Releases

Changelog.

What shipped in each plugin version, sourced directly from the plugin'sCHANGELOG.mdat build time.

v3.19.26 changes

Security update with review hardening for OAuth, menus and loops, and Cloud Safe Updates for reviewing plugin, theme and WordPress updates with a snapshot and automatic restore.

01
New: Cloud Safe Updates. From Account → Safe updates on EMCP Cloud, workspace owners can review the plugin, theme and WordPress updates a connected site has waiting and run them in groups. Each group gets a file and database snapshot first; the site shows a short maintenance page while it runs, chosen pages are checked afterwards, and a failed group is restored from its snapshot. Nothing starts without the owner's maintenance consent, the plugin never accepts download links, and sites it cannot recover safely (no HTTPS, multisite, must-use plugins, custom content paths, files it cannot write, another WordPress install sharing the database table prefix) are refused before anything changes, and the files at fault are named. If EMCP Cloud stops responding before any update has run, the site reopens by itself at the job deadline; once an update may have run, it stays in maintenance until Cloud restores it. A restore interrupted by a host time limit resumes where it stopped, and a finished job keeps only its status receipt: its snapshots and database credentials are deleted, and uninstalling removes finished job folders. The new cloud-safe-updates tool is under Tools → EMCP Modules → EMCP Cloud.
02
Security: Restrict credentialed Unsplash requests to the exact trusted HTTPS origin and disable redirects, preventing API key disclosure through crafted image URLs.
03
Security: Require management authorization and a valid settings nonce before interpreting posted tool toggles, preventing unauthorized changes during pending defaults updates.
04
Security: OAuth and request handling are stricter. Request values are type checked before they are used, malformed bearer tokens, hosts and client addresses are refused instead of being reinterpreted, the sign-in return address uses the configured site origin, and the consent page can no longer be framed by another site.
05
Security: Menu output is filtered, Elementor notices only show on EMCP screens, and the consent, menu icon, SVG and loop styles load through WordPress's own queues. Loop pages load their scripts with WordPress's own printers.
06
Security (Pro): EMCP Themer's condition search checks its inputs and only returns posts you can read, and the Widget Builder's current page links are normalized.

v3.19.14 changes

Patch release: Cloud buttons on the Connection screen work again, and uninstalling the plugin now completes and removes everything it stored.

01FixedCloud buttons no longer fail with "The link you followed has expired". The Connection screen's Cloud Connect, Disconnect, gateway and re-issue links carried an HTML-escaped &, so the browser dropped the security token and every click was refused, however fresh the session. The links are now plain URLs (reported by a customer; #158 by @amiriqbalmcs).
02FixedThe v1 prompts download works again. The Prompts screen's download link had the same escaped &.
03FixedDeleting the plugin no longer stops with a fatal error. WordPress runs the uninstall without the plugin's normal startup, and the uninstaller did not load two classes it needed, so it stopped at the custom widget step: PHP snippets, Pro blocks, Project Memory and AI Chat conversations and keys were never removed.
04FixedUninstalling removes everything EMCP stored. It now drops the OAuth client and token tables (#157 by @amiriqbalmcs), History, redirects, the search index and the Backup & Migrate tables (paired sites hold connector secrets), deletes every EMCP option, transient and user setting, and unschedules its tasks. Your pages, EMCP Themer templates, Brand Kit backups and backup archive files are kept.

v3.19.055 changesRead the blog

Ten Pro plugin integrations, from Polylang and Tutor LMS to Amelia and MailPoet, each with undo, plus security hardening, management access control and Cloud onboarding.

