Acadium AI Site Editor

Changelog

2.0.0

• Renamed to Acadium AI Site Editor. Settings, connections, endpoints and tool names are unchanged.
• Pages: create and edit pages with parent, template and order. Editing existing content follows the connected person’s role (Editors and Administrators: everyone’s, keeping the original author; Authors: their own; Contributors: their own drafts). New find-posts tool.
• Synced patterns: find, read, edit and restore shared blocks such as headers, footers and banners.
• Exact edits: update tools take edits ([{find, replace}]) to change specific text without resending the content. A whole-content save that would strip markup the person’s role can’t save is refused instead.
• The person’s own “unfiltered HTML” right is kept, so Administrators and Editors can keep scripts, SVG and embeds.
• New tools: trash-post, restore-revision; navigation menus (list-menus, create-menu, update-menu, restore-menu); categories and tags (create-term, update-term, delete-term with merge); image details (update-media); redirects (list-redirects, create-redirect, delete-redirect, using the Redirection plugin when active).
• Page builders: Claude is told whether Beaver Builder, Elementor, Divi or WPBakery draws a page, and content edits that wouldn’t show are refused.
• Responsive image attributes (srcset, sizes, loading and similar) are kept in Claude’s content.

1.9.0

• Staff connect Claude with their own WordPress accounts: posts Claude writes are credited to and owned by the person who connected it. No AI Agent user or administrator approval needed; anyone who can write posts can connect (filter agent_publisher_can_connect to limit it). Administrators can still credit an AI Agent user instead.
• Through a connection, a person’s capabilities are capped to the AI Agent’s (own posts only, no settings, no unfiltered HTML) and never exceed their own role: a Contributor’s Claude writes drafts; publishing needs both the site mode and the person’s own publish right.
• Upload links: request-upload gives the user a one-time page (valid 30 minutes) to drop their own image into the Media Library at full size; get-upload returns it to Claude. Needs a role that can upload files.
• Claude is told to use free stock photo URLs for generic images instead of generating images and sending them as base64.
• New installs: connector sign-in (OAuth) is on and the mode is “Publish and edit live posts”. Sites with saved settings keep them.
• Settings page: “Recommended Claude settings” for the connector’s tool permissions. Activity log marks actions “(via Claude)”.

1.8.0

• Featured images under the minimum width are refused when publishing or replacing a live post’s image, by default (Settings > Agent Publisher > Images; untick to allow them with a warning).
• Built-in minimum of 1,200 px when the site sets none, and a recommended width (the largest size WordPress generates) in get-capabilities, so agents always have a target.
• Agents are told never to reduce an image’s resolution to fit it through base64, and a small image sent as base64 gets a warning pointing to the upload route (Media > Add New, then find-media).

1.7.0

• New find-media tool: Claude finds images in the Media Library by title or file name. For large images, upload them in WordPress and ask Claude to use them.
• Image guidance under Settings > Agent Publisher > Images: minimum width, the aspect ratios your theme crops featured images to, and guidance for agents. get-capabilities reports it along with accepted types, the size limit and the sizes WordPress generates. Images that don’t fit get warnings in the result; “Strict” refuses to publish with them.
• update-draft-post and update-published-post accept featured_image, so a live post’s featured image can be replaced in one step. Post results include the featured image and the sizes WordPress generated from it.
• get-post reads the agent’s own published and scheduled posts.
• Base64 uploads accept line breaks, data: prefixes, URL-safe characters and missing padding; errors show what’s wrong and where. An optional sha256 refuses corrupted uploads. upload-media returns the file’s size and sha256.

1.6.1

• Fix: connector requests failed with a server error (HTTP 500, “Couldn’t connect to the server” in Claude) on sites where another plugin checks the logged-in user early, such as Limit Login Attempts Reloaded. Introduced in 1.5.0.

