@adsim/wordpress-mcp-server 4.5.1 → 4.6.0

package/src/plugins/adapters/elementor/elementorAdapter.js

@@ -0,0 +1,176 @@
+/**
+ * Elementor Adapter — read-only.
+ *
+ * Provides 3 tools for reading Elementor data via the REST API (elementor/v1):
+ *   - elementor_list_templates   List templates (page, section, block, popup)
+ *   - elementor_get_template     Get full template content and elements
+ *   - elementor_get_page_data    Get Elementor editor data for a post/page
+ *
+ * All tools are read-only (riskLevel: "low") and pass responses through
+ * contextGuard to prevent oversized payloads from consuming LLM context.
+ */
+
+import { applyContextGuard } from '../../contextGuard.js';
+
+// ── Helpers ─────────────────────────────────────────────────────────────
+
+function json(data) {
+  return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+}
+
+function auditLog(entry) {
+  console.error(`[AUDIT] ${JSON.stringify({ timestamp: new Date().toISOString(), ...entry })}`);
+}
+
+// ── Tool handlers ───────────────────────────────────────────────────────
+
+async function handleListTemplates(args, apiRequest) {
+  const t0 = Date.now();
+  const { limit = 20, type } = args;
+
+  const data = await apiRequest('/templates', { basePath: '/wp-json/elementor/v1' });
+  let list = Array.isArray(data) ? data : [];
+
+  // Filter by type if requested
+  if (type) {
+    list = list.filter(t => t.type === type);
+  }
+
+  // Apply limit
+  list = list.slice(0, limit);
+
+  const templates = list.map(t => ({
+    id: t.id,
+    title: t.title?.rendered ?? t.title ?? '',
+    type: t.type ?? 'unknown',
+    author: t.author ?? null,
+    date: t.date ?? null,
+    source: t.source ?? 'local',
+  }));
+
+  auditLog({ tool: 'elementor_list_templates', action: 'list_templates', status: 'success', latency_ms: Date.now() - t0, params: { count: templates.length, type: type || 'all' } });
+  return json({ total: templates.length, templates });
+}
+
+async function handleGetTemplate(args, apiRequest) {
+  const t0 = Date.now();
+  const { id } = args;
+
+  if (typeof id !== 'number' || !Number.isInteger(id) || id <= 0) {
+    throw new Error('Validation error: "id" must be a positive integer');
+  }
+
+  const data = await apiRequest(`/templates/${id}`, { basePath: '/wp-json/elementor/v1' });
+
+  const result = {
+    id: data.id ?? id,
+    title: data.title?.rendered ?? data.title ?? '',
+    type: data.type ?? 'unknown',
+    content: data.content ?? data.elements ?? data,
+  };
+
+  const guarded = applyContextGuard(result, { toolName: 'elementor_get_template', mode: 'compact', maxChars: 50000 });
+
+  auditLog({ tool: 'elementor_get_template', action: 'read_template', target: id, status: 'success', latency_ms: Date.now() - t0 });
+  return json(guarded);
+}
+
+async function handleGetPageData(args, apiRequest) {
+  const t0 = Date.now();
+  const { post_id } = args;
+
+  if (typeof post_id !== 'number' || !Number.isInteger(post_id) || post_id <= 0) {
+    throw new Error('Validation error: "post_id" must be a positive integer');
+  }
+
+  let data;
+  try {
+    data = await apiRequest(`/document/${post_id}`, { basePath: '/wp-json/elementor/v1' });
+  } catch {
+    // Fallback: read post meta _elementor_data via WP REST API
+    const post = await apiRequest(`/posts/${post_id}`, { basePath: '/wp-json/wp/v2' });
+    data = post?.meta?._elementor_data ?? null;
+  }
+
+  // Parse elements to extract widget info
+  const elements = Array.isArray(data?.elements) ? data.elements : (Array.isArray(data) ? data : []);
+  const widgetsUsed = new Set();
+  let elementsCount = 0;
+
+  function walkElements(els) {
+    for (const el of els) {
+      elementsCount++;
+      if (el.widgetType) widgetsUsed.add(el.widgetType);
+      if (el.elType === 'widget' && el.widgetType) widgetsUsed.add(el.widgetType);
+      if (Array.isArray(el.elements)) walkElements(el.elements);
+    }
+  }
+  walkElements(elements);
+
+  const result = {
+    post_id,
+    elementor_status: elements.length > 0 ? 'active' : 'inactive',
+    widgets_used: [...widgetsUsed],
+    elements_count: elementsCount,
+  };
+
