WordPress Plugins
GuardPress Royal AI Firewall ForgeCache SiteVault SiteVault Lite SEObolt Royal Links Royal Affiliates FormForge Royal MCP Pro Royal MCP Royal SMTP Royal Access
Free Tools
SERP Preview Schema Validator Meta Tag Checker SSL Checker HTTP Headers Site Scanner Plugin Scanner Royal Links (Chrome) Royal Access (Chrome)
Claude Skills
Skills Library Divi Claude Skill WooCommerce Claude Skill Elementor Claude Skill Submit a Skill
Resources
Resources Hub Blog Switch to Royal Plugin Graveyard
Pricing Support My Account Cart
Royal MCP · Changelog

Royal MCP changelog

Every Royal MCP release, newest first: what’s new, what improved and what was fixed. Each update installs from WordPress.org like any other plugin.

1.5.12

Latest
  • NewAI clients sign in at Royal MCP's own address, so Claude and ChatGPT connect even when another plugin answers the site's usual sign-in addresses.
  • NewA sign-in self-check names any plugin that answers part of Royal MCP's sign-in and shows how to fix it, including Rank Math's built-in MCP sign-in.
  • Newwp_security_triage, a read-only checklist of must-use plugins, unlisted plugin folders, recent plugin changes and users with extra capabilities.
  • Newwp_clone_post_as_draft copies a post or page into a new draft, so changes to published content can be prepared in drafts-only mode.
  • Newwp_get_mcp_coexistence lists the other MCP servers on the site and which plugin answers each shared sign-in address.
  • Newwp_revoke_preview_links ends every preview link for a post.
  • EnhancementUndo for wp_create_post and wp_create_page moves the new post to the trash.
  • EnhancementRoyal MCP tools carry their own categories, annotations and output schemas on the WordPress Abilities API and the MCP Adapter.
  • EnhancementCalls through the WordPress Abilities API and other MCP servers are rate limited per user, like calls to Royal MCP's own endpoint.
  • Enhancementwp_get_pages and wp_search can list drafts and other statuses the signed-in user may read, and wp_add_post_terms accepts term names and slugs.
  • Enhancementwp_create_menu_item links any post type or taxonomy that the Menus screen offers.
  • EnhancementTablePress CSV exports write cells that start with =, +, -, @ as plain text.
  • EnhancementWPForms form details include the number of input boxes a visitor sees.
  • EnhancementRoyal MCP keeps its MCP Adapter server off while classes from two different copies of the adapter are loaded.
  • EnhancementWhile Royal MCP is switched off, its abilities are not offered to other MCP servers at all.
  • FixUndo of wp_reorder_menu_items keeps nested menu items under their parents.
  • FixWP-CLI changes to drafts-only mode and access levels are recorded in the activity log.
  • FixExpired undo snapshots, sessions and tokens are cleaned up daily on every site.
  • FixWooCommerce and Complianz tools answer that the plugin is not active, instead of a permission error, when it is missing.
  • FixWooCommerce product prices and stock values are checked before saving, and order status changes no longer accept refunded.
  • FixRead abilities with only optional arguments run over a plain GET on the WordPress Abilities API.
  • Fixwp_count_terms, elementor_list_local_templates and the Royal AI Firewall reads return their data on the Abilities API and the MCP Adapter.
  • SecurityWooCommerce, Elementor template, comment moderation, custom CSS and preview link tools check the signed-in user's rights on each item.
  • Securitywp_get_post and wp_get_page return the stored source only to users who can edit the post.
  • SecurityElementor edits that would remove markup the signed-in user may not save are refused.
  • SecurityOn multisite networks, Royal AI Firewall, LiteSpeed and W3 Total Cache tools need a network administrator.

1.5.11

  • NewComplianz integration with seven tools for the consent setup, cookies, banner texts and legal documents, with undo for text edits.
  • NewPlugin developers can add their own tools to Royal MCP with two filters, described in the developer guide on royalplugins.com.
  • Enhancementwp_get_plugins lists must-use plugins and drop-ins, with a type and last-modified date for every plugin.
  • Enhancementwp_get_users and wp_get_user return each user's registration date and any capabilities granted beyond their roles.
  • EnhancementWooCommerce coupon lists page with totals, and order lists filter by date.
  • EnhancementSite owners can add fields such as customer emails to order, customer and user replies with three filters.
  • EnhancementTools added by other plugins follow read-only mode, drafts-only mode and each connection's access level.
  • EnhancementEvery list tool keeps its page size between one and its maximum.
  • EnhancementRoyal MCP tools are listed on Royal MCP's own MCP Adapter server instead of the adapter's default server.
  • EnhancementThe Redirection tools refuse to redirect the home page, sign-in, wp-admin or the REST API unless the call asks for it explicitly.
  • EnhancementThe royal_mcp_access_token_ttl filter receives the user and client each token is issued to.
  • FixMonsterInsights report tools return the overview, top pages, traffic sources and search queries on every connection.
  • FixSwitching Royal MCP off also stops calls through the WordPress Abilities API and the MCP Adapter, and those calls are logged.
  • Action requiredIf a connection sends the API key in the X-Royal-MCP-API-Key header, switch it to Authorization: Bearer; the old header is deprecated.