01
Security: MCP post writes check the post type's own capabilities. Creating a post checks that post type's create and publish capabilities (a WooCommerce product needs the product capabilities, not just edit_posts), assigning another author checks its edit_others capability, and changing a status to published, scheduled or private checks its publish capability. restore-content and History undo also need edit rights on the post they write to.
02
Security: Sitewide Elementor templates need theme-management rights. Editing or deleting an Elementor header, footer, single, archive, search, 404, popup or loop item template, or any template with display conditions or popup triggers, now needs edit_theme_options, in Elementor's editor, the REST API and EMCP alike. Editors without that capability can no longer change those templates. EMCP's theme-template and popup tools check the same rule and confirm the target is the right kind of template.
03
Security: EMCP Themer templates that run PHP are protected. Once a PHP template is attached, only administrators with unfiltered_html can edit or delete the Themer template, and only they can attach, swap or remove its PHP template.
04
Security: OAuth tokens and the Cloud Gateway credential are changed one at a time per client. Code exchange, refresh rotation and revocation take a per-client lock, so a revoke cannot lose a race with a refresh, and a deleted client can no longer exchange a code. Gateway provisioning, re-issue and revocation are serialized the same way, a failed upload no longer leaves a live credential behind, and a lost response keeps the previous credential so a retry is safe. Databases that do not support MySQL named locks use an options-table lock instead, so sign-in keeps working there.
05
Fixed: Integration write arguments and recovery reports match the installed plugins. FluentCRM contact imports refuse unknown row and address keys before writing. LifterLMS quiz limits require their enabling switches. MailPoet block-editor newsletters accept a separate campaign name, default it to the subject, and restore it on undo. FunnelKit accepts scratch step types and JSON step designs, resolves checkout embed templates, and reports missing builders or incomplete imports. If a hook throws after a step is stored, the failure is recorded without replay; observed new step IDs are marked unverified until their ownership is checked.
06
Changed: Plugins and Themes tabs on the Tools screen are one compact row per integration. Each row shows the integration's Read and Write switches side by side with their operation counts and any requirement ("Needs Polylang"); opening a row shows each tool's description, slug and operations and the integration's note. Integrations that share a group sit under one heading, and the per-group Enable and Disable buttons are gone from these two tabs (Bulk Actions still applies). Other tabs keep the card grid.
07
New: Site-local management access policy. An optional administrator allowlist decides who may open EMCP's screens and use its admin endpoints, with the same checks on every screen, REST route, admin-post and AJAX action, protection against stale updates and self-lockout, and host WP-CLI recovery (wp emcp management-access recover). While a list is set, EMCP Themer follows it too: templates have their own capabilities, so anyone off the list, administrators and editors alike, loses the Themer menu, list, editors, REST routes and Themer tools; with the default policy editors keep page-level access to Themer as before, and the Themer condition search works for them again. The list can also be set in wp-config.php with define( 'EMCP_TOOLS_MANAGEMENT_ADMINS', '1,5' ); (or an array of IDs, or 'all' to keep every administrator): the constant overrides the saved setting, the screen shows it read-only and flags listed IDs that are not administrators, saves and WP-CLI recovery refuse to change it, and an invalid value keeps management closed until it is fixed. Other MCP execution identities and permissions stay separate, and settings sync never overwrites the local policy.
08
New: Managed configuration for Cloud profiles. Read-only inspection of a fixed settings allowlist (no credentials, licences or free-text context), confirmed apply with a durable receipt, and conflict-aware rollback, written atomically with before-images. Needs the matching Cloud and Gateway rollout; deployment is off by default in Cloud.
09
New: Unattended Cloud enrollment. Workspace owners can issue short-lived grants with a fixed site allowance. wp emcp cloud onboard --phase=enroll and the manifest runner consume grants from the environment, preserve workspace and clone checks, and resume after transient failures. Enabling Gateway requires explicit consent. Requires bulk enrollment enabled in the matching Cloud deployment.
10
Fixed: Connection step 3 with an existing application password. The chosen password stays selected while the setup opens, and the screen explains that WordPress keeps only a hash, so the saved password is pasted once and the configs fill in. The paste field is now a plain text field that appears only after a password is chosen, so browsers no longer fill it with the WordPress login password, and the configs fill only from text in WordPress's application password format (a login password filled in earlier ended up in the Basic header). The ChatGPT App form guide is laid out as an aligned table again, the "Copy it now" notice no longer runs into the steps below it, and the password list fills its field.
11
Changed: The Facebook community invitation moved into EMCP's announcement bar. It no longer appears as a banner on the WordPress Dashboard; it rotates with the other announcements on EMCP's own screens. The What's new announcement describes 3.19.0, and Management access sits below Page Builders in the sidebar.
12
Fixed: Meta Box and ACF switches on the Tools screen follow their plugin. Without Meta Box installed its Read and Write switches looked live, because a catalog entry with no availability flag counted as available (the tools themselves never registered). Both integrations now show "Needs Meta Box" or "Needs Advanced Custom Fields" and greyed-out switches until the plugin is active.
13
