Release v1.4.0
WPCodeBox 2 v1.4.0
What's new in v1.4.0
WPCodeBox 2 v1.4.0 was released on . WPCodeBox allows you to save all your Code Snippets to the Cloud and share them across your WordPress sites. See the full changelog below and compare with the complete version history.
Release details
Released
5.6 MB
File available
Changelog
Added
- **Snippet Manager** — a dedicated library view for browsing, searching, filtering, organizing, and bulk-managing snippets. Switch between it and the classic editor from the toolbar; the selected view is remembered across reloads. A read-only Cloud section lists cloud folders and snippets with one-click download to local.
- **Tags** — assign tags to snippets, search and filter by tag or "Untagged", customize tag colors per browser, and edit tags from either the Snippet Manager or EditSnippet sidebar.
- **Bulk and drag-and-drop workflows** — select all/none or multiple snippets with a live selection count, then move, tag, enable, disable, or delete them together. Cards can be moved to folders or manually reordered with optimistic UI updates; `/` focuses search and `Esc` clears selection.
- **More ways to find snippets** — sort by Manual order, Name, or Last modified in both manager and classic sidebar; filter by type, tag, enabled/disabled/errored status, and whether conditions are set. Errored cards show a warning badge and error tooltip. Search is debounced and case-insensitive across snippet fields and tags.
- **Duplicate snippets in the Snippet Manager** — copy code, placement, conditions, and tags into the same folder as a disabled "Copy of …" snippet.
- **MCP / AI Access** — connect compatible AI clients to list, search, and read snippets, folders, tags, and revisions, and explicitly opt in to create, update, enable/disable, run, or delete operations. Read tools are the default when MCP is enabled; write and execute tools remain off until an administrator enables them. The standalone MCP endpoint accepts Application Password authentication only, requires `manage_options`, applies the per-tool allowlist and input validation, rate-limits calls, and audit-logs every request.
- **MCP snippet placement and conditions** — create/update tools accept validated `hooks` and condition-builder groups. Agents can select the named UI insertion points or raw actions, use multiple placements for JS/CSS/HTML, and configure editable Location, URL, content, taxonomy, user, device, time, and weekday rules; Custom PHP conditions remain unavailable to agents.
- **WordPress Abilities API support** — all 14 tools are registered under the `wpcodebox` category on WordPress 6.9+, with `readonly` and `destructive` annotations and core `wp-abilities/v1` discovery/execution routes. Both surfaces share the tool catalog, per-tool allowlist, input validation, `manage_options` capability check, and audit log. Unlike the standalone MCP endpoint, core Abilities REST also permits nonce-protected cookie authentication as well as Application Passwords and does not use WPCodeBox's MCP rate limiter. Disabled tools return a clear administrator-enable message.
- **Runtime PHP error detection** — hook-time fatal errors are caught, attributed, recorded, and disable the affected snippet without white-screening the site. Exceptions are recorded but leave the snippet enabled, while shutdown handling attributes otherwise uncatchable fatal errors to the executing sn
Improved
- With Manual sort active, All Snippets and Cloud All group cards by folder and show loose snippets under "No folder". Cards now show last-modified timestamps, open in the editor on double-click, and use the styled app dialog for delete confirmation.
- Snippet Manager icons, filters, dark-mode borders, and the upward-opening Move picker now match the rest of the editor. Folder moves/reorders update instantly, a duplicate-load guard prevents runaway reloads, and plugin-page CSS loads early to prevent the white-line/unstyled-content flash.
- MCP settings provide ready-to-copy Claude Desktop, Cursor/VS Code, and Claude Code configurations, plus higher-contrast dark-mode styling, a write-tool warning, and bulk enable/disable controls.
- The MCP run tool and in-app Run button now use one canonical one-shot PHP execution path. It strips only a leading PHP open tag, preserves embedded `<?php` text, rejects non-one-shot snippets, and always cleans up its output buffer after missing snippets or thrown errors.
Fixed
- Abilities registered for WordPress 6.9+ now carry MCP channel metadata, so AI clients connecting through core's ability-based MCP adapters see exactly the tools an administrator enabled instead of every registered ability. The execution-time allowlist check still gates each call.
- MCP tool names now use Anthropic-compatible underscores such as `wpcodebox_list_snippets`; saved allowlists using the former slash names are recognized and migrated. Reported by a customer in June 2026.
- The MCP endpoint responds at `plugins_loaded` so canonical/multilanguage plugins cannot redirect the request before the client receives it.
- Missing or quarantined MCP tool files are skipped instead of taking WordPress into recovery mode, and each skipped tool is logged once per occurrence until restored. Reported by RC testers on Cloudways.
Compatibility
- Requires WordPress
- 5.6
- Tested up to
- 7.1
- Requires PHP
- 7.4
Verified safe
WPCodeBox 2 v1.4.0 scanned clean with no security threats detected.
View full scan report