Resolves WordPress.org review finding for dynamic option keys in site settings handlers.<\/p>","2.0.2":"
Hardens WooCommerce customer updates, scopes admin notices, and resolves WordPress.org review findings for asset loading and bundled dependencies.<\/p>","2.0.1":"
Adds WordPress.org release metadata, uninstall controls, dependency notices, and submission-related security hardening.<\/p>","2.0.0":"
Invizo MCP is now standalone. Reconnect AI clients using a WordPress Application Password and the new Invizo MCP turns your WordPress site into a standalone Model Context Protocol server. It lets approved AI clients work with site content and supported plugins through a native endpoint hosted by WordPress:<\/p>\n\n No Invizo-hosted MCP backend, account, subscription, or license key is required. The plugin bundles the official WordPress MCP Adapter and PHP MCP Schema packages and exposes Invizo's action library through the WordPress Abilities API.<\/p>\n\n The MCP server exposes three compact protocol tools:<\/p>\n\n These tools discover and execute 143 scoped Invizo abilities without flooding AI clients with 143 top-level MCP tools.<\/p>\n\n Invizo MCP is intended for administrators, developers, agencies, and site maintainers who want an AI coding or automation client to work with a WordPress site through a documented, scoped protocol.<\/p>\n\n Because enabled write and delete scopes can modify important site data, use the plugin only with trusted clients and dedicated Application Passwords. Test destructive workflows on a staging site first.<\/p>\n\n Invizo MCP uses WordPress Application Passwords and WordPress REST authentication.<\/p>\n\n Only authenticated users with the Create a dedicated Application Password from Settings > Invizo MCP<\/strong> for every AI client or computer. Passwords can be revoked individually from the same screen.<\/p>\n\n Application Passwords normally require HTTPS. Local HTTP sites can enable them by setting:<\/p>\n\n Security plugins can disable Application Passwords. Invizo reports this condition on its settings screen.<\/p>\n\n Administrators choose exactly which read, write, and delete scopes are enabled. Abilities outside enabled scopes are hidden from MCP discovery and rejected during execution.<\/p>\n\n Optional integration scopes are unavailable unless their required plugin is active.<\/p>\n\n Existing handler safeguards remain in place, including:<\/p>\n\n Invizo MCP stores:<\/p>\n\n Application Passwords are created and stored by WordPress in user metadata. Invizo tags only the credentials it creates so they can be listed and revoked from the settings page.<\/p>\n\n Invizo MCP does not collect analytics or send usage information to Invizo.<\/p>\n\n The settings page generates current, copy-ready values using your site endpoint and WordPress username.<\/p>\n\n The primary setup uses A direct HTTP Add the generated JSON to:<\/p>\n\n Add the generated TOML to:<\/p>\n\n Both Add the generated JSON to:<\/p>\n\n Add the generated JSON to:<\/p>\n\n Trust your local certificate whenever possible. For local development only, bridge configurations may use Never commit Application Passwords to source control or paste them into prompts, tickets, screenshots, or chat messages.<\/p>\n\n The MCP endpoint is disabled by default on new installations. Enabling it does not expose abilities until scopes are selected.<\/p>\n\n The endpoint requires:<\/p>\n\n Use one dedicated Application Password per client or device so individual connections can be revoked without changing the WordPress account password.<\/p>\n\n When the plugin is uninstalled, Invizo-created Application Passwords are always revoked. Plugin settings and MCP-managed definitions are removed only when Delete Invizo settings and MCP-managed CPT\/meta definitions when the plugin is uninstalled<\/strong> is enabled. Existing posts and post meta values are never deleted by the uninstaller.<\/p>\n\n Please report security issues privately through the contact information on https:\/\/invizo.io\/. Do not publish sensitive vulnerability details in a public support topic before a fix is available.<\/p>\n\n Version 2.0 automatically removes the stored external MCP Server URL and shared secret.<\/p>\n\n It preserves:<\/p>\n\n Sites that previously had a shared secret configured are migrated with the standalone endpoint enabled. Other installations remain disabled until an administrator explicitly enables the endpoint.<\/p>\n\n The legacy signed endpoint Invizo MCP does not contact an Invizo-hosted service.<\/p>\n\n MCP clients may use the third-party npm package When the bridge is used, it sends the configured WordPress endpoint, username, Application Password, and MCP request data directly to the administrator's WordPress site. It does not send those credentials to Invizo.<\/p>\n\n Media upload actions can fetch a public file URL explicitly supplied by an authenticated MCP caller through WordPress media sideloading. In that case, the remote file host receives a normal HTTP request from the WordPress site. The service and data destination depend entirely on the URL supplied by the administrator's MCP client.<\/p>\n\n No external request is made merely by installing or activating Invizo MCP.<\/p>\n\n The distributed plugin contains the human-readable PHP source used at runtime.