+  const guarded = applyContextGuard(result, { toolName: 'elementor_get_page_data', mode: 'compact', maxChars: 50000 });
+
+  auditLog({ tool: 'elementor_get_page_data', action: 'read_page_data', target: post_id, status: 'success', latency_ms: Date.now() - t0 });
+  return json(guarded);
+}
+
+// ── Tool definitions (MCP format) ───────────────────────────────────────
+
+const TOOLS = [
+  {
+    name: 'elementor_list_templates',
+    description: 'Use to list Elementor templates (page, section, block, popup). Read-only.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        limit: { type: 'number', default: 20, description: 'Max templates to return (default 20)' },
+        type: { type: 'string', enum: ['page', 'section', 'block', 'popup'], description: 'Filter by template type (optional)' },
+      },
+    },
+    handler: handleListTemplates,
+  },
+  {
+    name: 'elementor_get_template',
+    description: 'Use to get full Elementor template content and elements. Read-only.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        id: { type: 'number', description: 'Template ID' },
+      },
+      required: ['id'],
+    },
+    handler: handleGetTemplate,
+  },
+  {
+    name: 'elementor_get_page_data',
+    description: 'Use to get Elementor editor data for a post or page. Read-only.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        post_id: { type: 'number', description: 'Post or page ID' },
+      },
+      required: ['post_id'],
+    },
+    handler: handleGetPageData,
+  },
+];
+
+// ── Adapter export ──────────────────────────────────────────────────────
+
+export const elementorAdapter = {
+  id: 'elementor',
+  namespace: 'elementor/v1',
+  riskLevel: 'low',
+  contextConfig: {
+    maxChars: 50000,
+    defaultMode: 'compact',
+    supportedModes: ['raw', 'compact', 'summary', 'ids_only'],
+  },
+  getTools: () => TOOLS,
+};

package/src/plugins/contextGuard.js

@@ -0,0 +1,57 @@
+/**
+ * Context Guard — prevents oversized responses from consuming LLM context.
+ *
+ * Every plugin-layer tool handler must pass its response through
+ * applyContextGuard() before returning. If the serialised JSON exceeds
+ * maxChars and the caller did not request mode='raw', the response is
+ * truncated and a warning is attached.
+ */
+
+/**
+ * @param {*} data           Raw response data (object, array, string…)
+ * @param {object} options
+ * @param {string} options.toolName   Tool name for logging
+ * @param {string} [options.mode]     Caller-requested mode (raw = no truncation)
+ * @param {number} [options.maxChars] Max serialised chars (default 50 000)
+ * @returns {*}  Original data or truncated wrapper
+ */
+export function applyContextGuard(data, options = {}) {
+  const { toolName = 'unknown', mode, maxChars = 50000 } = options;
+  const serialised = JSON.stringify(data);
+  const size = serialised.length;
+
+  if (size > maxChars && mode !== 'raw') {
+    console.error(JSON.stringify({
+      tool: toolName,
+      event: 'context_overflow',
+      size_chars: size,
+      max_chars: maxChars,
+      truncated: true,
+    }));
+
+    const truncated = serialised.substring(0, maxChars);
+
+    // Try to parse the truncated JSON back into an object; fall back to string
+    let parsed;
+    try {
+      // Find last complete JSON boundary to avoid broken UTF-8 / structure
+      const lastBrace = Math.max(truncated.lastIndexOf('}'), truncated.lastIndexOf(']'));
+      if (lastBrace > 0) {
+        parsed = JSON.parse(truncated.substring(0, lastBrace + 1));
+      } else {
+        parsed = truncated;
+      }
+    } catch {
+      parsed = truncated;
+    }
+
+    return {
+      _truncated: true,
+      _original_size: size,
+      _warning: "Response truncated. Use mode='raw' to get full data.",
+      data: parsed,
+    };
+  }
+
+  return data;
+}

package/src/plugins/registry.js

@@ -0,0 +1,94 @@
+/**
+ * Plugin Layer Registry — runtime detection and tool aggregation.
+ *
+ * Detects active WordPress plugins (ACF, Elementor, Astra) by inspecting
+ * the REST API namespaces at /wp-json/. Aggregates tools from active adapters
+ * and respects the WP_DISABLE_PLUGIN_LAYERS governance flag.