1.5.10

  • NewTablePress integration with six tools to list, read, create, copy and export tables and change cells, with undo.
  • NewCode Snippets integration with five tools to list, read, deactivate and rename snippets.
  • NewWPCode integration with three read-only tools for snippets, their code and their last error.
  • NewSettings for who can connect AI clients and who can use tools from other MCP servers; both default to Administrators only, so sites where editors connect should choose Editors and above.
  • EnhancementWooCommerce product, customer and variation lists page with totals, and products filter by IDs, SKU and stock status.
  • EnhancementCredential settings with one-word names and credential ACF fields are hidden from AI clients.
  • EnhancementThe Allowlisted plugin options setting shows which listed names are blocked.
  • EnhancementEvery tool checks the signed-in user's rights on each post, comment, term and template it reads or changes.
  • FixDivi 4 pages whose Code modules contain line breaks can be cloned, rewritten and validated.
  • SecuritySearch returns only content the signed-in user may read; thanks to Vincent Cassiau (CyberVanguard).
  • SecurityCloning an Elementor page checks the right to read the source and to publish the copy; thanks to Usama Arshad.

1.5.9

  • NewDrafts only setting lets AI clients create and edit drafts while refusing publishing, live pages and site settings.
  • NewEach connected AI client and the API key can be given its own access level: Full, Read-only or Drafts only.
  • NewRecent Changes screen and two tools show what AI clients changed in the last 72 hours, with the values before, after and now.
  • NewBlock editor tools read a page's blocks and insert, replace, move or delete single blocks, and read synced patterns, global styles and templates.
  • NewA media tool finds files already in the library by address or content, and uploads can reuse them instead of adding a copy.
  • NewThe settings page has ready-to-copy commands that connect Claude Code or Codex.
  • NewA setting to delete all plugin data when the plugin is deleted, off by default so settings, the activity log and connected clients are kept.
  • Enhancementpublish-and-promote creates a draft unless asked to publish.
  • EnhancementMedia details include file size, dimensions and a content fingerprint.
  • EnhancementMedia downloads that fail say why, such as a missing file, an expired link or the size limit.
  • EnhancementSEO fields for Yoast, Rank Math and SEObolt are written through the SEO tool and read back after saving.
  • EnhancementThe Elementor notices only appear when Elementor's own MCP server is switched on.
  • EnhancementDeleting the plugin clears expired sessions, tokens and undo history on every site of a network.
  • FixWrite and undo tools keep backslashes in content, meta and term values exactly.
  • HousekeepingThe Outbound AI Provider settings section is removed.

1.5.8

  • NewChatGPT can hand a file from the conversation straight to the media upload tool.
  • NewThe media upload tools can convert, resize and compress an image as it uploads, for example to a JPEG under 400 KB.
  • EnhancementThe media upload tools accept PDFs and any other file type your site allows in its media library.
  • EnhancementAn image whose file name has an unfamiliar extension, such as .jfif, is saved under its real image type.
  • EnhancementOption tool messages say where an administrator can allowlist an option.
  • EnhancementThe Claude platform settings offer the Claude 5.5 models, with Sonnet 5.5 as the default.
  • FixDeleting a post or page without force moves any post type to the trash, and refuses when the trash is not available.
  • FixPost term reads and writes refuse a taxonomy that is not registered for the post type.
  • Fixpassword-protected content is returned only to users who can edit the post.
  • Fixpublish-and-promote reads the publish date in the site timezone.
  • FixThe page-check rate limit counts calls, not redirect hops.

1.5.7

  • NewA tool to read the terms assigned to a post, and post and page reads now include their assigned terms.
  • NewAdmin notice when another plugin is answering OAuth sign-in for the site.
  • NewWordfence integration with eight tools for security status, blocked IPs, failed logins, blocked requests and scans.
  • NewLiteSpeed Cache integration with four tools for cache status, settings and purging.
  • NewEvery tool tells AI clients whether it only reads or can change the site.
  • NewAI clients can read site info, the active theme, the tool catalog and connection health as resources.
  • NewAI clients can revoke their own access when they disconnect.
  • NewConnected Clients screen lists the AI clients signed in through OAuth and lets you revoke them one at a time or all at once.
  • NewRead-only mode setting refuses every tool that changes the site while leaving all reads available.
  • NewSite Health tests check permalinks, the discovery document, the Authorization header and the sign-in addresses.
  • NewWP-CLI commands to check connection health, list connected clients and rotate the API key.
  • NewCompanion plugins can run their own tools through Royal MCP.
  • NewRead several posts in one call with trimmed text, and see robots, redirect, hreflang and structured-data details when checking a page.
  • EnhancementThe Revoke all active sessions button moved from the OAuth settings to the Connected Clients screen.
  • EnhancementTools for plugins that are not active are flagged in the tool list.
  • EnhancementThe plugin list reports network-active plugins and version requirements.
  • FixPreview links now open draft pages and custom post types.
  • FixThe Claude.ai connector starts OAuth sign-in reliably.
  • FixResetting OAuth or clearing a credential field no longer changes other settings.
  • FixOptions added under Allowlisted plugin options can be read and written by AI clients.
  • FixScheduled dates are read in the site timezone.
  • FixFeatured images set while creating or updating a post are saved in one step.
  • FixSEObolt noindex and SEO field updates now apply.
  • FixRoyal MCP registers with the WordPress MCP Adapter when another plugin bundles it.
  • FixA page or post published at /register or /token is shown to visitors.