<\/p>\n\n Composer dependencies are included under All bundled packages use the GPL-2.0-or-later license. Package source, Composer metadata, and individual license files are included. See From the plugin directory:<\/p>\n\n Create the WordPress.org submission ZIP from the parent plugins directory while excluding Git metadata, operating-system files, logs, and Node dependencies.<\/p>\n\n\n Do not install a source-only archive that omits Composer dependencies.<\/p>\n\n No. Version 2.0 does not require or contact an Invizo backend.<\/p><\/dd>\n Yes. WordPress serves MCP JSON-RPC requests at Some desktop clients communicate with local STDIO MCP processes more reliably than remote authenticated HTTP endpoints. No. Invizo requires The Invizo MCP route is not initialized. Existing Application Passwords remain valid WordPress credentials until revoked, but they cannot access an inactive Invizo endpoint.<\/p><\/dd>\n WooCommerce, Elementor, Rank Math SEO, LearnPress, and The Events Calendar scopes require the corresponding plugin to be active.<\/p><\/dd>\n\n<\/dl>\n\n\n\/wp-json\/mcp\/invizo<\/code> endpoint.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.0.3"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[261799,4932,242115,286,41933],"plugin_category":[45],"plugin_contributors":[246497],"plugin_business_model":[],"class_list":["post-327222","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-automation","plugin_tags-developer-tools","plugin_tags-mcp","plugin_tags-woocommerce","plugin_tags-wordpress-management","plugin_category-ecommerce","plugin_contributors-invizo","plugin_committers-invizo"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/invizo-mcp.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"\nhttps:\/\/example.com\/wp-json\/mcp\/invizo\n<\/code><\/pre>\n\n\n
discover-abilities<\/code><\/li>\nget-ability-info<\/code><\/li>\nexecute-ability<\/code><\/li>\n<\/ul>\n\nHighlights<\/h4>\n\n
\n
What can agents manage?<\/h4>\n\n
\n
Who is this for?<\/h4>\n\n
Authentication<\/h4>\n\n
manage_options<\/code> capability can access the MCP transport or execute Invizo abilities. In a standard WordPress installation this means administrators only.<\/p>\n\ndefine( 'WP_ENVIRONMENT_TYPE', 'local' );\n<\/code><\/pre>\n\nScopes and safeguards<\/h4>\n\n
\n
confirm: true<\/code> requirements for supported destructive operations.<\/li>\nData stored by the plugin<\/h4>\n\n
\n
invizo_mcp_settings<\/code> option.<\/li>\ninvizo_mcp_registered_cpts<\/code> option.<\/li>\ninvizo_mcp_registered_meta_fields<\/code> option.<\/li>\nClient Configuration<\/h3>\n\n
Claude Code<\/h4>\n\n
@automattic\/mcp-wordpress-remote<\/code> through npx<\/code>, with the endpoint, username, and Application Password stored as environment variables.<\/p>\n\n.mcp.json<\/code> alternative is also shown for clients that support authenticated HTTP MCP servers.<\/p>\n\nClaude Desktop<\/h4>\n\n
\n
~\/Library\/Application Support\/Claude\/claude_desktop_config.json<\/code><\/li>\n%APPDATA%\\Claude\\claude_desktop_config.json<\/code><\/li>\n<\/ul>\n\nCodex<\/h4>\n\n
\n
.codex\/config.toml<\/code><\/li>\n~\/.codex\/config.toml<\/code><\/li>\n<\/ul>\n\nnpx<\/code> bridge and direct authenticated HTTP examples are provided.<\/p>\n\nCursor<\/h4>\n\n
\n
.cursor\/mcp.json<\/code><\/li>\n~\/.cursor\/mcp.json<\/code><\/li>\n<\/ul>\n\nAntigravity<\/h4>\n\n
\n
~\/.gemini\/antigravity\/mcp_config.json<\/code><\/li>\n%USERPROFILE%\\.gemini\\antigravity\\mcp_config.json<\/code><\/li>\n<\/ul>\n\nLocal HTTPS<\/h4>\n\n
NODE_TLS_REJECT_UNAUTHORIZED=0<\/code> when the certificate cannot be trusted normally.<\/p>\n\nPrivacy and Security<\/h3>\n\n
\n
manage_options<\/code> capability.<\/li>\nReporting security issues<\/h4>\n\n
Upgrade from 1.x<\/h3>\n\n
\n
\/wp-json\/invizo\/v1\/execute<\/code> and its HMAC headers have been removed.<\/p>\n\nExternal Services<\/h3>\n\n
@automattic\/mcp-wordpress-remote<\/code> as a local bridge when configured by the administrator. The package is downloaded from the npm registry and runs on the computer hosting the AI client, not inside WordPress.<\/p>\n\n\n
Build and Source Files<\/h3>\n\n
PHP dependencies<\/h4>\n\n
vendor\/<\/code> because they are required for the standalone MCP endpoint:<\/p>\n\n\n
automattic\/jetpack-autoloader<\/code><\/li>\nwordpress\/mcp-adapter<\/code><\/li>\nwordpress\/php-mcp-schema<\/code><\/li>\n<\/ul>\n\nthird-party-notices.txt<\/code>.<\/p>\n\nRebuilding dependencies<\/h4>\n\n
composer install --no-dev --optimize-autoloader\n<\/code><\/pre>\n\n\n
vendor<\/code> directory.<\/li>\ndiscover-abilities<\/code>.<\/li>\n<\/ol>\n\nMinimum requirements<\/h4>\n\n
\n
WP_ENVIRONMENT_TYPE<\/code> is set to local<\/code>.<\/li>\n\n
Does Invizo contact api.mcp.invizo.io?<\/h3><\/dt>\n
Is WordPress itself the MCP server?<\/h3><\/dt>\n
\/wp-json\/mcp\/invizo<\/code>.<\/p><\/dd>\nWhy do some clients still use npx?<\/h3><\/dt>\n
@automattic\/mcp-wordpress-remote<\/code> is a local transport bridge; it is not an Invizo-hosted server.<\/p><\/dd>\nCan editors connect?<\/h3><\/dt>\n
manage_options<\/code> at the MCP transport and ability layers.<\/p><\/dd>\nWhat happens when the endpoint is disabled?<\/h3><\/dt>\n
Why is an integration scope disabled?<\/h3><\/dt>\n
2.0.3<\/h4>\n\n
\n
2.0.2<\/h4>\n\n
\n
2.0.1<\/h4>\n\n
\n
.test<\/code>, .local<\/code>, and WordPress local environments.<\/li>\n2.0.0<\/h4>\n\n
\n
\/wp-json\/mcp\/invizo<\/code>.<\/li>\n