Fixed: Admin status page was displaying version 0.4.0 instead of the actual plugin version. Changed hardcoded $version = ‘0.4.0’ class property to use GOLDTWMCP_VERSION constant.
0.5.2 – 2026-06-01
Fixed: Replaced deprecated mysql2date() calls with gmdate() in OAuth tokens admin view (deprecated since WordPress 5.3).
0.5.1 – 2026-06-01
Fixed: Settings link in plugins list pointed to non-existent page slug goldtwmcp — corrected to goldt-webmcp-bridge.
Fixed: Two unescaped echo calls in admin status page wrapped with esc_html().
Removed: Unnecessary WooCommerce recommendation notice (WooCommerce is not required by this plugin).
0.4.6 – 2026-05-20
Fixed (security): searchPosts and searchPages now hardcode post_status=publish instead of ‘any’. WP_Query with ‘any’ bypasses WordPress capability checks entirely and returns all posts including other users’ drafts — even to subscribers. Reverted to explicit ‘publish’.
0.4.5 – 2026-05-19
Fixed: Copy Code button on the OAuth authorization code page (OOB) was silently failing — the copyCode() JavaScript function was missing. Added with navigator.clipboard API and execCommand fallback.
Added: webmcp-master.ai added to the supported platforms list on the /ai-connect/ info page.
0.4.4 – 2026-05-19
Fixed: WordPress.org review — MyMemory external service URLs updated to working addresses.
Fixed: WordPress.org review — searchPosts and searchPages now use native WordPress capability filtering (post_status => ‘any’): subscribers see only published posts, authors see their own drafts, editors/admins see all. The status parameter has been removed from the tool schema since it is no longer needed.
Fixed: WordPress.org review — getPost and getPage now enforce current_user_can(‘read_post’) for non-published content, preventing unauthorized access to drafts/private pages by ID.
0.4.3 – 2026-05-19
Fixed: wp plugin check warnings — renamed unprefixed view variables to goldtwmcp_ prefix; wrapped $table in esc_sql() in schema-introspection queries; suppressed false-positive PluginCheck.Security.DirectDB warnings on whitelisted SQL fragments.
0.4.2 – 2026-05-18
Fixed: PHPCS WordPress coding standards compliance — resolved 16 errors and 3 warnings across class-database.php, class-token-registry.php, class-oauth-server.php, and admin-token-registry.php.
0.4.1 – 2026-05-13
Added: Manifest now exposes auth.registered_clients — an object mapping each registered OAuth client_id to its display name, so AI agents can discover which clients this site accepts without an extra round-trip.
Added: New default OAuth client webmcp-master (WebMCP Master) with full scopes (read, write, delete, manage_users) — seeded on fresh installs and idempotently inserted on upgrade for existing sites.
Schema: Database upgrade routine 1.4.0 — inserts the webmcp-master client when missing.
0.4.0 – 2026-05-11
Added: Token Registry — sidecar table ({prefix}aiconnect_token_registry) records every issued/refreshed token (only the 16-char prefix is stored, not the full secret), tracking issued_at / expires_at / last_used_at / revoked_at / revoked_by / source / ip_address.
Added: Admin REST endpoints GET /wp-json/goldt-mcp/v1/admin/tokens and DELETE /wp-json/goldt-mcp/v1/admin/tokens/{id} (manage_options only).
Added: WP-Admin sub-page “AI Connect → Token Registry” to view and revoke active tokens with active / revoked / all filters.
Improved: Bearer-auth lookups now update last_used_at and reject tokens revoked in the registry (defense in depth).
Improved: Token revocation is now a soft-delete (revoked_at + revoked_by) instead of a hard delete; refresh-token rotation also flows through the registry.
Schema: Database upgrade routine 1.3.0 — creates the new table on activation and on upgrade, with column-by-column ALTER fallback for partial pre-existing installs.
0.3.3 – 2026-05-06
Fixed: Removed “Powered by AI Connect” credit link from public-facing info page (WordPress.org compliance)
0.3.2 – 2026-04-12
Fixed: “Revoke All Tokens” button now actually revokes all active tokens in the database
Fixed: Tool names now use lowercase module prefix (wordpress.searchPosts) per WebMCP protocol spec
Improved: CSS/JS extracted to assets/ using wp_enqueue_style/wp_enqueue_script (WordPress.org compliance)
Improved: Admin settings page cleaned up – removed irrelevant status rows
Added: External Services disclosure for MyMemory API (WordPress.org compliance)
0.3.0
Added: Translation Provider setting (AI Self-Translate, MyMemory API, or Disabled)
Added: TranslationModule with MyMemory API integration (translate, getSupportedLanguages)
Added: Dynamic manifest instructions to prevent AI agents from inventing capabilities
Improved: OAuth client_id is now optional (defaults to ‘claude’)
Improved: Fuzzy client_id matching (recognizes variants like gemini_client, claude_ai)
Improved: Specific OAuth error messages instead of generic errors
0.2.1 – 2026-03-06
Security: Added OAuth scope validation – users must explicitly grant permissions for each tool
WordPress.org Compliance: Fixed inline scripts/styles – moved to wp_enqueue_script/style
WordPress.org Compliance: Removed /status endpoint per security review
WordPress.org Compliance: Updated .distignore to exclude vendor development files
Fixed: Updated Bearer_Auth endpoint paths to current plugin slug
