| Bulk meta, Export | `edit_posts` (per-item `edit_post` check) |
|
||||
| Cache purge, Transient flush, Site health, Audit hook, Regenerate thumbnails | `manage_options` |
|
||||
| Admin namespace (`/admin/*`) | `manage_options` |
|
||||
|
||||
## Privacy
|
||||
|
||||
@@ -119,6 +188,38 @@ The `/upload-chunk` route bypasses PHP's `upload_max_filesize` (typically 2–64
|
||||
|
||||
## Changelog
|
||||
|
||||
### 2.18.0 — 2026-05-04
|
||||
|
||||
- **F.19.3.2-.3: Database inspection (read) + bulk fan-out (write) + wordpress_advanced sunset.** Three new admin routes — `GET /admin/db/size` (single `information_schema.TABLES` aggregation, returns `{database_bytes, table_count, row_count_estimate, database_name, table_prefix}` — no SQL exposure), `GET /admin/db/tables` (per-table breakdown with name / engine / rows / data_bytes / index_bytes / total_bytes / collation, ordered by total_bytes desc), `POST /admin/db/search` (body `{query, post_type?, status?, limit?}` — wraps `WP_Query` with `s=$query`, sanitises via `sanitize_text_field` and length-caps at 200 chars server-side, `limit` capped at 100; returns `{query, limit, count, hits}`). New security rule **S-25**: db/search wraps `WP_Query`, NEVER raw SQL; `WP_Query`'s own `posts_clauses` filter (the same gate the WP search page uses) keeps non-readable posts (private/draft from other authors) out of the result set. Bulk write tools on the MCP Hub side (`wp_bulk_post_update`, `wp_bulk_term_update`) ride stock REST `wp/v2/posts/{id}` and `wp/v2/{taxonomy}/{id}` — no companion routes needed for those, but the cap of 50 items per call is documented under **S-26** in the MCP Hub spec. All admin routes gated on `manage_options` route-level. **Bundled with the wordpress_advanced sunset on the MCP Hub side**: the deprecated WP-CLI/Docker-socket plugin was removed in F.19.3.2-.3 (2026-05-04); `wordpress_specialist` is now the only WP-management surface and has no Docker socket dependency.
|
||||
|
||||
### 2.17.0 — 2026-05-03
|
||||
|
||||
- **F.19.6.B: Site layout (menus + widgets + customizer).** Seven new admin routes — three for menus, three for widgets, one for the customizer changeset queue. Menus: `GET /admin/menus`, `GET /admin/menus/{id}`, `PUT /admin/menus/{id}` (body `{items:[...], name?}` — full replace, items not in the array are deleted, slug stays frozen so `theme_location` mapping survives). Widgets: `GET /admin/widgets/areas` (each area carries `kind: 'block'|'legacy'`), `GET /admin/widgets/{area_id}` (block-kind returns parsed block tree + roundtrip-safe `raw`; legacy-kind returns option-keyed settings), `PUT /admin/widgets/{area_id}` (block areas accept any block raw HTML; legacy areas accept `text` widget settings only this round — other legacy types remain read-only and return `unsupported_legacy_widget`; caller-side `kind` is ignored, area kind is determined by the area itself). Customizer: `POST /admin/customizer/changeset` with `{action: get|apply|discard}` — single-tool wrapper around the changeset queue, intentionally limited because most modern themes use FSE/site-editor instead of the customizer. New security rules: **S-22** dispatches per nav-menu item type — `post_type` checks `current_user_can('read_post', id)`; `taxonomy` allows public taxonomies and otherwise requires the taxonomy's `assign_terms` cap (deliberately NOT `manage_categories` which is a write cap and would refuse routine "add public Category X to footer" flows for editors who don't manage taxonomies); `custom` URL items skip the object validation. Refusals surface as `forbidden_object_id` 403/404. **S-23** sanitises widget HTML via `wp_kses_post` unless the caller has `unfiltered_html` (mirrors S-13 from F.19.5). **S-24** customizer apply requires the `customize` cap on top of `manage_options` — same bar as `/wp-admin/customize.php`. All routes gated on `manage_options` route-level. Pre-validates every menu item before mutating so a partial S-22 failure leaves the menu untouched. Customizer apply is racy with concurrent edits via the customizer UI — intentional, mirrors WP behaviour.
|
||||
|
||||
### 2.16.0 — 2026-05-03
|
||||
|
||||
- **F.19.6.A: Site config surface.** Six new admin routes covering Settings → General + Reading + Permalinks: `GET/POST /admin/site/identity` (title / tagline / site_icon / custom_logo), `GET/POST /admin/site/reading` (show_on_front / page_on_front / page_for_posts / posts_per_page / posts_per_rss / blog_public), `GET/POST /admin/permalinks` (permalink_structure + category_base + tag_base). All gated on `manage_options`. POST routes validate attachment ids against the media library, reject non-published page ids for page_on_front / page_for_posts, and route every option write through WP's own `sanitize_option_*` hooks. After a permalink_structure write `flush_rewrite_rules()` runs so the new structure takes effect immediately. First consumer of the `settings` tier introduced by F.19.2.0.
|
||||
|
||||
### 2.15.0 — 2026-05-02
|
||||
|
||||
- **F.19.2.1: Plugin write management.** Five new admin routes — `POST /admin/plugins/install` (accepts `{slug}` for wp.org install OR `{zip_url|zip_base64}` for arbitrary zip; supports `activate` + `overwrite`), `POST /admin/plugins/{slug}/activate`, `POST /admin/plugins/{slug}/deactivate`, `POST /admin/plugins/{slug}/update`, `DELETE /admin/plugins/{slug}`. Per-route capability checks: `install_plugins` (install / update), `activate_plugins` (activate / deactivate), `delete_plugins` (delete). New security rules: S-20 refuses to deactivate / delete the Airano MCP Bridge companion itself (returns `companion_self` 409 — operator must use WP-Admin → Plugins instead); S-21 refuses to deactivate / delete plugins marked `Required: yes` in their header. Reuses S-15 (slug whitelist via `get_plugins()`) + S-18 (50 MB cap on install zip). Refuses to delete an active plugin (caller must deactivate first). Update route returns `up_to_date:true` cleanly when no update is available. Multisite supports `network_wide` activation/deactivation (requires `manage_network_plugins` for activate).
|
||||
|
||||
### 2.14.0 — 2026-05-02
|
||||
|
||||
- **F.19.7: Theme dev surface (install + activate + delete + file CRUD).** Three theme management routes — `POST /admin/themes/install` (accepts either `zip_url` or inline `zip_base64`; runs WP core's `Theme_Upgrader`; supports `activate` + `overwrite`), `POST /admin/themes/{slug}/activate`, `DELETE /admin/themes/{slug}` — and four file CRUD routes — `GET /admin/themes/files/{slug}` (glob walk capped at 1000 files, returns `path/size/mime/sha256/modified_at` per entry), `GET /admin/themes/files/{slug}/{path}` (read as base64), `PUT /admin/themes/files/{slug}/{path}` (write with optional `expected_sha256` for optimistic concurrency and `create_dirs`), `DELETE /admin/themes/files/{slug}/{path}`. Per-route capability checks: `install_themes`, `switch_themes`, `delete_themes`, `edit_themes`. PHP file writes additionally require `!DISALLOW_FILE_EDIT` (S-17). All file paths canonicalise via `realpath()` and must stay under `wp-content/themes/{slug}` (S-16). Per-call caps: 5 MB/file, 1000 files/list, 50 MB/install zip (S-18). Optimistic concurrency on `expected_sha256` returns `sha_mismatch` (409) on drift (S-19). Refuses to delete the active theme, the active parent theme, or `style.css` of the active theme.
|
||||
|
||||
### 2.13.0 — 2026-05-01
|
||||
|
||||
- **F.19.5: Page editing surface (Gutenberg + Elementor + Classic).** Seven new write routes — `POST /admin/blocks/{replace,insert,remove}`, `POST /admin/elementor/{post_id}` (set), `POST /admin/elementor/{post_id}/regen-css`, `POST /admin/elementor/templates/apply`, `POST /admin/classic/{post_id}/replace` — and three new read routes — `GET /admin/elementor/status`, `GET /admin/elementor/{post_id}`, `GET /admin/elementor/templates`. Writes require `manage_options` AND per-post `edit_post` (S-12); block + classic content sanitised via `wp_kses_post` unless caller has `unfiltered_html` (S-13); Elementor JSON node count capped at 5,000 per call (S-14). All Elementor writes fire `elementor/document/after_save` so caches and CSS regenerate cleanly.
|
||||
|
||||
### 2.12.0 — 2026-05-01
|
||||
|
||||
- **F.19.3.1: System diagnostic ports from `wordpress_advanced`.** Three more read-only admin routes — `GET /admin/system-info`, `GET /admin/phpinfo`, `GET /admin/disk-usage` — replace the legacy WP-CLI / Docker-socket flow so admins on shared hosting can use those tools too. All gated on `manage_options`. `phpinfo` returns curated structured JSON (extension list + ini whitelist + opcache state), never the full `phpinfo()` HTML dump (which would leak server internals). `disk-usage` walks bounded at 200k files / 5s per tree.
|
||||
|
||||
### 2.11.0 — 2026-05-01
|
||||
|
||||
- **F.19.1: Read-only admin namespace.** Six new routes under `airano-mcp/v1/admin/*` — `plugins`, `themes`, `users`, `options/{name}`, `cron`, `maintenance` — gated on `manage_options`. `options` route uses a deny-list of credential-shaped suffixes on top of the cap check. `users` route paginates up to 200/call with optional `role` + `search` filters. No state changes; write operations land in F.19.2.
