AlphaBridge MCP – Connect Claude and ChatGPT to WordPress

Ændringslog

4.5.3

• All visible texts of the plugin come in German on a German site (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal): the settings page with its cards, notices, tables, buttons, tooltips and the texts of its script; the consent screen with its access levels and its error pages; the description in the plugin list; the log, whose status and time now follow the language; and the refusals and error messages of the tools that an assistant passes on. The plugin brings these files itself; a language pack from translate.wordpress.org still takes precedence for every text it has.
• Stays English on purpose: what is written for the assistant — the descriptions of the tools and their parameters (shown behind the «i» in the fine-tuning), the server instructions and the notes on single elements in the outline that wp_get_builder_layout hands over — and the protocol’s own errors (JSON-RPC, and the error codes the OAuth standard sends to an app). The names and descriptions of abilities come from the plugins that offer them.
• The reasons why an app’s metadata document is refused, the note of wp_seo_detect about AIOSEO and the status and time in the log are translatable now. The plugin header names /languages as its Domain Path, so the plugin list shows the description in German also while the plugin is inactive.
• A command for Claude Code. After a connection is created, the settings page shows a ready-made claude mcp add --transport http … command with the endpoint and the token, as the guide on alphabridge-mcp.com does. The config with mcp-remote is now labelled for Cursor only: in Claude Code, ${AUTH} in that config stayed empty and /mcp reported it missing.
• The note under the fine-tuning names the rate limit without «(fixed)».
• The readme says what the audit log keeps: the latest 200 tool calls.

4.5.2

• The request for a review is a short strip at the foot of the coloured header of Settings → AlphaBridge MCP instead of a WordPress notice. As before it appears only there, once the site has used the plugin for at least 14 days and made at least 50 successful tool calls, names exactly these figures and asks everyone the same way. «Write a review» now counts as an answer: the strip does not come back afterwards, as after «Don’t show again». Its texts, and «(opens in a new tab)» for screen readers, come in German with the plugin, and so do the texts of the header around it that were still English on German sites («Connect your AI assistant», the question below it and the hints on the assistant buttons).
• A «Settings» link in the plugin list. The plugin’s row under Plugins now starts with «Settings», which opens Settings → AlphaBridge MCP, as WordPress plugins usually do. It shows only to users who may open that page, and it comes in German with the plugin (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal).

4.5.1

• The answer to a tool of AlphaBridge MCP Pro, and the paragraph about Pro in the server instructions, state facts only. A call of a tool that belongs to the separate AlphaBridge MCP Pro or its Agency plan is answered with the edition it belongs to and the page that describes the editions and their tools (https://alphabridge-mcp.com/docs). The steps to install Pro, the request to the assistant to point the person to Pro and the link to the prices are gone: ChatGPT’s app directory allows saying that a feature is missing, not promoting an upgrade. The server instructions of a site without Pro list what is not on the site and name the same page. No tool, permission or setting changed.
• The description says which reading tool waits for write access. It said that with write access off assistants could not read code, files, the database, logs or credentials; this plugin has no tool for any of these. Its only reading tool that waits for write access reads user profile fields (wp_get_user_meta). The description, the installation steps and the FAQ now say so. The description also says that each connection keeps its access level (Full, Content or Read only) when write access is on.
• The directory page is shorter: a shorter name and short description, the description in short paragraphs, the AlphaBridge Connect hub under its own heading (up to 10 sites in one chat, free, in every edition) and AlphaBridge MCP Pro as a list. «fast, stable» and «faster and more stable» are gone from the plugin’s description and the readme; nothing measured backs them. The captions of screenshots 1 and 5 match the current settings page.
• The new sentence of the answer to a Pro tool comes in German with the plugin (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal); the two sentences with the steps to install Pro are gone.
• A token in the query string or in the request body is never accepted, also with the connector URL switched on. With the connector URL on, /mcp?token=… and a token field in the body were taken as the token too; only the path /mcp/<token> was meant. Now only the path counts, as the FAQ says. Header authentication is unchanged.
• The server instructions of a site without Pro name changing the texts, links and images of page-builder elements as not on this site, instead of the texts of page-builder pages: reading them with wp_get_builder_layout works on every site. The list of what AlphaBridge MCP Pro adds says that its test requests run after PHP code is saved and catch the fatal errors they hit, not every error.

