Changelog — 7 releases
Every entry names a user-visible outcome. Refactors, test additions and documentation-only changes are left out unless they alter what an agent can do.
Versions follow semantic versioning. Nothing that is free in one release moves behind the licence in the next.
SiteHelm
form-list names every form the site's form plugin holds with its embed shortcode, form-get reads one form's fields (name, type, required) exactly as the stored template declares them, and form-entries-list reads a form's recent entries where the plugin stores any — for Contact Form 7, which delivers each entry by email and stores none, the answer says so plainly instead of erroring. Entries gate on manage_options because a submission can carry a visitor's personal information. Everything is read-only: no form write, no entry deletion. Other form plugins arrive through the same provider seam as an add-on.provider, and precedence across a multi-plugin site is fixed (Yoast, Rank Math, All in One SEO, SEOPress, The SEO Framework, Slim SEO, SureRank). A field a plugin has nowhere to store reads as null and a write to it promises null in the preview instead of failing after the fact.site-settings-read answers the whole thirteen-field allowlist (title, tagline, timezone, date and time formats, posts per page, front page geometry, permalink structure, default comment and ping status, search-engine visibility) typed in one call, and site-settings-set changes any subset of it as one previewed, snapshotted, reversible change. Values are validated strictly at plan time — a timezone must be a real identifier, a custom permalink structure must keep every post's URL unique, a front page must be a published page — and nothing outside the allowlist is reachable. Changing the permalink structure flushes rewrite rules and warns that existing URLs change; turning search-engine visibility off warns that removal from indexes is not guaranteed.content-seo-schema-get, content-seo-schema-set and content-seo-audit-fix (SiteHelm Pro 0.2.0), so a site without the add-on sees them as locked rows in their groups.content-seo-score-get reports one post's SEO and readability scores exactly as the plugin stored them (never recomputed, so the number matches the editor; Rank Math has no separate readability score and says null), plus a list of findings derived from the metadata — missing, too-short or too-long description, over-long title, missing focus keyword or one absent from the title, a published post kept out of search, a score under the caller's floor. content-seo-audit walks a page of posts (default 50, at most 100) and reports each one's scores and findings with a count of every finding across the page, detecting duplicate titles and descriptions within it; posts the caller may not edit are skipped and counted, not shown. The finding vocabulary is fixed and published in both output schemas.content-term-seo-get and content-term-seo-set read and write a category's or tag's title, description, canonical, focus keyword and noindex in Yoast SEO (the wpseo_taxonomy_meta option) or Rank Math (term meta, with the robots directive list edited rather than replaced). Both admit on edit_posts and then ask the taxonomy's own edit capability, so a contributor cannot rewrite what a category archive tells search engines. The write is previewed, snapshotted and reversible like every other. 74 operations.sitehelm_modules (add a module), sitehelm_register_operations (add operations to a module) and sitehelm_status_sections (add a section to the Health tab). Every hook is additive and contained: nothing an add-on returns can remove a built-in module, and a throwing handler is logged rather than allowed to break the boot.manage_options second. seo-settings-get / seo-settings-set read and write an allowlist of the plugin's own settings — separator, knowledge-graph name and logo, default social image and breadcrumbs at site scope; title and description templates, noindex and sitemap inclusion per public post type — as one previewed, snapshotted, reversible change per scope, translating between the two plugins' option layouts (Yoast's separator codes, Rank Math's two-key robots rule). content-seo-bulk-set applies the content-seo-set fields to up to fifty posts at once as a single reversible change, refusing the whole set if one post is missing or not the caller's to edit. seo-404-log-list and seo-redirection-list page Rank Math's 404 monitor and redirections newest first (at most 200 a page), and say plainly when a Yoast site has no such tables or the Rank Math module is switched off. The free plugin is unchanged: the operation count stays at 74.?page=sitehelm-connect (the console's first page is now ?page=sitehelm, Home).system-operation-schema will not describe it either; everything is on by default, including operations a later update adds. Stored in sitehelm_disabled_operations.wp-admin, and is itself re-restorable. The plan token never reaches the browser; it sits in a five-minute, per-user transient and is spent on the second click only.maxProperties is now both applied by the validator and declared on all six, two of them from limits their handlers were already enforcing without publishing. An over-large object is refused whole.content-block-update, content-meta-update, content-terms-assign, elementor-theme-conditions-set, menu-item-create, menu-item-update and menu-items-reorder accepted a list of any length, so their size was discovered by running out of time or memory rather than by being refused. One of them — the term identifiers inside content-terms-assign — sat one level