+ */
+
+const KNOWN_PLUGINS = [
+  { id: 'acf', namespace: 'acf/v3' },
+  { id: 'elementor', namespace: 'elementor/v1' },
+  { id: 'astra', namespace: 'astra/v1' },
+];
+
+export class PluginRegistry {
+  constructor() {
+    /** @type {Map<string, { id: string, namespace: string, version: string|null, tools: object[] }>} */
+    this.active = new Map();
+  }
+
+  /**
+   * Detect active plugins by calling GET /wp-json/ and inspecting namespaces.
+   *
+   * @param {Function} apiRequest  A function that takes (endpoint, options) and
+   *   returns parsed JSON. Must support basePath override to hit /wp-json/.
+   * @returns {Promise<{ active: string[], disabled_by_env: boolean }>}
+   */
+  async initialize(apiRequest) {
+    const discovery = await apiRequest('/', { basePath: '/wp-json' });
+    const namespaces = discovery?.namespaces || [];
+
+    for (const known of KNOWN_PLUGINS) {
+      if (namespaces.includes(known.namespace)) {
+        this.active.set(known.id, {
+          id: known.id,
+          namespace: known.namespace,
+          version: null,
+          tools: [],
+        });
+        console.error(JSON.stringify({
+          event: 'plugin_layer_detected',
+          plugin: known.id,
+          namespaces_found: namespaces.filter(ns => ns.startsWith(known.id)),
+        }));
+      }
+    }
+
+    return this.getSummary();
+  }
+
+  /**
+   * Return all tools from active adapters.
+   * Returns [] if WP_DISABLE_PLUGIN_LAYERS is true.
+   *
+   * @returns {object[]}
+   */
+  getAvailableTools() {
+    if (process.env.WP_DISABLE_PLUGIN_LAYERS === 'true') return [];
+    return [...this.active.values()].flatMap(a => a.tools ?? []);
+  }
+
+  /**
+   * Check whether a plugin is detected as active.
+   *
+   * @param {string} pluginId  e.g. "acf", "elementor", "astra"
+   * @returns {boolean}
+   */
+  isActive(pluginId) {
+    return this.active.has(pluginId);
+  }
+
+  /**
+   * Return a summary of the registry state.
+   *
+   * @returns {{ active: string[], disabled_by_env: boolean }}
+   */
+  getSummary() {
+    return {
+      active: [...this.active.keys()],
+      disabled_by_env: process.env.WP_DISABLE_PLUGIN_LAYERS === 'true',
+    };
+  }
+
+  /**
+   * Register an adapter's tools for a detected plugin.
+   *
+   * @param {string} pluginId
+   * @param {object[]} tools
+   */
+  registerTools(pluginId, tools) {
+    const entry = this.active.get(pluginId);
+    if (entry) entry.tools = tools;
+  }
+}

package/tests/unit/pluginLayer.test.js

@@ -0,0 +1,151 @@
+import { vi, describe, it, expect, beforeEach, afterEach } from 'vitest';
+
+vi.mock('node-fetch', () => ({ default: vi.fn() }));
+
+import fetch from 'node-fetch';
+import { handleToolCall, getFilteredTools, pluginRegistry } from '../../index.js';
+import { mockSuccess, makeRequest, parseResult } from '../helpers/mockWpRequest.js';
+import { acfAdapter } from '../../src/plugins/adapters/acf/acfAdapter.js';
+
+function call(name, args = {}) {
+  return handleToolCall(makeRequest(name, args));
+}
+
+let consoleSpy;
+const envBackup = {};
+
+function saveEnv(...keys) {
+  keys.forEach(k => { envBackup[k] = process.env[k]; });
+}
+function restoreEnv() {
+  Object.entries(envBackup).forEach(([k, v]) => {
+    if (v === undefined) delete process.env[k];
+    else process.env[k] = v;
+  });
+}
+
+beforeEach(() => {
+  fetch.mockReset();
+  consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  saveEnv('WP_DISABLE_PLUGIN_LAYERS');
+  delete process.env.WP_DISABLE_PLUGIN_LAYERS;
+
+  // Reset registry to clean state
+  pluginRegistry.active.clear();
+});
+afterEach(() => {
+  consoleSpy.mockRestore();
+  restoreEnv();
+  pluginRegistry.active.clear();
+});
+
+// ── Helper: simulate ACF detected ──
+
+function simulateAcfDetected() {
+  pluginRegistry.active.set('acf', {
+    id: 'acf',
+    namespace: 'acf/v3',