4.5.0

• The main switch «Write access for AI assistants» replaces the box with the modes Read and Full. It sits where the box was, the first thing on Settings → AlphaBridge MCP, and holds for every connection — Claude, ChatGPT, Cursor and all others. Off (as every site starts) assistants only read; on, they read and write with full power. The page calls the states «write access off (read only)» and «write access on (full power)»; the internal names (read, full), the option and the PHP interface stay as they were. Switching on opens a small window at the switch with the notice and a box to tick (without JavaScript the same fields stand in the page); switching off takes one click. The notice is new (version 2): changes take effect immediately, they can create, change and also delete, not everything can be undone, at your own risk, a current backup. A confirmation of the notice of 4.4.0 stays valid; nobody has to confirm again.
• Switching on write access switches everything on. Every tool is on afterwards, also one that was switched off before or kept off from a version before 4.4.0. Single tools can be switched off under Fine-tuning; that holds until write access is switched on the next time. Only a switch from off to on does this: a second click from an old tab while write access is on changes nothing. An update alone resets nothing.
• The fine-tuning, compact and open. Four main groups, seven at most with the Pro add-on (Content; Site & users; Plugins, themes & code; Database & operations; Shop; Undo; Abilities of other plugins), each with its switch, its tool groups and how many of its tools are on; every tool group opens its tools. Every tool shows a short name in your language next to its name in code, and its description for the assistant behind an «i»; the search finds a tool by either and by the names of its groups. The only badges left are «Reads» and «Writes», each with a symbol; readers that wait for write access say «only with write access». One button saves everything.
• Refusals of the switch, the access level, the role and the fine-tuning lead to the place where they are changed. When write access is off, the connection’s access level does not include a tool, the account lacks the capability, or a tool is switched off under Fine-tuning, the answer says why in one sentence, what the person can do, gives a direct link (to the switch, the fine-tuning, the connections or the users) and asks the assistant to pass it on kindly and try again afterwards. The same holds where a tool itself refuses because the account’s role does not allow it — this post, this user’s meta, publishing: the answer adds that an administrator can change the account’s role under Users, with the link.
• Tools of AlphaBridge MCP Pro are named as such. A call of a tool that belongs to the separate AlphaBridge MCP Pro or its Agency plan is answered with what it is and where it comes from instead of «Unknown tool», and the server instructions of a site without Pro say in a short paragraph what Pro adds. Nothing in this plugin is locked or limited by it.
• New connections start with the full access level. The consent screen preselects «Full», and says that the switch for write access on the site decides whether assistants may write; an approval without a choice gets the full level too. Connections made before keep their level.
• The texts of the switch and the fine-tuning, the short names of the tools and the refusals for the account’s role come in German with the plugin (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal); dates on the settings page follow the language.
• For add-ons: the action ab_mcp_reset_switches (write access switched on), the filters ab_mcp_unavailable_tool_message and ab_mcp_tool_label (a tool’s short name), the action ab_mcp_fine_save (one save for the fine-tuning), the helpers AB_MCP_Admin::fine_row_html(), fine_sub_html(), count_badges() and addon_text(), and the class AB_MCP_Guidance with role_refusal().