1.5.6

  • FixOAuth connector compatibility across MCP clients.

1.5.5

  • Newdry-run preview mode on high-blast option-write tools, a wp_verify_rendered_page tool for post-write confirmation, and a compact tool-discovery profile for context-limited AI clients.

1.5.4

  • Fixtools/list, prompts/list, and resources/list responses now conform to the modern-era MCP schema for connectors that require the newer wire shape.

1.5.3

  • NewLocal Protocol Insights admin page shows per-protocol-version request volume + top MCP clients + method-call frequency.
  • NewOAuth authorization responses include the iss parameter per RFC 9207.
  • NewProtected Resource Metadata is now also served at the RFC 9728 path-suffixed URL for the MCP endpoint.
  • EnhancementTool responses tag successful envelopes with resultType for downstream observability.
  • EnhancementServer accepts and logs the Mcp-Method and Mcp-Name request headers for client-side tracing.
  • EnhancementOAuth discovery advertises the wp-json fallback URLs directly in the server card and 401 responses.
  • EnhancementTimestamp fields in ForgeCache, UpdraftPlus, and undo-envelope responses now use ISO 8601 UTC format on the wire.
  • EnhancementWebMCP bridge status badge on the settings page is silent unless a bridge is actively detected.
  • Fixserver/discover response now conforms to the modern-era MCP schema for connectors that require the newer wire shape.
  • FixEmpty plugin-setting values return as empty in tool responses so callers can distinguish unconfigured fields from set-but-redacted ones.
  • HousekeepingProtocol-usage rollups are pruned by the daily maintenance cron.
Show 57 earlier releases

1.5.2

  • NewOptional "Require approval before new AI clients can connect" setting with a Pending Clients admin page for reviewing dynamically-registered OAuth clients.
  • NewOAuth discovery advertises client_id_metadata_document support for MCP clients that use CIMD instead of dynamic client registration.
  • NewOAuth discovery is also served under a /wp-json/royal-mcp/v1/.well-known/ alternate path for managed hosts that reserve the root .well-known/ prefix.
  • NewAdmin notice detects when the web server strips Authorization headers, with copy-paste Apache and nginx fix guidance.
  • Newserver/discover handler for MCP clients using the newer protocol era.
  • NewTwitter card fields on wp_update_seo_meta for Yoast SEO, Rank Math, SEOPress, and SEObolt.
  • Newfc_get_rum_stats MCP tool exposes ForgeCache real-user Core Web Vitals data.
  • NewSetting to disable the WordPress Abilities API bridge.
  • EnhancementTool descriptions include the site host so multi-connector setups can disambiguate identically-named tools.
  • Enhancementwp_replace_in_post supports targeted edits on the WordPress custom_css post.
  • Enhancementinitialize response advertises resources and prompts capabilities alongside tools.
  • Fixwp_update_widget and other tools with nested object schemas now validate under stricter MCP clients.
  • HousekeepingStale OAuth clients are pruned by the daily maintenance cron.

1.5.1

  • NewBrowser-based AI agents can now use Royal MCP tools via any WebMCP-compatible bridge, using the visitor's existing WordPress login.
  • NewBrowser Agents section on the settings page toggles the WebMCP path on or off.
  • NewPublishes a machine-readable server card and skills index so Agent Readiness scanners auto-detect the site.
  • EnhancementRate-limit responses now include the seconds until retry so MCP clients know exactly when to try again.
  • EnhancementAuthenticated requests get a higher rate-limit ceiling so legitimate bulk operations no longer trip the anti-abuse limit.
  • FixRate limits behind Cloudflare now count per real visitor instead of coalescing everyone at the edge server IP.
  • FixThe Perfmatters compatibility warning no longer appears when Disable REST API is only blocking logged-out visitors.
  • FixThe site icon in the server identity response now returns as a string for all icon formats.

1.5.0

  • NewThree Elementor discovery tools (widget schema, widget list, dynamic tags) plus an include-styles option on the page-outline tool.
  • NewThe Troubleshooting Help tab surfaces the fix for the most-reported OAuth reconnect issue directly in WordPress admin.
  • EnhancementRoyal MCP now speaks the modern MCP wire, improving compatibility with newer Claude.ai, ChatGPT, and other AI client connectors.
  • EnhancementSupport for multiple MCP protocol versions on the initialize handshake so newer AI clients get the latest wire behavior.
  • EnhancementOAuth discovery now works for AI clients that probe the alternate path-scoped discovery URL.
  • EnhancementEvery MCP request now appears in the Royal MCP Activity Log for improved diagnostic visibility.
  • EnhancementA compatibility notice appears when the Perfmatters plugin is set to disable the REST API, which would otherwise block MCP connections.
  • EnhancementEvery tool advertises complete input and response metadata for improved compatibility with strict MCP clients like ChatGPT.
  • EnhancementThe internal ChatGPT connection guide walks the sign-in modal, WordPress authorize page, and post-connection state as distinct steps.
  • FixUnknown MCP methods return the correct method-not-found response so probing AI clients do not get stuck in reconnect loops.
  • FixThe /register OAuth endpoint returns 405 Method Not Allowed with a proper Allow header for GET requests.
  • FixWhen a database table upgrade fails on incompatible host configurations, the plugin now skips retries for 24 hours to prevent error-log flooding.