down, inside an entry of another list. elementor-theme-conditions-set already enforced its limit in the handler and simply never published it; the schema now names the same constant. A new registry-wide test sweeps every input schema recursively and fails on the first array that declares no bound.type, enum, minimum, maxLength and the structural keywords, and silently ignored minLength, maximum, pattern, minItems and maxItems — 44 declarations across 22 files. A published schema is what an agent reads to learn what a site accepts, so a declared bound that is never checked is worse than an absent one: a well-behaved client stops checking for itself. maxItems was the only declared upper bound on array size anywhere in the catalog, so every batch operation accepted a list of any length and discovered the size only while walking it; an over-long array is now refused whole, before the walk. A new registry-wide test fails on the next keyword written into a schema that the validator does not apply.content-terms-assign writes one taxonomy at a time, but a failure reported the same two completed steps whichever write it happened on — so an operator whose second taxonomy failed was told that nothing had changed, when the first had already been applied. The rollback record was always complete; only the account of it was not.menu argument — menu-get, menu-item-create, menu-items-reorder, menu-location-assign — accepted a string of any length. A menu is a nav_menu term, and all three ways to name one resolve against columns bounded at 200 characters, so a longer string could never have matched one. It is now rejected by the argument schema, which says the bound, instead of by a not-found result after the search.media-upload and media-import described content that was fetched from a URL as though the caller had uploaded it, which reads as a refusal of some other request.xn-- form — the address is never converted, because the name checked and the name dialled would then be two different strings. That was learnable only from a refusal; it is now in the url field's own description.user-list and user-role-set. The people who can reach a site can now be read and, one account at a time, re-roled. The listing answers accounts by role or search term, newest registration first, and carries the role slugs this particular site has registered — a roster no fixed list could publish, since a store or a membership plugin adds its own. The write replaces one user's roles with a single registered slug. It refuses four things outright rather than letting a preview promise them: an unregistered slug, the acting user's own account, the last remaining administrator, and a multisite super admin — each of them a way to lock a site out of its own admin. Promoting someone to administrator is permitted and warned about, as is the collapse of a multi-role account down to the one role you sent; the snapshot keeps every role held beforehand, so a rollback restores the whole set rather than the first of them. Seeing the roster and changing it are two separate capabilities, and neither operation accepts the other's, so a client allowed to audit access cannot grant it. The target-bound edit check runs against the specific account in the preview, the apply, and the rollback. No password hash, reset key, or session token is reachable through either operation.comment-list, comment-status-set, and comment-reply. The comment queue can now be worked: listed by post, status, or search term newest first; one comment moved between approved, pending, spam, and trash; and a reply posted under a comment as the acting account. All three gate on the comment-moderation capability alone, so a moderator with no editing rights can use them and a capability meant for posts is never demanded alongside it. Nothing here deletes anything — spam and trash are reversible statuses on a row that stays where it is, every status write is snapshotted and rolls back, and the value that would perform a permanent deletion is not in the vocabulary at all. The status write goes through the same WordPress function the moderation screen does, so marking a comment as spam still records the prior status for WordPress's own unspam and still tells the anti-spam plugins what was decided. Two refusals exist because performing the write would produce a result with a hidden expiry date: a comment whose parent post is in the trash is refused with the real fix named, because WordPress owns that comment's status until the post returns; and a reply under a spam, trashed, or post-trashed parent is refused, because WordPress would silently reparent it to the top of the thread. Replying under a pending parent is allowed but warns that the parent is still awaiting moderation, so the reply does not sit invisible under an invisible comment. The listing defaults to approved plus pending together rather than the moderation queue alone — an empty queue reads as "nothing to do", which is the wrong answer to "what is on this post" — and spam and trash appear only when asked for by name. The commenter's IP address is never reported.content-seo-get and content-seo-set. One post's search-engine metadata can now be read and written on a site running either Yoast SEO or Rank Math, through one vocabulary that names neither: title, description, canonical, the four social fields, and the search-visibility directives. The answer carries a provider saying which store it came from, and that is the only place a plugin is named. If both plugins are installed Yoast serves the site, by a fixed precedence, so a write always lands in the store the read