=== Ppok AI Toolkit ===
Contributors: ppok
Tags: mcp, ai, model-context-protocol, claude, llm
Requires at least: 6.4
Tested up to: 6.7
Requires PHP: 8.1
Stable tag: 0.4.0
License: GPL-2.0-or-later (plus proprietary components — see LICENSE.md)
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Turn this WordPress site into a Model Context Protocol (MCP) endpoint that AI assistants can connect to via a companion remote bridge.

== Description ==

Ppok AI Toolkit exposes selected WordPress capabilities (REST resources, custom tools, site context) through a Model Context Protocol-compatible interface, so that AI clients such as Claude Desktop can discover and call them through a remote MCP bridge (see Automattic/mcp-wordpress-remote for the reference Node.js bridge).

Features (scaffolded; iterating):

* Settings page for enabling MCP, choosing an auth method, and scoping capabilities.
* REST namespace under `ppok/v1/mcp/*` for discovery and tool invocation.
* Pluggable tool registry for adding custom MCP tools.
* App-password / OAuth-friendly permission checks.

== Licensing ==

This plugin ships under a split license:

* WordPress-integrated code (everything outside `includes/lib/`) — GPL-2.0-or-later.
* Standalone library code in `includes/lib/` — proprietary.

See `LICENSE.md` at the plugin root for the full policy.

== Installation ==

1. Upload the `ppok-ai-toolkit` folder to `/wp-content/plugins/`.
2. Run `composer install --no-dev` inside the plugin folder.
3. Activate the plugin in the WordPress admin.
4. Visit *Settings → AI Toolkit* to configure MCP.

== Changelog ==

= 0.4.0 =
* Phase 5: new read-only ppok/blocks-registered ability — dumps WP_Block_Type_Registry as {name, title, description, category, is_dynamic, attributes_schema}. Optional namespace-prefix filter.
* Phase 5: new read-only ppok/blocks-find-usage ability — given a canonical block_name, returns posts containing it with per-post counts. SQL LIKE prefilter + parse_blocks recursive walk so nested usage counts and innerHTML false-positives don't. Core-namespace shortform alias handled.
* Phase 5: new read-only ppok/patterns-registered ability — dumps WP_Block_Patterns_Registry (core + theme + plugin-registered) with full content; optional category filter; include_content=false enumerates the catalog cheaply.
* Discovery hygiene: Abilities_List aggregator now also surfaces the example() payload for ppok/preview-url (Phase-4 omission).

= 0.3.0 =
* Phase 4: new ppok/preview-url ability — mints a short-lived (5-minute) HMAC-signed URL that bypasses the draft/pending/private redirect for visual review without admin login. Write-flagged so every mint is audited and admin opt-in via abilities_enabled is required. Companion pre_get_posts handler expands post_status when a valid token is on the request.

= 0.2.1 =
* Phase 3: rest-call slim default response (strips yoast_head, yoast_head_json, permalink_template, class_list, generated_slug) — pass params.include_extended=true to keep them.
* Phase 3: rest-call cursor pagination — collection responses with more pages return has_more + opaque next_cursor; pass back as params.cursor.
* Phase 3: new ppok/abilities aggregator — one call returns {name, title, description, input_schema, output_schema, example} for every registered ability.
* Phase 6 partial: new write ability ppok/set-post-blocks — accepts a parsed block tree, runs serialize_blocks + wp_update_post, returns revision_id for one-call rollback. Gated by L1 cap + L3 block-allowlist + L4 plugin-options scope (write_post_types, write_post_statuses).
* Phase 6 partial: new write ability ppok/replace-in-content — block-aware bulk find/replace; dry_run defaults true; capped at 500 candidate posts per call; opt-in attrs_text_keys parameter to traverse block attrs (Gutenbricks, ACF Blocks).
* Transport defenses: rest-call returns structured response_too_large WP_Error (default 1MB cap, filterable) instead of letting the bridge drop with "Connection closed"; try/catch around dispatch surfaces PHP exceptions as rest_call_dispatch_exception; correlation_id stamped onto every WP_Error data array; Event_Logger caps payload at 256KB with a stub.
* Bug fix: replace-in-content schema now uses anyOf for post_type/post_status (oneOf mis-validated valid string input on WP REST).

= 0.2.0 =
* Wire Request_Context at rest_pre_dispatch so audit rows carry correlation_id, mcp_client, and ip (previously NULL on every row).
* Fix Activator option seeds to match the v1 settings keys (abilities_enabled, write_post_types, write_post_statuses, block_allowlist_mode, block_curated_allowlist, log_retention_days).
* Settings page rebuilt on the WP Settings API; abilities_enabled toggles meta.mcp.public per write ability at registration.
* New Tools → Ppok Activity viewer over wp_ppok_ai_events with filters, free-text reason search, and a row-detail screen.

= 0.1.0 =
* Initial scaffold.
