What's new
Three composed features that together open a public extension surface for third-party plugins (planned BuddyBoss add-on, WooCommerce My Account, MemberPress) to enumerate and render MCP connection methods on their own admin/frontend surfaces without duplicating any of the F015 / F034 / F021 gate cascades.
F038 —
New shortcode lists every MCP server the current logged-in user can reach (F015 access-control gate) whose F037 Embeds tab has the master toggle ON and at least one enabled connection method — surfacing per server every enabled NPM / MCP Client / AI Connector DTO from F035.
Ships with a data-only abstract base class \AcrossAI_MCP_Manager\Public\Renderers\UserServers\AbstractUserServersRenderer so companion plugins can subclass and consume the enumeration primitive get_accessible_servers( ?int $user_id = null ): array without re-implementing the gate cascade. Concrete UserServersBlock is final per D36 (extend by filter, not subclass).
Two extension filters: acrossai_mcp_user_accessible_servers (reshape payload per context — NOT a gate-bypass surface, SEC-004) and acrossai_mcp_servers_shortcode_html (override markup without subclassing — NOT re-sanitized, SEC-002). Attributes: heading="", show_description="1", empty_message="…". Anonymous → silent no-render; logged-in with zero servers → empty-state wrapper. @experimental until 1.0.0.
F037 — Per-server Embeds tab + AbstractReactMountServerTab primitive · #52
New "Embeds" admin tab under the server-edit page lets site administrators enable/disable frontend shortcode + block output per server, with per-transport sub-toggles (NPM Methods, MCP Clients, AI Connectors). Master toggle default OFF — fresh install ships zero shortcode output for every server.
Persists via new BerlinDB junction table wp_acrossai_mcp_server_embed_transports (presence model per DEC-TOOL-SELECTION-PRESENCE-MODEL) plus new embeds_enabled TINYINT(1) column on wp_acrossai_mcp_servers (D28 3-part schema-drift contract; $version 1.1.2 → 1.1.3).
New AbstractEmbedTransport base class + three built-in transports (Npm/Client/AiConnector) with transport keys aligned 1:1 with F035 DTO category field. New filter acrossai_mcp_embed_transports for third-party transports. New shortcode with 3-gate cascade (master toggle → per-transport toggle → F015 AC). Admin UI is a React app at #acrossai-mcp-embeds-root per D37 (matches F017 / F020). Saves via POST /acrossai-mcp-manager/v1/servers/{server_id}/embeds.
Two granular observability actions per FR-024 (master + per-transport toggle events fire only on actual value transitions). Fail-forward per-listener try/catch per R3 (broken audit listeners MUST NOT roll back DB writes). Marked @experimental until 1.0.0.
F035 — Public connection-method discovery API + NPM extensibility filter · #50
New singleton AcrossAI_MCP_Manager\Public\Discovery\ConnectionMethodRegistry exposes every registered NPM method, MCP client, and AI connector as a unified list of plain-associative-array DTOs — one canonical entry point (get_all()) replaces three separate registries with three different shapes.
Every DTO across all three categories carries the same six top-level keys (category, slug, name, description, icon, meta) plus category-specific extras in meta; wp_json_encode() round-trips losslessly so consumers can safely persist to their own storage.
Adds two new filters: acrossai_mcp_npm_methods (closes the NPM extension-seam gap — NPM had no filter surface before this release) and acrossai_mcp_connection_methods (fires once on the assembled get_all() result for cross-category concerns). Delegates transparently to AbstractMCPClient::get_all_registered_clients() (F034) and ConnectorProfileRegistry::get_profiles() (F021) — never re-fires their filters. Malformed filter contributions silently dropped per SEC-035-001. Marked @experimental until 1.0.0.
Dependencies · #54
acrossai-co/main-menu0.0.23→0.0.27(shared main-menu package baseline)
Backwards compatibility
No breaking changes. All three new subsystems are additive. Existing shortcodes, filter contracts, and admin surfaces are unaffected. Fresh installs of F037 ship with Embeds OFF for every server — no shortcode output changes until an admin flips the master toggle.
Test coverage
user-serversPHPUnit suite added (F038): 11 algorithm cases + 12 render cases + 3 extensibility scenariosembedsPHPUnit suite added (F037): master toggle, per-transport toggle, 3-gate cascade, observability actionsdiscoveryPHPUnit suite added (F035): ~20 tests across two files — singleton shape, DTO invariants, JSON round-trip, filter fire + dedup + type-drift dropped- All three new suites registered in
phpunit.xml.dist+ CI