Fixed: Cloud refresh throttling no longer asks for reconnection. Temporary HTTP 408, 429 and server errors retain the saved connection and defer refresh using Retry-After, with a bounded fallback. Successful refresh clears the cooldown; rejected credentials still require reconnection.
14
New: Operator-run Cloud onboarding. wp emcp cloud onboard provides local preflight, workspace-pinned Cloud approval and resumable Gateway setup with a health check. The included bin/cloud-onboard.mjs processes manifests one site at a time and reports partial results. The prepare flow requests browser approval for each site; unattended enrollment requires an owner-issued grant. Licence activation and WordPress Multisite are outside this workflow. Requires the matching Cloud service update.
15
New: Cloud protection for cloned sites. Cloud connections record the WordPress home URL and block copied credentials when that URL changes. Connection > Cloud provides an explicit action to give the copy its own identity before reconnecting, preserving the source site's Cloud connection. Older connections without a recorded URL and copies using the same URL require manual separation. A legitimate URL move also requires reconnection.
16NewFunnelKit Funnel Builder write tool (Pro, #143). funnelkit-write creates and changes funnels and steps, checkout products (with discounts) and fields, order bumps, upsells and downsells, opt-in and thank-you pages, A/B tests and the store checkout, and imports FunnelKit templates and funnel exports. Deletes need confirm: true; creates and updates accept dry_run: true, which reports the exact request and, for checkout products, the price a buyer pays. Every write is recorded in History and most can be undone there, including deleting a step with its order bumps. The tool ships disabled; enable it under Tools > Plugins > FunnelKit.
17NewFunnelKit Automations read and write tools (Pro, #144). funnelkit-automations-read lists automations and their stats, contacts (as compact rows: id, email, tags, lists), tags, lists, fields, audiences, broadcasts, templates, form feeds, link triggers, carts, email reports and allowlisted settings. funnelkit-automations-write builds automations step by step (event, delay, email, tag and other actions), manages contacts, tags, lists and fields, and drafts, schedules and sends broadcasts. Anything that sends or deletes needs confirm: true; a broadcast's dry run reports how many contacts would receive it. API keys, connectors, licences and plugin installs are never reachable, and settings outside a short allowlist are refused. The write tool ships disabled.
18NewHistory records actions it cannot undo, with the reason. Sending a broadcast, putting contacts into an automation, deleting automations with their contact runs and similar actions are listed in History with why they cannot be rolled back, and the tools say so before you confirm.
19Changedfunnelkit-read covers the whole funnel. Besides funnels, pages and checkout data it now reads order bumps, upsells and offers, A/B tests and their stats, funnel analytics, orders and leads, and exports funnels and the store checkout as JSON.
20Newemcp-funnelkit agent skill (Pro). How to build a funnel end to end, set up an automation and send a broadcast safely, and what History can and cannot undo.
21NewPolylang read and write tools (Pro). polylang-read reports languages and settings, translation groups, pages missing a translation and string translations. polylang-write sets up languages, the default language, menus per language and settings, assigns languages (in bulk for existing content), links existing translations and creates term translations. Works with Polylang free; the write tool ships disabled.
22NewTranslate a page in a few calls. create-translation copies a page into another language with its Elementor or block content, meta, template, password and featured image, maps its parent and categories to their translations and links it. get-page-text returns every translatable string of the copy as one numbered list (Elementor widget text and links, Gutenberg block text, image alt text and captions, the title and the SEO title and description), and apply-page-text writes the translated list back in one call. Writes are all or nothing: one bad segment and nothing changes, and a failed save puts back what it had written. set-status publishes the result.
23NewTranslations never change the original. Polylang can copy dates, menu order, custom fields and categories between translations. While EMCP writes a translation it holds that copying back for what it writes, so publishing the French page leaves the English one exactly as it was; if anything is copied anyway, the write is reversed and History holds an entry to restore the other page.
24Newemcp-polylang agent skill (Pro). How to set up languages, translate a page end to end, and what History can and cannot undo.
25NewTranslatePress read and write tools (Pro). translatepress-read returns every string of a page in the translation language, in page order, with the whole sentence each fragment belongs to (TranslatePress splits a sentence at every link or bold word), plus the theme and plugin strings on it, string search and translation progress. translatepress-write writes up to 200 translations in one call and adds, updates, removes or sets the default language. Works with TranslatePress free; the write tool ships disabled.
26NewTranslatePress translations are safe to write. Translations are saved as machine translated unless marked reviewed, and a reviewed translation is never overwritten without asking. A string that someone else changed since it was read is a conflict. One bad entry writes nothing, and the translations and their History entry are saved in one database transaction, so a translation that cannot be undone is never saved. Reading a page never starts TranslatePress's automatic translation.
27Newemcp-translatepress agent skill (Pro). How to translate a page's fragments as whole sentences, what the free edition cannot translate, and what History can undo.
28NewTablePress read and write tools (Pro). tablepress-read lists tables and returns a table's cells, options and version, exports it as CSV, HTML or JSON, renders it with formulas worked out, finds the pages that show it and reads the custom CSS. tablepress-write creates tables, changes them whole or cell by cell, inserts and deletes rows and columns, copies, renames and deletes tables, imports one CSV, HTML, JSON, XLSX or ODS file from pasted data or a URL, sets TablePress's custom CSS and puts a table on an Elementor or Gutenberg page. Works with TablePress free; the write tool ships disabled.