that planned it came from. The visibility directives are tri-state — null means the post says nothing and the plugin's own default decides, which is a different state from an explicit instruction to index — and Rank Math's inability to store an explicit *follow* is declared in the preview rather than discovered at verification. Writing a flag on Rank Math merges into the directive list it already stores, so noarchive or nosnippet set in the plugin's own screen survives a noindex change. The two social images are read-only, because both plugins keep an identifier and a cached URL that a partial write would leave disagreeing. A snapshot records which plugin it was taken from, so a rollback on a site whose SEO plugin has since changed is refused rather than replayed into a store the site no longer renders from.elementor-theme-template-list and elementor-theme-conditions-set. The header, footer, archive, search, 404, singular, and product templates a site has built can now be listed with the display conditions each one stores, and one template's conditions can be replaced as a whole rule — include/general for the whole site, exclude/singular/page/12 to carve out a page. The list is replaced whole rather than edited entry by entry, because the conditions on a template are one indivisible rule; that makes the write idempotent and the preview a complete statement of where the template will display afterwards. An empty list is legal and detaches the template without deleting it. A condition that does not parse refuses the whole request, so a half-applied rule is not reachable. The write discards Elementor's resolved condition map in the same step that stores the rule, so the front end stops serving the previous header immediately — without that, the stored value is correct and every re-read agrees while visitors still see the old one. Rolling back distinguishes a template that had no conditions from one that had an empty list, so a restore of a never-configured template removes the row rather than storing an empty one. Both operations omit templates the caller may not edit, and the write requires edit_theme_options — the capability Elementor puts on site-wide settings — as well as edit rights on the template itself.redirect-list, redirect-set, and redirect-delete. A retired URL can be pointed at its successor, so the traffic and the ranking the old address earned survive a rename, and a page that is simply gone can be marked 410 instead of answering 404 forever. redirect-set creates or replaces in one call — the target is the path itself, so sending the same redirect twice leaves one row. The visitor's query string is carried over by default, and a target may carry its own, which wins where the two name the same argument. Redirects are served on template_redirect, ahead of the front-end request, and never on an administration, cron, or REST request. A redirect that would send a visitor back to the path they asked for is refused both when it is written and when it would be served, because a rename months later can turn a good redirect into a loop. A site holds at most 500, and redirect-list reports the count beside the capacity so the bound is visible before a write refuses it. The whole table is one stored value, so rolling either write back restores the table as it stood at apply — any other redirect changed in the interval is reverted with it, and both operations say so in their descriptions.content-links-check, which reports the links in one content item and says which of this site's own links no longer lead anywhere. A rename leaves the site pointing at its old paths from inside its own content, and nobody sees those until a visitor clicks one. Every answer comes from this site's database: a link to another host is listed and left unchecked, because a content operation that makes outbound requests is a content operation that can be pointed anywhere. This site's own links are resolved the way a visitor's request resolves them — to a post, to the redirect that catches the path, or to nothing at all. A link a redirect already catches is reported as a redirect rather than hidden among the working ones, because a hop is a net, not a repair. brokenOnly trims the list to what needs fixing while the counts keep describing the whole page.content-blocks-get, which reads the block structure of a page instead of its text. Called with an identifier alone it returns the outline: every block, its address, its depth, the *names* of its attributes, and a short plain-text preview — enough to find the paragraph you meant without spending a context window on the ones you did not. Called with an address as well, it returns that one block in full: attribute values and inner markup, with its descendants still in outline form. The outline also reports whether the document can be rewritten a block at a time, so a client learns that before it plans a change rather than when the change is refused.content-block-update, which changes the attributes or the inner markup of one block and leaves every other block byte-identical. Because post_content is one column, a block edit is unavoidably a whole-document write — so the operation reproduces the document from its own parse and refuses, without writing, if that reproduction is not byte-identical to what is stored. It also requires the caller to name the block it expects at the address, since an index path cannot notice that the page was re-ordered since the outline was read, and it replaces inner markup only on a block with no inner blocks and a single chunk of markup, rather than guessing where text belongs among a