Ai Wpoos MCP Server

NV Digital Open Operator System (NVoOS)

Version: 1.2.15 Release Date: 2026-11-01

See § Release History for the 12 most recent releases; every older release is in the Previous Releases table. Full detail: CHANGELOG.md.

🆕 v1.2.15 Highlights: the Astro Forge WP→Astro generator ships end-to-end (Proposal 096, MIT) — content-layer loader, sanitizer, scaffold CLI, WooCommerce storefront template, site_analyze, the 29-tool /mcp surface, and the companion standalone plugin nvoos-forge-bridge (0.1.0); the design-language import pipeline (Proposal 098 — inspired-by, never a clone) with draft/publish bridge products; Proposal 095 completes (CMS/ops slices, NDS DTCG round-trip, the /manage Design tab); the console brands from the WordPress site title and Records remote browsing ships; the npx MCP bridge gains manager-session bootstrap; the MCP gateway goes live on the official registry (0.2.0 + the PUBLIC_SITE_SLUGS privacy filter); the dictate release pipeline is fixed end-to-end. Tool count unchanged: ~355 base + ~1,378 Pro (~1,732 total; live registry authoritative). Coding-time skills 79 → 81.

MCP Specification: 2026-07-28 (Stateless Core, Full Compliance)
Maintained by NV Digital
License: GPLv3 or later
Requires: WordPress 6.0+, PHP 7.4+
Patent Status: Patent Pending (Application #19/410,504)
Documentation: Grade A (95/100) — 1,617 files across 12 directories, 108 admin screenshots, 100% feature coverage

🔍 For Reviewers & Auditors

New to this repo? Start here → docs/project/FOR_REVIEWERS.md

That document answers every common question in one place: what the project is, current security posture, what's production vs experimental, PHP version requirements, AI development methodology, compliance status, and scoping advice for a limited-budget review.

Quick links for reviewers:

• Addon Inventory — what each of 30 addons does and its status
• Security Posture — current state of all 50 audit findings
• Compliance Traceability — every .org rejection reason → commit → verification command
• AI-Assisted Development — methodology, transparency, and what to scrutinize
• Architecture Overview — component diagram and data flow

📑 Table of Contents

Getting Started

• 🧩 Overview
• 🎯 Our Mission
• 🛡️ Active Security Monitoring
• ⚠️ Warranty & Safe Use
• 🏗 System Architecture
• 🚀 Features
• 📦 Installation
  • 🌱 Try It on Your PC
• 🔌 What You Lose Without Third-Party Plugins
• ⚙️ Configuration Checklist
• 📚 Documentation

Core Functionality

• 🧠 Memory & Tool Stack Overview
• 🛠 Built-in tools & automations
• 🗨️ Front-end chat surfaces
• 💬 Frontend Shortcode

Addons & Extensions

• 🏗 System Architecture (covers addon ecosystem)

Orchestration & AI Features

• 🏗 System Architecture (covers orchestration, harnessing, MCP servers, memory bridge)

AI Providers & Integration

• 🧠 Language Model Providers
• 🧱 ChatKit Integration
• 🌐 Crawl4AI Integration
• 📡 Job Notification System
• 🧊 Elementor Widgets

Performance & Optimization

• ⚡ Message Bundling
• 🎯 Agentic Loop Token Management
• 🔄 Chat Performance Optimizations
• 🌐 Mesh Compute Routing
• 🔗 Federation & Discovery System

Remote MCP Setup

• 🔒 MCP Server Authentication
• 🌐 Connecting Remote MCP Clients
• 🛰 REST API Endpoints
• 🌊 SSE Streaming Support
• 📝 MCP JSON-RPC 2.0 Endpoint
• 🔑 Assistant API Credentials
• 🎫 Token Management UI

Assistant Management

• 🛠 Assistant Editor Overview
• 📊 Assistant Storage: CPT vs CCT
• ⚡ Assistant Tool Shortcuts
• 🧠 Agent Skills
• 👔 Professional & Team Layers
• 🧵 REST Chat Payloads & Attachments

