- Added update_webhook and delete_label tools (58 total Gitea tools)
- 97 unit tests (test_gitea_plugin.py)
- Gitea now public for all users (DEFAULT_PUBLIC_PLUGINS)
- Fixed merge_pull_request optional field handling
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Fix tool count: 596→565 (OpenPanel reduced from 73→42 in v3.4.0)
- Update DOCKER_README: dashboard-first site configuration
- Update .env.example version to 3.4.0
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove env-based site discovery from SiteManager and ProjectManager
- Unify admin and user OAuth Clients into single role-based page
- Update all documentation to reflect DB-based site management
- Clean up env.example, README, ARCHITECTURE docs
- Improve Projects page empty state with link to My Sites
- Remove obsolete env discovery tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
OpenPanel product analytics plugin fully reviewed, tested, and published.
Works with both self-hosted and cloud (openpanel.dev) instances.
- 42 tools: event tracking, data export, analytics, project/client management
- All tools use public REST APIs (Track, Export, Insights, Manage)
- Client modes: write (tracking), read (analytics), root (full access)
- Service page with description, setup notes, WordPress plugin download
- Dynamic URL hints in Add Site form
- 62 unit tests
- ENABLED_PLUGINS default now includes openpanel
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- fix(seo): REST API namespace seo-api-bridge/v1 → airano-mcp-seo-bridge/v1
- fix(config): add transport type field (streamableHttp/http) to config snippets
- feat(dashboard): support section for OAuth users, connect page guidance
- docs: hosted option, test count 481, WP plugin link, OAuth env vars, per-user endpoints
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Three bugs fixed for social-login users connecting Claude.ai via OAuth:
1. User OAuth clients now allow 'admin' scope by default — previously
defaulted to ['read', 'write'], causing invalid_scope when Claude.ai
requests 'admin' scope during authorization.
2. Fix JWT tokens with 'aud' claim being rejected by middleware — when
Claude.ai sends RFC 8707 resource parameter, the issued JWT gets an
aud claim. validate_access_token() now sets verify_aud=False to
prevent PyJWT InvalidAudienceError from silently marking valid tokens
as invalid in _is_valid_token().
3. Fix NameError in user_mcp_handler tools/call scope check — key_info
was only defined in the mhu_ auth path but referenced in tools/call
for both paths. Replaced with key_scopes variable set by both mhu_
and JWT auth paths.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Enable dashboard users (GitHub/Google social login) to approve OAuth
consent without needing to create and paste an API key. Adds mhu_ user
key support, session-based consent with __session__ marker, social login
links on the consent page, and return URL redirect after login.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- SUG-6: Replace auto-closing inline banner with persistent modal on Connect
page — key stays visible until user clicks "Done"
- SUG-4: Filter health_metric_recorded/health_check from project detail activity
- WooCommerce: Accept consumer_key/consumer_secret credentials (preferred) with
username/app_password fallback; fix health check to use WC endpoint and creds
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- BUG-12: ENCRYPTION_KEY validation now exits with sys.exit(1) on invalid key
- BUG-11: WP Advanced health check adds authenticated fallback with auth_valid
- BUG-7: Catch-all GET route serves styled 404 HTML instead of plain text
- BUG-10: Recent Activity fetches extra entries before filtering, fixes None project
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bug fixes (ordered by priority):
- BUG-14 (P1): Fix ImportError in per-user MCP endpoint
- BUG-8 (P2): Raise clear error when PUBLIC_URL missing for OAuth
- BUG-12 (P3): Validate ENCRYPTION_KEY at startup
- BUG-13 (P4): Handle stale JWT gracefully on site creation
- BUG-11 (P5): Add auth validation to WordPress health checks
- BUG-15 (P6): Fix copy button showing Python repr (dict method shadow)
- BUG-1 (P7): Dynamic version from pyproject.toml instead of hardcoded
- BUG-5 (P8): Fix server mode default (sse → streamable-http)
- BUG-9 (P9): Plugin-specific example tools in endpoint instructions
- BUG-4 (P10): Fix settings page sidebar RBAC (session type mismatch)
- BUG-6 (P11): Show real plugin descriptions instead of 'No description'
- BUG-2 (P12): Remove stale 'phase: X.3' from system info
- BUG-10 (P13): Guard timestamps against None in Recent Activity
- BUG-3 (P14): Guard timestamps against None in audit logs
- BUG-7 (P15): Styled 404 page instead of plain text
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Major release introducing the Live Platform architecture:
