# Royal MCP changelog

> Every Royal MCP release, newest first: new MCP tools, improvements and fixes in each version of the free WordPress MCP server.

- Canonical: <https://royalplugins.com/royal-mcp/changelog/>
- HTML version: <https://royalplugins.com/royal-mcp/changelog/>

---

- [Overview](https://royalplugins.com/royal-mcp/)
- [Features](https://royalplugins.com/royal-mcp/features/connect/)

  [Ways to connect](https://royalplugins.com/royal-mcp/features/connect/)
  [Works with other MCP plugins NEW](https://royalplugins.com/royal-mcp/features/works-with-other-mcp-plugins/)
  [Agent Ready NEW](https://royalplugins.com/royal-mcp/features/agent-ready/)
  [Safety and Recovery NEW](https://royalplugins.com/support/royal-mcp/safety-and-recovery/)
- [Getting Started](https://royalplugins.com/royal-mcp/how-it-works/)

  [How It Works](https://royalplugins.com/royal-mcp/how-it-works/)
  [WordPress MCP Guide NEW](https://royalplugins.com/royal-mcp/wordpress-mcp/)
  [Connect Claude](https://royalplugins.com/royal-mcp/connect-claude/)
  [Connect ChatGPT](https://royalplugins.com/royal-mcp/connect-chatgpt/)
  [Editing Elementor with Claude](https://royalplugins.com/blog/editing-elementor-with-claude-four-workflows/)
- [Troubleshooting](https://royalplugins.com/support/royal-mcp/troubleshooting-start-here/)

  [Start Here — Quick Checklist](https://royalplugins.com/support/royal-mcp/troubleshooting-start-here/)
  [Diagnose with curl](https://royalplugins.com/support/royal-mcp/diagnose-mcp-with-curl/)
  [Common Patterns](https://royalplugins.com/support/royal-mcp/#troubleshooting)
- [Developers](https://royalplugins.com/support/royal-mcp/add-your-plugin-tools/)

  [Add your plugin’s tools](https://royalplugins.com/support/royal-mcp/add-your-plugin-tools/)
  [Shape replies with filters](https://royalplugins.com/support/royal-mcp/exposing-customer-email-via-filter/)
  [WP-CLI commands](https://royalplugins.com/support/royal-mcp/wp-cli-commands/)
  [Changelog](https://royalplugins.com/royal-mcp/changelog/)
  [GitHub repository](https://github.com/royalplugins/royal-mcp)
- [Support](https://wordpress.org/support/plugin/royal-mcp/)
- [All Docs](https://royalplugins.com/support/royal-mcp/)

Overview
Features — Ways to connect
— Works with other MCP plugins (NEW)
— Agent Ready (NEW)
— Safety and Recovery (NEW)
Getting Started — How It Works
— WordPress MCP Guide (NEW)
— Connect Claude
— Connect ChatGPT
— Editing Elementor with Claude
Troubleshooting — Start Here
— Diagnose with curl
— Common Patterns
Developers — Add your plugin’s tools
— Shape replies with filters
— WP-CLI commands
— Changelog
— GitHub repository
Support (wp.org Forum)
All Docs

Royal MCP · Changelog

Every Royal MCP release, newest first: what’s new, what improved and what was fixed. Each update installs from WordPress.org like any other plugin.

## [1.5.12](#v1-5-12)

October 26, 2026
Latest

- NewAI clients sign in at Royal MCP's own address, so Claude and ChatGPT connect even when another plugin answers the site's usual sign-in addresses.
- NewA sign-in self-check names any plugin that answers part of Royal MCP's sign-in and shows how to fix it, including Rank Math's built-in MCP sign-in.
- Newwp\_security\_triage, a read-only checklist of must-use plugins, unlisted plugin folders, recent plugin changes and users with extra capabilities.
- Newwp\_clone\_post\_as\_draft copies a post or page into a new draft, so changes to published content can be prepared in drafts-only mode.
- Newwp\_get\_mcp\_coexistence lists the other MCP servers on the site and which plugin answers each shared sign-in address.
- Newwp\_revoke\_preview\_links ends every preview link for a post.
- EnhancementUndo for wp\_create\_post and wp\_create\_page moves the new post to the trash.
- EnhancementRoyal MCP tools carry their own categories, annotations and output schemas on the WordPress Abilities API and the MCP Adapter.
- EnhancementCalls through the WordPress Abilities API and other MCP servers are rate limited per user, like calls to Royal MCP's own endpoint.
- Enhancementwp\_get\_pages and wp\_search can list drafts and other statuses the signed-in user may read, and wp\_add\_post\_terms accepts term names and slugs.
- Enhancementwp\_create\_menu\_item links any post type or taxonomy that the Menus screen offers.
- EnhancementTablePress CSV exports write cells that start with =, +, -, @ as plain text.
- EnhancementWPForms form details include the number of input boxes a visitor sees.
- EnhancementRoyal MCP keeps its MCP Adapter server off while classes from two different copies of the adapter are loaded.
- EnhancementWhile Royal MCP is switched off, its abilities are not offered to other MCP servers at all.
- FixUndo of wp\_reorder\_menu\_items keeps nested menu items under their parents.
- FixWP-CLI changes to drafts-only mode and access levels are recorded in the activity log.
- FixExpired undo snapshots, sessions and tokens are cleaned up daily on every site.
- FixWooCommerce and Complianz tools answer that the plugin is not active, instead of a permission error, when it is missing.
- FixWooCommerce product prices and stock values are checked before saving, and order status changes no longer accept refunded.
- FixRead abilities with only optional arguments run over a plain GET on the WordPress Abilities API.
- Fixwp\_count\_terms, elementor\_list\_local\_templates and the Royal AI Firewall reads return their data on the Abilities API and the MCP Adapter.
- SecurityWooCommerce, Elementor template, comment moderation, custom CSS and preview link tools check the signed-in user's rights on each item.
- Securitywp\_get\_post and wp\_get\_page return the stored source only to users who can edit the post.
- SecurityElementor edits that would remove markup the signed-in user may not save are refused.
- SecurityOn multisite networks, Royal AI Firewall, LiteSpeed and W3 Total Cache tools need a network administrator.

