Adds OAuth connections for MCP clients and lets other plugins add skills to Site Agent's skill tools.
- New opt-in OAuth 2.1 connections. Turn on "OAuth connections" in Tools → Site Agent, then add the endpoint to an OAuth-capable client (Claude, ChatGPT and others) with no credentials. The client finds the sign-in through the endpoint's 401 response, registers itself, and sends you to a WordPress consent screen where you allow or deny it and pick the tool groups it may use. PKCE (S256) is required.
- OAuth clients get one-hour access tokens and rotating refresh tokens that end after 30 days without use. Only token hashes are stored, tokens authenticate only the MCP endpoint, reusing a rotated refresh token ends the connection, and connections stop when the approving account loses administrator rights. Revoke connections in Tools → Site Agent; audit history shows OAuth calls with the client name.
- Site Agent uses its own issuer,
/wp-json/site-agent/v1/oauth, so it never takes over the site-root OAuth discovery documents that another plugin's OAuth server may serve (Rank Math's MCP server does). Each registered client is stored separately. - Plugins can add read-only skills to
list-skillsandget-skillwith thesite_agent_skillsfilter. GT Extensions for FluentCart 2.8.3 uses it for itsgtfc-invoiceandgtfc-quoteskills. - Application Passwords in a header or the authenticated URL keep working unchanged.