|
||||
|
||||
### 2.9.0 — 2026-04-16
|
||||
|
||||
- New: `POST /airano-mcp/v1/upload-and-attach` — raw-body upload + metadata (title / alt / caption / description) + attach-to-post + set-featured in a single REST round-trip. Saves 2–3 calls for every hero-image or product-image workflow. Per-target permission enforced via `current_user_can('edit_post', attach_to_post)`.
|
||||
@@ -184,6 +285,22 @@ The `/upload-chunk` route bypasses PHP's `upload_max_filesize` (typically 2–64
|
||||
|
||||
## Upgrade notice
|
||||
|
||||
### 2.16.0
|
||||
|
||||
Adds the F.19.6.A site config surface (6 new admin routes — identity / reading / permalinks). All gated on `manage_options`. Permalink writes flush rewrite rules automatically. No breaking changes; existing routes unchanged.
|
||||
|
||||
### 2.15.0
|
||||
|
||||
Adds the F.19.2.1 plugin write management surface (5 new admin routes — install / activate / deactivate / update / delete). Per-route checks for `install_plugins` / `activate_plugins` / `delete_plugins`. Refuses to deactivate or delete the companion plugin itself. No breaking changes; existing routes unchanged.
|
||||
|
||||
### 2.14.0
|
||||
|
||||
Adds the F.19.7 theme dev surface (7 new admin routes — install / activate / delete + file CRUD). Per-route checks for `install_themes` / `switch_themes` / `delete_themes` / `edit_themes`; PHP file writes additionally require `!DISALLOW_FILE_EDIT`. No breaking changes; existing routes unchanged.
|
||||
|
||||
### 2.13.0
|
||||
|
||||
Adds the F.19.5 page editing surface (10 new admin routes — Gutenberg blocks, Elementor read/write/template, Classic html replace). Writes require `manage_options` AND per-post `edit_post`; raw-HTML pass-through is gated on `unfiltered_html`. No breaking changes; existing routes unchanged.
|
||||
|
||||
### 2.9.0
|
||||
|
||||
Adds `POST /airano-mcp/v1/upload-and-attach` — upload + metadata + attach + featured in one REST round-trip. No breaking changes to existing routes.
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -4,11 +4,11 @@ Tags: mcp, ai, rest-api, seo, media
|
||||
Requires at least: 5.0
|
||||
Tested up to: 6.9
|
||||
Requires PHP: 7.4
|
||||
Stable tag: 2.9.0
|
||||
Stable tag: 2.18.1
|
||||
License: GPLv2 or later
|
||||
License URI: https://www.gnu.org/licenses/gpl-2.0.html
|
||||
|
||||
Companion plugin for MCP Hub. REST API routes for SEO meta and raw-binary media uploads that bypass upload_max_filesize.
|
||||
Companion plugin for MCP Hub. REST API routes for SEO meta, raw-binary media uploads that bypass upload_max_filesize, and the WordPress Specialist admin namespace.
|
||||
|
||||
== Description ==
|
||||
|
||||
@@ -51,6 +51,78 @@ Companion plugin for MCP Hub. REST API routes for SEO meta and raw-binary media
|
||||
* `POST /wp-json/airano-mcp/v1/regenerate-thumbnails` — Regenerate attachment sub-sizes via `wp_generate_attachment_metadata` for a list of IDs or in paged batch mode (added in 2.8.0)
|
||||
* `POST /wp-json/airano-mcp/v1/upload-and-attach` — Raw-body upload + metadata + attach-to-post + set-featured in a single REST call (added in 2.9.0). Query params: `attach_to_post`, `set_featured`, `title`, `alt_text`, `caption`, `description`. Permission: `upload_files` + `edit_post` on the target post.
|
||||
|
||||
*WordPress Specialist admin namespace (`airano-mcp/v1/admin/*`, added in 2.11.0–2.18.0)*
|
||||
|
||||
All admin routes require `manage_options`. They power the `wordpress_specialist` MCP plugin (companion-backed advanced WordPress management — no Docker socket required).
|
||||
|
||||
Read routes (2.11.0–2.14.0):
|
||||
|
||||
* `GET /wp-json/airano-mcp/v1/admin/plugins` — Every plugin known to WP with active/network-active/version/author/update flags (2.11.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/themes` — Installed themes with stylesheet/template/parent/block-theme/active flags (2.11.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/users?role=&search=&page=&per_page=` — Paginated user list (cap 200/call) (2.11.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/options/{name}` — Single option fetch with deny-list of credential-shaped keys (`*_secret`, `*_password`, `*_api_key`, `auth_*_key`, etc.) (2.11.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/cron` — Full cron table with epoch + ISO 8601 next_run, schedule slug, interval, args (2.11.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/maintenance` — `.maintenance` sentinel inspection (`enabled` / `started_at` / `stale`) (2.11.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/system-info` — WP/PHP/MySQL/server versions + memory + paths in one envelope (2.12.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/phpinfo` — Sorted extension list + curated ini whitelist + disabled functions + opcache state (2.12.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/disk-usage` — Bytes for uploads/plugins/themes + filesystem `disk_total/free/used` (bounded 200k files/5s per tree) (2.12.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/elementor/status` — Elementor presence + version + Pro flag + supported post types; `installed:false` cleanly when absent (2.13.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/elementor/{post_id}` — Parsed `_elementor_data` (slash-stripped, JSON-decoded) (2.13.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/elementor/templates` — Saved Elementor templates (id/title/type/modified) (2.13.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/themes/files/{slug}?glob=&max_files=` — Theme directory walk (path/size/mime/sha256/modified per file; capped at 1000 files/call) (2.14.0)
|
||||
* `GET /wp-json/airano-mcp/v1/admin/themes/files/{slug}/{path}` — Single theme file as base64 + sha256 + mime (5 MB cap) (2.14.0)
|
||||
|
||||
Page-editing write routes (2.13.0). All require `manage_options` AND `edit_post` on the target post (S-12); block + classic content is sanitised via `wp_kses_post` unless the caller has `unfiltered_html` (S-13); Elementor JSON node count capped at 5,000 per call (S-14).
|
||||
|
||||
* `POST /wp-json/airano-mcp/v1/admin/blocks/replace` — Replace post block tree; companion runs `serialize_blocks()` server-side (max 200 blocks)
|
||||
* `POST /wp-json/airano-mcp/v1/admin/blocks/insert` — Insert one block at index N
|
||||
* `POST /wp-json/airano-mcp/v1/admin/blocks/remove` — Remove block at index N (returns the removed block for rollback)
|
||||
* `POST /wp-json/airano-mcp/v1/admin/elementor/{post_id}` — Replace `_elementor_data`; fires `elementor/document/after_save`
|
||||
* `POST /wp-json/airano-mcp/v1/admin/elementor/{post_id}/regen-css` — Trigger per-post Elementor CSS regeneration
|
||||
* `POST /wp-json/airano-mcp/v1/admin/elementor/templates/apply` — Copy a saved template into a target post
|
||||
* `POST /wp-json/airano-mcp/v1/admin/classic/{post_id}/replace` — Pure post_content swap for classic-editor sites
|
||||
|
||||
Theme dev write routes (2.14.0). Per-route capability checks layer on top of `manage_options`: `install_themes` for install, `switch_themes` for activate, `delete_themes` for theme delete, `edit_themes` for file CRUD. PHP file writes additionally require `!DISALLOW_FILE_EDIT` (S-17). theme_slug must match `wp_get_themes()` (S-15). File paths canonicalise via `realpath()` and must stay under `wp-content/themes/{slug}` (S-16). Caps: 5 MB/file, 50 MB/install zip (S-18). Optimistic concurrency on `expected_sha256` returns `sha_mismatch` (409) on drift (S-19).
|
||||
|
||||
* `POST /wp-json/airano-mcp/v1/admin/themes/install` — Install theme from `zip_url` or inline `zip_base64`; supports `activate` + `overwrite`. Companion runs WP core's `Theme_Upgrader`.
|
||||
* `POST /wp-json/airano-mcp/v1/admin/themes/{slug}/activate` — Switch the active theme.
|
||||
* `DELETE /wp-json/airano-mcp/v1/admin/themes/{slug}` — Delete an installed theme (refuses if active or active parent).
|
||||
* `PUT /wp-json/airano-mcp/v1/admin/themes/files/{slug}/{path}` — Write a theme file (base64 body, optional `expected_sha256`, optional `create_dirs`).
|
||||
* `DELETE /wp-json/airano-mcp/v1/admin/themes/files/{slug}/{path}` — Delete a theme file (refuses to delete `style.css` of the active theme).
|
||||
|
||||
Plugin write management routes (2.15.0). Per-route capability checks layer on `manage_options`: `install_plugins` for install / update, `activate_plugins` for activate / deactivate, `delete_plugins` for delete. New security rules: S-20 refuses to deactivate / delete the Airano MCP Bridge companion itself (would brick the MCP connection); S-21 refuses to deactivate / delete plugins marked `Required: yes` in their header. Reuses S-15 (slug whitelist via `get_plugins()`) + S-18 (50 MB cap on install zip).
|
||||
|
||||
* `POST /wp-json/airano-mcp/v1/admin/plugins/install` — Install via wp.org `slug`, OR via `zip_url`, OR via inline `zip_base64` (mutually exclusive). Supports `activate` + `overwrite`. Companion runs WP core's `Plugin_Upgrader`.