## [1.5.11](#v1-5-11)

October 22, 2026

- NewComplianz integration with seven tools for the consent setup, cookies, banner texts and legal documents, with undo for text edits.
- NewPlugin developers can add their own tools to Royal MCP with two filters, described in the developer guide on royalplugins.com.
- Enhancementwp\_get\_plugins lists must-use plugins and drop-ins, with a type and last-modified date for every plugin.
- Enhancementwp\_get\_users and wp\_get\_user return each user's registration date and any capabilities granted beyond their roles.
- EnhancementWooCommerce coupon lists page with totals, and order lists filter by date.
- EnhancementSite owners can add fields such as customer emails to order, customer and user replies with three filters.
- EnhancementTools added by other plugins follow read-only mode, drafts-only mode and each connection's access level.
- EnhancementEvery list tool keeps its page size between one and its maximum.
- EnhancementRoyal MCP tools are listed on Royal MCP's own MCP Adapter server instead of the adapter's default server.
- EnhancementThe Redirection tools refuse to redirect the home page, sign-in, wp-admin or the REST API unless the call asks for it explicitly.
- EnhancementThe royal\_mcp\_access\_token\_ttl filter receives the user and client each token is issued to.
- FixMonsterInsights report tools return the overview, top pages, traffic sources and search queries on every connection.
- FixSwitching Royal MCP off also stops calls through the WordPress Abilities API and the MCP Adapter, and those calls are logged.
- Action requiredIf a connection sends the API key in the X-Royal-MCP-API-Key header, switch it to Authorization: Bearer; the old header is deprecated.

## [1.5.10](#v1-5-10)

October 19, 2026

- NewTablePress integration with six tools to list, read, create, copy and export tables and change cells, with undo.
- NewCode Snippets integration with five tools to list, read, deactivate and rename snippets.
- NewWPCode integration with three read-only tools for snippets, their code and their last error.
- NewSettings for who can connect AI clients and who can use tools from other MCP servers; both default to Administrators only, so sites where editors connect should choose Editors and above.
- EnhancementWooCommerce product, customer and variation lists page with totals, and products filter by IDs, SKU and stock status.
- EnhancementCredential settings with one-word names and credential ACF fields are hidden from AI clients.
- EnhancementThe Allowlisted plugin options setting shows which listed names are blocked.
- EnhancementEvery tool checks the signed-in user's rights on each post, comment, term and template it reads or changes.
- FixDivi 4 pages whose Code modules contain line breaks can be cloned, rewritten and validated.
- SecuritySearch returns only content the signed-in user may read; thanks to Vincent Cassiau (CyberVanguard).
- SecurityCloning an Elementor page checks the right to read the source and to publish the copy; thanks to Usama Arshad.

## [1.5.9](#v1-5-9)

October 15, 2026

- NewDrafts only setting lets AI clients create and edit drafts while refusing publishing, live pages and site settings.
- NewEach connected AI client and the API key can be given its own access level: Full, Read-only or Drafts only.
- NewRecent Changes screen and two tools show what AI clients changed in the last 72 hours, with the values before, after and now.
- NewBlock editor tools read a page's blocks and insert, replace, move or delete single blocks, and read synced patterns, global styles and templates.
- NewA media tool finds files already in the library by address or content, and uploads can reuse them instead of adding a copy.
- NewThe settings page has ready-to-copy commands that connect Claude Code or Codex.
- NewA setting to delete all plugin data when the plugin is deleted, off by default so settings, the activity log and connected clients are kept.
- Enhancementpublish-and-promote creates a draft unless asked to publish.
- EnhancementMedia details include file size, dimensions and a content fingerprint.
- EnhancementMedia downloads that fail say why, such as a missing file, an expired link or the size limit.
- EnhancementSEO fields for Yoast, Rank Math and SEObolt are written through the SEO tool and read back after saving.
- EnhancementThe Elementor notices only appear when Elementor's own MCP server is switched on.
- EnhancementDeleting the plugin clears expired sessions, tokens and undo history on every site of a network.
- FixWrite and undo tools keep backslashes in content, meta and term values exactly.
- HousekeepingThe Outbound AI Provider settings section is removed.

## [1.5.8](#v1-5-8)

October 12, 2026

- NewChatGPT can hand a file from the conversation straight to the media upload tool.
- NewThe media upload tools can convert, resize and compress an image as it uploads, for example to a JPEG under 400 KB.
- EnhancementThe media upload tools accept PDFs and any other file type your site allows in its media library.
- EnhancementAn image whose file name has an unfamiliar extension, such as .jfif, is saved under its real image type.
- EnhancementOption tool messages say where an administrator can allowlist an option.
- EnhancementThe Claude platform settings offer the Claude 5.5 models, with Sonnet 5.5 as the default.
- FixDeleting a post or page without force moves any post type to the trash, and refuses when the trash is not available.
- FixPost term reads and writes refuse a taxonomy that is not registered for the post type.
- Fixpassword-protected content is returned only to users who can edit the post.
- Fixpublish-and-promote reads the publish date in the site timezone.
- FixThe page-check rate limit counts calls, not redirect hops.