Development

• 🐳 Local Development with Docker
• 🧑‍💻 Development Tooling
• 📦 NPM Packages
• 🧪 Testing & QA
• 🧩 Hooks & Filters
• 🧰 WP-CLI Commands

Reference

• 🔐 JetEngine Capability Reference
• 🛰 JetEngine REST API Reference
• 🧮 Usage Tracking
• 🧷 Attachment MIME Controls
• 🧾 Logging
• 🧾 JetEngine REST Endpoint Report Helper
• 🔌 Optional Tools & Dependencies
• ✅ Manual QA Scenarios

Changelog

• 📜 Release History
• 📋 Previous Releases

Sponsor & Support

• ❤️ Sponsor & Support

---

🗺 Repository Map

---

🧩 Overview

Real-time AI Orchestration Toolkit / Harness for Wordpress - NV oOS is a modular AI framework (Object-Oriented System) for WordPress that connects your site's data with 18 language-model providers: OpenAI, Gemini, Anthropic, DeepSeek, OpenRouter, Baseten, Kimi (Moonshot), Z.AI (GLM), DigitalOcean, NVIDIA NIM, Cloudflare Worker AI, Azure, Ollama, LM Studio, Hugging Face, and TypeSafe Jev (decision-only), plus local WebLLM and embedded engines. It allows you to create and manage AI Assistants that can interact with users, access WordPress data, and perform custom tool functions.

✨ What's New at a Glance (v1.2.15)

• 🏗 Astro Forge ships end-to-end (Proposal 096, Phases 0–4, MIT). examples/nvoos-astro-forge turns any WordPress/WooCommerce site into an Astro 7 headless frontend: the content-layer loader, the versioned sanitize-html XSS gate, the scaffold CLI, the blog + WooCommerce templates, site_analyze discovery, tokens_apply + a dependency-free WCAG contrast gate, the SEO suite (RSS/404/301 map), Pagefind search, and the /mcp tool surface (29 tools + 3 meta, dual-era, fail-closed write auth, SSRF guard) — plus the companion standalone plugin plugins/nvoos-forge-bridge 0.1.0 (HMAC rebuild webhooks, preview tokens, 23-test suite on WP 6.9 + 7.1).
• 🎨 Design-language import (Proposal 098). URL → design language → adapted, content-first theme: design_analyze/design_compare/design_plan/design_theme (SSRF-safe, WCAG-audited, DTCG + runtime-theme emission); the bridge product contract gains draft/publish status; live color-harvest fixes (#NaNNaNNaN rgba roles, on-accent ink classification).
• 🧩 Proposal 095 completes. The nvoos-astro-mcp 0.2.0 CMS/ops slices (cms_*, media_upload, site_status, preview_url, rebuild_trigger, screenshot — per-IP rate limits, audit log, design-vs-contract auth split); the NDS DTCG round-trip (nds_export + the NDS addon importer); the /manage Design System tab; the astro:build:done /mcp bundle fix; the bridge admin-SPA MIT carve-out (Q8).
• 🏷 Console branding + Records. The Complete Console brands from the WordPress site title (nav logo, browser tab, siteName through the Pro SPA config); Records remote browsing is opt-in per surface and enabled on all five command-center pages; empty detail grids fall back to the wp/v2 core fields.
• 🔌 MCP bridge sessions (npm 0.1.0-alpha.5). The npx bridge logs in via MCP_AI_LOGIN_URL + credentials and drives session-gated write surfaces (live-verified on astro.nvoos.cloud); SDK-v2 Accept/SSE protocol fixes.
• 🛡 Gateway live on the official MCP Registry. io.github.nvdigitalsolutions/nvoos-mcp-gateway v0.2.0 published (2026-11-01) after the runtime version-marker fix, the 100-char description trim, and the new PUBLIC_SITE_SLUGS privacy filter on the public /health.
• 🎤 Dictate release pipeline fixed. contents: write grant, tauri CLI + softprops release job, Apple signing env only when secrets exist, Windows exe artifact; the nvoos-dictate-v0.2.0 tag re-pushed (sub-project).
• 🐞 Dependencies. multer 2.5.0, the 2026-10-30 sweep (44 alerts incl. the astro-bridge zod 3→4 real-semantics fix), follow-redirects floor 1.16.2 (minimatch #7358 + glob #7359 deferred). Proposal 099 (ChatGPT OAuth connector) ships as docs + a 7-test PKCE e2e harness.
• 📚 Docs & skills. Two new coding-time skills — mcp-ai-wpoos-astro-forge, mcp-ai-wpoos-gateway-ops (79 → 81); the client-reference scrub; session learnings folded into astro-storefront, git-ops, and dependabot-loop. Proposals 096/098/099 shipped in-window (098 + 099 proposals-README registration deferred — recorded in the catch-up plan).
• 📦 Versioning — bumped to 1.2.15 across all version-bearing files. Pro addon: 1.2.15. No addon version moves — MCP Gateway stays 0.2.0 (the runtime marker fixed), Design System stays 0.3.0 (the importer ships app-side). Model catalog: v2026.10.03 (unchanged — zero diff). Provider count: 18 (unchanged). Addon count: 30 (unchanged). Media Worker: 3.4.0 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Security classes: 12 (unchanged). Tool count: ~355 base + ~1,378 Pro (~1,732 total — unchanged); the astro-mcp/Forge MCP tools are app-side (described, not counted); live registry authoritative. Stale build ZIPs removed: the 1.2.13 oOS set (30 files — 9 + 2 + 19); 1.2.14 stays as the fallback.

