Settings fixes:
- MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings
table (DB > ENV > default), so dashboard/settings changes apply without
restart. Sync cache refreshed on every save or delete.
- /api/me reports the live DB value for max_sites_per_user.
Admin improvements:
- Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS).
- Admin Overview now shows platform stats: registered users, new users (7d),
total user sites, available tools.
Plugin cleanup:
- Appwrite and Directus plugins removed from the active registry (8 plugins
now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase,
OpenPanel, Coolify). Plugin code is retained for future re-enabling.
- Settings page plugin visibility list updated to match.
Mobile onboarding:
- Stepper steps on narrow viewports stack vertically with correct full border
and rounded corners on each step.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Major release introducing the Live Platform architecture:
- SQLite database backend with async operations and migrations (E.1)
- AES-256-GCM credential encryption with HKDF key derivation (E.1)
- OAuth Social Login with GitHub and Google (E.2)
- Site management API with encrypted credential storage (E.3)
- Per-user MCP endpoints at /u/{user_id}/{alias}/mcp (E.3)
- User API keys with bcrypt hashing (E.3)
- Auto-generated config snippets for 5 MCP clients (E.3)
- Dashboard: dark/light mode, RBAC, My Sites, Connect page
- Active background health checks
- 452 tests (up from 303), all passing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- routes.py: fallback reads from importlib.metadata instead of hardcoded
- login.html: remove hardcoded default version
- README: use dynamic GitHub Release badge from shields.io
- DOCKER_README: remove hardcoded version string
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Health monitor now uses SiteManager for complete site discovery
- SEO Bridge: GPLv2+ license, Tested up to 6.9, fix escaping
- OpenPanel: fix wp_unslash, reduce tags, update branding
- Add logo.svg favicon, static file serving, plugin ZIPs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Previously any Bearer token (even invalid) passed the HTTP middleware and
got a session with access to tools/list and resources/list. Now the
OAuthRequiredMiddleware validates tokens against master key, API keys,
and OAuth JWT before allowing initialize.
Also fixes:
- WordPress Advanced env prefix: WORDPRESS_ → WORDPRESS_ADVANCED_ in docs
- Bump version to 3.0.1
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Show full temporary API key in logs (not masked) so users can log in
- Redirect root URL / to /dashboard (was 404)
- Add setup guidance and docs link to login page
- Make footer version dynamic (read from pyproject.toml)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Templates were at project root (templates/) which is outside the Python
package, so `pip install mcphub-server` would not include them. Moved to
core/templates/ and updated path references in server.py and
core/dashboard/routes.py. Also added py-modules for server.py and
server_multi.py to pyproject.toml.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