## [1.5.7](#v1-5-7)

October 6, 2026

- NewA tool to read the terms assigned to a post, and post and page reads now include their assigned terms.
- NewAdmin notice when another plugin is answering OAuth sign-in for the site.
- NewWordfence integration with eight tools for security status, blocked IPs, failed logins, blocked requests and scans.
- NewLiteSpeed Cache integration with four tools for cache status, settings and purging.
- NewEvery tool tells AI clients whether it only reads or can change the site.
- NewAI clients can read site info, the active theme, the tool catalog and connection health as resources.
- NewAI clients can revoke their own access when they disconnect.
- NewConnected Clients screen lists the AI clients signed in through OAuth and lets you revoke them one at a time or all at once.
- NewRead-only mode setting refuses every tool that changes the site while leaving all reads available.
- NewSite Health tests check permalinks, the discovery document, the Authorization header and the sign-in addresses.
- NewWP-CLI commands to check connection health, list connected clients and rotate the API key.
- NewCompanion plugins can run their own tools through Royal MCP.
- NewRead several posts in one call with trimmed text, and see robots, redirect, hreflang and structured-data details when checking a page.
- EnhancementThe Revoke all active sessions button moved from the OAuth settings to the Connected Clients screen.
- EnhancementTools for plugins that are not active are flagged in the tool list.
- EnhancementThe plugin list reports network-active plugins and version requirements.
- FixPreview links now open draft pages and custom post types.
- FixThe Claude.ai connector starts OAuth sign-in reliably.
- FixResetting OAuth or clearing a credential field no longer changes other settings.
- FixOptions added under Allowlisted plugin options can be read and written by AI clients.
- FixScheduled dates are read in the site timezone.
- FixFeatured images set while creating or updating a post are saved in one step.
- FixSEObolt noindex and SEO field updates now apply.
- FixRoyal MCP registers with the WordPress MCP Adapter when another plugin bundles it.
- FixA page or post published at /register or /token is shown to visitors.

## [1.5.6](#v1-5-6)

September 29, 2026

- FixOAuth connector compatibility across MCP clients.

## [1.5.5](#v1-5-5)

September 28, 2026

- Newdry-run preview mode on high-blast option-write tools, a `wp_verify_rendered_page` tool for post-write confirmation, and a compact tool-discovery profile for context-limited AI clients.

## [1.5.4](#v1-5-4)

September 22, 2026

- Fix`tools/list`, `prompts/list`, and `resources/list` responses now conform to the modern-era MCP schema for connectors that require the newer wire shape.

## [1.5.3](#v1-5-3)

September 21, 2026

- NewLocal Protocol Insights admin page shows per-protocol-version request volume + top MCP clients + method-call frequency.
- NewOAuth authorization responses include the `iss` parameter per RFC 9207.
- NewProtected Resource Metadata is now also served at the RFC 9728 path-suffixed URL for the MCP endpoint.
- EnhancementTool responses tag successful envelopes with `resultType` for downstream observability.
- EnhancementServer accepts and logs the `Mcp-Method` and `Mcp-Name` request headers for client-side tracing.
- EnhancementOAuth discovery advertises the wp-json fallback URLs directly in the server card and 401 responses.
- EnhancementTimestamp fields in ForgeCache, UpdraftPlus, and undo-envelope responses now use ISO 8601 UTC format on the wire.
- EnhancementWebMCP bridge status badge on the settings page is silent unless a bridge is actively detected.
- Fix`server/discover` response now conforms to the modern-era MCP schema for connectors that require the newer wire shape.
- FixEmpty plugin-setting values return as empty in tool responses so callers can distinguish unconfigured fields from set-but-redacted ones.
- HousekeepingProtocol-usage rollups are pruned by the daily maintenance cron.

Show 57 earlier releases

## [1.5.2](#v1-5-2)

September 15, 2026

- NewOptional "Require approval before new AI clients can connect" setting with a Pending Clients admin page for reviewing dynamically-registered OAuth clients.
- NewOAuth discovery advertises `client_id_metadata_document` support for MCP clients that use CIMD instead of dynamic client registration.
- NewOAuth discovery is also served under a `/wp-json/royal-mcp/v1/.well-known/` alternate path for managed hosts that reserve the root `.well-known/` prefix.
- NewAdmin notice detects when the web server strips Authorization headers, with copy-paste Apache and nginx fix guidance.
- New`server/discover` handler for MCP clients using the newer protocol era.
- NewTwitter card fields on `wp_update_seo_meta` for Yoast SEO, Rank Math, SEOPress, and SEObolt.
- New`fc_get_rum_stats` MCP tool exposes ForgeCache real-user Core Web Vitals data.
- NewSetting to disable the WordPress Abilities API bridge.
- EnhancementTool descriptions include the site host so multi-connector setups can disambiguate identically-named tools.
- Enhancement`wp_replace_in_post` supports targeted edits on the WordPress custom\_css post.
- Enhancement`initialize` response advertises resources and prompts capabilities alongside tools.
- Fix`wp_update_widget` and other tools with nested object schemas now validate under stricter MCP clients.
- HousekeepingStale OAuth clients are pruned by the daily maintenance cron.

## [1.5.1](#v1-5-1)

September 10, 2026

- NewBrowser-based AI agents can now use Royal MCP tools via any WebMCP-compatible bridge, using the visitor's existing WordPress login.
- NewBrowser Agents section on the settings page toggles the WebMCP path on or off.
- NewPublishes a machine-readable server card and skills index so Agent Readiness scanners auto-detect the site.
- EnhancementRate-limit responses now include the seconds until retry so MCP clients know exactly when to try again.
- EnhancementAuthenticated requests get a higher rate-limit ceiling so legitimate bulk operations no longer trip the anti-abuse limit.
- FixRate limits behind Cloudflare now count per real visitor instead of coalescing everyone at the edge server IP.
- FixThe Perfmatters compatibility warning no longer appears when Disable REST API is only blocking logged-out visitors.
- FixThe site icon in the server identity response now returns as a string for all icon formats.

