Agentimus

1.23.0

• New — Agent access alerts on every visit. The nav pill now re-lights whenever an agent authenticates or acts — not only the first time ever — and the log lists the newest activity first. The screen also gained its proper page header.
• New — Your voice, everywhere AI writes. If your WordPress defines Content Guidelines (the experimental brand-voice and copy-rules feature), Agentimus honors them automatically: Draft, Suggest and Fix with AI follow them, and AI agents connected over MCP see them right on the draft/edit tools — so agents write in your voice too. Nothing to configure; your guidelines never appear on any public endpoint.
• Improved — Markdown twins ready for WordPress 7.1. The new Tabs block converts with each tab clearly labelled, Playlists become a readable track list, tables come out as real Markdown tables instead of run-together text, and preformatted blocks keep their line breaks — diagrams built in the visual editor no longer flatten to one line.
• Fixed — Full description on WordPress.org. The plugin directory folds extra readme sections into the description before applying its word limit, so the listing was still truncated; two sections moved into the FAQ and everything shows again.

1.22.2

• Fixed — Clicking a summary tile now lands the section in view. On the Discovery screen, jumping to Providers, Capabilities, APIs or Tools scrolled the section’s heading up under the pinned header; it now lands just below it, so you see the heading you asked for.
• Fixed — No more “401” in the browser console. The MCP server settings card checked whether the server was answering by pinging its sign-in-only endpoint without credentials — a harmless 401 that the browser nonetheless logged as a red error on every admin page. It now asks over an authenticated route instead: same “Running” status, quiet console.
• Improved — A tidier Discovery screen. The discovery documents were listed in three places at once; the endpoint card no longer repeats them. The always-visible rail keeps its quick links, and the “Well-known documents” section keeps the full inventory with each file’s generated/managed status — each with its own job.
• Improved — AI Visibility explains its own keys. The settings now say, in place, why AI Visibility connects to each engine directly instead of using WordPress’s shared AI connector: a visibility check is graded on the sources each engine cited and compares several engines at once — neither of which the shared connector can provide.

1.22.1

• New — Connected AI tools can write now — each step behind its own switch. The MCP server card grows a trust ladder. A second switch (off by default) gives connected agents five write tools: draft a new post or page, edit an existing one, set a page’s AI description and its Topics for AI, and apply a Readiness fix — where “fix” means exactly what the readiness check itself recommends, and only ever enabling a plugin feature; a fix that needs your judgement or a server change refuses honestly and names the manual step instead. A third switch decides publishing: while it’s off, an agent can only leave drafts and pending posts for your review. Every write runs as the WordPress user behind the key — an author’s key can’t do editor things, a new category still needs the category permission, exactly as in wp-admin — and every write is recorded under More → Agent access, attributed to the key that made it. With the writes switch off the tools aren’t just refused, they don’t exist on any surface — MCP, the abilities endpoint, discovery — so “read-only” stays literally true; and switching the MCP server off switches writes (and publishing) off with it, so the ladder can never disagree with itself.
• New — An agent can dress a post completely. Creating and editing now also carry categories and tags (by name, with wp-admin’s exact permission rules: any author can create a tag, only category managers can create a category) and the featured image — an attachment you already have, or an image URL the plugin imports into your media library, alt text included, gated on the user’s upload permission and your site’s file-type and size rules. Draft it, dress it, leave it for review: no wp-admin visit required.
• New — The MCP card connects your AI tool for you. Pick the tool you use — Claude Desktop, ChatGPT/Codex, Claude Code — and the card mints a named application password in one click (or takes one you saved), hands you a finished setup with the endpoint and login already woven in, and proves the connection with a built-in test.
• Improved — The score card says how much, not just what’s next. Each rung now carries a quiet “n to fix” count, an unmeasured Cited rung says “not measured yet” instead of a dash that read as broken, and the “Next:” line explains why in a tooltip. Grading also stops nagging about pages nobody authored — a shop’s cart and checkout pages, and container pages whose only content is a plugin’s shortcode — so the Optimize rung measures your writing, not your plugins’.
• Fixed — The Discovery hub explains its own numbers. Its tiles reconcile what your site has with what anonymous agents are shown — “3 providers — 1 public · 2 sign-in only” instead of a bare “1” above a three-row list. The “MCP & tools” card now states one total and splits it by provider — “Agentimus abilities: 14 · Core abilities: 2”, adding up in plain sight — with the doors that serve each group (the MCP server, the Abilities API route) named on the group itself and their endpoints listed without counts, so there are no two overlapping numbers left to wrongly add together. And the card no longer claims “no agent tools yet” when every tool is simply sign-in-only and deliberately kept out of the public documents. One genuine counting bug fell out of the recheck too: an ability hidden from REST — which no agent can run remotely — no longer inflates any tool count, so the numbers shown are the numbers the endpoints actually answer. And the Content types setting now previews, live, exactly which read capabilities your selection advertises — a ticked type brings its public taxonomies along (posts add categories and tags) — so the capabilities number finally traces back to the switch that produces it.
• Fixed — WebMCP follows the browser’s move. Chrome relocated the WebMCP entry point (navigator.modelContext → document.modelContext); the search tool now registers on the current name and still recognises the old one, so it keeps working as browsers retire the alias.