1.4.45

  • FixPlugin constant definitions no longer emit PHP notices when Royal MCP is loaded alongside a wrapper plugin that pre-defines the same constants.
  • NewSolid Security integration adds four tools — read the security status summary, list currently locked-out IPs, read the security event log, and add an IP to the ban list.
  • NewContact Form 7 integration adds three tools — list forms, read a single form's parsed field schema, and list submissions when the Flamingo add-on is active.
  • NewMonsterInsights integration adds four tools — read the analytics overview, top pages, traffic sources, and top Google Search Console queries.
  • NewW3 Total Cache integration adds three tools — read cache configuration across every module, purge cache (all, by URL, or by post), and read usage statistics.
  • NewDuplicator integration adds three tools — list migration packages, read per-package status, and get the installer URL for a completed package.
  • NewBuddyPress integration adds four tools — list community members, read a single member profile, list groups, and read the activity feed.
  • NewMCP server identity now advertises the WordPress Site Icon so connector cards show per-site branding.
  • EnhancementWooCommerce coupon and product read responses now include ISO 8601 date variants and additional catalog and subscription fields.
  • EnhancementHelp page CSS and admin links now work correctly when the plugin is vendored inside a wrapper plugin.
  • FixWooCommerce order tools now register correctly with ChatGPT.

1.4.44.1

  • FixWooCommerce order tools now register correctly with ChatGPT.

1.4.44

  • NewYoast SEO integration adds five tools — read the full Yoast meta surface, capture the JSON-LD schema graph, list indexed internal links, list Premium redirects, and update Yoast title/description/focus keyword with a 72-hour undo token.
  • NewUpdraftPlus integration adds four tools — list local backup history, read per-backup status, trigger a new backup, and read the current backup schedule.
  • NewWPForms integration adds four tools — list forms, read a single form's field schema, and (Premium) list submissions plus read a single submission.
  • FixEnvelope helper's full-JSON-mirror path no longer throws on non-array input during defensive test paths.
  • FixPost meta, SEO meta, Yoast meta, and featured image edits made through Royal MCP tools now trigger the standard WordPress post-save event so page-cache plugins and SEO indexable rebuilders pick up the change automatically.
  • FixDivi tools now return a clean not-active error on sites where Divi is not installed.
  • Fixdivi_validate_layout accepts raw_content on sites without Divi installed so cross-site validation workflows work without the plugin being present.
  • FixMeta writes now bump the post modification timestamp so sitemap regenerators, feed cache invalidators, and staleness detectors keyed on post_modified fire correctly.
  • Fixwp_get_post, wp_get_page, wp_get_posts, and wp_get_pages return featured_media (attachment ID) and featured_media_url in the response envelope.
  • Fixwp_set_featured_image persists the alt_text argument on both the media_id and image_url input paths.
  • Fixmcp_undo_last_operation documentation names yoast_update_meta in the supported-tools list.
  • FixTier-gated tools return a uniform {state: "unavailable", reason, tier, message} envelope so AI callers cannot misread a tier gate as an empty query result.
  • Fixyoast_get_meta returns Open Graph, Twitter, canonical, and breadcrumb fields as both the stored template and the resolved value Yoast renders (featured image fallback, permalink fallback, post title fallback).
  • Fixyoast_get_meta surfaces analysis_pending so callers can distinguish a post that has never been scored from a post with a real low content_score or linkdex.
  • Fixyoast_get_schema removes empty author references from the JSON-LD graph so posts with unresolvable authors no longer produce invalid Article markup.
  • Fixyoast_get_internal_links returns link_index_status (indexed, index_pending, no_links) plus a content_anchor_count cross-check so callers can distinguish a post with no links from a post the link index has not processed yet.
  • Fixupdraftplus_trigger_backup dispatches asynchronously via WP-Cron and honors the entities argument (a caller requesting entities:["plugins"] gets a plugins-only backup).
  • Fixfc_purge_url purges the homepage, category and tag archives, paginated pages, and other URLs that do not resolve to a single post or page.
  • FixWPForms form schema returns choices as an indexed list with label/value/key, required as a boolean, timestamps as ISO 8601 strings alongside epoch integers, and form listing paginates deterministically on same-second creations.
  • NewIn-plugin Help page with per-client setup guides (Claude Desktop, claude.ai Web, Claude Code CLI, ChatGPT, Cursor, VS Code, Continue), a three-rung quick-fix troubleshooting ladder, and a copy-ready diagnostic-info block for support requests.
  • NewNewsletter signup link in the Royal MCP admin header and Support tab.
  • EnhancementCross-sell notice bar above every Royal MCP admin page.
  • EnhancementEvery integration's tools now appear in the MCP tool list on connect (WooCommerce, Elementor, Divi, ACF, Yoast, UpdraftPlus, WPForms, SiteVault, ForgeCache, GuardPress, Royal AI Firewall, Royal Ledger, Royal Links, Redirection) so activating a supported plugin no longer requires reconnecting the AI client, and every tool schema now passes strict-validator MCP clients (VS Code, ChatGPT strict mode) after fixing meta-update, WooCommerce order, Elementor widget, ACF field, option, theme-mod, and widget-update surfaces.