29NewTablePress writes are safe to retry and undo. Every change to an existing table names the version it read, so a newer change is never overwritten by accident. A write TablePress leaves half done is put back, a write History cannot record is not kept, and every write can be undone in History, a deleted table coming back under its old id. A user without the unfiltered_html capability cannot save a table holding HTML only administrators may save, because TablePress would strip it from the whole table. Imports never let a file choose or rename a table, and archives are refused.
30Newemcp-tablepress agent skill (Pro). How to build, edit, import and place a table, formulas and sanitizing, and what History can undo.
31NewTutor LMS read and write tools (Pro). tutor-read lists courses and returns a course's details, curriculum (topics with their lessons and quizzes, in order) and version, a lesson, a quiz with its questions and answers, a course's students and one student's progress. tutor-write creates and changes courses, topics, lessons (with video and attachments) and quizzes (true or false, single and multiple choice, open ended and fill in the blank), sets the curriculum order, publishes or trashes courses and enrols or un-enrols students in free courses. It runs Tutor's own course builder code, so Tutor validates and stores every change as its builder does. Works with Tutor LMS free; the write tool ships disabled.
32NewTutor LMS writes are partial, versioned and undoable. An update names only the fields it changes and keeps everything else, including the video, line breaks and the course's other details. Every change to an existing course, lesson or quiz names the version it read, so a newer change is never overwritten by accident, and a write Tutor leaves half done is put back. Every write can be undone in History, a deleted lesson or quiz coming back with its old id. Students' work is never touched: questions students answered cannot be changed or removed, a quiz with attempts cannot be deleted, and courses are only ever moved to the trash.
33Newemcp-tutor agent skill (Pro). How to build a course end to end, the free question types, versions and conflicts, and what History can undo.
34NewLifterLMS read and write tools (Pro). lifterlms-read lists courses and memberships and returns a course's details, curriculum (sections with their lessons and quizzes, in order), access plans and version, a lesson, a quiz with its questions and choices, a course's or membership's students and one student's progress. lifterlms-write creates and changes courses, sections, lessons and quizzes (choice, picture choice, true or false and content questions), sets the curriculum order, publishes or trashes courses, gives courses and memberships access plans, creates memberships and enrols or un-enrols students. It runs LifterLMS's own abilities and REST controllers, so LifterLMS validates and stores every change as its API does. Works with LifterLMS 10.1 or later; the write tool ships disabled.
35NewLifterLMS writes are partial, versioned and undoable. An update names only the fields it changes and keeps everything else. Every change to an existing course or membership names the version it read, which also covers its access plans' prices, so a newer change is never overwritten by accident, and a write LifterLMS leaves half done is put back. A membership enrolment is one change with the course enrolments it gives or takes, and its undo puts every one of them back, triggers included. Every write can be undone in History. Students' work is never touched: courses, lessons, quizzes and memberships are only ever moved to the trash, a quiz students took stays, and an undo that would take away a student's progress or attempts is refused.
36Newemcp-lifterlms agent skill (Pro). How to build a course end to end, the free question types, access plans and memberships, versions and conflicts, and what History can undo.
37NewThe Events Calendar read and write tools (Pro). events-calendar-read lists events by date range, status, category, venue, organizer or search, and returns an event with its venue, organizers, categories, tags, event status and version, plus venues, organizers and event categories. events-calendar-write creates and changes events with their date, time zone (identifiers, UTC and offsets), venue, organizers, categories and tags, publishes them, marks them cancelled or postponed with a reason, moves events, venues and organizers to the trash, and creates and changes venues, organizers and event categories. Works with The Events Calendar 6.x; the write tool ships disabled.
38NewThe Events Calendar writes keep every field and the calendar right. An update changes only the fields it names (TEC's own REST update loses the cost, the organizers and the featured flag and publishes drafts), new events start as drafts, and every write is read back and checked against TEC's calendar tables, which are repaired through TEC when they lag behind. Every change names the version it read, drafts of other authors stay private to those who may edit them, a venue or organizer events still use is not trashed, and every write can be undone in History, never onto a venue or organizer that is gone or in the trash.
39NewAmelia read and write tools (Pro). amelia-read reads the booking setup, service categories, services with their employees and prices, employees with their working week and days off, customers, appointments by date, employee, service, customer or status, free time slots, events with their periods and places left, and their attendees. amelia-write creates and changes categories, services, employees (profile, services, working hours, days off) and customers, books, reschedules, approves, cancels and rejects appointments and single bookings, creates, opens and cancels events and books attendees. Times are site-local and durations in minutes. Works with Amelia 2.4 or later, Lite included; the write tool ships disabled.
