3.9.4 (2026/11/12)

• Fix: Security: Block uploads of files that browsers would run as a web page (reported by ashv4ni via Patchstack).
• Add: MCP: wp_list_plugins now returns the WordPress, PHP and theme versions, plus each plugin's slug, status and available update.
• Add: MCP: Knowledge entries can be deleted by filter, including posts that are no longer published.
• Add: MCP: Discussions now show the chatbot's first reply and can be filtered by what it replied.
• Update: Marked o3 and GPT Image 2 as deprecated, since OpenAI retires them.
• Update: New sites now default to GPT Image 2.6 Flare for image generation; existing settings are kept.
• Update: GPT-5.6 Sol is now priced at its standard rate, as OpenAI's promotional price ends on November 30.
• Fix: MCP discovery no longer answers for other plugins' MCP servers, so ChatGPT can connect to both.
• Fix: The front search no longer shows old results for a day after Max Results or Min Score is changed.

3.9.3 (2026/11/10)

• Add: GPT Image 2.6 Sunburst and Flare models.
• Add: MCP now manage AI Engine itself: chatbots, discussions, insights, knowledge, settings and modules, with undo for chatbot and settings changes. MCP AI Engine tools can test a chatbot, read a knowledge entry in full, find entries by text or entries that lost their post, estimate costs, and keep removed content.
• Add: MCP Database tools can list the tables, describe one, and show what WordPress loads on every page (Pro).
• Add: Word, Excel, PowerPoint and other documents now work in chatbots on Azure OpenAI, read through Code Interpreter, while PDFs stay direct.
• Update: MCP's Ask Before setting now also covers changes to AI Engine's chatbots, settings, modules and knowledge.
• Update: The REST API settings only show when the Public API is enabled.
• Update: The Chatbots screen no longer overwrites changes made elsewhere meanwhile, by an AI assistant or another tab, and asks to reload instead.
• Update: The chatbot's close and full screen buttons are cleaner and match each other in every theme.
• Update: When a save fails because the server's reply is broken, the message now says why: a Cloudflare block, a PHP warning from another plugin, or the error page.
• Update: Admin tab switches are much faster.
• Update: Synced the shared Meow Apps library to 5.3 with the latest NekoUI.
• Fix: Saving a chatbot now sends only that chatbot, so large setups no longer hit the server's upload limit.
• Fix: Importing settings works again after the chatbots were changed elsewhere since the page loaded.
• Fix: Chatbot calls through the PHP API without a chatId are no longer saved as discussions.
• Fix: The MCP chatbot read now shows instructions as the model reads them.

3.9.2 (2026/11/06)

• Fix: Security: Uploads are now validated against their actual content and not only their filename, so HTML disguised as audio or another media type is refused in chat uploads, form uploads, the Public API and generated files (reported by peppa via Patchstack).
• Add: Hint in the Connect card for sites behind Cloudflare, listing what to allow when Claude or ChatGPT can't connect, with a link to the full steps.
• Fix: Documents sent to a chatbot on Azure OpenAI now upload to Azure itself, and PDFs work there.
• Fix: A full API address pasted as the Azure endpoint is now trimmed to the resource URL.
• Fix: Claude can now connect as a custom connector on hosts that answer /.well-known/ themselves, such as SiteGround.

3.9.1 (2026/11/05)

• Fix: Chatbots with image generation work again when a reasoning level is set.
• Fix: Knowledge sync marks a post as failed when the model returns no vector, instead of crashing and leaving half-written rows.
• Fix: Gemini 3.1 Flash Image is billed at its real price instead of half.
• Update: Turning Insights off now warns that the usage limits stop applying, since Insights is what enforces them.
• Add: MCP tools for WooCommerce Subscriptions: list and inspect subscriptions with their next payment dates and renewal orders, find overdue ones, and list failed renewals.
• Add: The MCP token panel also shows the address with the token inside it, for apps that cannot send headers like Claude's custom connectors.
• Add: Discreet Disable link in Maintenance to turn off automatic settings backups, which also deletes the existing ones since they hold the API keys.
• Add: Nano Banana 2.1 is listed under its own name with Google's prices.
• Update: After connecting an assistant, the Connect card shows a single status that turns green once the assistant reaches the site.
• Update: The MCP Connection Test now turns red when the MCP endpoint is blocked for every client, and names Cloudflare's bot challenge when that is the cause.
• Update: The Connection Test's Cloudflare advice now also allows the rest_route=/mcp/ query, which path-only rules missed.