- SQLite database backend with async operations and migrations (E.1)
- AES-256-GCM credential encryption with HKDF key derivation (E.1)
- OAuth Social Login with GitHub and Google (E.2)
- Site management API with encrypted credential storage (E.3)
- Per-user MCP endpoints at /u/{user_id}/{alias}/mcp (E.3)
- User API keys with bcrypt hashing (E.3)
- Auto-generated config snippets for 5 MCP clients (E.3)
- Dashboard: dark/light mode, RBAC, My Sites, Connect page
- Active background health checks
- 452 tests (up from 303), all passing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
WordPress client improvements:
- Add ConnectionError exception for network-level failures
- Differentiate DNS, SSL, timeout, and connection refused errors
- Add retry with exponential backoff for transient errors (502, 503, 504, 429)
- Auth/config errors are never retried
- Add request timeout (30s default)
Health check improvements:
- Detect REST API disabled (403/404 on /wp-json)
- Classify errors by type: dns_failure, ssl_error, timeout, connection_refused
Bare except cleanup:
- Replaced all bare except: with except Exception: across 12 files
Tests: 303 passed (13 new tests for error handling)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- smithery.yaml: Smithery.ai configuration for PyPI install via uvx
- server.json: Official MCP Registry manifest (io.github.airano-ir/mcphub)
- README.md: add <!-- mcp-name --> verification tag for MCP Registry publishing
Part of D.4 — MCP Registry submissions
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
load_dotenv() without usecwd=True fails for mcphub.exe because
find_dotenv() walks the call stack and searches from site-packages/
instead of the user's working directory. Bump to v3.0.4.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- routes.py: fallback reads from importlib.metadata instead of hardcoded
- login.html: remove hardcoded default version
- README: use dynamic GitHub Release badge from shields.io
- DOCKER_README: remove hardcoded version string
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
PyPI users running `mcphub` had to manually export env vars because
server.py didn't call load_dotenv(). Docker users were unaffected
since docker-compose loads .env automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The health monitor's _basic_site_health_check() used split("_", 1) to parse
project IDs like "wordpress_advanced_site1", incorrectly yielding
plugin_type="wordpress" and site_id="advanced_site1". Now uses SiteManager's
list_all_sites() for proper full_id lookup, and creates a temporary plugin
instance for proper health checks (REST API, WP-CLI) instead of basic HTTP.
Also fixes the same split bug in SiteManager.get_effective_path_suffix().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- docker-compose: OAuth vars commented out by default
- env.example: added WordPress Advanced section with CONTAINER docs
- DOCKER_README: added CONTAINER to env var table with usage notes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- docker-compose: ports "8000:8000" active by default
- README: fix /wordpress_advanced → /wordpress-advanced
- DOCKER_README: add version 3.0.1
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- WP Advanced health_check uses aiohttp to /wp-json/ directly
- SEO Bridge admin notice only on Plugins page
- SEO Bridge README.md consolidated, changelog complete
- OpenPanel Self-Hosted README.md created
- Dashboard sidebar uses actual logo.svg
- docker-compose: expose instead of ports for Coolify
- README: version badge, wordpress_advanced endpoint, env var table
- Docs: SSE references fixed to streamable-http
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Separate plugin identity for WordPress.org submission
- Text domain, folder, and file renamed to openpanel-self-hosted
- Description updated as fork of official OpenPanel plugin
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Health monitor now uses SiteManager for complete site discovery
- SEO Bridge: GPLv2+ license, Tested up to 6.9, fix escaping
- OpenPanel: fix wp_unslash, reduce tags, update branding
- Add logo.svg favicon, static file serving, plugin ZIPs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix SEO API Bridge branding, meta keys, route namespaces, GET auth
- Create WordPress.org-compatible readme.txt
- Fix transport types across all docs (streamableHttp/http, not sse)
- Add WordPress Plugin Requirements section to README
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CI: Fix black formatting in core/site_registry.py
Code: list_projects uses SiteManager, WP Advanced health uses REST API
Docs: Fix transport types, endpoint guide, env var reference for all plugins
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
