What's new in 1.4.38

• WordPress Abilities API bridge — all tools register as WordPress abilities on WP 6.9+, accessible via the WP Abilities REST API and the WordPress MCP Adapter alongside the native MCP endpoint.
• Redirection plugin integration — four new tools for listing, creating, updating redirects and listing groups.
• Google Site Kit — GA4 configuration accessible to AI agents with sensitive keys redacted.
• royal_mcp_connection_health now returns active page-builder versions (Divi, Elementor, WordPress core) so agents can plan multi-step operations without a probe call.
• New .mcpb bundle for one-click Claude Desktop install.
• Founding Members waitlist notification for the upcoming Royal MCP Pro release.

Tool counts

Up to 144 max (73 WordPress core + 71 conditional integrations).

Install

• WordPress.org: https://wordpress.org/plugins/royal-mcp/
• .mcpb bundle for Claude Desktop: attached to this release

What's new in 1.4.37

Royal AI Firewall integration

• Six new tools return dashboard stats, recent bot hits, per-bot policies, policy updates, daily rollups, and a block-all-AI-bots action.

Royal Tools admin page

• New page lists every free Royal Plugins family member with one-click install links.

Diagnostic + inspection tools

• New royal_mcp_connection_health returns route, auth method, session ID, and version details for any authenticated caller.
• New elementor_get_widget_settings reads full settings for a single Elementor widget, container, section, or column by ID.

Ecosystem coexistence

• Coexistence detection surfaces a routing hint on Elementor tool descriptions when Elementor's own MCP module is also active.

Admin chrome

• Custom top header bar renders on every Royal MCP admin page with View Docs and Support buttons.
• Lightweight admin footer shows Royal Plugins family links plus the current plugin version marker.

Write-path improvements

• wp_update_post and wp_update_page now accept menu_order, post_parent, password, comment_status, ping_status, excerpt, and post_author fields and return actual stored values so silent-drop by WordPress is surfaced rather than hidden.
• New royal_mcp_tool_context hook fires alongside the legacy royal_mcp_tool_called action with an enriched payload for downstream firewall integrations.

SEO correctness

• wp_get_seo_meta now correctly reports noindex state on Rank Math sites, and wp_update_seo_meta responses reflect actual stored values rather than requested values.

What's new

Three new read-only diagnostic tools, safe-HTML preservation across the plugin's write path, and two new admin notices for the most common OAuth-discovery blockers.

New diagnostic tools

• wp_get_site_status — one-shot environment diagnostic. Returns WordPress + PHP + MySQL/MariaDB versions, active plugin count, active theme (name + stylesheet + template + version), memory limit, max upload size, timezone, disk free bytes, install age in days, WP_DEBUG_LOG state, and site + home URLs. Replaces the 3-5 separate tool calls that previously opened a debugging conversation.
• wp_get_error_log_tail — safe tail of wp-content/debug.log. Args: lines (default 100, max 1000) and optional filter (case-insensitive substring). Caps file read at last 1MB so a multi-GB debug.log never blows up PHP memory (truncated=true in the response when that happens). Returns status="disabled" with copy-pasteable wp-config.php instructions when WP_DEBUG_LOG is off.
• wp_get_cron_schedule — enumerate every scheduled wp_cron event with hook name, next run (unix + ISO 8601), seconds-until-next-run, an is_overdue flag, recurrence + interval, and args. Sorted ascending so overdue events come first.

HTML preservation across write tools

Eight places where an AI-authored value was silently flattened to plain text now preserve safe HTML:

• Meta writes (wp_update_post_meta, wp_add_post_meta, wp_update_term_meta) — routed through wp_kses_post. New royal_mcp_meta_value_sanitizer filter signature: (sanitized, raw, meta_key, object_id, tool_name) for per-key overrides without patching the plugin.
• Term descriptions (wp_create_term, wp_update_term) — inline tags preserved per WordPress core's own comment-form allow-list.
• Comment content (wp_create_comment) — uses wp_filter_kses to match exactly what the WP comment form permits (<a>, <strong>, <em>, <blockquote>, <code>, <cite>, <abbr>, <acronym>).
• Post + page excerpts on both the MCP tool path and the REST controller path.
• WooCommerce order notes (wc_update_order_status) and coupon descriptions (wc_create_coupon, wc_update_coupon).

Admin notices for OAuth-discovery blockers

• Imunify360 detection — classifies the JSON denial body Imunify360 returns before PHP runs and surfaces an admin notice with the exact paths a customer needs their host to allowlist (/.well-known/*, /wp-json/*, /authorize, /token, /register). Links to a support article with copy-pasteable hosting request text.
• Plain-permalinks detection — early gate that runs before any network probe. When permalinks are set to Plain (which prevents OAuth endpoints from being served at the domain root), shows a notice with a one-click link to Settings → Permalinks.

Ergonomics

• Sharpened descriptions on ~10 high-traffic list tools (wp_get_pages, wp_get_media, wp_get_categories, wp_get_tags, wp_get_comments, wp_get_users, wp_get_menus, wp_get_plugins, wp_get_themes, wp_get_site_info) — each now describes what fields it returns and when to prefer it over an adjacent tool. Improves AI-agent tool-selection accuracy.
• wp_get_comments.status gained a proper enum (approve, hold, spam, trash, all).
• Additive total_count field on wp_get_terms and wc_get_orders responses. Existing total field kept unchanged — no breaking change to current callers.

Repository config

• New .gitleaks.toml allowlists the royal_mcp_*_dismissed user-meta key naming pattern (false-positive on the generic-api-key rule).