## [1.5.0](#v1-5-0)

September 5, 2026

- NewThree Elementor discovery tools (widget schema, widget list, dynamic tags) plus an include-styles option on the page-outline tool.
- NewThe Troubleshooting Help tab surfaces the fix for the most-reported OAuth reconnect issue directly in WordPress admin.
- EnhancementRoyal MCP now speaks the modern MCP wire, improving compatibility with newer Claude.ai, ChatGPT, and other AI client connectors.
- EnhancementSupport for multiple MCP protocol versions on the initialize handshake so newer AI clients get the latest wire behavior.
- EnhancementOAuth discovery now works for AI clients that probe the alternate path-scoped discovery URL.
- EnhancementEvery MCP request now appears in the Royal MCP Activity Log for improved diagnostic visibility.
- EnhancementA compatibility notice appears when the Perfmatters plugin is set to disable the REST API, which would otherwise block MCP connections.
- EnhancementEvery tool advertises complete input and response metadata for improved compatibility with strict MCP clients like ChatGPT.
- EnhancementThe internal ChatGPT connection guide walks the sign-in modal, WordPress authorize page, and post-connection state as distinct steps.
- FixUnknown MCP methods return the correct method-not-found response so probing AI clients do not get stuck in reconnect loops.
- FixThe /register OAuth endpoint returns 405 Method Not Allowed with a proper Allow header for GET requests.
- FixWhen a database table upgrade fails on incompatible host configurations, the plugin now skips retries for 24 hours to prevent error-log flooding.

## [1.4.45](#v1-4-45)

August 31, 2026

- FixPlugin constant definitions no longer emit PHP notices when Royal MCP is loaded alongside a wrapper plugin that pre-defines the same constants.
- NewSolid Security integration adds four tools — read the security status summary, list currently locked-out IPs, read the security event log, and add an IP to the ban list.
- NewContact Form 7 integration adds three tools — list forms, read a single form's parsed field schema, and list submissions when the Flamingo add-on is active.
- NewMonsterInsights integration adds four tools — read the analytics overview, top pages, traffic sources, and top Google Search Console queries.
- NewW3 Total Cache integration adds three tools — read cache configuration across every module, purge cache (all, by URL, or by post), and read usage statistics.
- NewDuplicator integration adds three tools — list migration packages, read per-package status, and get the installer URL for a completed package.
- NewBuddyPress integration adds four tools — list community members, read a single member profile, list groups, and read the activity feed.
- NewMCP server identity now advertises the WordPress Site Icon so connector cards show per-site branding.
- EnhancementWooCommerce coupon and product read responses now include ISO 8601 date variants and additional catalog and subscription fields.
- EnhancementHelp page CSS and admin links now work correctly when the plugin is vendored inside a wrapper plugin.
- FixWooCommerce order tools now register correctly with ChatGPT.

## [1.4.44.1](#v1-4-44-1)

August 30, 2026

- FixWooCommerce order tools now register correctly with ChatGPT.

## [1.4.44](#v1-4-44)

August 28, 2026

- NewYoast SEO integration adds five tools — read the full Yoast meta surface, capture the JSON-LD schema graph, list indexed internal links, list Premium redirects, and update Yoast title/description/focus keyword with a 72-hour undo token.
- NewUpdraftPlus integration adds four tools — list local backup history, read per-backup status, trigger a new backup, and read the current backup schedule.
- NewWPForms integration adds four tools — list forms, read a single form's field schema, and (Premium) list submissions plus read a single submission.
- FixEnvelope helper's full-JSON-mirror path no longer throws on non-array input during defensive test paths.
- FixPost meta, SEO meta, Yoast meta, and featured image edits made through Royal MCP tools now trigger the standard WordPress post-save event so page-cache plugins and SEO indexable rebuilders pick up the change automatically.
- FixDivi tools now return a clean not-active error on sites where Divi is not installed.
- Fixdivi\_validate\_layout accepts raw\_content on sites without Divi installed so cross-site validation workflows work without the plugin being present.
- FixMeta writes now bump the post modification timestamp so sitemap regenerators, feed cache invalidators, and staleness detectors keyed on post\_modified fire correctly.
- Fixwp\_get\_post, wp\_get\_page, wp\_get\_posts, and wp\_get\_pages return featured\_media (attachment ID) and featured\_media\_url in the response envelope.
- Fixwp\_set\_featured\_image persists the alt\_text argument on both the media\_id and image\_url input paths.
- Fixmcp\_undo\_last\_operation documentation names yoast\_update\_meta in the supported-tools list.
- FixTier-gated tools return a uniform {state: "unavailable", reason, tier, message} envelope so AI callers cannot misread a tier gate as an empty query result.
- Fixyoast\_get\_meta returns Open Graph, Twitter, canonical, and breadcrumb fields as both the stored template and the resolved value Yoast renders (featured image fallback, permalink fallback, post title fallback).
- Fixyoast\_get\_meta surfaces analysis\_pending so callers can distinguish a post that has never been scored from a post with a real low content\_score or linkdex.
- Fixyoast\_get\_schema removes empty author references from the JSON-LD graph so posts with unresolvable authors no longer produce invalid Article markup.
- Fixyoast\_get\_internal\_links returns link\_index\_status (indexed, index\_pending, no\_links) plus a content\_anchor\_count cross-check so callers can distinguish a post with no links from a post the link index has not processed yet.
- Fixupdraftplus\_trigger\_backup dispatches asynchronously via WP-Cron and honors the entities argument (a caller requesting entities:["plugins"] gets a plugins-only backup).
- Fixfc\_purge\_url purges the homepage, category and tag archives, paginated pages, and other URLs that do not resolve to a single post or page.
- FixWPForms form schema returns choices as an indexed list with label/value/key, required as a boolean, timestamps as ISO 8601 strings alongside epoch integers, and form listing paginates deterministically on same-second creations.
- NewIn-plugin Help page with per-client setup guides (Claude Desktop, claude.ai Web, Claude Code CLI, ChatGPT, Cursor, VS Code, Continue), a three-rung quick-fix troubleshooting ladder, and a copy-ready diagnostic-info block for support requests.
- NewNewsletter signup link in the Royal MCP admin header and Support tab.
- EnhancementCross-sell notice bar above every Royal MCP admin page.
- EnhancementEvery integration's tools now appear in the MCP tool list on connect (WooCommerce, Elementor, Divi, ACF, Yoast, UpdraftPlus, WPForms, SiteVault, ForgeCache, GuardPress, Royal AI Firewall, Royal Ledger, Royal Links, Redirection) so activating a supported plugin no longer requires reconnecting the AI client, and every tool schema now passes strict-validator MCP clients (VS Code, ChatGPT strict mode) after fixing meta-update, WooCommerce order, Elementor widget, ACF field, option, theme-mod, and widget-update surfaces.

