Discovery endpoints: /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server
Streamable HTTP transport (MCP 2025-11-25) as primary transport
Legacy SSE transport (/sse + /messages) for older client versions — compatible with all clients, not restricted by User-Agent
Mcp-Session-Id response header on initialize for session tracking (required by Cursor)
X-Accel-Buffering: no on SSE responses for nginx compatibility
Auth validation on session termination (DELETE /mcp)
Activity logging with client detection (Claude, ChatGPT, Gemini, Cursor, Windsurf, and others), storing each call’s parameters/result locally for audit purposes with sensitive-looking values redacted automatically
IP allowlist support
Admin dashboard with today’s success/fail stat cards, settings page, and activity log with CSV export
WP Dashboard widget (7-day activity bar chart)
WooCommerce (33 tools), ACF (3 tools), Elementor (6 tools), and Gravity Forms (2 tools) integrations — activate automatically when those plugins are present
Developer API: bcs_mcp_register_tool() helper and bcs_mcp_tools filter for custom tools
No tool creates new WordPress users; wp_update_user no longer accepts a role parameter — use wp_assign_user_role (requires promote_users) for role changes
Clean uninstall: removes all plugin tables, options, and transients with no orphaned data
Translation-ready: full .pot file included in /languages for translators