🎯 Mission: Modernizing Small to Medium Business Websites

NV oOS is specifically designed to help small to medium-sized businesses fast-track their outdated, stale, or insecure company websites to modern technology standards—without the need to add yet another wrapper around API calls. Instead, we're trying to peel back decades of API wrappers with the help of AI, providing:

• Direct AI Integration - No middleware required. Connect directly to OpenAI, Gemini, Anthropic, Hugging Face, Cloudflare Worker AI, Ollama, LM Studio, OpenRouter, and DeepSeek without custom development
• Security-First Architecture - Built-in protection against nefarious usage with active monitoring and prevention systems
• Enterprise-Grade Features - Access to capabilities typically requiring expensive custom development
• Compliance & Audit Tools - Comprehensive logging, rate limiting, and usage tracking built-in
• Zero Technical Debt - Modern codebase following WordPress standards, ready for current technology stacks

🛡 Active Security Monitoring

NV oOS actively prevents and monitors against nefarious behavior. The plugin includes:

• Nefarious Usage Monitor - Real-time detection of suspicious patterns and automatic emergency shutdown capabilities【F:includes/class-wp-mcp-ai-nefarious-usage-monitor.php†L1-L676】
• Root Security Key - Optional emergency authentication layer to prevent unauthorized reactivation after security incidents【F:docs/features/security/root-security-key.md†L1-L511】
• Granular Capability Controls - Every tool and API endpoint enforces WordPress capabilities to prevent unauthorized access
• Rate Limiting - Built-in protection against abuse with configurable limits per user, model, and time period
• Comprehensive Audit Logging - Track all API calls, tool executions, and security events for compliance and forensic analysis
• Input Sanitization & Output Escaping - All user input sanitized, all output escaped following WordPress security best practices

This is not a tool for circumventing security or promoting bad practices. Every feature is designed with security, transparency, and responsible AI usage as core principles. The plugin actively works to stop and prevent misuse before it happens.

Latest audit: See docs/operations/compliance/SECURITY_AUDIT_2026_04.md — the published summary of the April 2026 security & compliance code review (no Critical findings; 5 High items, 3 Fixed and 2 Partially Fixed). Full deliverables under docs/project/audits/2026-04/.

