| @@ -77,8 +77,18 @@ | ||
| 77 | 77 | */ |
| 78 | 78 | protected $is_destructive = true; |
| 79 | 79 | |
| 80 | 80 | /** |
| 81 | + * The agent runs bulk operations through this ability one item at a time — | |
| 82 | + * a large delete or update is hundreds of calls in a minute — so the | |
| 83 | + * interactive default (100/min) throttles a legitimate bulk run partway | |
| 84 | + * through. The REST proxy carries the same limit for the same reason. | |
| 85 | + * | |
| 86 | + * @var int | |
| 87 | + */ | |
| 88 | + protected $rate_limit = 1000; | |
| 89 | + | |
| 90 | + /** | |
| 81 | 91 | * Configure the ability metadata. |
| 82 | 92 | * |
| 83 | 93 | * @return void |
| 84 | 94 | */ |
| @@ -288,20 +298,19 @@ | ||
| 288 | 298 | // bundled `lib/mcp-adapter`. Its `McpAdapter` inits on `init` under |
| 289 | 299 | // WP-CLI. It is a stdio JSON-RPC MCP server. It routes `tools/call` to |
| 290 | 300 | // abilities. This runs in a process where `WP_CLI` is defined. |
| 291 | 301 | // |
| 292 | - // That entry point stops one hop short today. This is only because | |
| 293 | 302 | // `mcp-adapter/execute-ability` refuses anything without |
| 294 | - // `meta['mcp']['public'] === true`. No `zipai/*` ability sets it. One | |
| 295 | - // `mcp_adapter_default_server_config` filter would make it reachable. So | |
| 296 | - // treat this path as guarded by configuration. Do not treat it as | |
| 297 | - // unreachable. | |
| 303 | + // `meta['mcp']['public'] === true`. The ability loader sets it on every | |
| 304 | + // exposed `zipai/*` ability, this one included, while the external MCP | |
| 305 | + // endpoint is switched on (`External_Mcp::is_enabled()`, | |
| 306 | + // `External_Tool_Policy::is_exposed()`). So this path is reachable | |
| 307 | + // whenever that toggle is on. Do not treat it as unreachable. | |
| 298 | 308 | // |
| 299 | - // A related point is wider than this ability. Only | |
| 300 | - // `Rest_Api::handle_mcp_request` (`inc/api/rest-api.php:116`) enters the | |
| 301 | - // MCP-context flag of `Protected_Options_Filter`. So on ANY non-REST MCP | |
| 302 | - // transport the filter backstop is inert for every protected key. This is | |
| 303 | - // tracked separately. | |
| 309 | + // The MCP-context flag of `Protected_Options_Filter` is entered by | |
| 310 | + // `Rest_Api::handle_mcp_request`, and by `External_Mcp::enter_protected_context` | |
| 311 | + // for every call on this plugin's adapter server and for a call on any | |
| 312 | + // other adapter server that runs a `zipai/*` ability, this one included. | |
| 304 | 313 | if ( defined( 'WP_CLI' ) && WP_CLI && class_exists( '\WP_CLI' ) ) { |
| 305 | 314 | $families = array_column( $this->candidate_positionals( $args ), 0 ); |
| 306 | 315 | if ( ! in_array( 'search-replace', $families, true ) ) { |
| 307 | 316 | return $this->run_via_wpcli_api( $command ); |
