Fixes a bypass in 2.0.x: a REST route typed in another casing could escape the rules that hold writes. Adds the add-on API, rules on facts and budgets, and non-administrator approvals. Adds database columns; going back to 2.0.x makes some ledger entries fail the daily check.<\/p>","2.0.4":"
Security fixes from a review of 2.0.x: an expired held action can no longer be approved, agents see only their own held actions, and the 2.0.3 database change is confirmed rather than assumed.<\/p>","2.0.3":"
Fixes false tamper alerts from the activity ledger's daily check, makes rate limits exact when an agent writes several things at once, and stops an interrupted approval from running twice. Adds a database column and index; existing ledgers keep verifying.<\/p>","2.0.2":"
Times in the admin now show in your site's timezone, and recent ones read "30 minutes ago". An agent trying to use Agent Firewall's own controls is now recorded in the activity ledger.<\/p>","2.0.1":"
Each part of Agent Firewall is now its own page in the admin menu, with a new Settings page for alerts, webhooks and retention. Pages load faster, and links in earlier alerts still work.<\/p>","2.0.0":"
Security fixes: a stopped agent can no longer read the site, and an agent running as an administrator can no longer reach the plugin's own settings, ledger or policies. The audit ledger now checks itself daily. Paid Pro and Agency editions launch alongside; this free plugin loses nothing.<\/p>","1.8.1":"
Approving a held action now carries it out, and nothing WordPress would refuse is held any more. MCP clients using an unclaimed application password no longer flood the audit ledger. Longer display name; adds a database column.<\/p>","1.8.0":"
WooCommerce actions are classified correctly now: store lookups stop waiting in the approval queue, while price changes and deletions are held. Agent clients reading held-action responses from the Abilities API must branch on the Adds an Exposure Scan - what can write to this site, and a printable report for a client. Held actions now announce themselves by email or webhook rather than waiting for someone to open the dashboard. Both are off until you switch them on.<\/p>","1.6.0":" AI clients that authenticate with an application password - most MCP clients - can now be bound to an agent and governed by policy instead of bypassing it. Refusing unclaimed application-password writes is now a checkbox on the Agents screen. Nothing changes until you bind a password.<\/p>","1.5.0":" Security hardening: agent tokens can no longer reach the firewall's own screens and routes, and agents can no longer be linked to an administrator. Existing admin-linked agents are flagged for relinking. Agents are now linked, and shown, by user name rather than by numeric ID.<\/p>","1.4.0":" Fixes an activation failure on fresh installs alongside plugins that add their own cron schedules. Also names what agents touched in the activity ledger instead of bare database ids, links post edits to the revision that records them, and shows what changed in AI tool-change alerts.<\/p>","1.3.0":" Shows how many actions await approval in the admin menu, pages the activity ledger and approval queue instead of truncating them silently, and fixes database changes never reaching sites installed before an update.<\/p>","1.2.0":" Supports WordPress 7.1, records agent attempts WordPress refuses before they run, governs abilities registered before the firewall loads, and closes a way a plugin could have hidden its own AI tool from the registry monitor.<\/p>","1.1.0":" Governs AI agent tool calls that arrive over MCP, adds a mutation-level backstop for unrecognized transports, and names the site in alert emails.<\/p>","1.0.1":" Stops repeat "new ability" alert emails caused by abilities briefly vanishing during plugin auto-updates.<\/p>","1.0.0":" Adds an emergency kill switch, policy import\/export, a first-run setup guide, and single-digest ability-change alerts.<\/p>","0.1.1":" Hardens option rollback: snapshot capture and restore now enforce a strict settings whitelist.