|
||||
* `POST /wp-json/airano-mcp/v1/admin/plugins/{slug}/activate` — Activate an installed plugin. Optional `network_wide` for multisite.
|
||||
* `POST /wp-json/airano-mcp/v1/admin/plugins/{slug}/deactivate` — Deactivate. Refuses companion (S-20) and `Required` plugins (S-21).
|
||||
* `POST /wp-json/airano-mcp/v1/admin/plugins/{slug}/update` — Update to latest wp.org version. Returns `up_to_date:true` cleanly when no update available.
|
||||
* `DELETE /wp-json/airano-mcp/v1/admin/plugins/{slug}` — Delete. Refuses active plugins, the companion, and `Required` plugins.
|
||||
|
||||
Site config routes (2.16.0). All gated on `manage_options`. Writes route every option through WP's own `sanitize_option_*` hooks; permalink writes additionally call `flush_rewrite_rules()`.
|
||||
|
||||
* `GET /wp-json/airano-mcp/v1/admin/site/identity` — title / tagline / site_icon / custom_logo / charset / WP version / admin_email / language / siteurl
|
||||
* `POST /wp-json/airano-mcp/v1/admin/site/identity` — Update title / tagline / site_icon_id / custom_logo_id (any subset). Attachment ids are validated against the media library.
|
||||
* `GET /wp-json/airano-mcp/v1/admin/site/reading` — show_on_front / page_on_front / page_for_posts / posts_per_page / posts_per_rss / blog_public
|
||||
* `POST /wp-json/airano-mcp/v1/admin/site/reading` — Update reading settings. page_on_front / page_for_posts must reference published Pages.
|
||||
* `GET /wp-json/airano-mcp/v1/admin/permalinks` — permalink_structure / category_base / tag_base
|
||||
* `POST /wp-json/airano-mcp/v1/admin/permalinks` — Update permalink structure (empty string = plain). Calls `flush_rewrite_rules()` after the write so the new structure takes effect immediately.
|
||||
|
||||
Site layout routes (2.17.0). All gated on `manage_options`. Per-request capability checks layer on top per the new security rules: S-22 dispatches per nav-menu item type (`post_type` checks `read_post`; `taxonomy` allows public taxonomies and otherwise requires `assign_terms`; `custom` URL items skip the object check); S-23 sanitises widget HTML via `wp_kses_post` unless caller has `unfiltered_html`; S-24 customizer apply requires the `customize` cap (not just `manage_options`).
|
||||
|
||||
* `GET /wp-json/airano-mcp/v1/admin/menus` — Every nav menu with id / name / slug / theme locations / item count.
|
||||
* `GET /wp-json/airano-mcp/v1/admin/menus/{menu_id}` — One menu's items: `{id, title, type, object, object_id, parent, order, url, target, classes, xfn}`.
|
||||
* `PUT /wp-json/airano-mcp/v1/admin/menus/{menu_id}` — Full-replace items + optional rename. Slug stays frozen so theme_location mapping survives. Two-pass: every item validated against S-22 before any mutation.
|
||||
* `GET /wp-json/airano-mcp/v1/admin/widgets/areas` — Every registered sidebar with id / name / theme_location / widget_count / kind (`block` or `legacy`).
|
||||
* `GET /wp-json/airano-mcp/v1/admin/widgets/{area_id}` — One area's widgets. Block-kind returns `{id, type:'block', blocks: [...parsed], raw: '<!-- wp:... -->'}`; legacy-kind returns `{id, type, settings: {...}}` keyed by the widget's option store.
|
||||
* `PUT /wp-json/airano-mcp/v1/admin/widgets/{area_id}` — Full replace. Block areas accept `{raw}` (or `{blocks}` server-serialised); legacy areas accept `text` widget settings only this round (other legacy types remain read-only). Caller-side `kind` is ignored — area kind is determined by the area itself.
|
||||
* `POST /wp-json/airano-mcp/v1/admin/customizer/changeset` — `{action: get|apply|discard}`. `get` returns the pending changeset; `apply` publishes it; `discard` trashes it. Empty changeset returns `{status: 'empty'}` 200.
|
||||
|
||||
Database inspection routes (2.18.0). All gated on `manage_options`. New security rule S-25: db/search wraps `WP_Query` with `s=$query` (NEVER raw SQL); query is sanitised via `sanitize_text_field` and length-capped at 200 chars; `WP_Query`'s own `posts_clauses` filter (the same gate the WP search page uses) keeps non-readable posts out of the result set.
|
||||
|
||||
* `GET /wp-json/airano-mcp/v1/admin/db/size` — Aggregate database size. Single `information_schema.TABLES` aggregation scoped to the WP table prefix; returns `{database_bytes, table_count, row_count_estimate, database_name, table_prefix}`. No SQL exposure: caller doesn't pick the query.
|
||||
* `GET /wp-json/airano-mcp/v1/admin/db/tables` — Per-table breakdown. Same source as `db/size`, one row per WP table; returns `{database_name, table_prefix, tables: [{name, engine, rows, data_bytes, index_bytes, total_bytes, collation}]}` ordered by total_bytes descending.
|
||||
* `POST /wp-json/airano-mcp/v1/admin/db/search` — Full-text search wrapper around `WP_Query`. Body `{query, post_type?, status?, limit?}` (limit default 20, max 100). Returns `{query, limit, count, hits: [{id, post_type, status, title, snippet, url, modified}]}`.
|
||||
|
||||
**Designed for [MCP Hub](https://github.com/airano-ir/mcphub)** — the AI-native management hub for WordPress and self-hosted services.
|
||||
|
||||
== Installation ==
|
||||
@@ -92,6 +164,33 @@ Yes. All REST API endpoints work with any application that can make authenticate
|
||||
|
||||
== Changelog ==
|
||||
|
||||
= 2.18.1 =
|
||||
* WordPress.org review fixes: drop the unused `wp-admin/includes/media.php` include from `/upload-chunk` and `/upload-and-attach` (only helpers from `file.php` and `image.php` are actually used). Split the `/upload-and-attach` permission_callback into its own method (`require_upload_and_attach_capability`) that explicitly checks `current_user_can('edit_post', $attach_to_post)` at the route gate when `attach_to_post` is supplied, and rejects `set_featured` without a target. The per-target check is no longer hidden inside the callback body.
|
||||
|
||||
= 2.18.0 =
|
||||
* F.19.3.2-.3 — Database inspection (read) + bulk fan-out (write). Three new admin routes: `GET /admin/db/size` (single `information_schema.TABLES` aggregation: database_bytes + table_count + row_count_estimate, no SQL exposure), `GET /admin/db/tables` (per-table breakdown: name, engine, rows, data_bytes, index_bytes, total_bytes, collation), `POST /admin/db/search` body `{query, post_type?, status?, limit?}` wraps `WP_Query` with `s=$query` (NEVER raw SQL), `query` sanitised via `sanitize_text_field` and capped at 200 chars server-side, `limit` capped at 100. New security rule S-25 — db/search wraps `WP_Query`, never raw SQL; `posts_clauses` filter (same as the WP search page) keeps non-readable posts (private/draft from other authors) out of the result set. The bulk write tools (`wp_bulk_post_update`, `wp_bulk_term_update` on MCP Hub side) ride stock REST `wp/v2/posts/{id}` and `wp/v2/{taxonomy}/{id}` — no companion routes needed for those, but the cap of 50 items per call is documented under S-26 in the MCP Hub spec. All admin routes gated on `manage_options`. This release is bundled with the wordpress_advanced sunset on the MCP Hub side: the deprecated WP-CLI/Docker-socket plugin is removed in F.19.3.2-.3 (2026-05-04); `wordpress_specialist` is now the only WP-management surface.
|
||||
|
||||
= 2.17.0 =
|
||||
* F.19.6.B — Site layout (menus + widgets + customizer). Adds seven new admin routes: `GET /admin/menus`, `GET /admin/menus/{id}`, `PUT /admin/menus/{id}` (full-replace items + optional rename, slug stays frozen), `GET /admin/widgets/areas`, `GET /admin/widgets/{area_id}`, `PUT /admin/widgets/{area_id}` (block areas accept any block raw HTML; legacy areas accept `text` widget settings only — other legacy types remain read-only this round), and `POST /admin/customizer/changeset` (single-tool wrapper around the changeset queue with `{action: get|apply|discard}`). New security rules: S-22 dispatches per nav-menu item type — `post_type` checks `current_user_can('read_post', id)`, `taxonomy` allows public taxonomies and otherwise requires the taxonomy's `assign_terms` cap (deliberately NOT `manage_categories` which is a write cap), `custom` URL items skip the object validation; refusals surface as `forbidden_object_id` 403/404. S-23 sanitises widget HTML via `wp_kses_post` unless the caller has `unfiltered_html` (mirrors S-13 from F.19.5). S-24 customizer apply requires the `customize` cap (same bar as `/wp-admin/customize.php`); `manage_options` alone is not enough. All routes gated on `manage_options`. Pre-validates every menu item before mutating so a partial S-22 failure leaves the menu untouched. Customizer apply is racy with concurrent edits via the customizer UI — intentional, mirrors WP behaviour.
|
||||
|
||||
= 2.16.0 =
|
||||
* F.19.6.A — Site config surface. Six new admin routes covering Settings → General + Reading + Permalinks: `GET/POST /admin/site/identity` (title / tagline / site_icon / custom_logo), `GET/POST /admin/site/reading` (show_on_front / page_on_front / page_for_posts / posts_per_page / posts_per_rss / blog_public), `GET/POST /admin/permalinks` (permalink_structure / category_base / tag_base). All gated on `manage_options`. POST routes validate attachment ids against the media library, reject non-published page ids for page_on_front / page_for_posts, and route every option write through WP's own `sanitize_option_*` hooks. After a permalink_structure write `flush_rewrite_rules()` runs so the new structure takes effect immediately. First consumer of the `settings` tier introduced by F.19.2.0.