block's children. Like every other write it previews first, snapshots the prior columns, verifies the result by re-reading it, and can be rolled back.elementor-composition-get, which says what an Elementor page contains at a size that does not grow with how much it contains. It returns the page's totals, a census of widget types and container types by how often each is used, and one entry per top-level band naming that band's identifier, how many elements sit inside it, and the widget types found anywhere beneath it — enough to decide which band to read in full, without reading all of them first. It also reports how many elements carry no stored identifier, which is exactly how much of the page no write can address; reading a full tree node by node left a client to notice that for itself. A page whose stored data cannot be read is refused here exactly as the full read refuses it, because a cheap digest of a damaged page is the one wrong answer a client would act on without hesitating.audit-list, system-environment and image-size-list each declared a capability and then left the asking entirely to the request path that calls them. That path does ask, so nothing was exposed; but a handler reachable only one way is a guarantee about today rather than a guarantee. All three now check for themselves, and audit-list checks before it looks at its storage, so a caller who may not read the change log no longer learns whether the log exists. No refusal names the capability it wanted, because a message that does is a way to enumerate what a credential is missing.media-resize, which brings an oversized image within a width and a height you name, so the size the site actually serves fits the sizes the theme renders. The original file is never overwritten and never deleted: the reduced image is written to a new file beside it, the media item is re-pointed at the new file, and the untouched original stays reachable through the same metadata WordPress uses for its own scaled uploads. A second reduction still reads the true original rather than the previous reduction, so detail is not thrown away twice. Rolling back points the item at the file and the metadata the snapshot recorded and then checks that it landed. An image already within the requested maximum is refused rather than re-saved, so a repeated request cannot reduce it twice.elementor-elements-update, which changes the settings of several elements on one Elementor page as a single reviewed change. One preview covers all of it, one save writes it, and one rollback reference undoes it. Every entry is checked against the page before anything is written, so an entry naming a setting the widget does not declare — or a layout element, or an element that is not there — refuses the whole request and leaves the page untouched, rather than landing the entries before it and stopping. A refusal names which change in the request caused it. Two entries naming the same element are refused rather than resolved by order.bridge/sitehelm-bridge.mjs is that subprocess: no dependencies, Node 18 or newer, and it forwards each message to the site's endpoint unchanged. The Connect screen now hands out a config that runs it, so the code on the operator's machine is the code that was reviewed and installed here rather than whatever a package registry serves at launch. The credential travels in the config's env block instead of on a command line, which every process on the machine can read. The public mcp-remote bridge is still offered beneath it, for a client running somewhere the plugin's files are not.system-operation-schema, a fifth system read that returns one named operation's full input and output schema on demand. An operation the caller cannot see does not surrender its schema: an unknown name and a hidden one are refused identically, so the answer cannot be used to map the site's surface area.Host header at all — WP-CLI, cron, an internal dispatch — is not treated as a mismatch, and neither is the www. spelling of the site's own domain.inputSchema and outputSchema. A dispatcher holding a dozen operations spent most of a client's context window on schemas for operations it would never call. Each entry keeps its usage example, which states the argument shape concretely, and the catalog names system-operation-schema as the way to fetch one full schema when it is actually needed. A client that read schemas straight from the catalog must now ask for them.retired_host, rather than advertising it as available and refusing it on use.mcp-remote bridge. Each carries the config in the shape that client actually reads — including the servers object VS Code wants rather than the mcpServers object everything else wants, and a config fragment for OpenClaw rather than a whole file that would overwrite settings unrelated to SiteHelm.Authorization header, or a revoked password — and one request separates those without involving a client at all.sitehelm/v1/mcp, speaking protocol version 2025-06-18. Handles initialize, notifications/initialized, ping, tools/list, and tools/call.VerificationFailed with completedSteps saying how far the operation got.media-import resolves and validates the host before connecting; private, loopback, link-local, and reserved ranges are refused; every redirect hop is re-validated and re-pinned; the resolved address is pinned so the connection cannot be re-pointed between the check and the fetch; the wire read is capped; and the refusal message is deliberately digit-free so it cannot be used as an SSRF oracle.$wpdb->prepare, and table names come from the installer rather than a hardcoded prefix.