1.22.0

• New — An MCP server, one switch, nothing extra to install. Turn on Settings → Discovery → MCP server and AI tools you already use — Claude Code, Claude Desktop, Cursor, Codex — can talk to your site over the Model Context Protocol and run Agentimus’s nine read-only tools: readiness, AI traffic, request log, bot identification, and the page/JSON-LD/Markdown previews. The WordPress MCP Adapter library now ships inside the plugin and is loaded only when you opt in — with the switch off, nothing is loaded and no endpoint exists. Nothing becomes public: every call must sign in with a WordPress login (an application password works), every tool keeps the same permission checks as the admin screen it comes from, every call is recorded under More → Agent access — and switching it off disconnects connected tools immediately. To keep the surface exactly what you opted into, Agentimus also keeps the library’s generic “run any ability” server switched off. Needs WordPress 6.9+ (the Abilities API); off by default. Full transparency: the settings card also tells you what an application password really is — a login for your whole REST API, not just this server — and recommends one password per tool, on a user with only the permissions it needs.
• Fixed — The MCP wiring had quietly gone stale — in two places. The adapter library renamed its transport class some versions ago; Agentimus still asked for the old name, so even a site that had installed the adapter by hand got no server at all, silently. And the mcp.json manifest read each server’s tool list with equally outdated accessors, so a running server was advertised as having “0 tools” and its per-server card refused to serve. Both fixed: the manifest now lists every server’s real tools and links a card for each.
• New — Agent access now says who. Every row carries the user and the named application password behind it — “by anna · app password “zapier”” — resolved live from your own users and keys, so a renamed key shows its current name, a revoked one says “since revoked”, and a deleted user’s row says that too instead of a bare number. Password-lifecycle rows say “on anna’s account”, because that’s what is actually recorded — the key’s owner, not necessarily who clicked. Nothing new is stored: no IP addresses, no identities; the names are looked up at view time.
• Changed — The dashboard’s 7- and 30-day numbers are whole calendar days now. They used to be rolling windows ending at the current second, which meant they could visibly shrink between midnights as week-old hits aged out — watched live under auto-refresh, that read as data loss. Every window is now counted in whole calendar days (UTC), the same clock as the Today tile and the daily chart beneath them; numbers move only when a hit arrives or at midnight UTC. The tiles may read slightly higher after updating — the window now includes its first day’s early hours, which rolling had already dropped.

1.21.2

• Changed — Answering a page’s own URL with Markdown is now off by default. Agentimus could hand back the Markdown edition of a page from the page’s own address when a client asked for it (Accept: text/markdown). One address with two possible answers is only safe if every cache in front of your site respects “never store this” — and a common CDN setup (Cloudflare “Cache Everything” with an Edge TTL) overrides that instruction, stores the Markdown under the page’s address, and then serves it to human visitors. It hit this plugin’s own author: an AI crawler found a post seconds after publication, asked for Markdown, and readers got raw Markdown until the cache expired. No header an origin can send prevents that, and the person who finds out is your reader — so the convenience is now opt-in. Nothing is lost: every page still has its Markdown twin at /its-slug.md, a separate address a cache can never confuse with your article, and agents are still pointed to it from the page’s Link header, from llms.txt and from the discovery documents. If your caching is sound (no CDN, or one that honours no-store), turn it back on with one line: add_filter( ‘agentimus_negotiate_markdown’, ‘__return_true’ );

1.21.1

• Fixed — A CDN could serve the Markdown copy of a page to human visitors. Agentimus can answer a page’s own URL with its Markdown twin when a client asks for it (Accept: text/markdown), and marks that answer “never cache me”. A CDN configured to override origin cache headers (Cloudflare “Cache Everything” with an Edge TTL, and the equivalent elsewhere) ignored that, stored the Markdown under the page’s URL, and served it to everyone — so a freshly published post, fetched first by an AI crawler, could render as raw Markdown for readers until the cache expired. The no-store instruction is now sent in the CDN-specific headers an edge honours in preference to Cache-Control, so the Markdown answer can’t be stored. If your CDN caches it anyway, the new agentimus_negotiate_markdown filter turns page-URL negotiation off entirely; the .md address of every page keeps working, and agents find it exactly as before (it’s advertised in the page’s Link header, in llms.txt and in the discovery documents).
• Fixed — Markdown is no longer served to clients that prefer HTML. The Accept header was matched with a plain substring test, so a request saying “HTML first, Markdown if you must” (text/html;q=0.9, text/markdown;q=0.8) was answered with Markdown. Quality values are now honoured as the standard requires: Markdown is served only when the client actually ranks it above HTML, and a tie goes to HTML. No browser sends text/markdown at all, so no browser can be answered with it.