40NewAmelia writes run through Amelia's own controllers and email nobody unasked. Every write is validated first, names the version it read, goes through the controller Amelia's admin uses, and is read back; partial updates keep every other field even where Amelia replaces the whole object. No customer is emailed unless the call passes notify: true, and every answer lists what Amelia sent. A throw inside Amelia never leaves a transaction open: a write Amelia saved is kept and reported, a half-saved one is put back, and rows EMCP did not write itself are never touched. Fields Amelia Lite never stores (buffer times, deposits, group capacities, event tags) are refused rather than silently dropped. Every write can be undone in History, never onto a slot, a place or an email someone else has taken since.
41NewFluentCRM read and write tools (Pro). fluentcrm-read reads the setup, contacts with FluentCRM's filters, tags, lists, custom fields, campaigns with their recipient estimate, email templates, email previews, and automations with their contacts. fluentcrm-write creates, changes and erases contacts, imports and tags up to 200 contacts in one call, manages tags, lists, custom fields and notes, writes templates and campaign drafts, sends tests, schedules, unschedules, pauses and resumes campaigns, publishes automations and moves contacts in them. Works with FluentCRM 3.x and respects its own AI access switch; the write tool ships disabled.
42NewFluentCRM writes run no automation and email nobody unasked. Every write goes through FluentCRM's own abilities or REST API, names the version it read, changes only the fields it names (clearing included), and is read back. FluentCRM's automation triggers are held for the call unless it passes run_automations: true; nothing is emailed without confirm: true, and a schedule must name the recipient count it expects. Writes that would change a linked administrator or a WordPress user's email are refused. Undo never makes a contact who opted out sendable again, never re-arms an automation, and a scheduled campaign is withdrawn only while none of its emails has left the queue.
43NewErasing a FluentCRM contact erases it from History too. delete-contact cannot be undone, and every earlier History entry loses that contact's data: entries about the contact alone become not undoable, batch and tag entries keep working for the other contacts. A delete in FluentCRM's own admin does the same. The free History gains a redact() seam for this.
44NewMailPoet read and write tools (Pro). mailpoet-read reads the setup, subscribers with their lists, tags and custom fields, the list, tag and custom field registries, newsletters with their content, schedule and statistics, the live recipient count of a send, automations and forms. mailpoet-write adds, changes, unsubscribes and erases subscribers, imports and tags up to 200 in one call, manages lists, tags and custom fields, writes newsletters in MailPoet's block email editor, sends tests to the user, sends, schedules, unschedules, pauses and resumes newsletters, and switches automations on or off. Works with MailPoet 5.x; every operation checks MailPoet's own capability for its domain; the write tool ships disabled.
45NewMailPoet writes start nothing and email nobody unasked. Writes go through MailPoet's own code, name the version they read, change only the fields they name (clearing included) and never rewrite MailPoet's consent record. Automation triggers are held for the call, and the subscriber events MailPoet would fire when the request ends are fired inside it, still held, so a long-running MCP server starts nothing later either; run_automations: true lets them run and lists the runs. No welcome or confirmation email goes out unless asked, tests go to the user only, and a send must name the recipient count it expects. Unscheduling runs in one locked transaction of its own and is refused once sending has started or within two minutes of it.
46NewErasing a MailPoet subscriber erases them from History too, whether the delete runs through EMCP, MailPoet's own admin or a WordPress privacy erasure request (History is redacted before MailPoet's eraser anonymizes the subscriber). Undo never resubscribes anyone, never puts a subscriber back on a list they left, and never reactivates an automation.
47FixedHistory offered some large FluentCRM, Amelia, LifterLMS and The Events Calendar entries as undoable when their blockers would refuse them. The pre-undo check could not read a before-image stored in the snapshot table; the undo itself was already refused.
48NewThe Connection screen and the Dashboard name another plugin's MCP Adapter copy when it is the one loaded. Amelia loads its own older copy of the MCP Adapter before EMCP; EMCP keeps working with it, and now says so.
49Newemcp-events-calendar agent skill (Pro). How to build an event with its venue and organizers, dates and time zones, cancelling and postponing, versions and conflicts, and what History can undo.
50Newemcp-amelia agent skill (Pro). How to set up services, employees and working hours, book and manage appointments and events, who gets emailed, what Amelia Lite does not store, and what History can undo.
51Newemcp-fluentcrm agent skill (Pro). How to manage contacts, tags and lists, import in batches, schedule a campaign with its recipient count, keep automations still, handle consent and erasure, and what History can undo.
52Newemcp-mailpoet agent skill (Pro). How to manage subscribers, lists and tags, build and send newsletters with a recipient check, keep automations and welcome emails still, the consent rules, erasure, and what History can undo.
53ChangedThe emcp-plugins skill names the plugins with a skill of their own (FunnelKit, Polylang, TranslatePress, TablePress, Tutor LMS, LifterLMS, The Events Calendar, Amelia, FluentCRM and MailPoet), so an agent loads the right one before its first write or undo.
54ChangedHistory can undo several rows as one. An undo whose rows must change together now restores them, marks the entry and records the undo in one database transaction: if any part fails, nothing changes and the undo can be tried again.
55FixedThemer Post Content respects password-protected posts. A Themer single template's Post Content printed the content of a password-protected post without asking for the password. It now shows WordPress's password form until the visitor unlocks the post, as themes do.

