@automattic/mcp-wordpress-remote 0.2.2 → 0.2.4

package/dist/proxy.js

@@ -23,7 +23,9 @@ var CONFIG = {
   OAUTH_HOST: process.env.OAUTH_HOST || "127.0.0.1",
   WP_OAUTH_CLIENT_ID: process.env.WP_OAUTH_CLIENT_ID || "",
   // No default - site-specific
-  // MCP OAuth 2.1 specific settings
+  // OAuth flow type settings
+  // 'authorization_code' (recommended): MCP-compliant OAuth 2.1 with PKCE
+  // 'implicit' (legacy): Supported for WordPress.com and legacy implementations
   OAUTH_FLOW_TYPE: process.env.OAUTH_FLOW_TYPE || "authorization_code",
   OAUTH_USE_PKCE: process.env.OAUTH_USE_PKCE !== "false",
   // PKCE required for OAuth 2.1
@@ -101,9 +103,7 @@ function validateConfig() {
       errors.push("OAUTH_CALLBACK_PORT must be a valid port number (1-65535)");
     }
     if (CONFIG.OAUTH_FLOW_TYPE === "implicit") {
-      errors.push(
-        "OAUTH_FLOW_TYPE=implicit is deprecated. MCP Authorization specification 2025-06-18 requires OAuth 2.1 with authorization_code flow"
-      );
+      console.warn("\u26A0\uFE0F  Using deprecated implicit OAuth flow. Consider migrating to authorization_code flow for better security.");
     }
     if (CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && !CONFIG.OAUTH_USE_PKCE) {
       errors.push(
@@ -1266,10 +1266,18 @@ var WP_PERSISTENT_CONFIG = {
 var PersistentWPOAuthClientProvider = class {
   constructor(options) {
     this.authPromise = null;
+    const isWpCom = isWordPressComSite(options.serverUrl || "");
+    const recommendedConfig = getRecommendedOAuthConfig(options.serverUrl || "");
     this.options = {
       ...WP_PERSISTENT_CONFIG,
       ...options
     };
+    if (isWpCom && recommendedConfig.authorizationEndpoint) {
+      this.options.authorizeEndpoint = recommendedConfig.authorizationEndpoint;
+      logger.debug("Using WordPress.com OAuth endpoint", "OAUTH", {
+        endpoint: recommendedConfig.authorizationEndpoint
+      });
+    }
     this.serverUrlHash = generateServerUrlHash(this.options.serverUrl);
     this.events = new EventEmitter2();
     this.events.setMaxListeners(10);
@@ -1278,7 +1286,9 @@ var PersistentWPOAuthClientProvider = class {
       serverUrl: this.options.serverUrl,
       serverHash: this.serverUrlHash,
       clientId: this.options.clientId || "auto-generated",
-      callbackPort: this.options.callbackPort
+      callbackPort: this.options.callbackPort,
+      authorizeEndpoint: this.options.authorizeEndpoint,
+      isWordPressCom: isWpCom
     });
   }
   /**
@@ -1462,7 +1472,6 @@ var PersistentWPOAuthClientProvider = class {
    * Build the WordPress authorization URL
    */
   buildAuthorizationUrl(callbackUrl, state) {
-    const baseUrl = this.options.serverUrl.replace(/\/+$/, "");
     const authEndpoint = this.options.authorizeEndpoint || WP_PERSISTENT_CONFIG.authorizeEndpoint;
     const params = new URLSearchParams({
       response_type: "token",
@@ -1474,7 +1483,12 @@ var PersistentWPOAuthClientProvider = class {
     if (this.options.clientId) {
       params.set("client_id", this.options.clientId);
     }
-    return `${baseUrl}${authEndpoint}?${params.toString()}`;
+    if (authEndpoint.startsWith("http://") || authEndpoint.startsWith("https://")) {
+      return `${authEndpoint}?${params.toString()}`;
+    } else {
+      const baseUrl = this.options.serverUrl.replace(/\/+$/, "");
+      return `${baseUrl}${authEndpoint}?${params.toString()}`;
+    }
   }
   /**
    * Generate a secure state parameter

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/mcp-wordpress-remote",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "MCP WordPress Remote proxy server",
   "engines": {
     "node": ">=22.0.0"