|
||||
|
||||
= 2.15.0 =
|
||||
* F.19.2.1 — Plugin write management. Adds five new admin routes — `POST /admin/plugins/install` (accepts `{slug}` for wp.org install OR `{zip_url|zip_base64}` for arbitrary zip), `POST /admin/plugins/{slug}/activate`, `POST /admin/plugins/{slug}/deactivate`, `POST /admin/plugins/{slug}/update`, `DELETE /admin/plugins/{slug}`. Per-route capability checks: `install_plugins` (install / update), `activate_plugins` (activate / deactivate), `delete_plugins` (delete). New security rules: S-20 refuses to deactivate or delete the Airano MCP Bridge companion itself (would brick the MCP connection — operators must use WP-Admin → Plugins instead); S-21 refuses to deactivate / delete plugins marked `Required: yes` in their header (must-use plugins shipped by some managed hosts). Reuses S-15 (slug whitelist via `get_plugins()`) + S-18 (50 MB cap on install zip). Refuses to delete an active plugin (caller must deactivate first). Update route returns `up_to_date:true` cleanly when no update is available.
|
||||
|
||||
= 2.14.0 =
|
||||
* F.19.7 — Theme dev surface (install + activate + delete + file CRUD). Adds three theme management routes — `POST /admin/themes/install` (accepts either `zip_url` or `zip_base64`; runs WP core's `Theme_Upgrader`), `POST /admin/themes/{slug}/activate`, `DELETE /admin/themes/{slug}` — and four file CRUD routes — `GET /admin/themes/files/{slug}` (glob walk capped at 1000 files), `GET /admin/themes/files/{slug}/{path}` (file read as base64), `PUT /admin/themes/files/{slug}/{path}` (file write with optional `expected_sha256` for optimistic concurrency), `DELETE /admin/themes/files/{slug}/{path}`. New security rules: `theme_slug` must match `wp_get_themes()` (S-15); paths canonicalise via `realpath()` and must stay under `wp-content/themes/{slug}`, blocking `..`, symlinks, absolute paths, null bytes (S-16); PHP file writes additionally require `!DISALLOW_FILE_EDIT` (S-17); per-call caps 5 MB/file, 1000 files/list, 50 MB/zip (S-18); optimistic concurrency via `expected_sha256` returns `sha_mismatch` (409) on drift (S-19). All routes gated on `manage_options` route-side; per-handler capability checks add `install_themes` / `switch_themes` / `delete_themes` / `edit_themes`. Refuses to delete the active theme, the active parent theme, or `style.css` of the active theme.
|
||||
|
||||
= 2.13.0 =
|
||||
* F.19.5 — Page editing surface (Gutenberg + Elementor + Classic). Adds seven write routes — `POST /admin/blocks/{replace,insert,remove}`, `POST /admin/elementor/{post_id}` (set), `POST /admin/elementor/{post_id}/regen-css`, `POST /admin/elementor/templates/apply`, `POST /admin/classic/{post_id}/replace` — and three new read routes — `GET /admin/elementor/status`, `GET /admin/elementor/{post_id}`, `GET /admin/elementor/templates`. Writes require `manage_options` AND `edit_post` on the target post (S-12). Block + classic content is sanitised via `wp_kses_post` unless the caller has `unfiltered_html` (S-13). Elementor JSON node count capped at 5,000 per call; oversized payloads return `elementor_too_large` (S-14). All Elementor writes fire `elementor/document/after_save` so caches and CSS regenerate cleanly.
|
||||
|
||||
= 2.12.0 =
|
||||
* F.19.3.1 — Three more read-only admin routes ported from the legacy `wordpress_advanced` WP-CLI tools so they can run via the companion instead of `docker exec`. `GET /admin/system-info` (PHP/MySQL/WordPress versions + server software + memory limits), `GET /admin/phpinfo` (extension list + curated ini snapshot — never the full `phpinfo()` HTML which would leak server internals), `GET /admin/disk-usage` (uploads/plugins/themes/total bytes + `disk_free_space`, bounded at 200k files / 5s wall clock per tree). All gated on `manage_options`.
|
||||
|
||||
= 2.11.0 =
|
||||
* F.19.1 — New read-only admin namespace `airano-mcp/v1/admin/*` for the WordPress Specialist tool surface. Six new routes — `plugins`, `themes`, `users`, `options/{name}`, `cron`, `maintenance` — all gated on `manage_options`. `options` route uses a deny-list of credential-shaped suffixes (`*_secret`, `*_password`, `*_api_key`, `*_token`, `auth_*_key`, `auth_*_salt`) on top of the cap check. `users` route paginates up to 200/call with optional `role` + `search` filters. No state changes in this version; write operations land in F.19.2.
|
||||
|
||||
= 2.9.0 =
|
||||
* Added `POST /wp-json/airano-mcp/v1/upload-and-attach` — same raw-body semantics as `/upload-chunk`, but accepts query params (`attach_to_post`, `set_featured`, `title`, `alt_text`, `caption`, `description`) and applies them in one PHP round-trip. Saves 2-3 REST calls per upload. Per-target permission enforced via `current_user_can('edit_post', attach_to_post)`.
|
||||
* `status` + `capabilities` routes now advertise `upload_and_attach: true` alongside the existing capability flags.
|
||||
@@ -146,6 +245,33 @@ Yes. All REST API endpoints work with any application that can make authenticate
|
||||
|
||||
== Upgrade Notice ==
|
||||
|
||||
= 2.18.1 =
|
||||
WordPress.org review fixes only — no behaviour changes. Drops a redundant core file include and tightens the `/upload-and-attach` permission gate so the per-target `edit_post` check runs before the callback (visible to static analysis).
|
||||
|
||||
= 2.18.0 =
|
||||
Adds the F.19.3.2-.3 database inspection surface (3 new admin read routes — db/size / db/tables / db/search) wrapping `information_schema.TABLES` + `WP_Query`. NEVER exposes raw SQL (S-25 — query is sanitised and length-capped). All gated on `manage_options`. No breaking changes; existing routes unchanged.
|
||||
|
||||
= 2.17.0 =
|
||||
Adds the F.19.6.B site layout surface (7 new admin routes — menus / widgets / customizer changeset). New security rules S-22 (per-item caps for nav-menu object refs), S-23 (`wp_kses_post` on widget HTML unless `unfiltered_html`), S-24 (customizer apply requires `customize` cap). No breaking changes; existing routes unchanged.
|
||||
|
||||
= 2.16.0 =
|
||||
Adds the F.19.6.A site config surface (6 new admin routes — identity / reading / permalinks). All gated on `manage_options`. Permalink writes flush rewrite rules automatically. No breaking changes; existing routes unchanged.
|
||||
|
||||
= 2.15.0 =
|
||||
Adds the F.19.2.1 plugin write management surface (5 new admin routes — install / activate / deactivate / update / delete). Per-route checks for `install_plugins` / `activate_plugins` / `delete_plugins`. Refuses to deactivate or delete the companion plugin itself. No breaking changes; existing routes unchanged.
|
||||
|
||||
= 2.14.0 =
|
||||
Adds the F.19.7 theme dev surface (7 new admin routes — install / activate / delete + file CRUD). Per-route checks for `install_themes` / `switch_themes` / `delete_themes` / `edit_themes`; PHP file writes additionally require `!DISALLOW_FILE_EDIT`. No breaking changes; existing routes unchanged.
|
||||
|
||||
= 2.13.0 =
|
||||
Adds the F.19.5 page editing surface (10 new admin routes — Gutenberg blocks, Elementor read/write/template, Classic html replace). Writes require `manage_options` AND `edit_post` on the target post; raw HTML is gated on the caller also holding `unfiltered_html`. No breaking changes; existing routes unchanged.
|
||||
|
||||
= 2.12.0 =
|
||||
Adds three more read-only admin routes (`/admin/system-info`, `/admin/phpinfo`, `/admin/disk-usage`). They replace the legacy WP-CLI / Docker-socket flow used by the `wordpress_advanced` MCP plugin so admins on shared hosting can use those tools too. No breaking changes.
|
||||
|
||||
= 2.11.0 =
|
||||
Adds the `airano-mcp/v1/admin/*` namespace (six read routes) for the new WordPress Specialist MCP tool surface. No breaking changes; existing routes unchanged. Activate the plugin and any admin Application Password gets the new routes.
|
||||
|
||||
= 2.9.0 =
|
||||
Adds `POST /airano-mcp/v1/upload-and-attach` — upload + metadata + attach + featured in one REST round-trip. No breaking changes.
|
||||
|
||||
|
||||
63
wordpress-plugin/airano-mcp-seo-bridge-deprecated/README.md
Normal file
63
wordpress-plugin/airano-mcp-seo-bridge-deprecated/README.md
Normal file
@@ -0,0 +1,63 @@
|
||||
# airano-mcp-seo-bridge — deprecated (migration release)
|
||||
|
||||
This folder is the source of the **final** v1.3.1 release of the legacy
|
||||
slug `airano-mcp-seo-bridge`, kept here so it stays under git review.
|
||||
|
||||
The slug itself is still alive at:
|
||||
<https://wordpress.org/plugins/airano-mcp-seo-bridge/>
|
||||
|
||||
But it has been superseded by the broader `airano-mcp-bridge` plugin
|
||||
(approved 2026-05-10, published from
|
||||
[`wordpress-plugin/airano-mcp-bridge-wporg/`](../airano-mcp-bridge-wporg/)).
