WP MCP 0.8.108: Scoped identities can now be pinned to IP addresses and CIDR ranges

WP MCP 0.8.108 is out. Here is what changed in this release:

• Scoped identities can now be pinned to IP addresses and CIDR ranges (IPv4 and IPv6) with the new allowed_ips option on create-identity. Requests from any other address are refused before any tool runs and recorded in the audit log.
• Client addresses come from REMOTE_ADDR. Forwarded headers are only honored from reverse proxies you list with the new wpmcp_trusted_proxies filter, so they cannot be spoofed.
• The Connection screen now lists each scoped identity with its allowed addresses.

Download it from the GitHub release, or see this release on the changelog alongside every earlier one.