+    version: null,
+    tools: acfAdapter.getTools(),
+  });
+}
+
+// =========================================================================
+// Tests
+// =========================================================================
+
+describe('Plugin Layer integration', () => {
+
+  it('listTools includes acf_get_fields when ACF is detected', () => {
+    simulateAcfDetected();
+    const tools = getFilteredTools();
+    const names = tools.map(t => t.name);
+    expect(names).toContain('acf_get_fields');
+    expect(names).toContain('acf_list_field_groups');
+    expect(names).toContain('acf_get_field_group');
+  });
+
+  it('listTools does NOT include ACF tools when WP_DISABLE_PLUGIN_LAYERS=true', () => {
+    simulateAcfDetected();
+    process.env.WP_DISABLE_PLUGIN_LAYERS = 'true';
+    const tools = getFilteredTools();
+    const names = tools.map(t => t.name);
+    expect(names).not.toContain('acf_get_fields');
+    expect(names).not.toContain('acf_list_field_groups');
+    expect(names).not.toContain('acf_get_field_group');
+  });
+
+  it('callTool("acf_get_fields") routes to the adapter handler', async () => {
+    simulateAcfDetected();
+
+    // Mock the ACF REST API response
+    fetch.mockResolvedValue(mockSuccess({ acf: { title: 'Hello', price: 42 } }));
+
+    const res = await call('acf_get_fields', { id: 10, post_type: 'posts' });
+    expect(res.isError).toBeUndefined();
+    const data = parseResult(res);
+    expect(data.acf.title).toBe('Hello');
+    expect(data.acf.price).toBe(42);
+    expect(data.id).toBe(10);
+  });
+
+  it('callTool("wp_list_posts") continues to work normally', async () => {
+    simulateAcfDetected();
+
+    const mockPost = { id: 1, title: { rendered: 'Test Post' }, slug: 'test', status: 'publish', date: '2024-01-01', link: 'https://test.example.com/test', excerpt: { rendered: 'excerpt' }, author: 1, categories: [1], tags: [] };
+    fetch.mockResolvedValue(mockSuccess([mockPost]));
+
+    const res = await call('wp_list_posts', { per_page: 1 });
+    expect(res.isError).toBeUndefined();
+    const data = parseResult(res);
+    expect(data.posts[0].title).toBe('Test Post');
+  });
+
+  it('callTool with unknown tool returns error', async () => {
+    const res = await call('totally_fake_tool', {});
+    expect(res.isError).toBe(true);
+    expect(res.content[0].text).toContain('Unknown tool');
+  });
+
+  it('wp_site_info includes plugin_layer in response', async () => {
+    simulateAcfDetected();
+
+    // wp_site_info makes 3 sequential fetch calls
+    const siteInfo = { name: 'Test', description: 'A test', url: 'https://test.example.com', gmt_offset: 1, timezone_string: 'UTC' };
+    const userMe = { id: 1, name: 'Admin', slug: 'admin', roles: ['administrator'] };
+    const postTypes = { post: { slug: 'post', name: 'Posts', rest_base: 'posts' } };
+    mockSuccess(siteInfo);
+    mockSuccess(userMe);
+    mockSuccess(postTypes);
+
+    const res = await call('wp_site_info');
+    const data = parseResult(res);
+    expect(data.plugin_layer).toBeDefined();
+    expect(data.plugin_layer.active).toContain('acf');
+    expect(data.plugin_layer.disabled_by_env).toBe(false);
+  });
+
+  it('plugin_layer.active is empty when no plugins detected', async () => {
+    // Registry is empty (cleared in beforeEach)
+    const siteInfo = { name: 'Test', description: 'A test', url: 'https://test.example.com', gmt_offset: 1, timezone_string: 'UTC' };
+    const userMe = { id: 1, name: 'Admin', slug: 'admin', roles: ['administrator'] };
+    const postTypes = { post: { slug: 'post', name: 'Posts', rest_base: 'posts' } };
+    mockSuccess(siteInfo);
+    mockSuccess(userMe);
+    mockSuccess(postTypes);
+
+    const res = await call('wp_site_info');
+    const data = parseResult(res);
+    expect(data.plugin_layer.active).toEqual([]);
+  });