|
||||
|
||||
## What v1.3.1 changes vs v1.3.0
|
||||
|
||||
Only one thing: a dismissible admin notice that points users to
|
||||
`airano-mcp-bridge`.
|
||||
|
||||
- **No** REST routes changed.
|
||||
- **No** behaviour change for existing API consumers.
|
||||
- New methods: `handle_migration_notice_dismiss()` (consumes a
|
||||
nonce-protected `?airano_seo_bridge_dismiss_migration=1` GET),
|
||||
`render_migration_notice()` (renders the notice on every admin page
|
||||
for users with `install_plugins`, hidden once dismissed via
|
||||
`update_user_meta`).
|
||||
- New constant: `SEO_API_Bridge::MIGRATION_DISMISS_META`.
|
||||
|
||||
## Files
|
||||
|
||||
- `airano-mcp-seo-bridge.php` — main plugin file, v1.3.1
|
||||
- `readme.txt` — wp.org-format readme with the migration banner in
|
||||
the description and the 1.3.1 changelog/upgrade-notice entries
|
||||
|
||||
## SVN release flow (already done as r3527927/r3527928)
|
||||
|
||||
```bash
|
||||
# Working copy (gitignored):
|
||||
svn co https://plugins.svn.wordpress.org/airano-mcp-seo-bridge \
|
||||
wordpress-plugin/airano-mcp-seo-bridge-svn
|
||||
|
||||
# Copy these two files into trunk:
|
||||
cp airano-mcp-seo-bridge.php readme.txt \
|
||||
wordpress-plugin/airano-mcp-seo-bridge-svn/trunk/
|
||||
|
||||
# Then:
|
||||
svn ci wordpress-plugin/airano-mcp-seo-bridge-svn/trunk/ \
|
||||
-m "v1.3.1 — Add migration notice pointing to airano-mcp-bridge"
|
||||
svn cp wordpress-plugin/airano-mcp-seo-bridge-svn/trunk \
|
||||
wordpress-plugin/airano-mcp-seo-bridge-svn/tags/1.3.1
|
||||
svn ci wordpress-plugin/airano-mcp-seo-bridge-svn/tags/1.3.1 \
|
||||
-m "Tag 1.3.1"
|
||||
```
|
||||
|
||||
## What happens next
|
||||
|
||||
The migration notice will appear for every admin (with `install_plugins`)
|
||||
on every admin page until they either install the replacement plugin or
|
||||
click the **Dismiss** link in the notice.
|
||||
|
||||
When confident that most active installs have migrated, an email to
|
||||
`plugins@wordpress.org` with subject "Author request — close
|
||||
airano-mcp-seo-bridge (superseded by airano-mcp-bridge)" closes the slug
|
||||
permanently. Don't rush this — leave it open for several months so
|
||||
late migrators still get the notice.
|
||||
@@ -0,0 +1,794 @@
|
||||
<?php
|
||||
/**
|
||||
* Plugin Name: Airano MCP SEO Meta Bridge
|
||||
* Plugin URI: https://github.com/airano-ir/mcphub
|
||||
* Description: Exposes Rank Math SEO and Yoast SEO meta fields via WordPress REST API for use with MCP servers and AI agents. Supports posts, pages, and WooCommerce products with full CRUD operations.
|
||||
* Version: 1.3.1
|
||||
* Author: MCP Hub
|
||||
* Author URI: https://github.com/airano-ir
|
||||
* License: GPL-2.0-or-later
|
||||
* Requires at least: 5.0
|
||||
* Requires PHP: 7.4
|
||||
* Text Domain: airano-mcp-seo-bridge
|
||||
*
|
||||
* Changelog:
|
||||
* 1.3.1 - Migration notice — this plugin has been superseded by "Airano MCP Bridge" (slug `airano-mcp-bridge`), which carries the same SEO routes plus media uploads, bulk meta, cache purge, transient flush, site health, audit hook, and thumbnail regeneration. All SEO functionality in this plugin is unchanged; existing installs keep working. A dismissible admin notice points users to the replacement.
|
||||
* 1.3.0 - Added REST API endpoints for posts, pages, and products (GET/POST operations)
|
||||
* 1.2.0 - Enhanced WooCommerce product support, improved MariaDB compatibility
|
||||
* 1.1.0 - Added status endpoint and improved plugin detection
|
||||
* 1.0.0 - Initial release
|
||||
*/
|
||||
|
||||
// Prevent direct access
|
||||
if (!defined('ABSPATH')) {
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Airano MCP SEO Meta Bridge Main Class
|
||||
*/
|
||||
class SEO_API_Bridge {
|
||||
|
||||
/**
|
||||
* Plugin version
|
||||
*/
|
||||
const VERSION = '1.3.1';
|
||||
|
||||
/**
|
||||
* User-meta key tracking whether the current user dismissed the
|
||||
* migration notice that points to the replacement plugin.
|
||||
*/
|
||||
const MIGRATION_DISMISS_META = 'airano_seo_bridge_migration_dismissed';
|
||||
|
||||
/**
|
||||
* Supported post types
|
||||
*/
|
||||
private $supported_post_types = ['post', 'page', 'product'];
|
||||
|
||||
/**
|
||||
* Constructor
|
||||
*/
|
||||
public function __construct() {
|
||||
add_action('rest_api_init', [$this, 'register_meta_fields']);
|
||||
add_action('rest_api_init', [$this, 'register_rest_routes']);
|
||||
add_action('admin_notices', [$this, 'admin_notices']);
|
||||
|
||||
// 1.3.1 — surface the migration notice across the admin and
|
||||
// honour the dismissal click before notices render.
|
||||
add_action('admin_init', [$this, 'handle_migration_notice_dismiss']);
|
||||
add_action('admin_notices', [$this, 'render_migration_notice']);
|
||||
|
||||
// Add product support message if WooCommerce is active
|
||||
if ($this->is_woocommerce_active()) {
|
||||
$this->supported_post_types[] = 'product_variation'; // Also support variations
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Register REST API routes
|
||||
*/
|
||||
public function register_rest_routes() {
|
||||
// Status endpoint
|
||||
register_rest_route('airano-mcp-seo-bridge/v1', '/status', [
|
||||
'methods' => 'GET',
|
||||
'callback' => [$this, 'get_status'],
|
||||
'permission_callback' => function() {
|
||||
return is_user_logged_in();
|
||||
}
|
||||
]);
|
||||
|
||||
// Post SEO endpoints
|
||||
register_rest_route('airano-mcp-seo-bridge/v1', '/posts/(?P<id>\d+)/seo', [
|
||||
[
|
||||
'methods' => 'GET',
|
||||
'callback' => [$this, 'get_post_seo'],
|
||||
'permission_callback' => function() {
|
||||
return current_user_can('edit_posts');
|
||||
},
|
||||
'args' => [
|
||||
'id' => [
|
||||
'validate_callback' => function($param) {
|
||||
return is_numeric($param);
|
||||
}
|
||||
]
|
||||
]
|
||||
],
|
||||
[
|
||||
'methods' => 'POST',
|
||||
'callback' => [$this, 'update_post_seo'],
|
||||
'permission_callback' => function() {
|
||||
return current_user_can('edit_posts');
|
||||
},
|
||||
'args' => [
|
||||
'id' => [
|
||||
'validate_callback' => function($param) {
|
||||
return is_numeric($param);
|
||||
}
|
||||
]
|
||||
]
|
||||
]
|
||||
]);
|
||||
|
||||
// Page SEO endpoints
|
||||
register_rest_route('airano-mcp-seo-bridge/v1', '/pages/(?P<id>\d+)/seo', [
|
||||
[
|
||||
'methods' => 'GET',
|
||||
'callback' => [$this, 'get_page_seo'],
|
||||
'permission_callback' => function() {
|
||||
return current_user_can('edit_posts');
|
||||
},
|
||||
'args' => [
|
||||
'id' => [
|
||||
'validate_callback' => function($param) {
|
||||
return is_numeric($param);
|
||||
}
|
||||
]
|
||||
]
|
||||
],
|
||||
[
|
||||
'methods' => 'POST',
|
||||
'callback' => [$this, 'update_page_seo'],
|
||||
'permission_callback' => function() {
|
||||
return current_user_can('edit_pages');
|
||||
},
|
||||
'args' => [
|
||||
'id' => [
|
||||
'validate_callback' => function($param) {
|
||||
return is_numeric($param);
|
||||
}
|
||||
]
|
||||
]
|
||||
]
|
||||
]);
|
||||
|
||||
// Product SEO endpoints (WooCommerce)
|
||||
register_rest_route('airano-mcp-seo-bridge/v1', '/products/(?P<id>\d+)/seo', [
|
||||
[
|
||||
'methods' => 'GET',
|
||||
'callback' => [$this, 'get_product_seo'],
|
||||
'permission_callback' => function() {
|
||||
return current_user_can('edit_posts');
|
||||
},
|
||||
'args' => [
|
||||
'id' => [
|
||||
'validate_callback' => function($param) {
|
||||
return is_numeric($param);
|
||||
}
|
||||
]
|
||||
]
|
||||
],
|
||||
[
|
||||
'methods' => 'POST',
|
||||
'callback' => [$this, 'update_product_seo'],
|
||||
'permission_callback' => function() {
|
||||
return current_user_can('edit_posts');
|
||||
},
|
||||
'args' => [
|
||||
'id' => [
|
||||
'validate_callback' => function($param) {
|
||||
return is_numeric($param);
|
||||
}
|
||||
]
|
||||
]
|
||||
]
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get plugin status endpoint
|
||||
*/
|
||||
public function get_status() {
|
||||
$rank_math_active = $this->is_rank_math_active();
|
||||
$yoast_active = $this->is_yoast_active();
|
||||
|
||||
$response = [
|
||||
'plugin' => 'Airano MCP SEO Meta Bridge',
|
||||
'version' => self::VERSION,
|
||||
'active' => true,
|
||||
'seo_plugins' => [
|
||||
'rank_math' => [
|
||||
'active' => $rank_math_active,
|
||||
'version' => $rank_math_active && defined('RANK_MATH_VERSION') ? RANK_MATH_VERSION : null
|
||||
],
|
||||
'yoast' => [
|
||||
'active' => $yoast_active,
|
||||
'version' => $yoast_active && defined('WPSEO_VERSION') ? WPSEO_VERSION : null
|
||||
]
|
||||
],
|
||||
'supported_post_types' => $this->supported_post_types,
|
||||
'message' => $this->get_status_message($rank_math_active, $yoast_active)
|
||||
];
|
||||
|
||||
return rest_ensure_response($response);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get status message based on active plugins
|
||||
*/
|
