What's new

Three new read-only diagnostic tools, safe-HTML preservation across the plugin's write path, and two new admin notices for the most common OAuth-discovery blockers.

New diagnostic tools

• wp_get_site_status — one-shot environment diagnostic. Returns WordPress + PHP + MySQL/MariaDB versions, active plugin count, active theme (name + stylesheet + template + version), memory limit, max upload size, timezone, disk free bytes, install age in days, WP_DEBUG_LOG state, and site + home URLs. Replaces the 3-5 separate tool calls that previously opened a debugging conversation.
• wp_get_error_log_tail — safe tail of wp-content/debug.log. Args: lines (default 100, max 1000) and optional filter (case-insensitive substring). Caps file read at last 1MB so a multi-GB debug.log never blows up PHP memory (truncated=true in the response when that happens). Returns status="disabled" with copy-pasteable wp-config.php instructions when WP_DEBUG_LOG is off.
• wp_get_cron_schedule — enumerate every scheduled wp_cron event with hook name, next run (unix + ISO 8601), seconds-until-next-run, an is_overdue flag, recurrence + interval, and args. Sorted ascending so overdue events come first.

HTML preservation across write tools

Eight places where an AI-authored value was silently flattened to plain text now preserve safe HTML:

• Meta writes (wp_update_post_meta, wp_add_post_meta, wp_update_term_meta) — routed through wp_kses_post. New royal_mcp_meta_value_sanitizer filter signature: (sanitized, raw, meta_key, object_id, tool_name) for per-key overrides without patching the plugin.
• Term descriptions (wp_create_term, wp_update_term) — inline tags preserved per WordPress core's own comment-form allow-list.
• Comment content (wp_create_comment) — uses wp_filter_kses to match exactly what the WP comment form permits (<a>, <strong>, <em>, <blockquote>, <code>, <cite>, <abbr>, <acronym>).
• Post + page excerpts on both the MCP tool path and the REST controller path.
• WooCommerce order notes (wc_update_order_status) and coupon descriptions (wc_create_coupon, wc_update_coupon).

Admin notices for OAuth-discovery blockers

• Imunify360 detection — classifies the JSON denial body Imunify360 returns before PHP runs and surfaces an admin notice with the exact paths a customer needs their host to allowlist (/.well-known/*, /wp-json/*, /authorize, /token, /register). Links to a support article with copy-pasteable hosting request text.
• Plain-permalinks detection — early gate that runs before any network probe. When permalinks are set to Plain (which prevents OAuth endpoints from being served at the domain root), shows a notice with a one-click link to Settings → Permalinks.

Ergonomics

• Sharpened descriptions on ~10 high-traffic list tools (wp_get_pages, wp_get_media, wp_get_categories, wp_get_tags, wp_get_comments, wp_get_users, wp_get_menus, wp_get_plugins, wp_get_themes, wp_get_site_info) — each now describes what fields it returns and when to prefer it over an adjacent tool. Improves AI-agent tool-selection accuracy.
• wp_get_comments.status gained a proper enum (approve, hold, spam, trash, all).
• Additive total_count field on wp_get_terms and wc_get_orders responses. Existing total field kept unchanged — no breaking change to current callers.

Repository config

• New .gitleaks.toml allowlists the royal_mcp_*_dismissed user-meta key naming pattern (false-positive on the generic-api-key rule).