v3.18.15 changes

Patch release: fixes a missing MCP endpoint on sites running Elementor 4.3.3 with Elementor's own MCP server switched off, keeps link buttons readable when clicked, and adds a Cloud connection status to the top bar.

01FixedThe MCP endpoint no longer goes missing with Elementor 4.3.3. When Elementor's own MCP feature is off, Elementor 4.3.3 turns off the MCP adapter's default server. EMCP relied on that server to load the WordPress abilities, so it saw no tools and never registered /wp-json/mcp/emcp-tools-server: AI clients got a 404 rest_no_route while the Connection screen still reported the server as enabled and OAuth discovery looked healthy. EMCP now loads the abilities itself before registering its server. Verified on a live site with Elementor 4.3.3 over OAuth.
02FixedLink buttons keep their colours when clicked. Buttons that are links (such as Export as plugin) turned blue on blue after a click, because WordPress's link styles overrode them. Every button style now keeps its text colour on hover, click and focus, and keyboard focus shows the admin's own focus ring.
03NewCloud connection status in the top bar. While the Cloud module is on, a pill beside Server online shows Cloud connected, Cloud needs attention or Cloud not connected, and links to the Cloud section of the Connection screen.
04NewThe free Prompts and Brand Kits screens show what Pro adds. A banner on each lists the Pro library (100+ prompts; 50 brand kits) with a link to upgrade. Pro sites do not see it.
05ChangedThe free zip no longer includes the admin source files. The free download now holds only the files the plugin runs; the admin screens' source and build setup are in the public GitHub repository, tagged per release. The Pro download still includes its source.