<\/p>","0.1.0":" Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3637844,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3637844,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3637844,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3637844,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{"blueprint.json":{"filename":"blueprint.json","revision":3759976,"resolution":false,"location":"assets","locale":"","contents":"{\"$schema\":\"https:\\\/\\\/playground.wordpress.net\\\/blueprint-schema.json\",\"meta\":{\"title\":\"Agent Firewall demo\",\"description\":\"A shop site where an AI agent's edit was allowed, two deletions wait for approval, a read-only agent was refused, and an approval was stopped because a person had changed the page first.\",\"author\":\"agenticdaisy\",\"categories\":[\"Security\"]},\"landingPage\":\"\\\/wp-admin\\\/admin.php?page=agentic-daisy-ai-agent-firewall&tab=pending\",\"preferredVersions\":{\"php\":\"8.3\",\"wp\":\"latest\"},\"features\":{\"networking\":false},\"steps\":[{\"step\":\"installPlugin\",\"pluginData\":{\"resource\":\"wordpress.org\\\/plugins\",\"slug\":\"agentic-daisy-ai-agent-firewall\"},\"options\":{\"activate\":true},\"ifAlreadyInstalled\":\"skip\"},{\"step\":\"login\",\"username\":\"admin\",\"password\":\"password\"},{\"step\":\"runPHP\",\"code\":\" 'claude', 'user_pass' => wp_generate_password(), 'role' => 'editor', 'display_name' => 'Claude (Editor)' ) );\\n$posts = array(\\n\\t'sale' => wp_insert_post( array( 'post_title' => 'Spring sale: 20% off', 'post_content' => 'Everything in store is 20% off this week.', 'post_status' => 'publish' ) ),\\n\\t'about' => wp_insert_post( array( 'post_title' => 'About us', 'post_content' => 'A small shop on the corner since 1998.', 'post_status' => 'publish', 'post_type' => 'page' ) ),\\n\\t'shipping' => wp_insert_post( array( 'post_title' => 'Shipping policy', 'post_content' => 'Orders ship within 2 days.', 'post_status' => 'publish' ) ),\\n);\\n\\n$api = static function ( string $method, string $route, array $body = array() ) {\\n\\t$request = new WP_REST_Request( $method, $route );\\n\\t$request->set_body_params( $body );\\n\\treturn rest_do_request( $request )->get_data();\\n};\\n\\n$claude = $api( 'POST', '\\\/agenticdaisy-firewall\\\/v1\\\/agents', array( 'name' => 'Claude Desktop', 'agent_key' => 'claude-desktop', 'wp_user_id' => $editor ) );\\n$reporter = $api( 'POST', '\\\/agenticdaisy-firewall\\\/v1\\\/agents', array( 'name' => 'Weekly report bot', 'agent_key' => 'weekly-report-bot', 'wp_user_id' => $editor, 'scopes' => array( 'read' ) ) );\\n\\n\\\/\\\/ Kept for the next steps, and deleted by the last one.\\nupdate_option(\\n\\t'adaf_demo_seed',\\n\\tarray(\\n\\t\\t'posts' => $posts,\\n\\t\\t'tokens' => array(\\n\\t\\t\\t'claude' => $api( 'POST', \\\"\\\/agenticdaisy-firewall\\\/v1\\\/agents\\\/{$claude['id']}\\\/token\\\" )['token'],\\n\\t\\t\\t'reporter' => $api( 'POST', \\\"\\\/agenticdaisy-firewall\\\/v1\\\/agents\\\/{$reporter['id']}\\\/token\\\" )['token'],\\n\\t\\t),\\n\\t),\\n\\tfalse\\n);\\n\"},{\"step\":\"runPHP\",\"code\":\"set_body_params( $body );\\n\\trest_do_request( $request );\\n};\\n$posts = $seed['posts'];\\n$send( 'POST', \\\"\\\/wp\\\/v2\\\/posts\\\/{$posts['sale']}\\\", array( 'title' => 'Spring sale: 30% off everything' ) );\\n$send( 'DELETE', \\\"\\\/wp\\\/v2\\\/pages\\\/{$posts['about']}\\\" );\\n$send( 'DELETE', \\\"\\\/wp\\\/v2\\\/posts\\\/{$posts['shipping']}\\\" );\\n\"},{\"step\":\"runPHP\",\"code\":\"set_body_params( array( 'title' => 'Weekly report', 'status' => 'publish' ) );\\nrest_do_request( $request );\\n\"},{\"step\":\"runPHP\",\"code\":\"update(\\n\\t$wpdb->posts,\\n\\tarray(\\n\\t\\t'post_content' => 'Orders now ship within 1 day.',\\n\\t\\t'post_modified' => gmdate( 'Y-m-d H:i:s', time() + 60 ),\\n\\t\\t'post_modified_gmt' => gmdate( 'Y-m-d H:i:s', time() + 60 ),\\n\\t),\\n\\tarray( 'ID' => $shipping )\\n);\\nclean_post_cache( $shipping );\\n\\nforeach ( rest_do_request( new WP_REST_Request( 'GET', '\\\/agenticdaisy-firewall\\\/v1\\\/pending' ) )->get_data() as $held ) {\\n\\tif ( 'rest:delete:post' === $held['ability_name'] ) {\\n\\t\\trest_do_request( new WP_REST_Request( 'POST', \\\"\\\/agenticdaisy-firewall\\\/v1\\\/pending\\\/{$held['id']}\\\/approve\\\" ) );\\n\\t}\\n}\\n\\ndelete_option( 'adaf_demo_seed' );\\n\"}]}"}},"all_blocks":[],"tagged_versions":["0.1.