## [1.4.43](#v1-4-43)

August 24, 2026

- NewDivi 4 and Divi 5 page tools in Free — clone a page, swap images, and import a library template, all with 72-hour undo tokens.
- NewElementor library-to-page bridge (`elementor_apply_template_to_page`) plus tools to repair pages where the Elementor render is missing (single and bulk).
- NewSiteVault backup tools now work with the free SiteVault plugin from WordPress.org in addition to SiteVault Pro.
- EnhancementEvery destructive write emits a 72-hour undo token in the response text; responses now surface actionable URLs, IDs, and counts.
- Enhancement`elementor_replace_text` adds dry-run preview, expected-count guard, image alt/title walking, and optional media-library sync.
- FixTool schemas conform to strict JSON Schema so VS Code and ChatGPT Plugins accept the tools at load time.
- Fix`elementor_clone_page` populates page content so cloned pages stay visible to WordPress core search.
- FixOAuth discovery adds a filter to override the metadata URL for hosts intercepting `.well-known/`.

## [1.4.42](#v1-4-42)

August 20, 2026

- EnhancementWrite-verification helper now detects pre-write input mangling for tools that require strict input fidelity.
- EnhancementTool argument sanitizers now preserve %XX escape sequences so URLs, patterns, and templated inputs survive round-trip.
- Fixwp\_update\_permalink\_structure preserves permalink tokens like %category% and %author% when writing the structure.
- FixHardens redaction of sensitive data across plugin/option/meta read tools and debug log responses.

## [1.4.41](#v1-4-41)

August 15, 2026

- NewSix Divi builder tools for safer AI-driven Divi editing (get page format, outline, validate layout, list local templates, library get, replace text).
- Newwp\_publish\_and\_promote publishes a draft and inserts it into a menu in one call.
- Newwp\_create\_menu creates a WordPress navigation menu with optional theme-location assignment.
- Newwp\_create\_preview\_link generates a shareable draft-preview URL for one preview session.
- Enhancementwp\_get\_post\_revisions returns per-revision content\_length for quick change-size scanning.
- EnhancementDestructive write tools now warn when literal escape sequences appear in replacement text, so operators catch double-escaping before it lands.
- EnhancementOAuth discovery self-check now detects Sucuri / CloudProxy edge blocks and links to a Sucuri-specific fix guide.
- EnhancementA "Re-check now" button on host-blocked admin notices re-probes OAuth discovery in-place during troubleshooting.
- EnhancementOAuth discovery cache shortens automatically on WAF-fronted sites for faster feedback after configuration changes.

## [1.4.40](#v1-4-40)

August 12, 2026

- NewEvery write tool re-reads modified fields after the write and returns the actual saved values.
- NewUndo tokens now cover wp\_delete\_post, wp\_delete\_term, and wp\_delete\_menu\_item, restoring deleted objects within 72 hours via mcp\_undo\_last\_operation.
- Newwp\_update\_post preserves the WooCommerce product\_type when generic post updates would otherwise reset it to Simple.
- Newwc\_get\_order returns fee\_lines, shipping\_lines, and the raw payment method ID for full write-verification.
- Newwp\_get\_seo\_meta and wp\_update\_seo\_meta now support AIOSEO and SEObolt alongside Yoast and Rank Math.
- Newwp\_get\_widgets returns widget instance content and parsed block markup for before/after diffs.
- NewOAuth endpoint paths (authorize/token/register) are filterable via royal\_mcp\_oauth\_rewrite\_paths.
- NewAdmin notice detects when a published page shadows an OAuth endpoint.
- Enhancementwp\_get\_posts + wp\_count\_posts accept non-public post types when the caller has edit capability.
- EnhancementOption writes require opt-in to the read allowlist first; admin\_email + default\_role + mailserver\_\* permanently denylisted.
- EnhancementJSON-RPC envelope hardening re-forces "2.0" against edge-layer transformations.
- EnhancementRoyal MCP Pro promotion refreshed for post-launch with a green Upgrade to Pro link in the sidebar.
- Fixelementor\_replace\_text is now multi-byte and case-insensitive.
- FixUninstalling the free plugin no longer removes data used by Royal MCP Pro when Pro is installed on the same site.
- Fixseo\_audit\_meta\_tags now counts characters instead of bytes so titles and descriptions containing non-ASCII content are measured correctly.