4.4.0

• Page builders: wp_get_builder_layout recognises the builder a page was made with and reads the page as an outline. For an account that may edit the post, it lists the page’s elements in page order, each with its id, type and parent, and with its visible text, heading, HTML, link and image fields. Code, forms, global parts and elements it does not know are listed as locked, with the reason and without their content; the raw builder data, styling, attributes and scripts are never handed out. The answer also names the builder, whether it is active, what the site shows (storage), where copies of the page are kept, a hash of the layout to compare before and after a change, and the tools that change the page with a visible effect (write_via). Read, as of 1 October 2026: WordPress blocks, Elementor (classic and atomic elements), Beaver Builder, SiteOrigin Page Builder, SeedProd, GenerateBlocks, Kadence Blocks, Spectra, Stackable, Pagelayer, Otter Blocks and CoBlocks (both as plain blocks), WPBakery Page Builder, Divi 4, Avada, Flatsome and Enfold — the last five from the vendors’ documentation and code, not yet checked on a live installation, which the answer says. Further builders, among them Bricks, Breakdance, Oxygen and Divi 5, are recognised but not read; the dated list is in the FAQ. An Elementor element that Elementor has not registered is listed as locked with the way: the plugin that provides it; for a container while Elementor’s Container feature is off, the switch under Elementor › Settings › Features; for an atomic element while Elementor’s Atomic Editor is off, the switch under Elementor › Settings › Atomic Editor. A guided prompt, edit_builder_page, takes an assistant through recognising, reading, previewing, applying and checking a change.
• wp_get_post says which page builder a post was made with. The new field built_with names the builder, whether it is active, its version, what the site shows and the tools that change the page with a visible effect, with a note where post_content is not simply the page.
• wp_list_posts filters by page builder. built_with takes a builder id as wp_get_post names it, any for every known builder or none for posts without one. The totals count only matching posts, and each listed post names the builder found on it.
• wp_update_post refuses a change to the content only where the builder shows its own data. Where an active builder renders a page from its own data — Elementor, Beaver Builder, SiteOrigin Page Builder or Enfold, and only on a page that has such data — post_content is a copy the site does not show, so a change to it would not appear. Such a call is refused before anything is written, and the answer says how to change the page instead; title, status, excerpt and the other fields still change when the call leaves the content out. Where the builder is inactive, restores its own copy on its next save, or may or may not show its own data, the change is saved and the answer says what to expect.
• wp_duplicate_post copies a page with its custom fields and page builder data. A copy used to carry only title, content, excerpt, parent, order and terms, so a builder page came out as a text page. For an account that may edit the original, the copy now also gets the custom fields, the page template, the featured image and WordPress’ list of removed hooked blocks. Page builder data — Elementor, Beaver Builder, SiteOrigin, Themify, Zion, Live Composer, Brizy, Visual Composer, SeedProd and Pagelayer — holds markup, so it is copied only for an account with the unfiltered_html capability, and each builder’s keys together or not at all. Elementor elements get new ids where the layout can be read; otherwise it is copied unchanged, and the answer says so. Other builders’ data is copied byte for byte, and the answer says so. Builder caches, credential-shaped keys, the original’s editing state and other plugins’ protected keys are not copied; the answer lists what stayed behind and why.
• Hardening: page builder data in the meta argument needs the unfiltered_html capability. wp_create_post and wp_update_post wrote keys without “_” in which a page builder keeps markup or code — panels_data, dslc_code, pagelayer-data, brizy, mfn-page-items, tve_updated_post and others — for any account that may edit posts. For an account without unfiltered_html such a call is now refused before anything is written; the answer names who has the capability, the builder’s own editor, the tools that change the page’s texts, and the call without the key for the other fields. Other keys behave as before. Site owners can change the list with the ab_mcp_builder_markup_meta_keys filter.