3.9.0 (2026/11/02)

• Fix: Security: Image Studio now encodes the media ID in its requests, as extra hardening.
• Add: MCP Undo: every change an assistant makes can be undone in one click from the MCP tab, or just by asking, and the undo stops if someone edited the item since.
• Add: MCP approvals: approve deletions (or every site change) from the MCP tab, or keep assistants on drafts only.
• Add: MCP edits Gutenberg posts block by block, and turns Markdown into real blocks.
• Add: MCP works with your SEO plugin (Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework, Slim SEO, SEO Engine) and with Advanced Custom Fields.
• Add: MCP edits pages built with Elementor and Beaver Builder (Pro), Divi, Avada, WPBakery and SiteOrigin.
• Add: MCP manages menus, CSS, site styles, block theme templates, classic widgets, WooCommerce coupons and variations, comments, draft previews and Redirection redirects, and reads form entries.
• Add: MCP checks pages as visitors see them, reads the error log and Site Health, and restores revisions.
• Add: Assistants get a short introduction to the site and starter prompts when they connect.
• Add: Auto Sync can target several embeddings environments, with the mwai_embeddings_sync_env_ids filter.
• Add: The chatbot launcher can reuse the AI avatar.
• Update: Redesigned MCP tab: the token setup lives in Connect, integrations show as chips, activity covers 30 days, and the Claude and ChatGPT directory links go through Meow Apps' connector.
• Update: MCP tools that can break things are flagged so assistants ask before running them, and tool descriptions are shorter.
• Update: Turning on Cross-Site for a chatbot also turns on Popup.
• Fix: Trashing a post now deletes its vectors through each environment's own vector DB.
• Fix: On mobile, the Glass and Timeless chatbots keep the input above the keyboard in long conversations.
• Fix: A page that places the site-wide chatbot as a popup no longer shows it twice.

3.8.9 (2026/10/30)

• Add: GPT-6.1 Terra model.
• Add: Restore link in Recent Changes, which opens the version from before an AI edit.
• Update: Connect card now offers a choice between a direct connection (recommended) and the Meow Apps relay, with labels under each choice explaining what it brings, and the address to copy now sits in the Copy step.
• Update: Connect card opens on the direct connection for Claude and ChatGPT, with the directory and the ChatGPT app one click away.
• Update: Image Studio's edit link now only accepts a media ID.
• Fix: Chatbot now explains why a file could not be sent to OpenAI, instead of showing OpenAI's "Expected an ID that begins with file" error.
• Fix: OpenRouter model list now waits up to 30 seconds to load, for slow hosts.

3.8.8 (2026/10/27)