1.4.43

  • NewDivi 4 and Divi 5 page tools in Free — clone a page, swap images, and import a library template, all with 72-hour undo tokens.
  • NewElementor library-to-page bridge (elementor_apply_template_to_page) plus tools to repair pages where the Elementor render is missing (single and bulk).
  • NewSiteVault backup tools now work with the free SiteVault plugin from WordPress.org in addition to SiteVault Pro.
  • EnhancementEvery destructive write emits a 72-hour undo token in the response text; responses now surface actionable URLs, IDs, and counts.
  • Enhancementelementor_replace_text adds dry-run preview, expected-count guard, image alt/title walking, and optional media-library sync.
  • FixTool schemas conform to strict JSON Schema so VS Code and ChatGPT Plugins accept the tools at load time.
  • Fixelementor_clone_page populates page content so cloned pages stay visible to WordPress core search.
  • FixOAuth discovery adds a filter to override the metadata URL for hosts intercepting .well-known/.

1.4.42

  • EnhancementWrite-verification helper now detects pre-write input mangling for tools that require strict input fidelity.
  • EnhancementTool argument sanitizers now preserve %XX escape sequences so URLs, patterns, and templated inputs survive round-trip.
  • Fixwp_update_permalink_structure preserves permalink tokens like %category% and %author% when writing the structure.
  • FixHardens redaction of sensitive data across plugin/option/meta read tools and debug log responses.

1.4.41

  • NewSix Divi builder tools for safer AI-driven Divi editing (get page format, outline, validate layout, list local templates, library get, replace text).
  • Newwp_publish_and_promote publishes a draft and inserts it into a menu in one call.
  • Newwp_create_menu creates a WordPress navigation menu with optional theme-location assignment.
  • Newwp_create_preview_link generates a shareable draft-preview URL for one preview session.
  • Enhancementwp_get_post_revisions returns per-revision content_length for quick change-size scanning.
  • EnhancementDestructive write tools now warn when literal escape sequences appear in replacement text, so operators catch double-escaping before it lands.
  • EnhancementOAuth discovery self-check now detects Sucuri / CloudProxy edge blocks and links to a Sucuri-specific fix guide.
  • EnhancementA "Re-check now" button on host-blocked admin notices re-probes OAuth discovery in-place during troubleshooting.
  • EnhancementOAuth discovery cache shortens automatically on WAF-fronted sites for faster feedback after configuration changes.

1.4.40

  • NewEvery write tool re-reads modified fields after the write and returns the actual saved values.
  • NewUndo tokens now cover wp_delete_post, wp_delete_term, and wp_delete_menu_item, restoring deleted objects within 72 hours via mcp_undo_last_operation.
  • Newwp_update_post preserves the WooCommerce product_type when generic post updates would otherwise reset it to Simple.
  • Newwc_get_order returns fee_lines, shipping_lines, and the raw payment method ID for full write-verification.
  • Newwp_get_seo_meta and wp_update_seo_meta now support AIOSEO and SEObolt alongside Yoast and Rank Math.
  • Newwp_get_widgets returns widget instance content and parsed block markup for before/after diffs.
  • NewOAuth endpoint paths (authorize/token/register) are filterable via royal_mcp_oauth_rewrite_paths.
  • NewAdmin notice detects when a published page shadows an OAuth endpoint.
  • Enhancementwp_get_posts + wp_count_posts accept non-public post types when the caller has edit capability.
  • EnhancementOption writes require opt-in to the read allowlist first; admin_email + default_role + mailserver_* permanently denylisted.
  • EnhancementJSON-RPC envelope hardening re-forces "2.0" against edge-layer transformations.
  • EnhancementRoyal MCP Pro promotion refreshed for post-launch with a green Upgrade to Pro link in the sidebar.
  • Fixelementor_replace_text is now multi-byte and case-insensitive.
  • FixUninstalling the free plugin no longer removes data used by Royal MCP Pro when Pro is installed on the same site.
  • Fixseo_audit_meta_tags now counts characters instead of bytes so titles and descriptions containing non-ASCII content are measured correctly.

