The most common reason people don’t install an AI plugin for WordPress: they don’t want to hand an AI the keys and hope for the best. Version 2.4.0 is about fixing that.
The real objection
Every time I show someone StrifeBridge MCP, the demo lands. Claude edits a theme file, fixes a meta description, drafts a post, all through a chat window. People get it immediately.
Then they ask the obvious question. “What stops it doing something I didn’t ask for?”
That’s a fair question and it deserves a better answer than “it probably won’t.” So the latest release is not about adding more tools. It’s about being able to see and control what the tools do.
Every action is recorded
StrifeBridge MCP now keeps an activity log. Every tool call gets a row: which tool ran, a short summary of what it touched, whether it succeeded, when, and from what IP.
Open Settings and you see the recent entries straight away. No configuration, nothing to switch on.
create_post success title=Spring hours update
update_option success key=blogdescription
delete_post success id=482
update_option denied key=siteurl
auth denied (invalid token)That fourth line matters more than the three above it.
Refused is not the same as broken
The log separates three outcomes, and the distinction is deliberate.
- Success. The tool did what was asked.
- Error. Something genuinely went wrong.
- Denied. A guard stopped it.
A denied row means the plugin refused on purpose. Someone tried to rewrite the site URL, or overwrite a stored API secret, or delete media through a tool group you’d switched off. Those attempts are recorded rather than silently swallowed.
Failed authentication is logged too. If someone points a wrong token at your site, you’ll see it.
The log is safe to hand to a client
This part took the most care. An activity log is worthless if you can’t show it to anyone.
So the log never records option values, post content, widget settings, uploaded file data, or your access token. It records the option key, not what was written to it. It records a post title, not the body. Argument summaries are allowlisted per tool, and a tool the plugin doesn’t recognise records no arguments at all.
The token fingerprint in each row is a one-way hash, not any part of the real token. You can tell two different tokens apart in the log without either one being recoverable from it.
If you manage sites for clients, you can export the month and send it over.
Guardrails, if you want them
Visibility is half of it. The other half is limiting what’s possible in the first place. Three switches, all off by default so upgrading changes nothing about how your site behaves:
- Never publish. New posts are created as drafts, and an update that would publish or schedule a draft is refused. Editing something already live still works, so turning this on doesn’t break normal editing.
- Trash instead of delete. Deletions stay recoverable.
- Read-only mode. Every tool that would change anything is refused. Reads still work. This is the one I’d suggest starting with: let it run for a week, read the log, and see what it actually wanted to do before you let it do anything.
New installs start with “trash instead of delete” already on.
Try it read-only first
If you’ve been curious but not comfortable, that’s the honest path in. Install the free plugin, turn on read-only mode, connect it to Claude, and ask it questions about your site for a few days. Which pages are missing meta descriptions. What’s in the error log. Which plugins haven’t been updated.
It can’t change anything. You’ll have a log of everything it asked for. Then decide.
The free version on WordPress.org includes the activity log, all three safety switches, and over thirty tools covering posts, pages, media, menus, taxonomies, widgets, options, and plugin management. The Pro version adds full searchable history with CSV export, theme and plugin file access, database queries, and user management.
One more thing
If you’re already running Pro, update it. Versions before 2.4.0 had an update checker that never worked, so your site has never been offered an update, and it was quietly logging a PHP warning on every admin page load. Both are fixed. You’ll need to install 2.4.0 by hand once, and after that updates arrive normally.
Download StrifeBridge MCP free from WordPress.org, or read more about what it does.