• Fix: Security: Shop Managers can no longer edit administrator accounts through MCP, and the plugin and theme file tools now follow DISALLOW_FILE_EDIT.
• Fix: Security: Forms and the Public API can no longer read protected uploads, the Google voice chatbot no longer exposes its API key, voice chats cannot replace someone else's conversation, and only admins can read the logs.
• Fix: Security: Guests can no longer reset their usage limits with a fake IP header, while proxies and Cloudflare are still recognized.
• Fix: Security: Chatbot replies now drop embedded frames and forms, and guest uploads are capped at 20 per hour.
• Add: MCP tab showing the week's activity, recent changes with links to each WordPress diff, connections, access and tools.
• Add: Settings backups with a restore in Maintenance, and settings now save only what changed.
• Add: Chatbots panel in Workspace to chat with the site's own chatbots, using their instructions, model and Knowledge.
• Add: Gemini 4 models such as gemini-4-argon now get vision, PDF, web search, Google Maps and thinking, as features follow the version number.
• Add: Keepalives for streams that stay silent from the start, so nginx no longer cuts them at 120 seconds.
• Add: The header shows the installed version and, when a newer one is out, how to update or renew.
• Update: The MCP connect card guides you through Claude's directory first, confirms when your assistant reaches the site, points ChatGPT users to the official AI Engine app with Developer mode as the direct option, says the connector stores no password and none of your content, and offers an optional, unticked Meow Apps news signup.
• Update: MCP stays off on updated sites that never stored the setting, only new installs get it on by default.
• Update: The MCP Connection Test warns when the host strips the Authorization header and gives the .htaccess line, and AI Engine reads that header from Apache when WordPress cannot see it.
• Update: The MCP post list accepts several post types or statuses at once, returns everything when asked for all posts, understands an author given by name, and the post count and post list tools return clearer data.
• Update: In the Knowledge tab, creating an environment moved into the environment dropdown and Create New became Add Manually.
• Update: New Meow Apps dashboard, from the latest shared common code.
• Update: The admin now works on tablets, with the header, columns and Chatbots toolbar no longer breaking.
• Update: The header lights the button of the screen you are on.
• Update: Various labels and links, including the Dashboard footer now pointing to the Getting started guide and the Discussions setting pointing to the Discussions tab.
• Fix: Chatbots keep web search, MCP servers and their reasoning settings after calling a function, which also stops Claude's "Invalid signature in thinking block" error.
• Fix: Chatbots keep their Knowledge context after calling a function on every provider, including Google, OpenRouter and other compatible providers.
• Fix: Syncing a large OpenAI Vector Store no longer times out, each step stops after about 25 seconds and the next one continues from there.
• Fix: The chatbot preview in the Chatbots tab shows the conversations held before 3.8.7 again instead of starting empty.
• Fix: Content Studio no longer shows each section heading twice when the model repeats it.
• Fix: MCP tools now accept text request ids as the JSON-RPC spec allows.
• Fix: Re-setting a featured image through MCP no longer fails, terms can be removed, and featured image errors say why.
• Fix: Admin scripts refresh when only the UI library changes instead of staying cached.

3.8.7 (2026/10/23)