WordPress.org compliance hardening (May 9, 2026): docs/operations/compliance/WORDPRESS_ORG_COMPLIANCE_2026_05_09.md — findings B3, B8, B10, B13, and production vendor remap all resolved.

⚠ Warranty & Safe Use

We make every effort to keep NV oOS safe and secure — but by design, it can be destructive and resource-intensive when not properly configured.

NV oOS grants AI assistants access to powerful WordPress operations. The same capability that automates real work can cause irreversible harm if misconfigured:

• Destructive tools — bulk content deletion, user management, file writes, mass email, WP-CLI, direct database operations
• API billing exposure — uncapped AI provider calls can exhaust quotas and trigger unexpected charges
• Server resource exhaustion — concurrent agentic loops and SSE streams can saturate CPU/memory on shared hosting

Before going live: test on staging, take verified backups, apply least-privilege tool permissions, enable rate limiting, and review the system prompt of every public-facing assistant.

📄 Full details: WARRANTY.md — security commitment, "AS IS" disclaimer, destructive-operations table, resource-consumption guide, and mitigation checklist aligned with OWASP, NIST SP 800-53, ISO/IEC 27001, and the WordPress Plugin Developer Handbook.

Patent Pending

NV oOS is the subject of a pending patent application for its novel System and Method for Dynamic AI Orchestration Layer with Real-Time Capability Gating and Resource Budgeting.

Application Number: 19/410,504

The patent covers NV oOS's innovative approach to implementing sophisticated AI orchestration in WordPress's request-based PHP architecture—a platform not designed for real-time streaming, asynchronous operations, or persistent state management. This technical achievement enables enterprise-grade AI capabilities on WordPress by recreating event-driven behavior within PHP's synchronous execution model.

Key Innovations Covered:

• Dynamic resource budget allocation during streaming operations
• Capability-based access control for AI tool execution
• Registry-state-based scheduling in stateless environments
• Metrics-driven budget adjustment for real-time optimization
• Persistent-behavior illusion in request-based architectures

The orchestration layer makes NV oOS unique in the WordPress ecosystem by solving fundamental architectural limitations that prevent traditional WordPress plugins from supporting advanced AI features. See the System Architecture section below for technical details on how these innovations work together.

🏗 System Architecture

NV oOS implements a comprehensive orchestration layer for managing AI operations during real-time streaming events. The system architecture comprises:

• 18 language-model providers — OpenAI, Gemini, Anthropic, DeepSeek, OpenRouter, Baseten, Kimi (Moonshot), Z.AI (GLM), DigitalOcean, NVIDIA NIM, Cloudflare Worker AI, Azure, Ollama, LM Studio, Hugging Face, TypeSafe Jev (decision-only), plus local WebLLM + embedded engines
• ~1,732 tool classes (~355 base + ~1,378 Pro; live count via WP_MCP_AI_Tool_Registry::get_tools() is authoritative) registered through a singleton Tool Registry
• 36 REST controllers (16 base + 20 pro) under the mcp-ai/v1 namespace
• 64 service classes powering orchestration, budgets, and workflows
• 5 authentication methods — WordPress nonce, assistant credentials, mesh keys, Auth0 JWT, guest tokens
• Toolkit MCP servers — per-toolkit JSON-RPC 2.0 servers exposed under /wp-json/mcp-ai-pro/v1/mcp/{slug}; discoverable at /.well-known/mcp
• 8 inline-async-tick consumers — cooperative tick-lock pattern eliminates WP-Cron startup latency for background jobs (transcript mining, async tool executor, SaaS Apply, Crawl4AI, Docs Hub rebuild, Graphify reindex, Harness eval, Gemini Veo polling)
• 7 LLM Harness layers (+ 1 Pro) — opt-in epistemic layers A–H activated per-assistant via the LLM Harness metabox
• Orchestration Phases 1–7 — HITL approval queue, prompt-injection detector, structured output, OTel exporter, DAG builder, durable runs, triggers/webhooks, sub-agents

📖 For a detailed explanation of how NV oOS extends standard SSE and MCP protocols with novel orchestration features, see ORCHESTRATION-LAYER-ARCHITECTURE.md