||||
private function get_status_message($rank_math_active, $yoast_active) {
|
||||
if (!$rank_math_active && !$yoast_active) {
|
||||
return 'No SEO plugin detected. Please install and activate Rank Math SEO or Yoast SEO.';
|
||||
}
|
||||
|
||||
$active_plugins = [];
|
||||
if ($rank_math_active) $active_plugins[] = 'Rank Math SEO';
|
||||
if ($yoast_active) $active_plugins[] = 'Yoast SEO';
|
||||
|
||||
return 'Airano MCP SEO Meta Bridge is active and working with ' . implode(' and ', $active_plugins) . '.';
|
||||
}
|
||||
|
||||
/**
|
||||
* Register all meta fields for REST API
|
||||
*/
|
||||
public function register_meta_fields() {
|
||||
// Register Rank Math fields if plugin is active
|
||||
if ($this->is_rank_math_active()) {
|
||||
$this->register_rank_math_fields();
|
||||
}
|
||||
|
||||
// Register Yoast SEO fields if plugin is active
|
||||
if ($this->is_yoast_active()) {
|
||||
$this->register_yoast_fields();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if Rank Math is active
|
||||
*/
|
||||
private function is_rank_math_active() {
|
||||
return defined('RANK_MATH_VERSION') || class_exists('RankMath');
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if Yoast SEO is active
|
||||
*/
|
||||
private function is_yoast_active() {
|
||||
return defined('WPSEO_VERSION') || class_exists('WPSEO_Options');
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if WooCommerce is active
|
||||
*/
|
||||
private function is_woocommerce_active() {
|
||||
return class_exists('WooCommerce') || defined('WC_VERSION');
|
||||
}
|
||||
|
||||
/**
|
||||
* Register Rank Math meta fields
|
||||
*/
|
||||
private function register_rank_math_fields() {
|
||||
$rank_math_fields = [
|
||||
// Core SEO Fields
|
||||
'rank_math_focus_keyword' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math focus keyword',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_title' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math SEO title (meta title)',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_description' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math meta description',
|
||||
'single' => true,
|
||||
],
|
||||
|
||||
// Additional Keywords
|
||||
'rank_math_additional_keywords' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math additional keywords (comma-separated)',
|
||||
'single' => true,
|
||||
],
|
||||
|
||||
// Advanced Fields
|
||||
'rank_math_canonical_url' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math canonical URL',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_robots' => [
|
||||
'type' => 'array',
|
||||
'description' => 'Rank Math robots meta (noindex, nofollow, etc.)',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_breadcrumb_title' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math breadcrumb title',
|
||||
'single' => true,
|
||||
],
|
||||
|
||||
// Open Graph Fields
|
||||
'rank_math_facebook_title' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math Facebook Open Graph title',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_facebook_description' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math Facebook Open Graph description',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_facebook_image' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math Facebook Open Graph image URL',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_facebook_image_id' => [
|
||||
'type' => 'integer',
|
||||
'description' => 'Rank Math Facebook Open Graph image ID',
|
||||
'single' => true,
|
||||
],
|
||||
|
||||
// Twitter Card Fields
|
||||
'rank_math_twitter_title' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math Twitter Card title',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_twitter_description' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math Twitter Card description',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_twitter_image' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math Twitter Card image URL',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_twitter_image_id' => [
|
||||
'type' => 'integer',
|
||||
'description' => 'Rank Math Twitter Card image ID',
|
||||
'single' => true,
|
||||
],
|
||||
'rank_math_twitter_card_type' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Rank Math Twitter Card type (summary, summary_large_image)',
|
||||
'single' => true,
|
||||
],
|
||||
];
|
||||
|
||||
$this->register_fields($rank_math_fields);
|
||||
}
|
||||
|
||||
/**
|
||||
* Register Yoast SEO meta fields
|
||||
*/
|
||||
private function register_yoast_fields() {
|
||||
$yoast_fields = [
|
||||
// Core SEO Fields
|
||||
'_yoast_wpseo_focuskw' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO focus keyword',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_title' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO title (meta title)',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_metadesc' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO meta description',
|
||||
'single' => true,
|
||||
],
|
||||
|
||||
// Advanced Fields
|
||||
'_yoast_wpseo_canonical' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO canonical URL',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_meta-robots-noindex' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO noindex setting (0 = index, 1 = noindex)',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_meta-robots-nofollow' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO nofollow setting (0 = follow, 1 = nofollow)',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_bctitle' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO breadcrumb title',
|
||||
'single' => true,
|
||||
],
|
||||
|
||||
// Open Graph Fields
|
||||
'_yoast_wpseo_opengraph-title' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO Open Graph title',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_opengraph-description' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO Open Graph description',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_opengraph-image' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO Open Graph image URL',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_opengraph-image-id' => [
|
||||
'type' => 'integer',
|
||||
'description' => 'Yoast SEO Open Graph image ID',
|
||||
'single' => true,
|
||||
],
|
||||
|
||||
// Twitter Card Fields
|
||||
'_yoast_wpseo_twitter-title' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO Twitter title',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_twitter-description' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO Twitter description',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_twitter-image' => [
|
||||
'type' => 'string',
|
||||
'description' => 'Yoast SEO Twitter image URL',
|
||||
'single' => true,
|
||||
],
|
||||
'_yoast_wpseo_twitter-image-id' => [
|
||||
'type' => 'integer',
|
||||
'description' => 'Yoast SEO Twitter image ID',
|
||||
'single' => true,
|
||||
],
|
||||
];
|
||||
|
||||
$this->register_fields($yoast_fields);
|
||||
}
|
||||
|
||||
/**
|
||||
* Register fields for all supported post types
|
||||
*/
|
||||
private function register_fields($fields) {
|
||||
foreach ($this->supported_post_types as $post_type) {
|
||||
foreach ($fields as $meta_key => $args) {
|
||||
$show_in_rest = $args['type'] === 'array'
|
||||
? [ 'schema' => [ 'type' => 'array', 'items' => [ 'type' => 'string' ] ] ]
|
||||
: true;
|
||||
|
||||
register_post_meta($post_type, $meta_key, [
|
||||
'show_in_rest' => $show_in_rest,
|
||||
'single' => $args['single'],
|
||||
'type' => $args['type'],
|
||||
'description' => $args['description'],
|
||||
'auth_callback' => function() {
|
||||
return current_user_can('edit_posts');
|
||||
}
|
||||
]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get SEO data for a post
|
||||
*/
|
||||
public function get_post_seo($request) {
|
||||
$post_id = $request['id'];
|
||||
return $this->get_seo_data($post_id, 'post');
|
||||
}
|
||||
|
||||
/**
|
||||
* Update SEO data for a post
|
||||
*/
|
||||
public function update_post_seo($request) {
|
||||
$post_id = $request['id'];
|
||||
return $this->update_seo_data($post_id, $request->get_json_params(), 'post');
|
||||
}
|
||||
|
||||
/**
|
||||
* Get SEO data for a page
|
||||
*/
|
||||
public function get_page_seo($request) {
|
||||
$post_id = $request['id'];
|
||||
return $this->get_seo_data($post_id, 'page');
|
||||
}
|
||||
|
||||
/**
|
||||
* Update SEO data for a page
|
||||
*/
|
||||
public function update_page_seo($request) {
|
||||
$post_id = $request['id'];
|
||||
return $this->update_seo_data($post_id, $request->get_json_params(), 'page');
|
||||
}
|
||||
|
||||
/**
|
||||
* Get SEO data for a product
|
||||
*/
|
||||
public function get_product_seo($request) {
|
||||
$post_id = $request['id'];
|
||||
return $this->get_seo_data($post_id, 'product');
|
||||
}
|
||||
|
||||
/**
|
||||