1.6.0

• Claude Desktop extension (MCP Bundle) for sites that can’t use the connector: download it from Settings > Agent Publisher, create an Application Password there, and open the file. Claude Desktop installs it with its own Node.js; no Node.js install, npx path or JSON editing. The password is stored securely by Claude Desktop.
• The Application Password panel now shows the connection URL, username and password with Copy buttons, for the extension’s install dialog. The claude_desktop_config.json block is still available for manual setups.
• The extension pins the WordPress MCP bridge to a tested version instead of fetching the latest from npm at every start.

1.5.0

• New “Connect Claude” setup on the settings page: create the AI Agent user, turn on connector sign-in and copy the connection URL in a few clicks. An Application Password and a ready-made Claude Desktop configuration are available for sites that can’t use the connector.
• New connection checks: HTTPS, permalinks, whether the connection URL answers, whether the Authorization header reaches WordPress (with a one-click .htaccess fix on Apache) and whether connector sign-in can be discovered.
• Security: publishing, unpublishing and editing live posts through the abilities is now limited to AI Agent users; other users need their own WordPress capabilities (for example, Contributors can no longer publish through the abilities in Publish mode).
• Security: OAuth access tokens work only on the MCP and Abilities REST routes, checked on the route actually dispatched; never in wp-admin, admin-ajax, cron or XML-RPC.
• Security: invalid authorization requests show an error page instead of redirecting; the consent screen shows the app’s address and flags apps outside claude.ai as unverified; administrators who also hold the AI Agent role can’t be chosen as a connection’s user.
• Security: reusing a rotated refresh token revokes the connection; clients can only revoke their own tokens; token and revocation rate limits are per client (new filter agent_publisher_client_ip for sites behind a proxy).
• Image downloads stop at the size limit instead of fetching the whole file first.
• MCP errors are written to the PHP error log only when WP_DEBUG is on.

1.4.0

• New create-post replaces create-draft-post. In one call it creates the post with categories, tags and a featured image (featured_image uploads it), and can submit it for review or publish or schedule it when the site mode allows. An agent now needs one approval for a finished post instead of up to three.
• If a pre-publish check fails, create-post creates nothing (including the uploaded image), so the agent can fix its input and try again.
• Tool descriptions and server instructions no longer tell agents to ask again in chat for something the user already requested.

1.3.1

• Fix: when no custom fields are enabled, the create, update and update-published tools no longer send an invalid schema. MCP clients such as Claude Desktop skipped those tools, so agents could not create posts.

1.3.0

• The MCP Adapter is now built in; the separate MCP Adapter plugin is no longer needed.
• New MCP endpoint /wp-json/acadium-agent-publisher/mcp lists each ability as its own tool. The MCP Adapter default endpoint keeps working, including with OAuth.
• A notice with a one-click fix when the site uses “Plain” permalinks, which AI clients cannot connect through.
• Setup status on the settings page now shows permalinks and the connection URL.

1.2.0

• OAuth 2.1 for MCP clients, so claude.ai (web, desktop and mobile apps) can connect as a custom connector without an Application Password. Includes discovery metadata (RFC 9728, RFC 8414), dynamic client registration (RFC 7591), authorization code with PKCE, rotating refresh tokens and revocation (RFC 7009).
• Administrator consent screen: each connection acts as a chosen AI Agent user.
• Connected apps list with Disconnect on the settings page.
• OAuth is off by default (“Allow OAuth connections”).

1.1.0

• Publishing modes under Settings > Agent Publisher: drafts only (default), submit for review, publish, publish and edit live posts.
• New abilities: get-capabilities, submit-for-review, publish-post (now or scheduled), unpublish-post, update-published-post.
• Pre-publish checks: featured image with alt text, allowed categories, daily limit.
• Recent agent activity on the settings page.
• The AI Agent role (previously “AI Agent (drafts only)”) never has publishing capabilities; publishing goes only through the plugin’s abilities.
• Write abilities now all use POST in the core Abilities REST API (update-draft-post previously required DELETE).

1.0.0

• First release: list terms, get post, create draft post, update draft post and upload media abilities, plus the AI Agent (drafts only) role.