+
+  it('none of the 86 core tools are overwritten by plugin tools', () => {
+    simulateAcfDetected();
+    const tools = getFilteredTools();
+    const names = tools.map(t => t.name);
+
+    // Check no duplicates
+    const unique = new Set(names);
+    expect(unique.size).toBe(names.length);
+  });
+});

package/tests/unit/plugins/acf/acfAdapter.test.js

@@ -0,0 +1,205 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { acfAdapter } from '../../../../src/plugins/adapters/acf/acfAdapter.js';
+import { validateAdapter } from '../../../../src/plugins/IPluginAdapter.js';
+
+let consoleSpy;
+const envBackup = {};
+
+function saveEnv(...keys) {
+  keys.forEach(k => { envBackup[k] = process.env[k]; });
+}
+function restoreEnv() {
+  Object.entries(envBackup).forEach(([k, v]) => {
+    if (v === undefined) delete process.env[k];
+    else process.env[k] = v;
+  });
+}
+
+beforeEach(() => {
+  consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  saveEnv('WP_READ_ONLY');
+});
+afterEach(() => {
+  consoleSpy.mockRestore();
+  restoreEnv();
+});
+
+// ── Helpers ──
+
+function parseResult(result) {
+  return JSON.parse(result?.content?.[0]?.text);
+}
+
+function getAuditLogs() {
+  return consoleSpy.mock.calls
+    .map(c => c[0])
+    .filter(m => typeof m === 'string' && m.startsWith('[AUDIT]'))
+    .map(m => JSON.parse(m.replace('[AUDIT] ', '')));
+}
+
+function mockApi(data, shouldThrow = false) {
+  if (shouldThrow) {
+    return async () => { throw new Error('WP API 404: Not Found'); };
+  }
+  return async () => data;
+}
+
+// ── Mock data ──
+
+const mockAcfFields = {
+  acf: {
+    hero_title: 'Welcome to our site',
+    hero_subtitle: 'The best place',
+    price: 29.99,
+    show_banner: true,
+    gallery: [{ url: 'https://example.com/img1.jpg' }, { url: 'https://example.com/img2.jpg' }],
+  },
+};
+
+const mockFieldGroups = [
+  {
+    id: 101,
+    title: { rendered: 'Hero Section' },
+    fields: [{ name: 'hero_title' }, { name: 'hero_subtitle' }],
+    location: [[{ param: 'post_type', operator: '==', value: 'page' }]],
+  },
+  {
+    id: 102,
+    title: { rendered: 'Product Info' },
+    fields: [{ name: 'price' }, { name: 'sku' }],
+    location: [[{ param: 'post_type', operator: '==', value: 'product' }]],
+  },
+];
+
+const mockFieldGroupDetail = {
+  id: 101,
+  title: { rendered: 'Hero Section' },
+  fields: [
+    { key: 'field_abc', name: 'hero_title', type: 'text', label: 'Hero Title' },
+    { key: 'field_def', name: 'hero_subtitle', type: 'text', label: 'Hero Subtitle' },
+  ],
+  location: [[{ param: 'post_type', operator: '==', value: 'page' }]],
+  active: true,
+};
+
+// =========================================================================
+// Tests
+// =========================================================================
+
+describe('ACF Adapter', () => {
+
+  // 1. validateAdapter
+  it('passes validateAdapter without errors', () => {
+    const { valid, errors } = validateAdapter(acfAdapter);
+    expect(valid).toBe(true);
+    expect(errors).toEqual([]);
+  });
+
+  // 2. acf_get_fields — success
+  it('acf_get_fields returns ACF fields for a post', async () => {
+    const tool = acfAdapter.getTools().find(t => t.name === 'acf_get_fields');
+    const result = await tool.handler({ id: 42, post_type: 'posts' }, mockApi(mockAcfFields));
+    const data = parseResult(result);
+    expect(data.id).toBe(42);
+    expect(data.acf.hero_title).toBe('Welcome to our site');
+    expect(data.acf.price).toBe(29.99);
+    expect(data.fields_count).toBe(5);
+  });
+
+  // 3. acf_get_fields — fields filter
+  it('acf_get_fields filters to requested keys only', async () => {
+    const tool = acfAdapter.getTools().find(t => t.name === 'acf_get_fields');
+    const result = await tool.handler(
+      { id: 42, fields: ['hero_title', 'price'] },