Core Orchestration Layer: Overcoming PHP's Limitations

Critical Context: Most real-time AI streaming systems are built with Node.js, Python FastAPI, or Go — platforms designed for asynchronous, event-driven operations. These platforms natively support:

• Long-lived connections and persistent state
• Non-blocking I/O and parallel execution
• Event loops and asynchronous callbacks
• WebSocket protocols and SSE streaming

NV oOS achieves the same capabilities in PHP/WordPress — an environment fundamentally not designed for these patterns — through a sophisticated orchestration layer that creates a "persistent-behavior illusion":

1. Real-Time Budget Enforcement - Monitors token/memory usage during streaming, prevents exhaustion through predictive allocation
2. Capability-Based Tool Gating - WordPress role-based access control for AI tool execution
3. Predictive Optimization - Analyzes usage patterns to prevent resource overruns before they occur
4. Distributed Orchestration - Multi-provider support with policy-aware routing
5. Auditability & Compliance - Complete governance layer with logging and rate limiting
6. Cron-Based Task Orchestration - Extends orchestration to async operations with budget inheritance

Multi-Agent Orchestration Enhancement (DeepSeek V4-Inspired)

Added: January 2026 (v1.1.0)

Building upon the core orchestration layer, NV oOS now includes a sophisticated multi-agent coordination framework inspired by DeepSeek V4's orchestration patterns:

Key Components:

• Agent Role System - Four specialized roles (Planner, Executor, Critic, Specialist) with role-specific capabilities
• Team Composition - Automated team assembly based on task requirements and profession expertise
• Coordinated Workflows - Multi-step workflows with agent delegation, result aggregation, and validation
• Team CPT Integration - Persistent team configurations with orchestration modes (single/sequential/parallel/swarm)
• Profession-Based Discovery - 296 professions auto-assigned agent roles via intelligent seeding across 17 knowledge bases

Example Multi-Agent Workflow:

// 1. Compose research team (planner + executors + critic)
$orchestrator = new WP_MCP_AI_Agent_Team_Orchestrator();
$team = $orchestrator->compose_team( array( 'task_type' => 'research' ) );

// 2. Execute coordinated workflow
// Planner decomposes task → Executors research subtasks → 
// Communication service aggregates → Critic validates quality
$result = $orchestrator->execute_team_workflow( $team, $task, $context );

Documentation:

• See Multi-Agent Orchestration for complete technical details
• See DEEPSEEK-V4-README.md for documentation suite overview
• See DEEPSEEK-V4-USAGE-GUIDE.md for practical examples

Why This Architecture Is Novel: Overcoming PHP's Limitations

• Event loops and background workers

PHP/WordPress, by contrast, is fundamentally request-based:

• Every HTTP request spawns a new process that dies after responding
• I/O operations block execution
• No persistent memory between requests
• No native event loop or async coordination

NV oOS solves this by implementing an orchestration layer that creates a "persistent-behavior illusion" — effectively recreating Node.js's event loop behavior within WordPress's synchronous, request-based architecture. This architectural compensation is the system's core technical innovation:

This makes NV oOS patent-worthy as a technical workaround — it achieves sophisticated AI orchestration in an environment specifically not designed for such patterns. See ORCHESTRATION-LAYER-ARCHITECTURE.md for the complete technical analysis.

Computer-Implemented Resource Management

The system operates as a computer-implemented method executing on a processor with memory, performing:

1. Dynamic Resource Budget Allocation: The orchestration layer dynamically allocates token and memory budgets to tool execution requests based on real-time system capacity and operation requirements. The WP_MCP_AI_Resource_Manager continuously monitors server resources (PHP memory limits, execution time constraints) and automatically adjusts operational parameters.

2. Capability-Based Access Control: Tool execution endpoints enforce granular capability-based access controls. Each tool in the registry declares required WordPress capabilities, and the REST API controller validates user permissions before allowing execution. This ensures secure, policy-driven access to all operations.