• MCP 2026-07-28 alongside the older revisions. The endpoint also speaks the stateless revision 2026-07-28: a request that names it in _meta is answered in it, with server/discover, result types, cache hints and the checks of the MCP-Protocol-Version, Mcp-Method and Mcp-Name headers, and without a session. initialize and the requests of the revisions 2024-11-05, 2025-03-26 and 2025-06-18 are answered as before, apart from one new field in the site’s self-description (protocol_versions). The newer revision can be switched off under Settings → AlphaBridge MCP → Your connections → «MCP protocol 2026-07-28 (advanced)», or with the ab_mcp_modern_protocol filter; the site then answers in the older revisions only.
• Apps can identify themselves with a client metadata document (CIMD). Besides registering with the site (RFC 7591, unchanged), an app may give the HTTPS address of its client metadata document as its client id, the registration MCP 2026-07-28 prefers. The site fetches that document only once a logged-in user who may approve connections opens the consent screen: from public addresses only, without redirects, at most 5 KB within 5 seconds, kept for at most a day. The consent screen names the host it came from. It can be switched off under Settings → AlphaBridge MCP → Your connections → «Connect from Claude (OAuth, advanced)» → «Accept apps with a metadata document», or with the ab_mcp_oauth_cimd filter, and it is off while WordPress blocks outgoing requests. Details under External services.
• Read out of the box: the modes Read and Full. AlphaBridge MCP now starts in Read, on new sites and on every site after this update: assistants can read content, media, terms, comments, settings and the structure of the site; every tool that creates, changes or deletes is refused, wp_undo included, and so is every tool marked Mighty that reads code, files, the database, logs or credentials, with an answer saying why and that an administrator can switch to Full at the top of Settings → AlphaBridge MCP. That switch is the first thing on the page. Switching to Full takes a ticked box under a notice that it can be destructive and is at the site owner’s own risk; the account, the time, the version and the wording of the notice and the plugin version are recorded in the plugin’s settings and in its log, the last 20 switches also in a history that clearing the log leaves alone, and the page shows since when and by whom — or that code set Full and nobody confirmed it there. In Full every tool is on, the powerful ones marked Mighty included, unless an administrator switches it off under «Fine-tuning (for advanced users)». Back to Read takes one click. The server instructions and the consent screen say when a site is in Read; the tools it refuses stay listed there, as writing tools did under the former read-only mode, and are refused when called. After the update, administrators see a notice that explains the change until one of them dismisses it or switches the mode. The global read-only switch is gone, Read replaces it; switches saved before no longer hold writing Mighty tools off, while a Mighty tool that only reads and was switched off stays off in Full until an administrator switches it on under Fine-tuning. The texts of the modes come in German with the plugin (de_DE, de_DE_formal, de_AT, de_CH, de_CH_informal); a language pack from translate.wordpress.org takes precedence. The access levels per connection (Read only, Content, Full) are unchanged.
• The access levels on the consent screen are described. When an app connects, the consent screen offers Read only, Content and Full as a choice, each with one sentence on what the connection may then do and what not. Content stays preselected.
• Refusals from AlphaBridge’s own checks name the way. Where AlphaBridge itself refuses a call or reports a failure, the answer now says, beyond what did not work and why, what does: the tool that finds an id, the right it takes and who has it, the switch under Settings → AlphaBridge MCP → Fine-tuning, a wider access level when connecting, the values a parameter accepts, the filter a site owner can use — and, where WordPress gives no reason, how to check the result. Errors WordPress itself reports are passed on as WordPress words them. The rate limit names its figure. No limit, permission or behaviour changed.
• The texts about the Pro add-on’s undo give its current window: undo points expire after 7 days by default, adjustable from 1 to 30 days, in the description and in the box about AlphaBridge MCP Pro on the settings page.
• For add-ons: the builder interface is versioned by the constant AB_MCP_BUILDER_API (1), with the filters ab_mcp_builder_adapters, ab_mcp_builder_signatures, ab_mcp_builder_block_profiles, ab_mcp_builder_write_via and ab_mcp_builder_content_update_guard. AB_MCP_Site_Mode says which mode a site is in (get(), is_full(), allows()), and the action ab_mcp_site_mode_changed fires when an administrator switches. A connection with Content access may run an add-on’s wp_update_builder_element.