v3.18.028 changesRead the blog

01
New: Works alongside Elementor's own MCP server. Elementor 4.3 ships a built-in MCP server; both now run side by side on the same site. EMCP's Elementor tools follow the same safety rule as Elementor's: a write to a page that another user has open in the Elementor editor with unsaved changes is refused (nothing is written), and every successful write tells an open editor that the page changed. When Elementor's server is on, EMCP's server instructions tell a connected agent which server to use for which job. The admin bar item now reads EMCP instead of MCP, so it is not mistaken for Elementor's.
02
Fixed: Brand Kits tab missing. The Brand Kits tab was hidden whenever Elementor was not the selected page builder. It now follows its module switch only, like Templates, and explains on the page when Elementor is not active.
03
Fixed: The Skills tab follows the Agent Skills module. Switching the module off now removes Skills from the sidebar and the Dashboard, like the other module tabs.
04
Fixed: A restored backup no longer brings back its own "running" record (Pro). A backup stored its own in-progress backup and job rows, so after a full restore History listed a stale 0-byte backup. Backups now leave out EMCP's backup and job tables, and a restore keeps the site's own backup history, so archives made before this update restore cleanly too.
05
Fixed: Bricks 2.4 compatibility. The Bricks integration can be enabled on 2.4.x after native verification on 2.4.1. Updated the compatibility gate, admin requirements and bundled guidance.
06
New: Loop Items, Loop Grid and Loop Carousel in EMCP Themer (free). A new loop template type holds one post card, and two new Elementor widgets and two new Gutenberg blocks repeat it. Loop Grid: responsive columns, masonry, equal height, a wider first card, hover and entrance effects, and pagination as numbers, previous/next, a load more button or infinite scroll, with a page reload or AJAX. Loop Carousel: slides per view, autoplay, loop, fade and coverflow effects, centered slides, peek offsets, arrows and three dot styles. The card is built with either builder and works in both: an Elementor card can be repeated by the Gutenberg block and the other way round. Every field inside a card shows that card's post, including Themer dynamic sources, Elementor dynamic tags, ACF fields and core post blocks. Queries cover posts of any type, the current archive, related posts, a manual selection and WooCommerce products. The free tier includes one Loop Item and every widget and block option; EMCP Pro adds unlimited Loop Items and, for the Loop Grid widget, alternate templates at chosen grid positions. The Themer MCP tools accept type: loop and a preview argument and the widgets are in the widget catalog, so an agent can build a card and place a grid end to end. No new MCP tools.
07
Fixed: Themer dynamic images and links in Elementor. Binding the Featured Image, Site Logo or Author Avatar source to an Elementor image or background no longer crashes the page, and in a Loop Grid every card shows its own background again. The Featured Image size setting now takes effect, so a block binding that sets a size now shows that size. The Fallback setting works again on the Themer link sources, including fallbacks saved before this update. EMCP Pro: Author Avatar, Term Name and Term URL now show their values instead of staying empty; a card in a loop shows its own term. If a dynamic tag from another plugin fails, the page still renders without that tag's styles instead of breaking.
08
New: OpenCode Go and OpenCode Zen in AI Chat (Pro, #150). OpenCode's Go subscription and its pay-as-you-go Zen API join Anthropic, OpenAI, OpenRouter and Gemini as AI Chat providers, each with its own key. OpenCode's API does not accept requests from a browser, so AI Chat sends OpenCode turns through a server relay that only ever talks to OpenCode's fixed address, keeps your key on the server (it is never shown in the browser), and allows two replies at a time per user. Each model is routed to the API style OpenCode documents for it. Gemini models on Zen use Google's own format and are not offered there; use the Gemini provider for them. Zen's free models are hidden too: OpenCode limits them to its own client and says data sent to some of them may be used for training. A key is first checked on your first chat. OpenCode describes Go as designed for OpenCode and similar coding agents, so review its terms before using it for page building. Zen bills a prepaid balance and, by default, reloads $20 when it drops below $5.
09
Fixed: Blank padding and margin sides are no longer saved (#151). Sending a padding, margin, border radius or border width with one to three sides left blank used to save the blank value, and Elementor then dropped the whole rule, including the sides that were set. Now an update fills the blank sides from the saved value when it is complete and uses the same unit; otherwise the setting is not written and the saved value stays as it was. New elements, imported templates and page content leave the partial value out. The warning says exactly which of these happened. This covers every tool that writes element or page settings, widget spacing controls such as button padding, and tablet and mobile values.
10
Fixed: Curated widget settings match Elementor's real controls (#152). 55 of the curated widget parameters that get-widget-schema lists had names Elementor does not use (for example object_fit on the image widget, which is object-fit), so values sent under them were saved and ignored. All 55 are corrected or removed, and every catalog option list and default now uses values Elementor accepts: that fixes progress bars added with the default settings never showing their percentage, code blocks never showing line numbers or the copy button, and size defaults that rendered nothing. The bundled skill helpers send the real names too. The widget tools now warn when a setting is not a control of that widget, with the likely correct name. Values sent earlier under the old names never took effect; send them again under the new names.
11
Changed: EMCP Themer is off by default on new installs. Turn it on from EMCP Tools > Modules to use the theme builder and the new Loop Items, Loop Grid and Loop Carousel. Sites that already have Themer on keep it on after updating.
12