3. Registry-State-Based Scheduling: The WP_MCP_AI_Tool_Registry maintains tool availability state and schedules execution based on policy constraints. Tools are loaded conditionally based on dependency availability, and execution is scheduled according to assistant configuration and user permissions.

4. Metrics-Driven Budget Adjustment: The system continuously monitors execution metrics (memory usage, API response times, token consumption) and adjusts resource budgets in response to prevent resource exhaustion and reduce latency. The WP_MCP_AI_Token_Budget_Manager implements safety margins and dynamic chunking to prevent API limit overruns.

System Components

The system comprises a processor and memory storing instructions that:

• Monitor real-time resource availability through PHP runtime introspection
• Enforce capability checks at REST endpoint boundaries
• Schedule tool execution through a centralized registry
• Adjust token and memory budgets based on detected system metrics
• Maintain operation logs for audit and optimization

This architecture is embodied in non-transitory computer-readable media (PHP source files) that, when executed by a web server processor, cause the system to perform the complete resource management workflow. The implementation prioritizes stability, security, and efficient resource utilization across diverse hosting environments.

Symfony Process Integration (December 2025)

NV oOS Pro addon integrates the Symfony Process component for secure external command execution. This modern framework replaces direct exec() calls in 6 Pro tools and 2 supporting services, providing:

• Enhanced Security: Proper argument escaping and command validation
• Timeout Management: Configurable timeouts with graceful handling
• Better Error Handling: Comprehensive exception catching and WordPress-friendly error reporting
• Process Control: Real-time output streaming and cancellation support

Migrated Tools & Services:

• FFmpeg operations (video frame extraction, metadata reading)
• Python rembg (background removal)
• WP-CLI execution
• Meta AI Jukebox (music generation)
• Supporting services for video and audio processing

The Process Service (WP_MCP_AI_Process_Service) provides WordPress-friendly wrappers with WP_Error integration, making external process execution consistent with WordPress coding standards.【F:includes/services/class-wp-mcp-ai-process-service.php†L1-L220】【F:docs/history/2025/implementations/symfony-phases/SYMFONY_PHASE2B_PROCESS_INTEGRATION.md†L1-L100】

---

📜 Release History

The 12 most recent releases are documented in full below. Every older release has a one-line summary in the Previous Releases table, and complete per-release detail lives in CHANGELOG.md.

v1.2.15 — November 01, 2026

Astro Forge Ships End-to-End, Design-Language Import, Gateway Live on the MCP Registry