4.3.11

• An invitation to the affiliate programme, on the settings page. One line in the side column, below the box about AlphaBridge MCP Pro: the commission — 60% of every Pro and Agency sale you refer, renewals included — and a link to the programme’s page on alphabridge-mcp.com, which has the full terms and says how to apply. The link opens in a new tab and carries no tracking. The commission comes from sales of the separately sold Pro and Agency editions; this free plugin itself earns none. Where the Pro add-on shows your own affiliate figures, it takes the line’s place. No tool or setting changed.
• For add-ons: the filter ab_mcp_affiliate_invite decides whether the line shows.

4.3.10

• A new settings page: pick your assistant first, then follow its steps. The page opens with the plugin’s logo, this site’s state (connections, tools switched on, read-only mode) and a choice of assistant — Claude, ChatGPT, Cursor or another client. Each gets its own steps with direct links: for Claude into its connector directory, with this site’s address ready to copy, the setup video and the step-by-step guide; for ChatGPT to its plugins page, with this site’s endpoint. Creating a token is offered where one is needed — for Cursor and other clients — and no longer next to the ways that never use one. The page remembers the assistant you picked in your browser.
• Capabilities with switches. One switch turns all tools on or off, one read-only mode, and every group has a switch of its own. Open a group to see each tool with what it does — the first sentence, the whole description behind the «i» — and switch it on its own. A search finds a tool by name or description. A group that is partly on shows it; the bar at the bottom tells you when switches have changed and are not saved yet. What the form saves is unchanged.
• The connections now follow the capabilities, above the log. «1 tool» instead of «1 tools».
• For add-ons: the side column has a place for their boxes (ab_mcp_admin_side_boxes), between the box about AlphaBridge MCP Pro and the guides.

4.3.9

• The box about AlphaBridge MCP Pro on the settings page says what Pro adds, how to try it and what it costs. It now stands at the top of the side column: what the separately sold plugin adds on this site, a button that starts the 7-day trial without a card, and the monthly and the yearly price. Each link opens the Freemius checkout, which sells AlphaBridge MCP Pro, for exactly what it names — trial, monthly or yearly — and carries no tracking. On a site where AlphaBridge MCP Pro runs with a valid Pro or Agency licence the box no longer shows; it offered what the site already had. Its look comes from a small stylesheet that ships with the plugin and loads only on this settings page; nothing is loaded from outside. No tool or setting changed: this free plugin remains complete and fully functional on its own.

4.3.8

• wp_update_post saves a page whose page template is gone like any other. WordPress saves a post’s page template along on every save; where that template no longer exists — after a theme switch, say — the tool reported «Invalid page template» although the change was already saved, and the hooks after the save did not run: a scheduled post got no schedule, caches were not cleared. Now WordPress falls back to the default template, as the classic editor does, and finishes the save; the page already looked that way.

