Version 1.7.1 is a fix-only release, the third correctness release in a row after 1.6.2 and 1.7.0. It changed nothing in the catalog: no ability added, removed, renamed, or moved to a different permission. The count is still 153 governed abilities. What it changed is whether a handful of already-permitted actions do what they claim, starting with a WPML sweep that reported success over an incomplete scan. Here are the fixes worth knowing about if you run the plugin.
A WPML sweep reported success over a partial scan
If you run WPML, a read with lang: "all" is supposed to mean every language you have configured. It did not. The read measured only a partial set of those languages and then reported success anyway, so an agent asked to sweep every language got back a clean-looking result over a scan that had quietly stopped short. Nothing in the response said so.
1.7.1 queries every configured WPML language now, across posts, pages, media, terms, search, and WooCommerce products, and the shared count helper sums across all of them rather than a subset. This is a data-integrity fix more than a feature one. A partial result that looks complete is worse than an error, because an error at least tells the agent to try again. The same reasoning drove the earlier language work in WPML MCP: language-aware content reads.
A sweep that measures three languages and reports on five is not a sweep, it is a guess dressed as a total. The read now counts what it actually queried, and it queries everything you configured.
Tool discovery could disagree with permission
A tool’s visibility in the MCP tools/list could disagree with what its execute-time permission check actually allowed, and it could disagree in both directions. Sometimes it hid a tool an agent was in fact allowed to call, so the agent never saw a capability it had. Sometimes it advertised a tool the agent could not call, so the agent tried and got refused. Either way the menu and the kitchen were telling different stories.
1.7.1 reconciles the two. Discovery now reflects the same execute-time permission check the call itself runs, across custom post types, pages, and ACF term fields. What the list shows is what execution will allow.
A discovery route returned 404 and broke a connection
The RFC 9728 protected-resource-metadata route is how a client finds out where to authorize. It was answering 404 at the exact path agents request it at, which was enough to break the connection for at least one real user who reported it. The route existed, it just was not resolving where the spec says to look for it.
1.7.1 serves it at the path-suffixed URL the spec calls for, so the discovery step completes and the connection can proceed.
moderate-comment reported failure on a no-op
Asking to approve a comment that was already approved, or to spam one that was already spam, is a no-op: nothing needs to change and nothing is wrong. The moderate-comment ability treated it as a failure anyway, handed back an error, and logged an audit error to match.
Now a no-op reads as success, because that is what it is, and it no longer writes an error into the log for a call that did nothing wrong. That keeps the audit log honest about what was actually a problem.
Stuck started rows in the audit log
The audit log opens a row when a call begins and closes it when the call ends with a real outcome. Several code paths could short-circuit or reject a call before it finished, which left the row stuck on “started” with no ending, or unreadable, rather than a proper outcome. Older WordPress cores, before 7.1, could hit this too.
1.7.1 gives every invocation a unique token and closes out its row cleanly, whichever way the call ends. A log you audit for what happened cannot afford rows that never say what happened.
Bridged third-party output, hardened
When another plugin registers its own ability and this plugin bridges it through, the output belongs to that other plugin. That output could hide an unsafe object a level or two deep, past a shallow check. The bridge now recurses into the result to find it, and refuses a bare or ambiguous object rather than assuming it is safe to pass along.
One honest limit to state plainly: bridged output is not redacted the way this plugin’s own abilities redact theirs. The bridge can refuse an unsafe shape, but it does not scrub a third party’s fields the way it scrubs its own. The readme now says so, so nobody has to find that out the hard way.
What this release is, and is not
None of the fixes above change what an agent is allowed to do. They change whether an already-permitted action does what it says: a language sweep that actually reads every language, a tool list that matches what execution will allow, a discovery route that resolves, a no-op that reads as success, an audit row that closes, and bridged output that gets a second look before it is trusted. A batch of smaller vendor correctness fixes rode along in the same release, across WooCommerce, ACF, AIOSEO, Rank Math, and Yoast. The full history is on the changelog page, and the current safety controls are on security.