30 days free. No credit card. Full access from the moment you connect your site.

Start free trial
AcrossAI

AcrossAI

Pricing

v0.5.0

Consolidated release rolling up unreleased patch iterations 0.5.1 + 0.5.2 + 0.5.3 into a single public release.

Security fixes

  • Defend OAuth endpoints against full-page cache poisoning (PR #13). Full-page caches (LiteSpeed Cache verified against 7.8.1 source; WP Rocket, W3 Total Cache, WP Super Cache, host-level FastCGI caches) do not honor arbitrary Cache-Control: no-store response headers — they gate on define( 'DONOTCACHEPAGE', true ). LSC additionally does not vary its cache by query string, so /authorize?client_id=X and /authorize?client_id=Y were treated as the same cached URL, potentially serving one OAuth client's consent page to a subsequent request from a different client. New includes/OAuth/CacheHeaders.php utility centralizes the three-pronged defense and is wired into every OAuth response path (AuthorizationController, TokenController, ClientRegistrationController). DiscoveryController intentionally unchanged — .well-known/oauth-* metadata IS meant to be edge-cached.

New capabilities

  • CIMD (Client ID Metadata Document) client trust layer (PR #12, Feature 005). Additive OAuth 2.1 client-trust path alongside RFC 7591 DCR. Adapted from wp-media/mcp-oauth (GPL-3). Claude bundled as trusted publisher (claude.ai host, two pinned client_ids). Gated behind a default-OFF kill switch — the 0.4.0 → 0.5.0 upgrade is a runtime no-op for the CIMD path until an operator opts in with: add_filter( 'acrossai_ai_connectors_cimd_enabled', '__return_true' );
    Security posture: three-layer SSRF hardening (URL shape → trusted-host allowlist → wp_safe_remote_get), 5 KB response cap, redirects disabled, token_endpoint_auth_method='none' hard-enforced at persist, hash_equals byte-match on client_id ↔ URL, failures never cached. Feature-006 H4 default require_admin_approval=ON kept for CIMD too (Option A, security-first). Trusted-publisher list extendable via acrossai_ai_connectors_cimd_trusted_publishers filter. No schema change — reuses the existing metadata_fingerprint column on oauth_clients as an implicit CIMD-vs-DCR source discriminator.
  • Discovery Site Health check (PR #12). New direct Site Health test at Tools → Site Health → Status named "MCP OAuth discovery documents". Loopback-fetches both .well-known/oauth-* documents and reports one combined status. Distinguishes the acme-challenge interception fingerprint (bare 404 with no WordPress-originated headers → critical — the Trac #37201 wontfix pattern seen on OVH / cPanel-AutoSSL / Plesk / most managed-WP hosts) from ambiguous failures (recommended). Adapted from wp-media/mcp-oauth. Always on; no configuration required. 5-minute transient cache. Short-circuits to recommended when pretty permalinks are disabled.

Bug fixes — Feature-003 runtime

  • Fixed OAuth-operational admin notices (HTTPS + DISABLE_WP_CRON warnings) being suppressed on installs where mcp-manager still owns the OAuth code path (PRs #10, #11).
  • Fixed class_exists FQN reference in Main::maybe_log_missing_registry() pointing at a moved class location (PR #8).
  • Fixed Loader::add_action component-vs-callback footgun where passing array( $this, 'method' ) as the component argument fatal-ed at fire time (PR #8).
  • Fixed ACROSSAI_AI_CONNECTORS_VERSION constant drift from the plugin-header Version: field (PR #8). Both aligned at 0.5.0.
  • Root .mcp.json now gitignored (PR #9) — would otherwise commit MCP client credentials.

Feature 003 — Import AI Connectors + OAuth 2.1 stack from acrossai-mcp-manager

Relocated ~41 files (Connectors framework, OAuth server, BerlinDB modules, admin tab, JS/CSS, consent template) into this plugin with namespace-only edits. Table names, option keys, cron hook (acrossai_mcp_manager_oauth_cleanup), REST namespace (acrossai-mcp-manager/v1), and hook action strings all preserved byte-for-byte — zero data migration, zero re-auth for existing Claude/ChatGPT/Grok connections. Ships DORMANT via a class_exists( '\AcrossAI_MCP_Manager\Includes\OAuth\AuthorizationController' ) probe. BC filter bridge — third-party plugins using the legacy acrossai_mcp_manager_connector_profiles filter continue to work. New settings tab on shared ?page=acrossai-settings with "Delete all data on uninstall" (dual-gated on both admin opt-in AND mcp-manager Feature 039 landing).

Upgrade notes

  • Upgrade is a runtime no-op for the CIMD path — CIMD kill switch defaults OFF; operators explicitly opt in via filter.
  • Cache-poisoning defense is always on — no operator configuration required. Every install running a full-page cache immediately gains the guard.
  • Coupled-rollback policy with acrossai-mcp-manager — once mcp-manager Feature 039 lands, this plugin can only be rolled back by also rolling back mcp-manager. Fixes after that point are forward-only via hotfix release.

Full compare: v0.4.0…v0.5.0

Keep reading