New: Starter prompts in AI Chat (Pro). A new chat shows six suggested prompts above the message box, drawn from 20 site tasks on the AI Chat page (landing, About, Contact and FAQ pages, blog posts, brand colors and fonts, SEO, accessibility, speed and security checks) and 15 page tasks in the Elementor and block editor panels. Your most used prompt always comes first and the rest are shuffled from the ones you have not tried yet, so each new chat suggests something new. Usage is remembered per user. A click puts the prompt in the box for you to finish, with any [placeholder] selected. Developers can change the list with the emcp_ai_chat_suggestions filter.
13
New: Sandbox Plugin Export (Pro module, on by default). Sandbox > Export as plugin packages every ACTIVE Sandbox widget, block and PHP snippet as a standalone WordPress plugin ZIP that keeps working after EMCP Tools is deactivated. Widget types, block names, snippet functions, the [emcp_snippet] shortcode, asset handles and the emcp-custom category are preserved verbatim, so existing pages keep rendering. Widgets that use the query, shortcode or remote controls get the runtime they call bundled under includes/lib/; remote API keys are read from EMCP_TOOLS_REMOTE_KEY_* constants (placeholders in config.php, embedding is opt-in). The exported plugin decides ownership on plugins_loaded (priority 50): it stays dormant while EMCP Tools is active or another export owns the site, and takes over on the first request after EMCP is deactivated. The ZIP is built in a directory verified to sit outside every web-served path, streamed once and deleted. It is on by default for licensed sites and can be switched off on the Modules tab; while it is on, the Sandbox overview shows a fourth card.
14
New: A redesigned admin. Every EMCP Tools screen was rebuilt inside one frame: a grouped sidebar with counts, a search palette (Ctrl or Cmd + K) over screens, tools, prompts and templates, a notifications drawer, a save bar that warns before you leave with unsaved changes, and a recovery panel if a screen fails to load. Tools, Modules, Page Builders, Connection, Prompts, Brand Kits, Templates, Marketplace, Context, Skills, Memory, the Sandbox screens, AI Chat, History, Backup & Migrate, Redirects, the MCP Log, the Dashboard and the Changelog are all new. The old screens, their scripts and the admin-ajax handlers only they used are removed. No MCP tools were added or removed.
15
New: Dashboard. What your AI did over the last 7, 14 or 30 days: changes kept and rolled back per day, tool calls and errors (Templates applied and Prompts copied on Pro), the most used tools, the five newest changes with Undo, and a health strip for the MCP server, connected clients, tools and version. Needs your attention lists what to act on: the MCP server switched off, changes History could not record, sandbox items awaiting review, disabled tools, plugin and theme updates, EMCP Cloud disconnected while Marketplace items depend on it, and on Pro no backup in 14 days or a failed scheduled backup. A dismissed item comes back when its situation changes.
16
New: Guided connection setup. The Connection screen walks you through choosing a client, a sign-in method (OAuth, an application password, or WP-CLI on local sites) and the client's own steps, then waits for that client's first MCP call and confirms it arrived.
17
New: History with sessions, diffs and session undo. Changes are grouped by the AI session that made them and can be searched and filtered by kind, client and date. Each change shows a before and after diff where one is available, a whole session can be undone newest first, and History keeps 30, 90, 180 or 365 days. History now has its own database table; your existing history moves there on the first admin page load after updating.
18
Changed: Reconnect your AI clients after updating. An AI client that stays connected through the update keeps running the previous version, so its changes are not recorded in History until it reconnects. A notice says so while that happens.
19
New: MCP Log screen. Every MCP request with its client, session, sign-in, status and timing, filterable, with request, error and timing totals and a CSV export (spreadsheet formulas are neutralised).
20
New: Scheduled backups (Pro). Daily or weekly backups at a set time run through WP-Cron in short steps, keep the newest copies you choose, and can be continued from the Backup & Migrate screen if WP-Cron stalls. Two tabs or a tab and WP-Cron never drive the same backup at once.
21
New: Redirects match query strings. A redirect can now match one query string (/page?ref=ad) while another redirect for the same path catches the rest. Existing redirects behave exactly as before.
22
New: Context sections and a site profile. Choose which parts of the site description connected agents receive (builder, plugins, theme, global styles, site structure, WooCommerce) and describe the site's name, industry, purpose and voice, with a preview of exactly what agents see.
23
Changed: Sandbox items created over MCP are always drafts. An agent can create and edit custom widgets, blocks and PHP snippets but can no longer activate them; activation happens on the Sandbox screens.
24
New: Custom skills (Pro). Skills > Custom skills lets you write your own playbooks (a name, a short description and Markdown instructions) in a full editor. Switched-on skills join the bundled ones in the skills catalog agents see, and agents load them with get-skill like any other. The editor shows how much each skill adds to the catalog and to the context budget.
25
New: Customize a prompt before you copy it. Every prompt card has a Customize panel for the page builder, business name, brand colours, fonts and content facts, with a live preview. On Pro, Use in AI Chat opens AI Chat in a new tab with the prompt already in the message box.
26
New: 100 premium prompts (Pro). The Pro prompt library grows to 100 prompts across 20 categories: the 50 landing-page prompts plus 50 new complete-website prompts in 10 new categories.
27
Changed: add-pro-widget is on by default on new installs. It registers only when Elementor Pro is active and only adds widgets, so a site with Elementor Pro can place Pro widgets straight away. Existing sites keep their saved choice.
28
Changed: Marketplace loads faster. The Marketplace screen asks EMCP Cloud for a slimmer listing (about a third of the previous size), shows five cards per row on wide screens with whole thumbnails, and pages 20 listings at a time.

Showing 5 of 83 releases