* Update SEO data for a product
|
||||
*/
|
||||
public function update_product_seo($request) {
|
||||
$post_id = $request['id'];
|
||||
return $this->update_seo_data($post_id, $request->get_json_params(), 'product');
|
||||
}
|
||||
|
||||
/**
|
||||
* Generic method to get SEO data
|
||||
*/
|
||||
private function get_seo_data($post_id, $post_type) {
|
||||
// Verify post exists and is correct type
|
||||
$post = get_post($post_id);
|
||||
if (!$post || $post->post_type !== $post_type) {
|
||||
return new WP_Error(
|
||||
'invalid_post',
|
||||
sprintf('%s not found', ucfirst($post_type)),
|
||||
['status' => 404]
|
||||
);
|
||||
}
|
||||
|
||||
$seo_data = [
|
||||
'post_id' => $post_id,
|
||||
'post_type' => $post_type,
|
||||
'post_title' => $post->post_title,
|
||||
];
|
||||
|
||||
// Detect which SEO plugin is active and get data
|
||||
if ($this->is_rank_math_active()) {
|
||||
$seo_data['plugin'] = 'rank_math';
|
||||
$seo_data = array_merge($seo_data, $this->get_rank_math_data($post_id));
|
||||
} elseif ($this->is_yoast_active()) {
|
||||
$seo_data['plugin'] = 'yoast';
|
||||
$seo_data = array_merge($seo_data, $this->get_yoast_data($post_id));
|
||||
} else {
|
||||
return new WP_Error(
|
||||
'no_seo_plugin',
|
||||
'No supported SEO plugin found (Rank Math or Yoast required)',
|
||||
['status' => 500]
|
||||
);
|
||||
}
|
||||
|
||||
return rest_ensure_response($seo_data);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get Rank Math SEO data
|
||||
*/
|
||||
private function get_rank_math_data($post_id) {
|
||||
return [
|
||||
'focus_keyword' => get_post_meta($post_id, 'rank_math_focus_keyword', true),
|
||||
'seo_title' => get_post_meta($post_id, 'rank_math_title', true),
|
||||
'meta_description' => get_post_meta($post_id, 'rank_math_description', true),
|
||||
'canonical_url' => get_post_meta($post_id, 'rank_math_canonical_url', true),
|
||||
'robots' => get_post_meta($post_id, 'rank_math_robots', true),
|
||||
'og_title' => get_post_meta($post_id, 'rank_math_facebook_title', true),
|
||||
'og_description' => get_post_meta($post_id, 'rank_math_facebook_description', true),
|
||||
'og_image' => get_post_meta($post_id, 'rank_math_facebook_image', true),
|
||||
'twitter_title' => get_post_meta($post_id, 'rank_math_twitter_title', true),
|
||||
'twitter_description' => get_post_meta($post_id, 'rank_math_twitter_description', true),
|
||||
'twitter_image' => get_post_meta($post_id, 'rank_math_twitter_image', true),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Get Yoast SEO data
|
||||
*/
|
||||
private function get_yoast_data($post_id) {
|
||||
return [
|
||||
'focus_keyword' => get_post_meta($post_id, '_yoast_wpseo_focuskw', true),
|
||||
'seo_title' => get_post_meta($post_id, '_yoast_wpseo_title', true),
|
||||
'meta_description' => get_post_meta($post_id, '_yoast_wpseo_metadesc', true),
|
||||
'canonical_url' => get_post_meta($post_id, '_yoast_wpseo_canonical', true),
|
||||
'noindex' => get_post_meta($post_id, '_yoast_wpseo_meta-robots-noindex', true),
|
||||
'nofollow' => get_post_meta($post_id, '_yoast_wpseo_meta-robots-nofollow', true),
|
||||
'og_title' => get_post_meta($post_id, '_yoast_wpseo_opengraph-title', true),
|
||||
'og_description' => get_post_meta($post_id, '_yoast_wpseo_opengraph-description', true),
|
||||
'og_image' => get_post_meta($post_id, '_yoast_wpseo_opengraph-image', true),
|
||||
'twitter_title' => get_post_meta($post_id, '_yoast_wpseo_twitter-title', true),
|
||||
'twitter_description' => get_post_meta($post_id, '_yoast_wpseo_twitter-description', true),
|
||||
'twitter_image' => get_post_meta($post_id, '_yoast_wpseo_twitter-image', true),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Generic method to update SEO data
|
||||
*/
|
||||
private function update_seo_data($post_id, $params, $post_type) {
|
||||
// Verify post exists and is correct type
|
||||
$post = get_post($post_id);
|
||||
if (!$post || $post->post_type !== $post_type) {
|
||||
return new WP_Error(
|
||||
'invalid_post',
|
||||
sprintf('%s not found', ucfirst($post_type)),
|
||||
['status' => 404]
|
||||
);
|
||||
}
|
||||
|
||||
$updated_fields = [];
|
||||
|
||||
// Update based on active SEO plugin
|
||||
if ($this->is_rank_math_active()) {
|
||||
$updated_fields = $this->update_rank_math_data($post_id, $params);
|
||||
} elseif ($this->is_yoast_active()) {
|
||||
$updated_fields = $this->update_yoast_data($post_id, $params);
|
||||
} else {
|
||||
return new WP_Error(
|
||||
'no_seo_plugin',
|
||||
'No supported SEO plugin found',
|
||||
['status' => 500]
|
||||
);
|
||||
}
|
||||
|
||||
return rest_ensure_response([
|
||||
'post_id' => $post_id,
|
||||
'post_type' => $post_type,
|
||||
'updated_fields' => $updated_fields,
|
||||
'message' => 'SEO metadata updated successfully'
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Update Rank Math data
|
||||
*/
|
||||
private function update_rank_math_data($post_id, $params) {
|
||||
$updated = [];
|
||||
$field_map = [
|
||||
'focus_keyword' => 'rank_math_focus_keyword',
|
||||
'seo_title' => 'rank_math_title',
|
||||
'meta_description' => 'rank_math_description',
|
||||
'canonical_url' => 'rank_math_canonical_url',
|
||||
'robots' => 'rank_math_robots',
|
||||
'og_title' => 'rank_math_facebook_title',
|
||||
'og_description' => 'rank_math_facebook_description',
|
||||
'og_image' => 'rank_math_facebook_image',
|
||||
'twitter_title' => 'rank_math_twitter_title',
|
||||
'twitter_description' => 'rank_math_twitter_description',
|
||||
'twitter_image' => 'rank_math_twitter_image',
|
||||
];
|
||||
|
||||
foreach ($field_map as $param_key => $meta_key) {
|
||||
if (isset($params[$param_key])) {
|
||||
update_post_meta($post_id, $meta_key, $params[$param_key]);
|
||||
$updated[] = $meta_key;
|
||||
}
|
||||
}
|
||||
|
||||
return $updated;
|
||||
}
|
||||
|
||||
/**
|
||||
* Update Yoast data
|
||||
*/
|
||||
private function update_yoast_data($post_id, $params) {
|
||||
$updated = [];
|
||||
$field_map = [
|
||||
'focus_keyword' => '_yoast_wpseo_focuskw',
|
||||
'seo_title' => '_yoast_wpseo_title',
|
||||
'meta_description' => '_yoast_wpseo_metadesc',
|
||||
'canonical_url' => '_yoast_wpseo_canonical',
|
||||
'og_title' => '_yoast_wpseo_opengraph-title',
|
||||
'og_description' => '_yoast_wpseo_opengraph-description',
|
||||
'og_image' => '_yoast_wpseo_opengraph-image',
|
||||
'twitter_title' => '_yoast_wpseo_twitter-title',
|
||||
'twitter_description' => '_yoast_wpseo_twitter-description',
|
||||
'twitter_image' => '_yoast_wpseo_twitter-image',
|
||||
];
|
||||
|
||||
foreach ($field_map as $param_key => $meta_key) {
|
||||
if (isset($params[$param_key])) {
|
||||
update_post_meta($post_id, $meta_key, $params[$param_key]);
|
||||
$updated[] = $meta_key;
|
||||
}
|
||||
}
|
||||
|
||||
return $updated;
|
||||
}
|
||||
|
||||
/**
|
||||
* Display admin notices
|
||||
*/
|
||||
public function admin_notices() {
|
||||
// Only show notices on the Plugins page to avoid clutter on every admin page
|
||||
$screen = get_current_screen();
|
||||
if ( ! $screen || $screen->id !== 'plugins' ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$rank_math_active = $this->is_rank_math_active();
|
||||
$yoast_active = $this->is_yoast_active();
|
||||
$woocommerce_active = $this->is_woocommerce_active();
|
||||
|
||||
if (!$rank_math_active && !$yoast_active) {
|
||||
echo '<div class="notice notice-warning is-dismissible">';
|
||||
echo '<p><strong>Airano MCP SEO Meta Bridge:</strong> ' . esc_html__( 'Neither Rank Math SEO nor Yoast SEO is detected. Please install and activate one of these plugins to enable SEO meta field access via REST API.', 'airano-mcp-seo-bridge' ) . '</p>';
|
||||
echo '</div>';
|
||||
} else {
|
||||
$active_plugins = [];
|
||||
if ($rank_math_active) $active_plugins[] = 'Rank Math SEO';
|
||||
if ($yoast_active) $active_plugins[] = 'Yoast SEO';
|
||||
|
||||
$supported_types = implode(', ', $this->supported_post_types);
|
||||
|
||||
echo '<div class="notice notice-success is-dismissible">';
|
||||
echo '<p><strong>Airano MCP SEO Meta Bridge v' . esc_html( self::VERSION ) . ':</strong> ' . esc_html( sprintf( 'Successfully registered meta fields for %s.', implode( ' and ', $active_plugins ) ) ) . '</p>';
|
||||
echo '<p><strong>' . esc_html__( 'Supported post types:', 'airano-mcp-seo-bridge' ) . '</strong> ' . esc_html( $supported_types ) . '</p>';
|
||||
|
||||
if ($woocommerce_active) {
|
||||
echo '<p><strong>WooCommerce:</strong> ' . esc_html__( 'Detected and supported. Product SEO fields are available via REST API.', 'airano-mcp-seo-bridge' ) . '</p>';
|
||||
}
|
||||
echo '</div>';
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 1.3.1 — Handle the per-user dismissal click for the migration
|
||||
* notice. Triggered before notices render so the dismissed state
|
||||
* is reflected on the same page load (no double-render after
|
||||
* redirect).
