WP MCP 0.8.2 to 0.8.35: everything that shipped

WP MCP went from 0.8.2 to 0.8.35 in one long release train. That is a lot of version numbers, so this post groups the user-facing changes by theme instead of by release. Every item links back to the exact notes on the changelog, and the tools reference lists every ability the plugin now registers.

The one rule that runs through all of it: changes to existing data are snapshotted first, so your agent’s work stays undoable.

A PHP snippet store

0.8.2 adds a PHP snippet store: create, list, get, update and delete PHP snippets as stored, validated objects. Snippets are always created inactive, critical validation findings block creation, and every change is snapshotted and reversible. Activation is a separate, governed Pro operation that never executes code, and rollback always restores a snippet inactive.

Theme tools and a theme builder

• Theme context and theme mods (0.8.2): read the active theme’s framework, parent and child, block theme support and menus, and write allowlisted theme mods with a snapshot for rollback. Theme writes are off by default.
• Child themes and Astra settings (0.8.4): scaffold a child of the active theme with one confirmed call (off by default, never activated for you, fully reversible), and read or update Astra’s core colors and content width when Astra is the active theme.
• A built-in theme builder (0.8.10): create header, footer and 404 site parts, show each one by include and exclude display conditions (entire site, front page, archives, search, 404, post types and single posts), and render them into both classic and block themes without a page builder. A resolver explains which part wins for a given page and why.

Site archives, restores and site-to-site push

• Real restores (0.8.12): site backups can now be restored, not just checked. A restore takes a safety archive first, puts the site in maintenance mode, validates every SQL statement before anything is written, and rolls back to the safety archive automatically if the import fails. Database dumps also stop corrupting values that contain a percent sign.
• Push to another site (0.8.32): push a backup archive to another WordPress install over a secure connection, with a dry run by default, resumable chunked uploads, and a restore plus URL rewrite on the target. Both sides must opt in before any migration can run.
• Safer URL rewrites (0.8.32): rewriting site URLs now takes a database safety archive first and reports how to undo the pass.

Local to live sync

0.8.13 adds selective local-to-live sync. Build a change set of chosen pages, templates, patterns, menus and theme mods with their media, terms and template dependencies, inspect it, then apply it to another site with a dry run by default. Apply is snapshot-first and conflict-aware: objects changed on both sides are reported and left alone unless you force them, live-only data such as orders is never touched, and a whole sync can be undone with one session rollback.

WooCommerce: catalog depth and a two-step import

• Variations, bulk edits, coupons and taxes (0.8.17): create and delete variations, update up to 50 products or variations in one call as a single undoable session, and manage coupons (including validating a code against store rules) and tax rates. Deletes stay off until the site opts in and always need confirmation.
• The operations catalog, on Pro (0.8.28): read and write store data across products, variations, orders, refunds, coupons, customers, shipping, taxes, webhooks and settings through WooCommerce’s own REST API, with WooCommerce’s permission checks as the final gate. Changes to existing data are snapshotted, batches of up to 25 share one rollback session, and destructive operations such as deletes and refunds are off by default. Refunds never contact the payment gateway unless asked.
• A two-step product import (0.8.33): plan-product-import previews every row (create, update with a field-level diff, skip or error) without writing anything, and apply-product-import writes the approved plan, including variable products, variations and images, refusing if the store changed since. A whole import is one undo session.
• The WooCommerce edition (0.8.18) now ships the same WordPress.org-ready build as the main directory plugin, and a boot error in that edition is fixed.

Forms integrations

0.8.29 adds forms tools for Contact Form 7: list forms, fields and mail notifications, and read, trash, restore or delete Flamingo entries, with every status change snapshotted. On Pro, a forms adapter pack covers WPForms, Gravity Forms, Formidable, Ninja Forms and Fluent Forms: forms, fields, notifications, entries and reversible entry status changes.

Two things to know. Form submissions are now treated as user data, so every forms integration needs an administrator-level capability to read or change entries, and forms tools register only while their forms plugin is active. And the five adapters in the pack moved from the free tier to Pro in this release.

A custom widget builder

0.8.26 brings a custom widget builder to Pro: describe an Elementor widget as a data spec and the plugin compiles it into a real widget class. The generated PHP is linted against a closed allowlist before it touches disk, and it loads only from a hardened sandbox through a hash-verified manifest, so a tampered file stops loading. Compiling is opt-in through a filter and refuses without the edit_files capability or when DISALLOW_FILE_EDIT is set. On the block side, 0.8.9 makes updating, changing the status of and deleting a custom block snapshot-first, with an operation ID to roll back.