1.4.39

  • NewFree plugin refuses activation when Royal MCP Pro is already active.
  • NewOAuth session-length setting lets site owners choose how long AI sessions stay connected before requiring re-authorization.
  • NewRevoke all active AI sessions from Settings → OAuth.
  • Newwp_replace_in_post and wp_replace_in_page tools for literal find/replace inside post content with dry-run, expected-count safety, and read-after-write verification.
  • NewSettings-page section to allowlist third-party plugin options for wp_update_option without writing filter code.
  • NewWidget tools — list widget instances (optionally filtered by sidebar), list sidebars, and update widget content; writes gated by the theme-appearance admin toggle.
  • Newwp_reorder_menu_items now returns an undo token that mcp_undo_last_operation can consume within 72 hours to restore the prior order.
  • Newmcp_undo_last_operation tool consumes an undo token and reverses the operation that generated it.
  • Newseo_audit_meta_tags fetches a post's actual rendered HTML and reports title, meta description, canonical, viewport, Open Graph and Twitter Card tags — catches conflicts that only appear in served output.
  • NewWooCommerce order write tools — wc_create_order, wc_update_order, wc_add_order_note — for B2B, wholesale, phone orders, and support-note trails.
  • Fixelementor_replace_text now walks Blockquote widget fields (author name and quote content).
  • EnhancementOAuth sessions now default to 24 hours.
  • EnhancementAdmin auto-detects BitNinja WebShield interference with OAuth discovery and shows targeted host-support instructions.
  • EnhancementAdditional /authorize, /token, and /register diagnostics in Activity Log.
  • EnhancementReadme highlights Royal AI Firewall as the companion plugin for HTTP-layer AI bot visibility alongside Royal MCP.

1.4.38

  • NewAll tools register as WordPress abilities on WP 6.9+, accessible via the WP Abilities REST API and the WordPress MCP Adapter alongside the native MCP endpoint.
  • NewRedirection plugin integration adds four tools for listing, creating, updating redirects and listing groups.
  • NewGoogle Site Kit GA4 configuration accessible to AI agents with sensitive keys redacted.
  • Newroyal_mcp_connection_health tool now returns active page-builder versions (Divi, Elementor, WordPress core) so agents can plan multi-step operations without a probe call.
  • NewNew .mcpb bundle for one-click Claude Desktop install.
  • NewFounding Members waitlist notification for the upcoming Royal MCP Pro release.

1.4.37

  • NewSix new Royal AI Firewall tools return dashboard stats, recent bot hits, per-bot policies, policy updates, daily rollups, and a block-all-AI-bots action.
  • NewNew Royal Tools admin page lists every free Royal Plugins family member with one-click install links.
  • NewNew royal_mcp_connection_health diagnostic tool returns route, auth method, session ID, and version details for any authenticated caller.
  • NewNew elementor_get_widget_settings tool reads full settings for a single Elementor widget, container, section, or column by ID.
  • NewCoexistence detection surfaces a routing hint on Elementor tool descriptions when Elementor's own MCP module is also active.
  • NewCustom top header bar renders on every Royal MCP admin page with View Docs and Support buttons.
  • EnhancementLightweight admin footer shows Royal Plugins family links plus the current plugin version marker.
  • Enhancementwp_update_post and wp_update_page now accept menu_order, post_parent, password, comment_status, ping_status, excerpt, and post_author fields and return actual stored values so silent-drop by WordPress is surfaced rather than hidden.
  • EnhancementNew royal_mcp_tool_context hook fires alongside the legacy royal_mcp_tool_called action with an enriched payload for downstream firewall integrations.
  • Fixwp_get_seo_meta now correctly reports noindex state on Rank Math sites, and wp_update_seo_meta responses reflect actual stored values rather than requested values.

1.4.36

  • NewNew wp_get_site_status tool returns WordPress, PHP, MySQL, plugin, theme, and environment info in a single call.
  • NewNew wp_get_error_log_tail tool returns the last lines of the debug log with optional keyword filtering.
  • NewNew wp_get_cron_schedule tool lists every scheduled event with next-run time and overdue flag.
  • FixHTML preserved in post meta, term meta, term descriptions, comments, order notes, post and page excerpts, and coupon descriptions.
  • NewNew royal_mcp_meta_value_sanitizer filter lets sites customize per-key sanitization.
  • NewAdmin notice detects when Imunify360 is intercepting the OAuth discovery endpoints and links to a fix article.
  • NewAdmin notice detects when the site uses Plain permalinks and links directly to Settings -> Permalinks.
  • EnhancementRefined descriptions across several read tools.
  • EnhancementList responses on wp_get_terms and wc_get_orders include a total_count field.

1.4.35

  • FixOAuth-authenticated MCP sessions remain valid across access-token rotation.

1.4.34

  • Newwp_update_post_meta accepts any JSON type (string, number, boolean, array, object).
  • NewNew wp_add_post_meta tool adds a meta row without overwriting existing values under the same key.
  • NewNew wp_get_terms tool lists terms in any registered taxonomy with pagination.
  • SecurityMeta-write tools reject strings that look like PHP-serialized payloads at the schema boundary.

1.4.33

  • Newwp_create_post, wp_update_post, wp_create_page, and wp_update_page accept a date parameter for scheduling and backdating.
  • NewCreate-post and create-page status enum expanded to include future, pending, and private.
  • NewNew royal_mcp_tool_called action hook fires after every MCP tool invocation with (tool_name, status, error_message).
  • NewActivity Log page surfaces a pointer to the free Royal AI Firewall plugin for HTTP-layer AI bot visibility.

1.4.32

  • Newwp_search accepts optional snippet and per_page parameters for excerpted results.
  • Newwc_get_orders accepts a page parameter and returns {orders, page, per_page, total, total_pages}.
  • HousekeepingGeneral readme cleanup and updates.