What's new

• OAuth session survives access-token rotation — the per-session auth_fingerprint was bound to a hash of the raw bearer token, so hourly access-token rotation invalidated the fingerprint stored at initialize and every subsequent MCP call returned HTTP 403 "Session credentials mismatch" until the session TTL expired. Long automations (bulk edits, navigation-menu rebuilds, anything crossing an hour of activity) hit this reliably.
• Fix — fingerprint now derives from client_id + user_id returned by Token_Store::validate_token(). Both survive access-token rotation, so a re-issued token still resolves to the same session. Session-hijack defense across different (client_id, user_id) pairs is unchanged. API-key auth was never affected.
• No schema change, no forced migration. Sessions opened before 1.4.35 will still return 403 on their first post-refresh call until they expire naturally or the client re-initializes.

Resolves #54 (root cause + reproducer) and #13 (same underlying bug at a different tempo — long menu rebuild rather than long bulk edit).

What's new

• wp_update_post_meta — value schema expanded from string-only to any JSON type (string, integer, number, boolean, array, object). Arrays and objects are serialized by WordPress on write and round-trip as PHP arrays on read. Strictly additive — existing string callers see no behavior change.
• wp_add_post_meta — new tool mirroring WP core add_post_meta(). Adds a meta row without overwriting existing values under the same key. unique=true returns created=false cleanly when a row with the key already exists.
• wp_get_terms — new tool listing terms in any registered taxonomy with paginated output. Optional search, hide_empty, parent filters. Complements wp_add_post_terms (which needs integer term IDs) so agents can map term names to IDs on-site.
• Security — the two meta-write tools reject strings that look like PHP-serialized payloads at the schema boundary. Prevents PHP-object-injection primitives via maybe_unserialize(). Callers pass structured data directly; WordPress serializes safely on write.

Tool counts: WordPress core 67 → 69, total 126 → 129.

Highlights

• wp_create_post, wp_update_post, wp_create_page, wp_update_page accept a date param (ISO 8601). Combine with status="future" to schedule; use alone on update tools to backdate.
• Create-tool status enum expanded to [publish, draft, future, pending, private]. publish_posts cap gates future/private in addition to publish.
• New royal_mcp_tool_called action hook fires on every tool call (tool_name, status, error_message).
• Activity Log page surfaces a pointer to Royal AI Firewall for HTTP-layer AI bot visibility.

Summary

• Feature: wp_search now accepts optional snippet (int, max 1000 chars) and per_page (default 20, max 100) parameters. When snippet is set, each result row includes the matched post's slug and a content excerpt windowed around the first occurrence of the search term -- lets AI drivers skip a follow-up wp_get_page per result on multi-page audits. Snippet extraction strips HTML and registered shortcodes and is multibyte-safe. Strictly additive; existing callers see no behavior change.
• Feature: wc_get_orders now accepts a page parameter for stores with more than per_page orders. Breaking response shape: the tool returns {orders, page, per_page, total, total_pages} instead of a bare array. AI drivers should iterate page until page >= total_pages. Pre-1.4.32, orders beyond the first 100 were unreachable.
• Docs: General readme cleanup and updates.

Summary

• Hardening: wp_delete_post cap check now runs before existence lookup (no longer leaks existence to non-deleters); wp_get_post_meta requires edit_post for underscore-prefixed protected keys, mirroring WP core's is_protected_meta() convention.
• Hardening: wp_update_post / wp_update_page / wp_update_media / wp_update_term treat empty-string text fields as "preserve existing" rather than "blank the field." Defends against AI drivers that template-fill optional text args with empty strings.
• Ergonomics: Every post-identifying tool now accepts either id or post_id. Handler-level acceptance only; no schema changes; existing callers unchanged.
• UX: Founders Bundle banner switched to version-stamped dismissal (re-appears once per plugin version update). New wp.org review-request banner at the top of the settings page, same version-stamped pattern.

Summary

• New: elementor_add_widget MCP tool — first structural-write Elementor tool. Curated path covers 11 widget types (container, heading, text-editor, button, image, image-box, icon-box, icon-list, video, divider, spacer) with flat params; raw path accepts any registered widget type plus a full settings object. Containers nest children inline; atomic V4 widgets pass through opaquely. Curated video host-detects YouTube/Vimeo/Dailymotion; curated icon-list auto-generates repeater _ids. Cap-gated via edit_post.
• Hardening: elementor_add_widget validates widget_type against Elementor's widget registry — rejects unknown slugs at the boundary instead of serializing typos into _elementor_data as silent empty placeholders. Atomic V4 prefixes (a-* / e-*) pass through opaquely; fails open if the registry is unreachable.
• Hardening: Capability check order in six integration tool wrappers (GuardPress, SiteVault, ForgeCache, Royal Ledger, ACF, Royal Links) — cap check now fires BEFORE the "X is not active" check. Pre-1.4.30 a Subscriber-tier OAuth Bearer hitting an inactive integration received the "not active" error path, leaking integration presence. Per-handler object-level caps remain unchanged.

Summary

Restore the runtime DB-migration retry semantic that regressed in 1.4.27, plus three additional table-recovery hardening fixes so any install whose tables go missing (auto-update race, externally-dropped tables, uninstall/reinstall cycle) self-heals on the next pageload without user intervention.

• Restore maybe_upgrade_db() success-tracking — db_version only advances when every required migration actually ran, with a force-load fallback so a transient autoloader miss can't latch the install.
• Defensive /register self-heal — OAuth client registration now attempts to create missing tables once and retries before returning 500.
• maybe_upgrade_db() table-existence probe — the version-string short-circuit now also verifies required tables physically exist before returning early, closing a recovery gap where externally-dropped tables couldn't be self-healed by the runtime migration.
• uninstall.php clears royal_mcp_db_version — pre-1.4.29 the option survived uninstall and could short-circuit the next install's runtime healer on the same WP install.

Recommended for everyone on 1.4.27 and 1.4.28.