Bump wordpress/mcp-adapter from 0.5.0 to 0.6.1

[dependabot]

Bumps wordpress/mcp-adapter from 0.5.0 to 0.6.1.

Release notes

Sourced from wordpress/mcp-adapter's releases.

v0.6.1

MCP Adapter 0.6.1 repairs the production release ZIP. It contains no other changes.

Who should upgrade

Anyone running 0.6.0 from the mcp-adapter.zip release asset should upgrade. Installations built from source or required through Composer are unaffected.

Fixed

• The release ZIP no longer ships a Jetpack Autoloader class map that points to files the ZIP omits. In 0.6.0 the class map listed test-only global classes, including WP_CLI and WP_CLI_Command, and mapped them to files under tests/phpunit/, which the release artifact excludes. Any plugin calling class_exists( 'WP_CLI' ) on a normal web request could therefore trigger an uncaught fatal error. class_exists( 'WP_CLI' ) now returns false when WP-CLI is unavailable.

No API, hook, or protocol behavior changed. Upgrading from 0.6.0 requires no migration.

Thank you to @​rebeccahum for reporting this in #283, their first contribution to MCP Adapter.

Full Changelog: WordPress/mcp-adapter@v0.6.0...v0.6.1

v0.6.0

MCP Adapter 0.6.0 improves protocol compatibility, resource metadata handling, session reliability, WP-CLI behavior, and coexistence with plugins that bundle their own copy of the adapter.

Before upgrading

• WordPress 6.9 or newer is now required. The standalone Abilities API plugin is no longer a supported installation path.
• Abilities with meta.public: true are now exposed through the default MCP server unless meta.mcp.public explicitly opts out. Existing permission callbacks and capability checks still apply.
• On multisite only, active Streamable HTTP sessions must reconnect once after upgrading because session storage moves from a network-wide key to separate per-site keys. Single-site installations are unaffected.
• The MIME validation helpers previously exposed by McpValidator have been removed. Integrations calling them directly should apply their own application-specific MIME validation.

MCP resources and metadata

• Preserve _meta on resource contents, embedded resources, content blocks, and prompt messages.
• Omit malformed _meta without discarding the payload it accompanies.
• Emit mimeType exactly as declared, including values with parameters such as text/html;profile=mcp-app.
• Correctly handle blob-only resource contents.
• Support resources/templates/list, returning an empty template list when no templates are available.
• Match resource URI schemes case-insensitively, so clients can read resources even when they normalize the scheme to lowercase.

These changes improve compatibility with MCP Apps and other clients that depend on resource metadata.

Reliability and compatibility

• Protect concurrent session mutations with bounded retries, reducing the risk of one request overwriting another session.
• Scope session storage by blog on WordPress multisite.
• Use Jetpack Autoloader so the newest available WP\MCP classes win when the standalone adapter and another plugin bundle different versions.
• Normalize empty arguments for schema-defining abilities, allowing valid zero-argument tool calls to execute correctly.

WP-CLI improvements

• Keep JSON-RPC stdout clean when wp mcp-adapter serve selects the default server.
• Use WP-CLI’s global --user argument instead of registering a conflicting local option.

... (truncated)

Changelog

Sourced from wordpress/mcp-adapter's changelog.

[0.6.1] - 2026-08-13

Fixed

• The release ZIP no longer ships a Jetpack Autoloader class map pointing at files the ZIP omits. In 0.6.0 the class map listed test-only global classes, including WP_CLI and WP_CLI_Command, and mapped them to files under tests/phpunit/, which the release artifact excludes. Any plugin calling class_exists( 'WP_CLI' ) on a normal web request could therefore trigger an uncaught fatal error. class_exists( 'WP_CLI' ) now returns false when WP-CLI is unavailable (#283).

No API, hook, or protocol behavior changed. Upgrading from 0.6.0 requires no migration. Installations built from source or required through Composer were unaffected.

[0.6.0] - 2026-08-12

Breaking Changes

• WordPress 6.9 or newer is now required. The standalone Abilities API plugin is no longer a supported installation path.
• Abilities with meta.public: true are now exposed through the default MCP server unless meta.mcp.public explicitly opts out. Existing permission callbacks and capability checks still apply.
• On multisite only, active Streamable HTTP sessions must reconnect once after upgrading, because session storage moves from a network-wide key to separate per-site keys. Single-site installations are unaffected.
• The MIME validation helpers previously exposed by McpValidator have been removed. Integrations calling them directly should apply their own application-specific MIME validation.

Added

• Support for resources/templates/list, returning an empty template list when no templates are available.
• Blocked direct execution of plugin PHP files.
• Expanded automated compatibility, dependency, and Plugin Check coverage.

Changed

• Jetpack Autoloader is now used so the newest available WP\MCP classes win when the standalone adapter and another plugin bundle different versions.
• Session storage is scoped by blog on WordPress multisite.
• Concurrent session mutations are protected with bounded retries, reducing the risk of one request overwriting another session.
• Documentation clarifies that the Abilities API is included in WordPress 6.9 and newer, documents the required ability category field, and improves examples throughout.

Fixed

• _meta is preserved on resource contents, embedded resources, content blocks, and prompt messages.
• Malformed _meta is omitted without discarding the payload it accompanies.
• mimeType is emitted exactly as declared, including values with parameters such as text/html;profile=mcp-app.
• Blob-only resource contents are handled correctly.
• Resource URI schemes are matched case-insensitively, so clients can read resources even when they normalize the scheme to lowercase.
• Empty arguments are normalized for schema-defining abilities, allowing valid zero-argument tool calls to execute.
• wp mcp-adapter serve keeps JSON-RPC stdout clean when selecting the default server.
• WP-CLI's global --user argument is used instead of registering a conflicting local option.

Commits

• 23cb53e fix: prevent dangling release classmap entries (#284)
• 073e2a9 Prepare the 0.6.0 release (#282)
• c320a04 fix(deps-dev): bump the npm-dev-minor-patch group with 2 updates (#279)
• 5b6642a fix(deps): bump automattic/jetpack-autoloader from 5.0.21 to 5.0.22 in the co...
• a996566 fix: carry _meta through to every emitted DTO (#263)
• 65ea934 fix: pin tag_name so release zip attaches to the correct release (#171)
• 1b96b15 docs: clarify Abilities API is core in 6.9+ (fixes #150) (#223)
• 6b85675 fix(deps-dev): update websocket-driver to 0.7.5 (#252)
• 0a42274 chore(deps): bump wordpress/php-mcp-schema to v0.1.3 (#277)
• 8cc81cf Fix warning of registering duplicate global flag --user (#275)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)