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.8.1","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3755065,"resolution":"1","location":"assets","locale":"","width":1400,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3755065,"resolution":"2","location":"assets","locale":"","width":1400,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3755065,"resolution":"3","location":"assets","locale":"","width":1400,"height":1033},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3755065,"resolution":"4","location":"assets","locale":"","width":1400,"height":2575},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3755065,"resolution":"5","location":"assets","locale":"","width":1400,"height":1509},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3755065,"resolution":"6","location":"assets","locale":"","width":1400,"height":900}},"screenshots":{"1":"The activity ledger: every agent action, the rule that decided it, and a one-click undo.","2":"The approval queue: each held action names what it would change and shows its full payload, and waits until a person approves or rejects it.","3":"Agents: each one tied to a least-privilege user, with a token shown once or a bound application password.","4":"Policies: allow, deny, log or hold by action, content type or ability, with the built-in defaults spelled out and a dry-run to test any action against them.","5":"Exposure scan: everything that can write to this site and who is accountable for it, with a printable report for a client.","6":"Settings: alert emails, a signed webhook for Slack, Discord or Google Chat, and how long the ledger keeps its history."}},"plugin_section":[],"plugin_tags":[256265,232494,8534,242115,600],"plugin_category":[54],"plugin_contributors":[262708],"plugin_business_model":[],"class_list":["post-349096","plugin","type-plugin","status-publish","hentry","plugin_tags-abilities-api","plugin_tags-ai-agent","plugin_tags-audit-log","plugin_tags-mcp","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-agenticdaisy","plugin_committers-agenticdaisy"],"banners":{"banner":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/banner-772x250.png?rev=3637844","banner_2x":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/banner-1544x500.png?rev=3637844","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/icon-128x128.png?rev=3637844","icon_2x":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/icon-256x256.png?rev=3637844","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/screenshot-1.png?rev=3755065","caption":"The activity ledger: every agent action, the rule that decided it, and a one-click undo."},{"src":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/screenshot-2.png?rev=3755065","caption":"The approval queue: each held action names what it would change and shows its full payload, and waits until a person approves or rejects it."},{"src":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/screenshot-3.png?rev=3755065","caption":"Agents: each one tied to a least-privilege user, with a token shown once or a bound application password."},{"src":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/screenshot-4.png?rev=3755065","caption":"Policies: allow, deny, log or hold by action, content type or ability, with the built-in defaults spelled out and a dry-run to test any action against them."},{"src":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/screenshot-5.png?rev=3755065","caption":"Exposure scan: everything that can write to this site and who is accountable for it, with a printable report for a client."},{"src":"https:\/\/ps.w.org\/agentic-daisy-ai-agent-firewall\/assets\/screenshot-6.png?rev=3755065","caption":"Settings: alert emails, a signed webhook for Slack, Discord or Google Chat, and how long the ledger keeps its history."}],"raw_content":"\n Install this before you give an AI agent an application password.<\/strong><\/p>\n\n Connecting Claude, ChatGPT, Cursor or any other MCP client to WordPress hands it a real login. From then on it can edit, publish, change settings and delete as fast as it can act - including when it has misunderstood you, or been talked into something by text it read along the way. Agent Firewall sits between those agents and your site:<\/p>\n\n It does not replace your MCP server. Keep the official MCP Adapter or whichever MCP plugin you already use; Agent Firewall governs what arrives through it, whether that is a WordPress ability, a REST API call or an MCP tool call.<\/p>\n\n Everything else on this page is free, with no limits, and stays free. The paid editions add tools for people answering to clients, and for agencies running many sites:<\/p>\n\nadaf_pending_approval<\/code> error code; the REST API is unchanged.<\/p>","1.7.0":"\n
Pro and Agency<\/h4>\n\n
\n