Meikero MCP 1.1.0 — 2026-10-24
ChatGPT OAuth preview, Elementor read/write, native WordPress Abilities

NEW
- Site-local OAuth authorization-code flow with mandatory S256 PKCE, ChatGPT callback validation, administrator consent and automatic public client registration.
- Resource metadata and authorization-server discovery. Missing/invalid MCP credentials return an OAuth resource-metadata challenge.
- Separate read-only/full OAuth grants. One-hour access tokens, rotating refresh tokens, hashed credential storage, revocation in existing client-key management. Main-key rotation or connection-owner changes invalidate OAuth grants.
- ChatGPT setup replaces Coming soon; existing Claude Bearer authentication remains supported.
- Eight Elementor tools: list widgets, inspect widget controls, read layout, read element, replace layout, replace element, list snapshots, restore snapshot. Seven are new; elementor_get_layout is expanded.
- Elementor uses native document saves, current layout hashes, mandatory confirmation, snapshots, bounded trees, unique IDs, installed-widget checks and cache invalidation.
- Builder Read & write permission is selectable and persists. Target content/product write permission and plan are independently required. Existing access levels are retained.
- Register Meikero tools under meikero/* in WordPress Abilities API when present. Shared MCP/Abilities execution enforces tool availability, permissions, plan and client read-only limits. Native REST abilities require normal WordPress authentication as the configured owner; Meikero Bearer keys are not WordPress login credentials.
- Elementor snapshots are tracked by existing trial recovery policy.

SCOPE
- Elementor Free supported; Pro and third-party widgets are usable only if installed, registered and licensed on the target site. This does not unlock paid widgets.
- Elementor page/post/product documents only. No global kits, Theme Builder templates, dynamic-tag management or Elementor Pro entitlement management. Document settings are read and preserved; arbitrary document-settings updates are not a separate tool.
- Full layout replacement permits element insertion, removal, ordering and settings changes. Individual replacement preserves the target element ID.
- ACF remains schema-read only; navigation and health remain read-only. No blanket enablement of all website permissions.
- 67 static tools in the test inventory; live availability depends on installed integrations, configured scopes, plan and optional native Oxygen abilities.
- Optional Abilities API requires WordPress 6.9+ or a compatible API implementation. Existing MCP remains available without it. Oxygen already used Abilities API; this release additionally publishes Meikero tools to it.
- License Manager 0.4.8 unchanged. Existing licensing and release-server protocols are unchanged.

VALIDATION
- PHP 8.3 syntax lint: all 24 production PHP files pass.
- 45 isolated regression checks pass (WordPress/Elementor test doubles).
- Full plugin boot/inventory smoke check passes with WordPress function doubles; tool names unique; unavailable Elementor tools hidden; missing Abilities API does not block boot.
- No live WordPress database, Elementor install, browser consent flow, ChatGPT connection, reverse proxy or host .well-known routing was available. These are not verified by isolated tests. ChatGPT and Elementor write support remain preview features pending live acceptance tests.

INSTALL / TEST
1. Back up the site and use staging first. Upload this ZIP as an update to Meikero MCP.
2. Keep License Manager 0.4.8 on the license server. No replacement license ZIP is needed.
3. Meikero > Connection: enable the HTTPS connection. Open ChatGPT OAuth setup.
4. In ChatGPT custom MCP/app settings choose OAuth, use the displayed MCP URL and automatic registration. Leave manual client credentials empty. Custom MCP availability depends on the account/workspace.
5. Sign in to WordPress as an administrator. Approve Read only first; test get_site_info and a read call.
6. For edits: reconnect and approve Read and write; set Builders > ACF schema & Elementor read/write and Posts & pages (or WooCommerce) to Read & write. Use a plan/trial permitting writes. Turn off Core tools only, then refresh tools in ChatGPT.
7. Test a draft Elementor page: elementor_get_layout, change one heading with its current edit_sha256 and confirm_write=true, read it back, inspect the frontend, then test elementor_restore_backup.
8. Verify read-only grants cannot execute write tools; revoke the OAuth key and confirm access stops.
9. For Abilities API, use WordPress 6.9+; inspect meikero/* abilities authenticated as the configured connection owner. Standard WordPress auth and Meikero scopes are both required.

HOST REQUIREMENTS
- Public HTTPS URL, working Authorization header forwarding and form-encoded POSTs to the token endpoint.
- Authorization-server discovery at the issuer's .well-known URL must reach WordPress. Hosts intercepting .well-known, subdirectory WordPress installations and plain permalinks may require routing configuration.
- Only exact ChatGPT connector callbacks are accepted; this OAuth server is not a general-purpose provider for other AI clients. Existing clients can continue using Bearer keys.
- OAuth has no client secret. PKCE and WordPress administrator consent protect each grant. Tokens expire; revoke old keys when the 20-key limit is reached.

OFFICIAL REFERENCES
https://developers.openai.com/plugins/build/auth
https://developer.wordpress.org/apis/abilities-api/
https://developer.wordpress.org/apis/abilities-api/rest-api-endpoints/
https://github.com/elementor/elementor/blob/main/core/base/document.php