## [1.4.39](#v1-4-39)

August 6, 2026

- NewFree plugin refuses activation when Royal MCP Pro is already active.
- NewOAuth session-length setting lets site owners choose how long AI sessions stay connected before requiring re-authorization.
- NewRevoke all active AI sessions from Settings → OAuth.
- Newwp\_replace\_in\_post and wp\_replace\_in\_page tools for literal find/replace inside post content with dry-run, expected-count safety, and read-after-write verification.
- NewSettings-page section to allowlist third-party plugin options for `wp_update_option` without writing filter code.
- NewWidget tools — list widget instances (optionally filtered by sidebar), list sidebars, and update widget content; writes gated by the theme-appearance admin toggle.
- Newwp\_reorder\_menu\_items now returns an undo token that mcp\_undo\_last\_operation can consume within 72 hours to restore the prior order.
- Newmcp\_undo\_last\_operation tool consumes an undo token and reverses the operation that generated it.
- Newseo\_audit\_meta\_tags fetches a post's actual rendered HTML and reports title, meta description, canonical, viewport, Open Graph and Twitter Card tags — catches conflicts that only appear in served output.
- NewWooCommerce order write tools — wc\_create\_order, wc\_update\_order, wc\_add\_order\_note — for B2B, wholesale, phone orders, and support-note trails.
- Fix`elementor_replace_text` now walks Blockquote widget fields (author name and quote content).
- EnhancementOAuth sessions now default to 24 hours.
- EnhancementAdmin auto-detects BitNinja WebShield interference with OAuth discovery and shows targeted host-support instructions.
- EnhancementAdditional /authorize, /token, and /register diagnostics in Activity Log.
- EnhancementReadme highlights Royal AI Firewall as the companion plugin for HTTP-layer AI bot visibility alongside Royal MCP.

## [1.4.38](#v1-4-38)

July 29, 2026

- NewAll tools register as WordPress abilities on WP 6.9+, accessible via the WP Abilities REST API and the WordPress MCP Adapter alongside the native MCP endpoint.
- NewRedirection plugin integration adds four tools for listing, creating, updating redirects and listing groups.
- NewGoogle Site Kit GA4 configuration accessible to AI agents with sensitive keys redacted.
- New`royal_mcp_connection_health` tool now returns active page-builder versions (Divi, Elementor, WordPress core) so agents can plan multi-step operations without a probe call.
- NewNew `.mcpb` bundle for one-click Claude Desktop install.
- NewFounding Members waitlist notification for the upcoming Royal MCP Pro release.

## [1.4.37](#v1-4-37)

July 23, 2026

- NewSix new Royal AI Firewall tools return dashboard stats, recent bot hits, per-bot policies, policy updates, daily rollups, and a block-all-AI-bots action.
- NewNew Royal Tools admin page lists every free Royal Plugins family member with one-click install links.
- NewNew `royal_mcp_connection_health` diagnostic tool returns route, auth method, session ID, and version details for any authenticated caller.
- NewNew `elementor_get_widget_settings` tool reads full settings for a single Elementor widget, container, section, or column by ID.
- NewCoexistence detection surfaces a routing hint on Elementor tool descriptions when Elementor's own MCP module is also active.
- NewCustom top header bar renders on every Royal MCP admin page with View Docs and Support buttons.
- EnhancementLightweight admin footer shows Royal Plugins family links plus the current plugin version marker.
- Enhancement`wp_update_post` and `wp_update_page` now accept `menu_order`, `post_parent`, `password`, `comment_status`, `ping_status`, `excerpt`, and `post_author` fields and return actual stored values so silent-drop by WordPress is surfaced rather than hidden.
- EnhancementNew `royal_mcp_tool_context` hook fires alongside the legacy `royal_mcp_tool_called` action with an enriched payload for downstream firewall integrations.
- Fix`wp_get_seo_meta` now correctly reports noindex state on Rank Math sites, and `wp_update_seo_meta` responses reflect actual stored values rather than requested values.

## [1.4.36](#v1-4-36)

July 18, 2026

- NewNew `wp_get_site_status` tool returns WordPress, PHP, MySQL, plugin, theme, and environment info in a single call.
- NewNew `wp_get_error_log_tail` tool returns the last lines of the debug log with optional keyword filtering.
- NewNew `wp_get_cron_schedule` tool lists every scheduled event with next-run time and overdue flag.
- FixHTML preserved in post meta, term meta, term descriptions, comments, order notes, post and page excerpts, and coupon descriptions.
- NewNew `royal_mcp_meta_value_sanitizer` filter lets sites customize per-key sanitization.
- NewAdmin notice detects when Imunify360 is intercepting the OAuth discovery endpoints and links to a fix article.
- NewAdmin notice detects when the site uses Plain permalinks and links directly to Settings -> Permalinks.
- EnhancementRefined descriptions across several read tools.
- EnhancementList responses on `wp_get_terms` and `wc_get_orders` include a `total_count` field.

## [1.4.35](#v1-4-35)

July 12, 2026

- FixOAuth-authenticated MCP sessions remain valid across access-token rotation.

## [1.4.34](#v1-4-34)

July 9, 2026

- New`wp_update_post_meta` accepts any JSON type (string, number, boolean, array, object).
- NewNew `wp_add_post_meta` tool adds a meta row without overwriting existing values under the same key.
- NewNew `wp_get_terms` tool lists terms in any registered taxonomy with pagination.
- SecurityMeta-write tools reject strings that look like PHP-serialized payloads at the schema boundary.

## [1.4.33](#v1-4-33)

July 3, 2026

- New`wp_create_post`, `wp_update_post`, `wp_create_page`, and `wp_update_page` accept a `date` parameter for scheduling and backdating.
- NewCreate-post and create-page status enum expanded to include `future`, `pending`, and `private`.
- NewNew `royal_mcp_tool_called` action hook fires after every MCP tool invocation with `(tool_name, status, error_message)`.
- NewActivity Log page surfaces a pointer to the free Royal AI Firewall plugin for HTTP-layer AI bot visibility.

## [1.4.32](#v1-4-32)

June 29, 2026

- New`wp_search` accepts optional `snippet` and `per_page` parameters for excerpted results.
- New`wc_get_orders` accepts a `page` parameter and returns `{orders, page, per_page, total, total_pages}`.
- HousekeepingGeneral readme cleanup and updates.

## [1.4.31](#v1-4-31)

June 25, 2026

- Security`wp_delete_post` capability check runs before the post-existence lookup.
- Security`wp_get_post_meta` requires `edit_post` capability for protected (underscore-prefixed) meta keys.
- SecurityEmpty-string text fields on update tools preserve the existing value instead of blanking it.
- EnhancementEvery post-identifying tool accepts either `id` or `post_id`.
- EnhancementNew wp.org review-request banner on the settings page, dismissable per plugin version.