Custom CSS and JavaScript

0.8.8 adds CSS scoped to a single page or a single Elementor element, sanitized when written and again when rendered, with a snapshot per page so each change rolls back on its own. Site-wide custom JavaScript is optional and off by default: it works only when the site owner opens the WPMCP_ALLOW_JS_INJECTION gate and the caller can post unfiltered HTML, and every attempt is audited. See the custom CSS guide for the site-wide CSS path.

Deeper SEO

0.8.23 detects SEOPress alongside Yoast, Rank Math, The SEO Framework and SureRank, and SEO edits now require permission to edit the target post. New Pro tools read and write term-level SEO, set OpenGraph and Twitter images, read resolved social meta, and generate meta tags and JSON-LD schema (Article, WebPage, LocalBusiness, Product). Every SEO write is snapshotted and reversible.

Cloud settings sync and the marketplace

0.8.25 syncs your governance, exposure, skills and identity settings with WP MCP Cloud, with every synced change recorded and undoable. You can also browse the WP MCP Cloud marketplace and install widget and block specs as inactive drafts, validated and sanitized before they are stored. Before that, 0.8.16 moved cloud credentials into an authenticated-encryption vault keyed to your site’s salts, and made token refreshes safe under concurrent requests.

Media upload from bytes

0.8.20 adds upload-media, which puts a file in the Media Library straight from base64 bytes, for agents that hold the file itself rather than a URL. The file type is checked from the actual bytes against the site’s allowed upload types, executables and SVG are refused, the size is capped at the site upload limit, and rolling back deletes the upload and its files.

Site-wide find and replace

0.8.30 adds find-replace-content: find and replace across post content, titles, excerpts and selected post meta, preview-only by default, with every applied pass undoable in one step. Serialized and JSON meta, block attributes and page-builder data are never corrupted; unsafe items are skipped and reported.

A rendered page HTML reader

0.8.27 adds get-rendered-html, which returns the front-end HTML a visitor sees for a published page on your site, in chunks, with optional script stripping or text-only output. Your agent can now check an edit against what visitors actually get. It only ever fetches your own site’s address, and drafts, private and password-protected posts are not fetched.

Elementor global variables and a render cache fix

• Global variables (0.8.31): Elementor v4 color, font and size design tokens can be listed, created, updated and deleted, with strict type and value checks, a usage report before any delete, and one-step rollback. A breakpoint-only font size in global typography now actually renders on tablet and mobile.
• Rollback that really shows (0.8.21): undoing an Elementor edit could leave the page showing the undone styling, because the generated CSS was not refreshed. Rollbacks now clear Elementor’s generated CSS and element render cache, a new regenerate-elementor-css ability rebuilds it for one page or the whole site, and editing one page’s data clears only that page’s caches.

OAuth tokens bound to the MCP endpoint, and gateways

0.8.24 binds MCP OAuth access tokens to the MCP endpoint, so they no longer authenticate any other route on the site, such as the WordPress REST API or admin-ajax. OAuth discovery now names the MCP endpoint as the protected resource, and refresh token redemption is atomic. If a connected MCP client stops working after this update, reconnect it. Alongside this, 0.8.22 adds site-local gateway credentials with no cloud dependency, and refresh tokens now stop working when their user changes password or is deleted.

0.8.34 builds on those gateway credentials. A gateway credential can be bound to a scoped identity, is accepted only on the MCP connection, and every call it makes is narrowed to that identity and recorded in the audit log. Cloud gateway provisioning asks for explicit consent on cloud connect (off by default), and a kill switch revokes the credential locally, even offline. The self-hosted proxy can route a tool call to one named site or broadcast it to every site, with a separate credential and session per site and a confirm gate for broadcast writes.

An in-admin AI chat

0.8.5 adds an in-admin AI chat on Pro: talk to your site from wp-admin using your own Anthropic API key, stored encrypted per user and never sent to the browser. Chat runs every tool through the same permission, governance, rate-limit and snapshot path as any MCP client, under its own scoped identity. Any action that is not a pure read is shown as a proposal with its exact arguments and runs only after you approve it.

Smaller changes worth knowing

• Bridged third-party abilities are governed one by one, with the same toggles, identity scope and block rules as built-in abilities, and can be narrowed to an allowlist (0.8.6).
• Elementor atomic elements follow Elementor 4.3’s schema, and option names are matched the way the database matches them, so look-alike names cannot reach a protected option (0.8.2).
• Stock image search falls back to Openverse, a keyless provider, when none is set (0.8.11).
• Front-end redirects read from the object cache instead of querying the database on every page view (0.8.19).
• Each release package (directory, WooCommerce and full) was installed on a fresh WordPress 7.1 site and passed an MCP session with a snapshot and one-step rollback (0.8.35).

The remaining releases in this range (0.8.3, 0.8.7, 0.8.14 and 0.8.15) were internal test, code-quality and release-check changes.

Get it

Download the latest release from GitHub, browse every release, or see what Pro adds.