1.21.0

• New — Manage every client decision in one place. Settings → AI access gains a “Manage clients” dialog: three tabs — Blocked, Allowed, Ignored — showing each client’s identity (for known crawlers), when you decided, and a one-click undo (Unblock, Un-trust, Un-ignore). It’s also the first UI over the review queue’s “Ignore”, which previously could not be seen or reversed anywhere. Decisions made from this release on carry their date; older entries simply show none rather than an invented one.
• New — Click any day’s bar for that day’s report. Both dashboard charts now open a day report. Endpoint activity had one already — it gains a fixed size (no growing mid-load), a clear loading state, and day-to-day arrows. Traffic from AI gets a brand-new one: click a day and see which assistant sent visitors to which page, with the same styled tooltips and navigation. Dialogs close on Esc or the Close button only, so a stray click can’t silently drop the report you were reading.
• New — The admin dresses to match your colour scheme. If your WordPress admin runs Coffee, Ectoplasm, Midnight or any other colour scheme, Agentimus’s score card, buttons and chips now wear that scheme’s colour — hand-tuned per scheme so the text always stays readable. The default scheme keeps the design you know; a filter (agentimus_match_admin_scheme) turns matching off.
• Fixed — Your own verification clicks no longer count as agent traffic. “Verify live” and the exposed-files scan fetch your public endpoints anonymously on purpose — they grade what an agent receives — so each run used to log a handful of “Browser” hits against your own site. Those fetches now carry a short-lived, server-minted token that keeps them out of the visit log; a crawler can’t mint or reuse one to hide itself.
• Improved — Unknown crawlers are named more honestly. A client that declares its own name (“ethicrawl/0.1 …”) now appears in the activity feed under that name instead of a vague “Other bot”, and a home-page URL declared in its User-Agent is recognised whether or not it uses the “+https://” convention — so the review queue can show you where a new crawler leads instead of claiming it declares nothing.
• Improved — A heads-up when blocking is on but verification is off. Blocking matches names, and real search engines are always let through — so a blocked bot could dodge every rule by calling itself “Googlebot”. The blocking section now says so, and points at the reverse-DNS verification toggle that closes the loophole.
• Fixed — Esc now closes every dialog, every time. Clicking outside a dialog used to leave Escape unresponsive in six of them (Agent preview among others); all dialogs now listen for Esc for as long as they’re open.
• Fixed — the admin footer’s version line now aligns exactly with the content edges, and the plugin’s uninstall cleans up the new decision-dates option along with everything else.

1.20.1

• Fixed — Three read-only abilities can now be run by an outside AI agent, not just listed. Agentimus’s readiness score, AI Visibility results and exposed-files check take no arguments — and a no-argument call through WordPress’s abilities REST endpoint was rejected before it ran, so an assistant could see these abilities but never actually use them. They now run as intended. Your own admin screens were never affected; this only touched external agents calling in.

1.20.0

• New — Agent access. A new screen (More → Agent access) records who authenticates to, and acts on, the machine surface Agentimus creates — the other half of the activity log, which shows who reads it. It notes when an application password (the key a program uses to reach WordPress as you) is created, first used, renamed or revoked; when one of WordPress’s abilities is run; and when a request is refused, or probes for abilities that don’t exist. It’s a record, not a guard — it never blocks anything — and it keeps Agentimus’s no-personal-data promise: no IP addresses, so it names the key that was used, not the person, and it sees machine logins only (a normal password sign-in never appears). A brand-new application password is the one worth a second look — it keeps working even after you change your password. On by default; nothing to configure.
• Security — The discovery documents now tell agents the truth about your abilities. The nine read-only abilities Agentimus registers require a signed-in administrator, yet the public discovery file described them as needing no authentication and published their full descriptions and input/output schemas to anyone who asked. Sign-in-only abilities are no longer advertised to anonymous callers (an agent holding real credentials still discovers them the proper way), every document now reports the correct authentication, and turning a resource off now removes it from every served file, including mcp.json.
• Security — A firmer cap on what a spoofed crawler can log. A flood pretending to be a known crawler — a forgeable name — could write far more to the activity log than intended, and on sites without a persistent object cache, a database write on every request. Recognised crawlers now share one generous budget instead of a budget per name, so faking names no longer multiplies it, and the write pressure is bounded.
• Security — “Draft with AI” and “Fix with AI” are now rate-limited per user. These buttons make a paid AI call, so a per-minute cap stops a runaway script (or a compromised account) from running up your AI bill. A person clicking the buttons never notices it.
• Fixed — Machine-readable output stays clean. A line break in a page title could forge a stray entry in llms.txt; titles and other values are now kept to a single line. The full-text file (llms-full.txt) had a size budget sitting exactly on the common object-cache limit, so on some hosts it silently never cached and was rebuilt on every request — the budget now leaves headroom.
• Improved — Multisite reliability. On a network install, activating no longer risks writing one site’s page-address rules into another (which could 404 a sub-site’s posts); deleting a sub-site now removes Agentimus’s tables with it; and uninstalling cleans up every site, not just the first thousand.
• Fixed — a malformed ?author[]= request no longer triggers a PHP notice, and several small internal flags are now loaded more efficiently on every request.

Earlier versions

The full changelog for every release lives in the plugin repository: https://github.com/heera/agentimus/blob/main/CHANGELOG.md