=== wpreef Bridge ===
Contributors: wiseit
Tags: ai, mcp, abilities, agent, site management
Requires at least: 6.7
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lets an AI assistant reach the parts of your admin screens the WordPress REST API leaves out — themes, updates, Customizer values, settings, cron and caches.

== Description ==

WordPress ships a REST API that covers posts, pages, media, comments, users and the Site Editor. It does not cover switching a theme, running updates, Customizer values, Additional CSS, most settings, cron, caches, or custom fields a plugin never registered. An assistant connected to your site can therefore write a post but cannot change your logo.

This plugin fills exactly those gaps and nothing else. Each capability is registered as a **WordPress Ability**, the standard introduced in WordPress 6.9, so it works with any client that speaks that standard — including the official WordPress MCP adapter and the wpreef server. On WordPress 6.7 and 6.8 the same capabilities are served under `/wp-json/wpreef/v1/` instead.

**You stay in control.**

* Capabilities are grouped, and the groups that change how your site runs are **switched off** until you turn them on.
* A switched-off group is not registered at all. The assistant cannot see it, cannot suggest it, and there is no code path that reaches it.
* An assistant can never do more than the WordPress account it signed in as is allowed to do.
* Settings that could lock you out or change what code runs — your site address, active plugins, security keys — can never be written through this plugin.
* Every change is listed under Tools → wpreef, with what it was before.
* One stop switch turns everything off at once.

**What it adds, by group**

*On by default*

* Site information — environment, PHP and WordPress versions, constants, available updates, allow-listed settings, the cron schedule, and this plugin's own change log.
* Design — Customizer theme mods, Additional CSS, menu locations, theme information, and switching to an installed theme.
* Content and media — custom fields the REST API does not expose, WXR export, thumbnail regeneration, and replacing a media file in place.

*Off until you enable them*

* Install and update themes and plugins, including from a ZIP URL.
* Write settings, permalink structure, media sizes and maintenance mode.
* Run a cron event, delete transients, flush caches, update WordPress core.
* Empty the trash and delete spam comments.

== Installation ==

1. Install and activate the plugin.
2. Go to **Tools → wpreef** and decide which groups your assistant may use. The defaults are deliberately conservative.
3. Create an application password for the WordPress account the assistant should act as (Users → Profile → Application Passwords). Give it an account with the smallest role that can do the job.
4. Connect your assistant to the site with that account.

== Frequently Asked Questions ==

= Does this give an AI full control of my site? =

No more than the WordPress account you point it at. The plugin adds no capability the account does not already have; it only makes existing admin actions reachable over the API. Choose the account's role the way you would for a new colleague.

= What happens if I turn a group off? =

Its abilities stop being registered. They disappear from the assistant's list entirely, rather than failing when called.

= Can it edit PHP files or run arbitrary code? =

No. There is no file editor and no code execution. The only files written are those WordPress itself writes when installing or updating a theme or plugin, plus the maintenance flag.

= Does it work without WordPress 6.9? =

Yes. On 6.7 and 6.8 the same capabilities are served under `/wp-json/wpreef/v1/`. The Abilities API is used when it is available.

= Where do I see what the assistant did? =

Tools → wpreef lists recent changes with the previous value, so you can undo one by hand if you need to.

== Changelog ==

= 0.1.0 =
* First release.