## [1.4.30](#v1-4-30)

June 22, 2026

- NewNew `elementor_add_widget` tool builds Elementor pages widget by widget, with curated shortcuts for the 11 most common widget types and raw passthrough for the long tail.
- Security`elementor_add_widget` rejects unknown widget-type slugs at the boundary.
- SecurityCapability check order tightened in six integration tool wrappers.

## [1.4.29](#v1-4-29)

June 19, 2026

- FixRuntime DB migration reliably creates the sessions and OAuth tables on all installs.
- Fix`/register` self-heals when the OAuth tables are missing.
- Fix`uninstall.php` also removes the `royal_mcp_db_version` option for a fully clean slate on reinstall.

## [1.4.28](#v1-4-28)

June 13, 2026

- NewMCP clients can send their API key via the standard `Authorization: Bearer` header in addition to the existing `X-Royal-MCP-API-Key` header.
- New`wp_get_seo_meta` and `wp_update_seo_meta` cover the post URL slug alongside the existing SEO fields.

## [1.4.27](#v1-4-27)

June 13, 2026

- EnhancementMCP session state moved onto a dedicated `wp_royal_mcp_sessions` table.
- HousekeepingRemoved unused admin-AJAX handlers.
- HousekeepingReworded a section of the plugin description.

## [1.4.26](#v1-4-26)

June 9, 2026

- SecurityPer-tool WordPress capability checks added across all content, user, term, comment, and integration tools, with status filters converted to positive allowlists.

## [1.4.25](#v1-4-25)

June 3, 2026

- EnhancementMCP Server URL surfaced at the top of General Settings as the canonical inbound URL for every client.
- NewNew in-product MCP Client Setup Guides accordion covering Claude.ai, ChatGPT, Claude Desktop, and Cursor.
- EnhancementOutbound AI Provider Configuration renamed and separated from inbound MCP setup.
- EnhancementLegacy REST API Base URL and manual OAuth Client ID / Secret moved into an Advanced subsection.
- EnhancementUniversal admin icon alignment, keyboard focus rings on settings-page buttons, and improved helper-text contrast.

## [1.4.24](#v1-4-24)

May 31, 2026

- NewAdvanced Custom Fields integration -- 4 tools (`acf_get_field`, `acf_get_fields`, `acf_update_field`, `acf_get_field_groups`).
- Fix`wc_create_product` respects the `type` argument and creates the matching WooCommerce product class (Simple, Variable, Grouped, External).
- HousekeepingDescription and Installation sections point to the first-time setup walkthrough.

## [1.4.23](#v1-4-23)

May 26, 2026

- FixAI Platforms model dropdowns refreshed across Claude, OpenAI, Gemini, Groq, and Bedrock.

## [1.4.22](#v1-4-22)

May 24, 2026

- FixAI Platforms Test Connection on Claude uses the model selected in the dropdown.
- FixManually-configured OAuth Client ID and Secret can be cleared through the UI.
- SecurityOAuth root rewrite rules match both bare and trailing-slash variants.
- NewAdmin notice detects host-side 301 redirects on POST `/register`.
- New`.well-known/` self-check detects when a plugin or theme intercepts the discovery endpoint with an HTML page.

## [1.4.21](#v1-4-21)

May 20, 2026

- FixGutenberg block content round-trips byte-for-byte through the post-write tools.

## [1.4.20](#v1-4-20)

May 18, 2026

- FixWooCommerce order tools handle refund records without hanging.

## [1.4.19](#v1-4-19)

May 16, 2026

- NewSix Elementor clone-and-customize tools (`elementor_clone_page`, `elementor_replace_text`, `elementor_replace_image`, `elementor_get_page_outline`, `elementor_list_local_templates`, `elementor_import_template`).
- NewAdmin notice detects stale static `.well-known/oauth-authorization-server` files.
- HousekeepingElementor handling described explicitly in the page-builder section.

## [1.4.18](#v1-4-18)

May 16, 2026

- FixAuthenticated GET on the MCP endpoint is User-Agent-aware for the Anthropic session probe.
- Fix`wp_update_menu_item` and `wp_reorder_menu_items` preserve fields that were not included in the update.
- HousekeepingNew FAQ entries for DB-restore recovery, OAuth endpoint locations, and troubleshooting.

## [1.4.17](#v1-4-17)

May 16, 2026

- FixAuthorization codes moved onto a dedicated `wp_royal_mcp_oauth_auth_codes` table with atomic single-row consume.
- NewNew "Reset OAuth State" admin button clears registered clients, tokens, and pending auth codes in one click.
- NewMCP `tools/call` requests write a structured Activity Log entry on every invocation (argument keys logged, values excluded).
- FixActivity Log "View Details" modal renders Request/Response JSON.
- EnhancementPlugin admin CSS/JS use content-hash cache-busting.

## [1.4.16](#v1-4-16)

- NewOAuth flow writes structured Activity Log entries on every `/token`, `/register`, or `/authorize` failure (auth codes, PKCE verifiers, secrets, and tokens are excluded).

## [1.4.15](#v1-4-15)

May 9, 2026

- FixRegenerate API Key button reliably issues a new key.
- EnhancementNew API keys are 32-char lowercase hex to eliminate visual-ambiguity transcription errors; existing keys keep working.
- EnhancementMCP sessions use a sliding 24-hour TTL with refresh-on-access.
- SecurityAll `/wp-json/royal-mcp/*` responses send `Cache-Control: no-store, no-cache, must-revalidate, private`.
- SecurityInvalid API key returns HTTP 401 with `WWW-Authenticate: Bearer` per RFC 7235.