4.3.7

• In wp_update_post, a file that would take its visibility from its parent needs the right to publish — also through «draft» or another parent. WordPress stores a file with any status but «private», «trash» or «auto-draft» as «inherit», and a file with «inherit» is as visible as its parent: public without one, and public the moment the parent is published. wp_update_post asked for the right to publish only when the status asked for would publish, so an account without that right could make a private file public by asking for «draft» or «pending», or make a file that a draft kept hidden public by giving it another parent. Now a save that makes a file «inherit», or leaves a file «inherit» or in the trash (from where it comes back as «inherit») under another parent, needs the right to publish — whatever the parent’s status is now, since a draft that is published later shows the file too. The parent that counts is the one WordPress stores: none where a loop would run through the file, which any save can cause, a title alone included. A save that leaves status and parent as they are needs no such right. This is stricter than it would have to be in some cases, on purpose: an account without the right to publish can no longer move a file from one published post to another. «Visible» means the attachment page, the file’s entry in the REST API and its title, caption and description: WordPress never protects the uploaded file itself, whose address stays reachable.
• wp_create_post and wp_duplicate_post make no files. A file created or copied there had no file behind it: an attachment page with whatever text was given, stored as «inherit» — public without a parent — and a copy of a private file showed its title, caption and description. Files are added with wp_upload_media or wp_upload_media_from_url. A copy WordPress could not save is now reported as an error; it came back as a copy with the id 0.
• A parent must be a post id. wp_update_post took a parent given as null or a list as none — a file came off its post, a page moved to the top level — and wp_create_post took a list as post 1. Both are refused now. A file goes under another post only where the account may edit that post, as with the upload tools, and never under a revision or another file.
• A post in the trash that wp_update_post gives a status comes out the way WordPress takes one out: its comments get their states back, the notes the trash keeps are removed, and the hooks other plugins listen to run; a plugin may also keep it in the trash. It is still one save, with the status, date and fields asked for.
• wp_update_media reports a save that failed instead of «updated», and follows the rule of wp_update_post for files.
• wp_delete_post puts every kind of post into the trash unless force is set. It promised the trash, but WordPress moves only posts and pages there: a product, an event or a post of any other type was deleted for good, and a file together with the file on the server. Without force any post now goes to the trash. A file is deleted with wp_delete_media or with force, since the media library has no trash unless a site turns it on. A post already in the trash, or on a site without a trash, needs force to be deleted for good.

4.3.6

• In the connections list, the time a connection was last used and an expiry still ahead are shown as the site’s date and time in digits, to the minute, for example «2026-09-27 12:52» — the form of the log below, which adds the seconds. They were phrases such as «2 weeks ago» and «in 3 days»: WordPress translates the time span, the words around it come from this plugin, and a site whose language this plugin has no translation for yet mixed the two — a German site read «2 Wochen ago». «never», «expired» and the dash for a connection not used yet stay as they were. Found while recording a setup video on 27 September 2026.
• The steps for Claude start with the simplest way: «AlphaBridge MCP for WordPress» in Claude’s connector directory, where you enter your site’s address instead of copying the endpoint; it connects through the AlphaBridge Connect hub. The settings screen shows that way first, with this site’s address, while connecting from Claude (OAuth) is switched on — the hub signs in through it. The direct way, a custom connector with the endpoint, follows as the way without the hub.
• The steps for Claude no longer spell out its menus. Claude has rearranged them — Connectors now sit under «Customize», and a custom connector is added through an «Add» menu — so the settings screen, the notice after saving the tool selection and the installation steps, which pointed to «Settings → Connectors», no longer matched what Claude shows. The settings screen and the installation steps now say to open Connectors in Claude and add a custom connector there. The notice after saving says where in Claude to make a change visible: in Connectors, refresh the connector’s tool list — new in the notice — or disconnect and connect again.
• wp_list_posts keeps a steady order when several posts share the same date to the second, as posts created by an import or a script often do. Such posts came back in whatever order the database chose, which could change from one call to the next, so paging through a list could show one of them twice and leave another out. Posts that tie on the field being sorted by — date, title, modified or menu order — are now also sorted by their id, in the same direction, so a tie no longer shifts posts between pages. Sorting by id is unchanged. Found while recording a setup video on 27 September 2026, on a demo site where several posts carry the same date.
• wp_update_post takes a date, in the forms wp_create_post takes: site time, or RFC 3339 with an offset. Neither tool publishes a post, or takes one off the site, unless the call asks for it. WordPress decides between «publish» and «future» by the date: a post saved as «future» whose date is not at least a minute ahead is published at once. Until now «future» without a date did exactly that to a draft, which takes the time of the save. Such a save is now refused before anything is written, with the date it would have had and what to pass instead — a later date to schedule, status «publish» to publish, status «future» to schedule a published post. An edit to …