1.4.31

  • Securitywp_delete_post capability check runs before the post-existence lookup.
  • Securitywp_get_post_meta requires edit_post capability for protected (underscore-prefixed) meta keys.
  • SecurityEmpty-string text fields on update tools preserve the existing value instead of blanking it.
  • EnhancementEvery post-identifying tool accepts either id or post_id.
  • EnhancementNew wp.org review-request banner on the settings page, dismissable per plugin version.

1.4.30

  • NewNew elementor_add_widget tool builds Elementor pages widget by widget, with curated shortcuts for the 11 most common widget types and raw passthrough for the long tail.
  • Securityelementor_add_widget rejects unknown widget-type slugs at the boundary.
  • SecurityCapability check order tightened in six integration tool wrappers.

1.4.29

  • FixRuntime DB migration reliably creates the sessions and OAuth tables on all installs.
  • Fix/register self-heals when the OAuth tables are missing.
  • Fixuninstall.php also removes the royal_mcp_db_version option for a fully clean slate on reinstall.

1.4.28

  • NewMCP clients can send their API key via the standard Authorization: Bearer header in addition to the existing X-Royal-MCP-API-Key header.
  • Newwp_get_seo_meta and wp_update_seo_meta cover the post URL slug alongside the existing SEO fields.

1.4.27

  • EnhancementMCP session state moved onto a dedicated wp_royal_mcp_sessions table.
  • HousekeepingRemoved unused admin-AJAX handlers.
  • HousekeepingReworded a section of the plugin description.

1.4.26

  • SecurityPer-tool WordPress capability checks added across all content, user, term, comment, and integration tools, with status filters converted to positive allowlists.

1.4.25

  • EnhancementMCP Server URL surfaced at the top of General Settings as the canonical inbound URL for every client.
  • NewNew in-product MCP Client Setup Guides accordion covering Claude.ai, ChatGPT, Claude Desktop, and Cursor.
  • EnhancementOutbound AI Provider Configuration renamed and separated from inbound MCP setup.
  • EnhancementLegacy REST API Base URL and manual OAuth Client ID / Secret moved into an Advanced subsection.
  • EnhancementUniversal admin icon alignment, keyboard focus rings on settings-page buttons, and improved helper-text contrast.

1.4.24

  • NewAdvanced Custom Fields integration -- 4 tools (acf_get_field, acf_get_fields, acf_update_field, acf_get_field_groups).
  • Fixwc_create_product respects the type argument and creates the matching WooCommerce product class (Simple, Variable, Grouped, External).
  • HousekeepingDescription and Installation sections point to the first-time setup walkthrough.

1.4.23

  • FixAI Platforms model dropdowns refreshed across Claude, OpenAI, Gemini, Groq, and Bedrock.

1.4.22

  • FixAI Platforms Test Connection on Claude uses the model selected in the dropdown.
  • FixManually-configured OAuth Client ID and Secret can be cleared through the UI.
  • SecurityOAuth root rewrite rules match both bare and trailing-slash variants.
  • NewAdmin notice detects host-side 301 redirects on POST /register.
  • New.well-known/ self-check detects when a plugin or theme intercepts the discovery endpoint with an HTML page.

1.4.21

  • FixGutenberg block content round-trips byte-for-byte through the post-write tools.

1.4.20

  • FixWooCommerce order tools handle refund records without hanging.

1.4.19

  • NewSix Elementor clone-and-customize tools (elementor_clone_page, elementor_replace_text, elementor_replace_image, elementor_get_page_outline, elementor_list_local_templates, elementor_import_template).
  • NewAdmin notice detects stale static .well-known/oauth-authorization-server files.
  • HousekeepingElementor handling described explicitly in the page-builder section.

1.4.18

  • FixAuthenticated GET on the MCP endpoint is User-Agent-aware for the Anthropic session probe.
  • Fixwp_update_menu_item and wp_reorder_menu_items preserve fields that were not included in the update.
  • HousekeepingNew FAQ entries for DB-restore recovery, OAuth endpoint locations, and troubleshooting.

1.4.17

  • FixAuthorization codes moved onto a dedicated wp_royal_mcp_oauth_auth_codes table with atomic single-row consume.
  • NewNew "Reset OAuth State" admin button clears registered clients, tokens, and pending auth codes in one click.
  • NewMCP tools/call requests write a structured Activity Log entry on every invocation (argument keys logged, values excluded).
  • FixActivity Log "View Details" modal renders Request/Response JSON.
  • EnhancementPlugin admin CSS/JS use content-hash cache-busting.

1.4.16

  • NewOAuth flow writes structured Activity Log entries on every /token, /register, or /authorize failure (auth codes, PKCE verifiers, secrets, and tokens are excluded).

1.4.15

  • FixRegenerate API Key button reliably issues a new key.
  • EnhancementNew API keys are 32-char lowercase hex to eliminate visual-ambiguity transcription errors; existing keys keep working.
  • EnhancementMCP sessions use a sliding 24-hour TTL with refresh-on-access.
  • SecurityAll /wp-json/royal-mcp/* responses send Cache-Control: no-store, no-cache, must-revalidate, private.
  • SecurityInvalid API key returns HTTP 401 with WWW-Authenticate: Bearer per RFC 7235.