• 🏗 Astro Forge (Proposal 096, Phases 0–4, MIT). examples/nvoos-astro-forge turns any WordPress/WooCommerce site into an Astro 7 headless frontend: the WP REST client (_fields/_embed pruning, explicit truncated), the content-layer loader, the versioned sanitize-html allowlist (the mandatory XSS gate before set:html), the scaffold CLI, the blog + WooCommerce templates (wc/v3 consumer-key auth from .env), site_analyze discovery, tokens_apply + a dependency-free WCAG contrast gate, the SEO suite (RSS/404/_redirects 301 map), SmartImage (same-host through Astro Image, external passthrough), Pagefind search, and the /mcp tool surface — 29 tools + 3 meta, dual-era, single-source registry, fail-closed write auth, an SSRF guard — plus setup_wizard, the AES-256-GCM vault, octokit deploys, and the generated pipeline. The companion standalone plugin plugins/nvoos-forge-bridge 0.1.0 ships HMAC rebuild webhooks + single-use preview tokens with a 23-test suite on WP 6.9 + 7.1 (sub-project, own track).
• 🎨 Design-language import (Proposal 098). URL → design language → adapted, content-first theme: design_analyze/design_compare/design_plan/design_theme (SSRF-safe fetcher, deterministic analyzer, WP theme.json + GitHub-trees source modes, opt-in rendered capture, WCAG audit, DTCG + runtime-theme emission); the bridge product contract gains draft/publish status (drafts 404 publicly); live fixes for #NaNNaNNaN rgba roles and on-accent ink classification (#7334).
• 🧩 Proposal 095 completes (#7318/#7320/#7322/#7323/#7325). nvoos-astro-mcp 0.2.0 gains the CMS slice (cms_* + media_upload), the ops slice (site_status/preview_url/rebuild_trigger/screenshot), state-file durability, per-IP rate limits, an audit log, request context, and the design-vs-contract auth split; the NDS DTCG round-trip (nds_export + the NDS addon's importer) and the /manage Design System tab ship; the /mcp bundle survives production builds via the astro:build:done integration; the bridge admin SPA carries its own MIT grant (Q8); the browser rebrand e2e fixed the env-snapshot 401 and the promo-island race.
• 🏷 Console branding + Records (#7321/#7324/#7326/#7327/#7330). The console brands from the WordPress site title (nav logo, browser tab, siteName through the Pro SPA config); Records remote browsing is opt-in per surface and enabled on all five command-center pages; empty detail grids fall back to the wp/v2 core fields.
• 🔌 MCP bridge sessions (npm 0.1.0-alpha.5, #7328). MCP_AI_LOGIN_URL + credentials bootstrap a manager session for the published npx bridge (cookies attached to every upstream request, one 401/403 re-establishment) — live-verified against astro.nvoos.cloud; SDK-v2 Accept/SSE-unwrap protocol fixes.
• 🛡 Gateway live on the official MCP Registry (#7345–#7349). io.github.nvdigitalsolutions/nvoos-mcp-gateway v0.2.0 published (2026-11-01) after the runtime version-marker fix (the health test now pins the package.json contract), the 100-char description trim, the PUBLIC_SITE_SLUGS privacy filter on the public /health (typo warns, never fatal), and the logo asset.
• 📝 Proposal 099 + PKCE harness (#7361/#7362). The ChatGPT OAuth connector plan (Auth0 AS half, DCR + S256 mandates — awaiting owner decisions) ships as docs; the hermetic PKCE e2e harness drives the real client sequence through an in-process fake AS (7 tests; 27/27 OAuth group; static keys keep working — dual mode).
• 🎤 Dictate release pipeline fixed (#7351/#7353/#7354/#7356 + main twins). contents: write, tauri CLI + softprops release job, Apple signing env only when the secrets exist, Windows exe artifact; the nvoos-dictate-v0.2.0 tag re-pushed (sub-project).
• 🛠 Dependencies + skills. multer 2.5.0 (#7308); the 2026-10-30 sweep — 44 alerts incl. the astro-bridge zod 3→4 migration's real .refine()-on-undefined semantics fix (#7311); follow-redirects floor 1.16.2 (5 manifests; minimatch #7358 + glob #7359 deferred). Two new coding-time skills (mcp-ai-wpoos-astro-forge, mcp-ai-wpoos-gateway-ops — 79 → 81) + the client-reference scrub + session learnings folded into astro-storefront/git-ops/dependabot-loop.
• 📦 Versioning — bumped to 1.2.15 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.15. No addon version moves in-window (MCP Gateway stays 0.2.0 — runtime marker fixed; Design System stays 0.3.0 — importer ships app-side; the Astro Bridge license column corrected to Mixed in-window). Media Worker: 3.4.0 (unchanged). Model catalog: v2026.10.03 (unchanged — zero diff). Tool count: ~355 base + ~1,378 Pro (~1,732 total — unchanged) — zero registry diffs in-window (the astro-mcp 20 + Forge MCP 29+3 tools are app-side, described-not-counted; live registry authoritative). Provider count: 18 (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Coding-time agent skills: 79 → 81. Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.13 oOS set (30 files — 9 + 2 + 19); the 1.2.14 set stays as the current fallback.

v1.2.14 — October 30, 2026

Astro Storefront Lands, Bridge Rename + /manage Cookie-Auth Restored, F&B Multi-Connection, Gateway Policy Layer

Documentation truncated — see the full README on GitHub.