← All changes | includes/mcp-server-bootstrap.php +12 -12 2.6.16 → 2.7.2 View file →

		@@ -2,9 +2,9 @@
2	2	/**
3	3	* MetaSync — MCP Server Bootstrap
4	4	*
5	5	* Creates the MCP server instance and registers all MCP tools. Extracted from
6		- * metasync.php (WP-530) to keep the plugin entry file a lean bootstrap. Loaded
	6	+ * metasync.php to keep the plugin entry file a lean bootstrap. Loaded
7	7	* via require_once from metasync.php; registers metasync_init_mcp_server() on
8	8	* the WordPress 'init' hook. Function names and hook timing are unchanged.
9	9	*
10	10	* @package Search Atlas SEO
		@@ -18,9 +18,9 @@
18	18	* Initialize WordPress MCP Server
19	19	*
20	20	* Safely register a single MCP tool class, logging failures without aborting
21	21	* subsequent registrations. Extracted as a named function so both production
22		- * code and unit tests exercise the same logic (WP-265).
	22	+ * code and unit tests exercise the same logic.
23	23	*
24	24	* @param object $server The MCP server instance (must have register_tool()).
25	25	* @param string $class_name Fully-qualified tool class name.
26	26	*/
		@@ -27,9 +27,9 @@
27	27	function metasync_safe_register_mcp_tool($server, $class_name) {
28	28	static $logged_missing = [];
29	29	if (!class_exists($class_name)) {
30	30	if (empty($logged_missing[$class_name])) {
31		- error_log('MetaSync MCP: ' . $class_name . ' class not found — skipping registration. Run composer dump-autoload to regenerate the classmap.');
	31	+ error_log('MetaSync MCP: ' . $class_name . ' class not found — skipping registration. Run composer dump-autoload to regenerate the classmap.'); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
32	32	$logged_missing[$class_name] = true;
33	33	}
34	34	return;
35	35	}
		@@ -35,9 +35,9 @@
35	35	}
36	36	try {
37	37	$server->register_tool(new $class_name());
38	38	} catch (\Throwable $e) {
39		- error_log('MetaSync MCP: Failed to register tool ' . $class_name . ': ' . $e->getMessage());
	39	+ error_log('MetaSync MCP: Failed to register tool ' . $class_name . ': ' . $e->getMessage()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
40	40	}
41	41	}
42	42
43	43	/**
		@@ -50,9 +50,9 @@
50	50	return;
51	51	}
52	52	// Skip the heavy MCP boot (server + sync logger + REST inventory + 100+ tool objects)
53	53	// unless this request is actually targeting the MCP REST route or was loaded via
54		- // the stdio/HTTP bridge. WP-255.
	54	+ // the stdio/HTTP bridge.
55	55	if (!metasync_is_mcp_rest_request() && !defined('METASYNC_MCP_BRIDGE')) {
56	56	return;
57	57	}
58	58	// Initialize MCP server
		@@ -63,12 +63,12 @@
63	63
64	64	// Attach MCP sync logger so all write tool calls are recorded in Sync History.
65	65	new Metasync_MCP_Sync_Logger();
66	66
67		- // SEO Inventory: shared builder + standalone REST endpoint (WP-135)
	67	+ // SEO Inventory: shared builder + standalone REST endpoint
68	68	new Metasync_REST_SEO_Inventory();
69	69	} catch (\Throwable $e) {
70		- error_log('MCP Server Initialization Error: ' . $e->getMessage());
	70	+ error_log('MCP Server Initialization Error: ' . $e->getMessage()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
71	71	return;
72	72	}
73	73
74	74	// Helper: register a single tool, logging failures without aborting subsequent registrations
		@@ -246,17 +246,17 @@
246	246	// System Diagnostics & Plugin Info (4 tools)
247	247	$safe_register('MCP_Tool_System_Diagnostics');
248	248	$safe_register('MCP_Tool_List_All_Plugins');
249	249	$safe_register('MCP_Tool_Get_Cron_Jobs');
250		- $safe_register('MCP_Tool_Get_WP_Option');
	250	+ // $safe_register('MCP_Tool_Get_WP_Option'); // DISABLED - may expose protected option values.
251	251
252		- // SEO Inventory (1 tool — WP-135)
	252	+ // SEO Inventory (1 tool)
253	253	$safe_register('MCP_Tool_List_Posts_SEO_Inventory');
254	254
255		- // Read-Only Database Access (3 tools)
	255	+ // Read-Only Database Access (2 tools - direct SQL queries disabled for safety)
256	256	$safe_register('MCP_Tool_DB_Tables');
257	257	$safe_register('MCP_Tool_DB_Describe');
258		- $safe_register('MCP_Tool_DB_Select');
	258	+ // $safe_register('MCP_Tool_DB_Select'); // DISABLED - safety
259	259
260	260	// Breadcrumb Tools (1 tool)
261	261	$safe_register('MCP_Tool_Get_Breadcrumb_Path');
262	262
		@@ -270,9 +270,9 @@
270	270	$safe_register('MCP_Tool_Get_LLMs_Txt_Settings');
271	271	$safe_register('MCP_Tool_Update_LLMs_Txt_Settings');
272	272	$safe_register('MCP_Tool_Get_Post_Markdown');
273	273
274		- // SEO Plugin Audit (4 tools — WP-202)
	274	+ // SEO Plugin Audit (4 tools)
275	275	$safe_register('MCP_Tool_Read_SEO_Plugin_Data');
276	276	$safe_register('MCP_Tool_SEO_Plugin_Diff');
277	277	$safe_register('MCP_Tool_Sync_To_Active_Plugins');
278	278	$safe_register('MCP_Tool_Detect_SEO_Conflicts');