• Fix: Security: Voice chatbots now only run functions attached to their own chatbot.
• Fix: Security: Editors on MCP can no longer publish other content types or file references through a decoy fields object, and Public API tools and MCP servers stay restricted to administrators.
• Fix: Security: Cross-Site requests are now matched on their real REST route, so other REST calls can no longer skip the nonce check by mimicking its URL.
• Fix: Security: Contributors can no longer take over a live chatbot through WordPress' embed preview, and outside post content a shortcode can no longer replace a live chatbot's prompt, model or API key.
• Fix: Security: The Gemini file upload now verifies TLS.
• Fix: Security: The MCP sign-in page can no longer be framed by another site, shows where the app sends you, and warns when an app calls itself Claude or ChatGPT without being it.
• Add: Explore AI Engine, a ten-goal tour from the dashboard that follows you as a slim bar onto each screen, with Knowledge guidance in the chatbot settings.
• Add: Workspace mobile app on the dashboard, with QR code, store links and a status line once a phone is paired.
• Add: Sakana AI (Fugu and Namazu) as a native provider, hidden until switched on with MWAI_SAKANA.
• Add: Read-only access for Claude and ChatGPT MCP connections, with a switch per connection in Connected Apps.
• Add: Clean Up button in Knowledge for rows of deleted environments and orphans.
• Add: The mwai_openai_body filter, to set any OpenAI parameter AI Engine leaves to the defaults, like high quality for the chatbot's image tool.
• Update: Redesigned the dashboard with a Your AI card for models and providers, a This week chart compared with last week, shuffleable idea tiles and per-company AI visibility bars.
• Update: Glass now takes its colors from the lights you pick for the visitor's bubbles, the launcher and the accent, and the theme editor preview opens with a sample conversation that is never saved or sent to the AI.
• Update: New popup chatbots now open in the macOS frame and header, while existing chatbots keep the frame they already have.
• Update: The MCP screen now shows how many tools each set brings and how many AI Engine has in all.
• Update: MCP deletes without force now always go to the trash (products, events, media and comments too) or refuse clearly, and deletes that would be permanent ask the AI to check with the user first.
• Update: The Settings screen, dashboard cards and feature showcase are now translatable, and Knowledge, Privacy First and Content Studio wording is clearer.
• Update: Every Pro link in the admin now points to the AI Engine page and is tagged, Pro-locked buttons open it instead of doing nothing, and Pro chatbot modes show their Pro pill for free users.
• Update: The License tab was redesigned, with an Activate your license link for Pro buyers who have not entered a key yet.
• Update: The Pro update check now reports whether MCP was used in the last 30 days and how many phones are paired.
• Update: The chatbot preview in the admin now keeps its own history, and the dashboard uses the same spacing as the other tabs.
• Fix: Insights logs work again on sites whose logs table predates 2.5.6, since tables now get their missing columns on update.
• Fix: Chatbots and forms no longer stay blank when one of their settings contains entity text like ".
• Fix: Posts containing an escaped "<" (like "<48 dB") no longer lose everything after it in Knowledge and Content-Aware.
• Fix: AI Forms in chatbot mode now use the chatbot's own Max Tokens, model and temperature instead of hidden form values that cut replies at 4096 tokens.
• Fix: Messages, uploads, stopping a reply and loading a conversation now follow the right chatbot's discussion when a chat id belongs to another chatbot.
• Fix: Claude no longer rejects the answer after a function call when Knowledge is on (Invalid signature in thinking block).
• Fix: When a thinking model spends its whole Max Tokens reasoning, the reply now says so instead of showing the raw reasoning as the answer.
• Fix: Knowledge no longer retries rows of deleted environments, and large OpenAI Vector Stores sync page by page instead of timing out.
• Fix: MCP connections no longer drop when a client revokes the token it just replaced after a refresh, and sign-in responses say which site answered.
• Fix: Links in the GDPR consent text are now clickable instead of shown as raw text.
• Fix: The site-wide popup chatbot no longer leaves a screen of blank space at the bottom of the page on themes that give the body a height.
• Fix: The user's IP is shown again under their name in Discussions and Insights for logged-in users, and in the discussion details.
• Fix: Chatbot names with & no longer show &.
• Fix: Admin screens no longer load blank, and the header now shows the Free and Pro tiles.
• Fix: Links on other plugins' screens are no longer tagged as AI Engine traffic.
• Fix: OVHcloud and Sakana AI now follow one rule: hidden until switched on with MWAI_OVH or MWAI_SAKANA, and always shown where an environment of that type exists.
• 🎵 Discuss with others about Ai Engine on the Discord.
• 🌴 Keep us motivated with a little review here. Thank you!
• 🥰 If you want to help us, check our Patreon. Thank you!
• 🚀 Click here to vote for the features you want the most.

3.8.6 (2026/10/17)

• Fix: Security: Editors can no longer change the title or excerpt of posts they are not allowed to edit (coupons, menus, templates) through the AI helpers, and the other helpers taking a post ID now check permissions too (reported by Anatoly Gorbounov, x1will, via WPScan).
• Fix: Hotfix: Chatbot replies no longer crash on servers with an older cURL, such as Xserver, because of a constant added in 3.8.5.
• Add: The MCP screen's Claude step now opens Claude with this site's connector already filled in, so there is nothing to copy and paste.
• Fix: Messages like "0" or an image alone no longer fail the reply when Knowledge is on.
• Fix: Chatbot saves silently refused by the database now show an error.
• Fix: A Max Height set without a unit is now treated as pixels.
• Fix: AI Forms set to a specific environment with the Default model now work instead of failing with "Model not found".
• Fix: Settings changed while a chatbot reply is running are no longer undone when that reply saves its usage stats, which could revert a refreshed model list.

For older releases, see changelog.txt.