1.4.14

  • FixUnauthenticated GET on the MCP endpoint returns HTTP 401 with WWW-Authenticate: Bearer resource_metadata="..." per RFC 9728 so web-based MCP clients trigger OAuth discovery correctly.
  • NewSelf-check detects when the host blocks /.well-known/oauth-authorization-server and surfaces a dismissible admin notice with the manual fix.

1.4.13

  • SecurityOAuth endpoint responses (/register, /token, /authorize) send Cache-Control: no-store by default.
  • New10 WooCommerce variation and attribute tools covering CRUD, batch operations, and attribute-term management.
  • New7 WooCommerce coupon management tools with full CRUD plus trash and purge.

1.4.12

  • EnhancementMCP protocolVersion bumped to 2025-11-25 to match current Claude Desktop builds.
  • FixMCP GET stream returns HTTP 405 with Allow: POST, DELETE, OPTIONS.
  • Enhancementwp_get_taxonomies returns a slug field alias; wp_get_term_meta returns a structured response matching the rest of the term-meta family.

1.4.11

  • NewNew tools -- wp_update_term, wp_get_term_meta, wp_update_term_meta, wp_delete_term_meta, wp_get_taxonomies.
  • Enhancementwp_create_term, wp_delete_term, and wp_add_post_terms accept any registered taxonomy.
  • Enhancementwp_create_term accepts an optional slug; wp_create_post and wp_update_post accept a post_author user ID.

1.4.10

  • NewRoyal Ledger integration (4 tools), ForgeCache integration (3 tools), and Royal Links integration (3 tools), each auto-loading when the host plugin is active.
  • NewSEO meta tools (wp_get_seo_meta, wp_update_seo_meta) auto-detect the active SEO plugin and read/write title, description, focus keyword, robots, and OG fields.
  • NewPermalink structure tools and post revision tools (read history and revert).

1.4.9

  • NewTheme appearance tools (active theme, theme mods, custom CSS read/write) gated by an admin toggle and a royal_mcp_writable_theme_mods allowlist filter.
  • NewMenu item CRUD (create, update, delete, reorder) and comment moderation (pending list, approve, spam, trash).

1.4.8

  • FixCustom connector setup succeeds on sites updated from an early build without a deactivate/reactivate cycle.
  • FixDynamic Client Registration (POST /register) returns a real 500 with the underlying error when the DB write fails.

1.4.7

  • NewNew wp_get_plugin_settings tool returns wp_options matching a plugin slug with sensitive keys redacted.
  • NewNew wp_update_option tool gated by an admin toggle (off by default), the royal_mcp_writable_options filter, and a hard denylist for sensitive option names.
  • Securitywp_get_option redacts sensitive keys; outbound HTTP timeouts reduced to 10 seconds.
  • HousekeepingRefreshed plugin directory banners and tags.

1.4.6

  • NewNew tools -- wp_upload_media_from_url (SSRF-hardened), wp_upload_media (base64), wp_set_featured_image, and wp_update_media.
  • Enhancementwp_create_post and wp_update_post accept featured_media attachment ID.
  • EnhancementAPI-key authenticated requests run with administrator capability to match the trust level of the admin-only-accessible key.

1.4.5

  • NewWordPress Playground live preview available from the plugin listing.
  • NewVideo walkthrough embedded on the plugin listing page.

1.4.4

  • NewCustom post type support -- wp_get_posts and wp_create_post accept post_type, and a new wp_get_post_types tool discovers all registered public post types.

1.4.3

  • SecurityAccess control on MCP REST API endpoints -- all tool calls require an authenticated API key or OAuth Bearer.

1.4.2

  • SecurityAuthentication enforced on every MCP request, with sessions bound to authenticated credentials.

1.4.1

  • FixResolved fatal error during activation on WordPress 7.0.

1.4.0

  • NewOAuth 2.0 authorization server with Dynamic Client Registration (RFC 7591), PKCE-secured authorization code flow, token refresh with rotation, WordPress login consent screen, and discovery at /.well-known/oauth-authorization-server.
  • SecurityAccess tokens stored as SHA-256 hashes; authorization codes single-use with 10-minute expiry; PKCE (S256) required; redirect URIs restricted to localhost or HTTPS.

1.3.0

  • NewWooCommerce integration (9 tools), GuardPress integration (7 tools), and SiteVault integration (6 tools).
  • SecurityMCP endpoint requires API key (X-Royal-MCP-API-Key header) with rate limiting at 60 requests per minute per IP and timing-safe comparison.

1.2.3

  • SecuritySSRF protection for outbound URLs; text domain renamed to royal-mcp; menu slugs updated for wp.org compliance.

1.2.2

  • NewDocumentation link on the Plugins page and documentation banner on the settings page.

1.2.1

  • FixClaude Connector setup guide link renders correctly.

1.2.0

  • SecurityOrigin header validation against DNS rebinding, session ID format validation, MCP 2025-03-26 Streamable HTTP spec compliance, and new royal_mcp_allowed_origins filter.

1.1.0

  • NewMulti-platform AI support (Claude, OpenAI, Gemini, Groq, Azure, Bedrock), Claude Desktop MCP connector, activity logging, and connection testing.