+      mockApi(mockAcfFields)
+    );
+    const data = parseResult(result);
+    expect(Object.keys(data.acf)).toEqual(['hero_title', 'price']);
+    expect(data.acf.hero_subtitle).toBeUndefined();
+    expect(data.fields_count).toBe(2);
+  });
+
+  // 4. acf_get_fields — contextGuard truncation
+  it('acf_get_fields applies contextGuard on large responses', async () => {
+    // Generate a response > 30000 chars
+    const bigFields = {};
+    for (let i = 0; i < 500; i++) {
+      bigFields[`field_${i}`] = 'x'.repeat(100);
+    }
+    const tool = acfAdapter.getTools().find(t => t.name === 'acf_get_fields');
+    const result = await tool.handler(
+      { id: 1, mode: 'compact' },
+      mockApi({ acf: bigFields })
+    );
+    const data = parseResult(result);
+    expect(data._truncated).toBe(true);
+    expect(data._original_size).toBeGreaterThan(30000);
+    expect(data._warning).toContain('truncated');
+  });
+
+  // 5. acf_get_fields — 404
+  it('acf_get_fields propagates 404 error', async () => {
+    const tool = acfAdapter.getTools().find(t => t.name === 'acf_get_fields');
+    await expect(
+      tool.handler({ id: 99999 }, mockApi(null, true))
+    ).rejects.toThrow('404');
+  });
+
+  // 6. acf_list_field_groups — success
+  it('acf_list_field_groups returns the list', async () => {
+    const tool = acfAdapter.getTools().find(t => t.name === 'acf_list_field_groups');
+    const result = await tool.handler({}, mockApi(mockFieldGroups));
+    const data = parseResult(result);
+    expect(data.total).toBe(2);
+    expect(data.field_groups[0].title).toBe('Hero Section');
+    expect(data.field_groups[0].fields).toEqual(['hero_title', 'hero_subtitle']);
+    expect(data.field_groups[1].id).toBe(102);
+  });
+
+  // 7. acf_get_field_group — success
+  it('acf_get_field_group returns full details', async () => {
+    const tool = acfAdapter.getTools().find(t => t.name === 'acf_get_field_group');
+    const result = await tool.handler({ id: 101 }, mockApi(mockFieldGroupDetail));
+    const data = parseResult(result);
+    expect(data.id).toBe(101);
+    expect(data.fields).toHaveLength(2);
+    expect(data.fields[0].name).toBe('hero_title');
+  });
+
+  // 8. acf_get_field_group — 404
+  it('acf_get_field_group propagates 404 error', async () => {
+    const tool = acfAdapter.getTools().find(t => t.name === 'acf_get_field_group');
+    await expect(
+      tool.handler({ id: 99999 }, mockApi(null, true))
+    ).rejects.toThrow('404');
+  });
+
+  // 9. None of the tools are write tools — not blocked by WP_READ_ONLY
+  it('none of the 3 tools appear in core writeTools list', () => {
+    const writeTools = [
+      'wp_create_post', 'wp_update_post', 'wp_delete_post', 'wp_create_page',
+      'wp_update_page', 'wp_upload_media', 'wp_create_comment',
+      'wp_create_taxonomy_term', 'wp_update_seo_meta', 'wp_activate_plugin',
+      'wp_deactivate_plugin', 'wp_restore_revision', 'wp_delete_revision',
+      'wp_submit_for_review', 'wp_approve_post', 'wp_reject_post',
+      'wc_update_product', 'wc_update_stock', 'wc_update_order_status',
+    ];
+    const acfToolNames = acfAdapter.getTools().map(t => t.name);
+    for (const n of acfToolNames) {
+      expect(writeTools).not.toContain(n);
+    }
+  });
+
+  // 10. Audit log format
+  it('acf_get_fields logs correct audit format to stderr', async () => {
+    const tool = acfAdapter.getTools().find(t => t.name === 'acf_get_fields');
+    await tool.handler({ id: 42, post_type: 'posts' }, mockApi(mockAcfFields));
+    const logs = getAuditLogs();
+    const entry = logs.find(l => l.tool === 'acf_get_fields');
+    expect(entry).toBeDefined();
+    expect(entry.action).toBe('read_acf_fields');
+    expect(entry.target).toBe(42);
+    expect(entry.status).toBe('success');
+    expect(typeof entry.latency_ms).toBe('number');
+  });
+});