|
||||
*/
|
||||
public function handle_migration_notice_dismiss() {
|
||||
if ( ! isset( $_GET['airano_seo_bridge_dismiss_migration'] ) ) {
|
||||
return;
|
||||
}
|
||||
if ( ! is_user_logged_in() ) {
|
||||
return;
|
||||
}
|
||||
$nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
|
||||
if ( ! wp_verify_nonce( $nonce, 'airano_seo_bridge_dismiss_migration' ) ) {
|
||||
return;
|
||||
}
|
||||
update_user_meta( get_current_user_id(), self::MIGRATION_DISMISS_META, 1 );
|
||||
// Redirect back to a clean URL so the query parameter doesn't
|
||||
// linger in the address bar or history.
|
||||
$redirect = remove_query_arg( [ 'airano_seo_bridge_dismiss_migration', '_wpnonce' ] );
|
||||
if ( $redirect ) {
|
||||
wp_safe_redirect( $redirect );
|
||||
exit;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 1.3.1 — Persistent migration notice that points users to the
|
||||
* replacement plugin "Airano MCP Bridge" (slug `airano-mcp-bridge`).
|
||||
* Shown on every admin page so users don't miss it; permanently
|
||||
* dismissible per-user via a nonce-protected query param.
|
||||
*/
|
||||
public function render_migration_notice() {
|
||||
if ( ! current_user_can( 'install_plugins' ) ) {
|
||||
return;
|
||||
}
|
||||
if ( get_user_meta( get_current_user_id(), self::MIGRATION_DISMISS_META, true ) ) {
|
||||
return;
|
||||
}
|
||||
$install_url = wp_nonce_url(
|
||||
self_admin_url( 'plugin-install.php?s=airano-mcp-bridge&tab=search&type=term' ),
|
||||
'airano_seo_bridge_open_install'
|
||||
);
|
||||
$dismiss_url = wp_nonce_url(
|
||||
add_query_arg( 'airano_seo_bridge_dismiss_migration', '1' ),
|
||||
'airano_seo_bridge_dismiss_migration'
|
||||
);
|
||||
$msg = sprintf(
|
||||
/* translators: 1: replacement plugin name, 2: installed plugin name. */
|
||||
esc_html__( '%1$s supersedes %2$s — same SEO routes, plus media uploads, bulk meta, cache purge, transient flush, site health, audit hook, and thumbnail regeneration. Existing SEO functionality keeps working until you migrate.', 'airano-mcp-seo-bridge' ),
|
||||
'<strong>Airano MCP Bridge</strong>',
|
||||
'<strong>Airano MCP SEO Meta Bridge</strong>'
|
||||
);
|
||||
?>
|
||||
<div class="notice notice-info" style="border-left-color:#51b9f4;">
|
||||
<p style="margin-bottom:8px;"><?php echo wp_kses_post( $msg ); ?></p>
|
||||
<p style="margin-top:0;">
|
||||
<a href="<?php echo esc_url( $install_url ); ?>" class="button button-primary"><?php esc_html_e( 'Install Airano MCP Bridge', 'airano-mcp-seo-bridge' ); ?></a>
|
||||
|
||||
<a href="<?php echo esc_url( $dismiss_url ); ?>"><?php esc_html_e( 'Dismiss', 'airano-mcp-seo-bridge' ); ?></a>
|
||||
</p>
|
||||
</div>
|
||||
<?php
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// Initialize the plugin
|
||||
new SEO_API_Bridge();
|
||||
90
wordpress-plugin/airano-mcp-seo-bridge-deprecated/readme.txt
Normal file
90
wordpress-plugin/airano-mcp-seo-bridge-deprecated/readme.txt
Normal file
@@ -0,0 +1,90 @@
|
||||
=== Airano MCP SEO Meta Bridge ===
|
||||
Contributors: airano
|
||||
Tags: seo, rest-api, rank-math, yoast, mcp
|
||||
Requires at least: 5.0
|
||||
Tested up to: 6.9
|
||||
Requires PHP: 7.4
|
||||
Stable tag: 1.3.1
|
||||
License: GPLv2 or later
|
||||
License URI: https://www.gnu.org/licenses/gpl-2.0.html
|
||||
|
||||
Exposes Rank Math SEO and Yoast SEO meta fields via WordPress REST API for use with MCP servers and AI agents.
|
||||
|
||||
== Description ==
|
||||
|
||||
> **⚠️ This plugin has been superseded by [Airano MCP Bridge](https://wordpress.org/plugins/airano-mcp-bridge/) (slug `airano-mcp-bridge`).** The replacement carries the same SEO routes plus media uploads (bypass `upload_max_filesize`), bulk meta writes, cache purge, transient flush, site health, audit hook, and thumbnail regeneration. Existing installs of *Airano MCP SEO Meta Bridge* keep working — no breaking changes — but new installs should use *Airano MCP Bridge*. An admin notice in v1.3.1+ links to the replacement.
|
||||
|
||||
Airano MCP SEO Bridge is a WordPress plugin that exposes Rank Math SEO and Yoast SEO meta fields via dedicated REST API endpoints. This enables MCP servers, AI agents, and other applications to read and write SEO metadata programmatically for posts, pages, and WooCommerce products.
|
||||
|
||||
**Features:**
|
||||
|
||||
* **Rank Math SEO Support** — Full access to all Rank Math meta fields
|
||||
* **Yoast SEO Support** — Full access to all Yoast SEO meta fields
|
||||
* **WooCommerce Compatible** — Works with product post types
|
||||
* **Secure** — Requires WordPress Application Password and edit_posts capability
|
||||
* **Auto-Detection** — Automatically detects which SEO plugin is active
|
||||
* **Status Endpoint** — Dedicated API endpoint for plugin and SEO detection
|
||||
* **Zero Configuration** — Works out of the box after activation
|
||||
|
||||
**REST API Endpoints:**
|
||||
|
||||
* `GET/POST /wp-json/airano-mcp-seo-bridge/v1/posts/{id}/seo` — Post SEO data
|
||||
* `GET/POST /wp-json/airano-mcp-seo-bridge/v1/pages/{id}/seo` — Page SEO data
|
||||
* `GET/POST /wp-json/airano-mcp-seo-bridge/v1/products/{id}/seo` — Product SEO data (WooCommerce)
|
||||
* `GET /wp-json/airano-mcp-seo-bridge/v1/status` — Plugin status and SEO detection
|
||||
|
||||
**Designed for [MCP Hub](https://github.com/airano-ir/mcphub)** — the AI-native management hub for WordPress and self-hosted services.
|
||||
|
||||
== Installation ==
|
||||
|
||||
1. Upload the `airano-mcp-seo-bridge` folder to `/wp-content/plugins/`
|
||||
2. Activate the plugin through the 'Plugins' menu in WordPress
|
||||
3. Ensure either Rank Math SEO or Yoast SEO is active
|
||||
4. The REST API endpoints are now available
|
||||
|
||||
== Frequently Asked Questions ==
|
||||
|
||||
= Which SEO plugins are supported? =
|
||||
|
||||
Rank Math SEO and Yoast SEO. The plugin auto-detects which one is active.
|
||||
|
||||
= Does it work with WooCommerce? =
|
||||
|
||||
Yes. Product SEO endpoints are available when WooCommerce is active.
|
||||
|
||||
= How is authentication handled? =
|
||||
|
||||
All endpoints require WordPress Application Password authentication and the `edit_posts` capability. POST requests require the same capability.
|
||||
|
||||
= Can I use this without MCP Hub? =
|
||||
|
||||
Yes. The REST API endpoints work with any application that can make HTTP requests with proper WordPress authentication.
|
||||
|
||||
== Changelog ==
|
||||
|
||||
= 1.3.1 =
|
||||
* Migration notice — this plugin is now superseded by [Airano MCP Bridge](https://wordpress.org/plugins/airano-mcp-bridge/). A dismissible admin notice links to the replacement; SEO routes and behaviour are otherwise unchanged so existing installs continue to work without modification. Per-user dismissal is honoured via a nonce-protected query parameter and persisted in `user_meta`.
|
||||
|
||||
= 1.3.0 =
|
||||
* Added REST API endpoints for posts, pages, and products (GET/POST operations)
|
||||
* Added authentication requirement for all endpoints
|
||||
* Fixed rank_math_title meta key registration
|
||||
|
||||
= 1.2.0 =
|
||||
* Enhanced WooCommerce product support
|
||||
* Improved MariaDB compatibility
|
||||
|
||||
= 1.1.0 =
|
||||
* Added status endpoint for plugin detection
|
||||
* Improved error handling
|
||||
|
||||
= 1.0.0 =
|
||||
* Initial release with Rank Math and Yoast SEO support
|
||||
|
||||
== Upgrade Notice ==
|
||||
|
||||
= 1.3.1 =
|
||||
This plugin has been superseded by Airano MCP Bridge. v1.3.1 only adds a migration notice that links to the replacement; existing SEO routes are unchanged. Recommended: install Airano MCP Bridge from the directory and deactivate this plugin once migrated.
|
||||
|
||||
= 1.3.0 =
|
||||
GET endpoints now require authentication (edit_posts capability). Update your API clients if needed.
|
||||
Reference in New Issue
Block a user