## [1.4.14](#v1-4-14)

May 7, 2026

- FixUnauthenticated GET on the MCP endpoint returns HTTP 401 with `WWW-Authenticate: Bearer resource_metadata="..."` per RFC 9728 so web-based MCP clients trigger OAuth discovery correctly.
- NewSelf-check detects when the host blocks `/.well-known/oauth-authorization-server` and surfaces a dismissible admin notice with the manual fix.

## [1.4.13](#v1-4-13)

May 5, 2026

- SecurityOAuth endpoint responses (`/register`, `/token`, `/authorize`) send `Cache-Control: no-store` by default.
- New10 WooCommerce variation and attribute tools covering CRUD, batch operations, and attribute-term management.
- New7 WooCommerce coupon management tools with full CRUD plus trash and purge.

## [1.4.12](#v1-4-12)

- EnhancementMCP `protocolVersion` bumped to `2025-11-25` to match current Claude Desktop builds.
- FixMCP GET stream returns HTTP 405 with `Allow: POST, DELETE, OPTIONS`.
- Enhancement`wp_get_taxonomies` returns a `slug` field alias; `wp_get_term_meta` returns a structured response matching the rest of the term-meta family.

## [1.4.11](#v1-4-11)

- NewNew tools -- `wp_update_term`, `wp_get_term_meta`, `wp_update_term_meta`, `wp_delete_term_meta`, `wp_get_taxonomies`.
- Enhancement`wp_create_term`, `wp_delete_term`, and `wp_add_post_terms` accept any registered taxonomy.
- Enhancement`wp_create_term` accepts an optional `slug`; `wp_create_post` and `wp_update_post` accept a `post_author` user ID.

## [1.4.10](#v1-4-10)

- NewRoyal Ledger integration (4 tools), ForgeCache integration (3 tools), and Royal Links integration (3 tools), each auto-loading when the host plugin is active.
- NewSEO meta tools (`wp_get_seo_meta`, `wp_update_seo_meta`) auto-detect the active SEO plugin and read/write title, description, focus keyword, robots, and OG fields.
- NewPermalink structure tools and post revision tools (read history and revert).

## [1.4.9](#v1-4-9)

- NewTheme appearance tools (active theme, theme mods, custom CSS read/write) gated by an admin toggle and a `royal_mcp_writable_theme_mods` allowlist filter.
- NewMenu item CRUD (create, update, delete, reorder) and comment moderation (pending list, approve, spam, trash).

## [1.4.8](#v1-4-8)

- FixCustom connector setup succeeds on sites updated from an early build without a deactivate/reactivate cycle.
- FixDynamic Client Registration (`POST /register`) returns a real 500 with the underlying error when the DB write fails.

## [1.4.7](#v1-4-7)

- NewNew `wp_get_plugin_settings` tool returns wp\_options matching a plugin slug with sensitive keys redacted.
- NewNew `wp_update_option` tool gated by an admin toggle (off by default), the `royal_mcp_writable_options` filter, and a hard denylist for sensitive option names.
- Security`wp_get_option` redacts sensitive keys; outbound HTTP timeouts reduced to 10 seconds.
- HousekeepingRefreshed plugin directory banners and tags.

## [1.4.6](#v1-4-6)

- NewNew tools -- `wp_upload_media_from_url` (SSRF-hardened), `wp_upload_media` (base64), `wp_set_featured_image`, and `wp_update_media`.
- Enhancement`wp_create_post` and `wp_update_post` accept `featured_media` attachment ID.
- EnhancementAPI-key authenticated requests run with administrator capability to match the trust level of the admin-only-accessible key.

## [1.4.5](#v1-4-5)

- NewWordPress Playground live preview available from the plugin listing.
- NewVideo walkthrough embedded on the plugin listing page.

## [1.4.4](#v1-4-4)

- NewCustom post type support -- `wp_get_posts` and `wp_create_post` accept `post_type`, and a new `wp_get_post_types` tool discovers all registered public post types.

## [1.4.3](#v1-4-3)

- SecurityAccess control on MCP REST API endpoints -- all tool calls require an authenticated API key or OAuth Bearer.

## [1.4.2](#v1-4-2)

- SecurityAuthentication enforced on every MCP request, with sessions bound to authenticated credentials.

## [1.4.1](#v1-4-1)

- FixResolved fatal error during activation on WordPress 7.0.

## [1.4.0](#v1-4-0)

- NewOAuth 2.0 authorization server with Dynamic Client Registration (RFC 7591), PKCE-secured authorization code flow, token refresh with rotation, WordPress login consent screen, and discovery at `/.well-known/oauth-authorization-server`.
- SecurityAccess tokens stored as SHA-256 hashes; authorization codes single-use with 10-minute expiry; PKCE (S256) required; redirect URIs restricted to localhost or HTTPS.

## [1.3.0](#v1-3-0)

- NewWooCommerce integration (9 tools), GuardPress integration (7 tools), and SiteVault integration (6 tools).
- SecurityMCP endpoint requires API key (`X-Royal-MCP-API-Key` header) with rate limiting at 60 requests per minute per IP and timing-safe comparison.

## [1.2.3](#v1-2-3)

- SecuritySSRF protection for outbound URLs; text domain renamed to `royal-mcp`; menu slugs updated for wp.org compliance.

## [1.2.2](#v1-2-2)

- NewDocumentation link on the Plugins page and documentation banner on the settings page.

## [1.2.1](#v1-2-1)

- FixClaude Connector setup guide link renders correctly.

## [1.2.0](#v1-2-0)

- SecurityOrigin header validation against DNS rebinding, session ID format validation, MCP 2025-03-26 Streamable HTTP spec compliance, and new `royal_mcp_allowed_origins` filter.

## [1.1.0](#v1-1-0)

- NewMulti-platform AI support (Claude, OpenAI, Gemini, Groq, Azure, Bedrock), Claude Desktop MCP connector, activity logging, and connection testing.

## [1.0.0](#v1-0-0)

- Initial release.