Skip to main content

Changelog

1.2.14 (2026-11-04)

Fixed

  • Security fixes

1.2.13 (2026-10-28)

Fixed

  • Saving an admin user with active MCP tokens failed - on System Permissions All Users, clicking Save for a user who had active MCP tokens did nothing, because the Revoke All Tokens button on the user's MCP Info tab broke the page's form check. The user now saves normally, and Revoke All Tokens still asks for confirmation before it revokes the tokens.

1.2.12 (2026-10-26)

Features

  • Public Base URL for headless stores - a new Public Base URL field under Stores Configuration Mirasvit Extensions MCP Server General Settings sets the address AI clients use to reach Magento. On a headless or PWA store, the store's base URL points to the separate frontend, which cannot answer the MCP connection, sign-in (OAuth) and discovery addresses, so AI clients could never finish connecting. Enter the domain where Magento itself answers (for example https://api.example.com/), and the MCP endpoint, the sign-in addresses, the discovery documents and the connection details shown in the admin all use it. Leave it empty to keep using the store's base URL as before.

1.2.11 (2026-10-22)

  • Fixed the copy button on the MCP connection info screen on Magento 2.4.0–2.4.3.
  • MCP clients now receive a readable error when a request fails, instead of a page they could not read.

1.2.10 (2026-10-15)

Features

  • Rules for AI agents - a new Rules for AI Agents field under Stores Configuration Mirasvit Extensions MCP Server holds your rules for every connected AI agent, for example "Never remove product images" or "Never change data on store view cz". Agents receive them when they connect, at the start of the server's instructions, before the list of tools, so the rules no longer have to be pasted into every AI client. Rules for one role's agents are added on the role's MCP Info tab and come after the store-wide text, never in its place. The text is advice to the AI model, not a permission: to limit what an agent can do, use its role's resources and write access. With both fields empty, agents receive exactly the same instructions as before.
  • Change Journal in the menu - System AI Agent Connector Change Journal and the extension's title menu open the new journal of every write AI agents make through the built-in tools.
  • Requires mirasvit/module-mcp-tool 1.1.18 or newer.

1.2.9 (2026-10-08)

Improvements

  • AI clients see what the connection may do - with the MCP Tools write access setting set to read-only for the store or for the connected admin's role, the AI client is no longer offered write operations, and tools whose writes are blocked are marked read-only. AI workspaces that allow only read-only tools (such as ChatGPT) can then use them.
  • Requires mirasvit/module-mcp-tool 1.1.16 or newer.

1.2.8 (2026-10-05)

Fixed

  • A failed attempt to generate or revoke a personal access token now shows a clear error message instead of a raw technical database error.

1.2.7 (2026-09-28)

Improvements

  • Internal code improvements and maintenance.

1.2.6 (2026-09-16)

Fixed

  • MCP tools no longer read or write storefront-decorated data. MCP requests ran in the storefront context, so storefront-only extensions (SEO friendly image URLs, brand name prefixes and similar) took part in every read and write an MCP tool performed - the AI client saw decorated values and saved them back. A single product write also cleared the full-page cache for the whole catalog instead of just that product, which on a busy store meant the storefront rebuilding category and product pages dozens of times during one assistant session. MCP requests now run in their own dedicated context, so tools see and save plain product, customer and order data, and only the affected pages are refreshed. This pairs with MCP Tools 1.1.15, which composer updates alongside this extension
  • Revoking a user's tokens now includes their personal access token. The mirasvit:mcp:revoke command, the admin Revoke all and Disable actions and the automatic cleanup on admin user deletion all left the personal access token active - the command even reported that all tokens had been revoked - so a token you believed was cancelled would start working again as soon as MCP was re-enabled for that user
  • Console commands failed on Magento 2.4.5. mirasvit:mcp:revoke and the MCP token cleanup command ended in an error on 2.4.5 and 2.4.6, which ship an older console library than the commands expected
  • Unrecognized /mcp/... addresses now return a clear JSON "not found" response instead of leaving the request hanging
  • Removed the unused PKCEService::generateCodeVerifier() method, which had no callers and relied on a framework method absent from Magento 2.4.5. Generating a code verifier is the AI client's job; the server's side of PKCE is unchanged

1.2.5 (2026-08-25)

Fixed

  • OAuth discovery endpoints now respond to path-suffixed well-known URLs (e.g. /.well-known/oauth-protected-resource/mcp) required by RFC 9728-compliant AI clients such as xAI Grok — previously these requests returned 404 and prevented the client from completing OAuth discovery

1.2.4 (2026-04-29)

Fixed

  • Fixed OAuth authorization being blocked by Magento's Content Security Policy in restrict mode — the AI client's redirect URL is now allowed for the consent form submission, so authorization completes successfully on stores with strict CSP enabled

1.2.3 (2026-04-21)

Improvements

  • Added i18n support for 15 core locales (ar_SA, cs_CZ, de_DE, es_ES, fr_FR, it_IT, ja_JP, nl_NL, pl_PL, pt_BR, pt_PT, sv_SE, tr_TR, uk_UA, zh_Hans_CN)

1.2.2 (2026-04-17)

Improvements

  • Added a Prompts shortcut to the MCP admin menu for quicker access to the Prompts management page

1.2.1 (2026-04-16)

Fixed

  • Fixed admin users with full access seeing no MCP tools on the OAuth consent page — roles with "All" permissions now correctly grant access to all tools

1.2.0 (2026-04-15)

Features

  • MCP Prompts — AI clients can now discover and use prompt templates served by the MCP server. Prompts support customizable arguments, and only prompts matching the user's permissions are shown. Manage prompts from the new "Prompts" page in the MCP admin menu

Improvements

  • Active MCP sessions now stay alive longer — the session lifetime resets with each request, so sessions no longer expire unexpectedly during use
  • Tool access checks now use explicit role-based permissions instead of inherited ACL rules, ensuring tools are only available when the admin role has the specific resource assigned
  • ⚠️ Now requires mirasvit/module-mcp-tool version 1.1.0 or higher

1.1.7 (2026-04-13)

Fixed

  • Fixed error on the MCP client configuration page when displaying dates (e.g. token creation or expiry dates)

1.1.6 (2026-04-01)

Features

  • Personal Access Tokens (PAT) — Generate, reveal, and revoke long-lived bearer tokens for AI clients that do not support OAuth 2.1 (e.g. Manus.ai). Tokens are generated per admin user, require password confirmation to create or reveal, and appear in the MCP Users grid alongside OAuth clients. Configure under Stores Configuration MCP Server Authentication Personal Access Tokens
  • ⚠️ New database table mst_mcp_user_token — run bin/magento setup:upgrade after updating

Improvements

  • Authentication settings reorganized into separate OAuth 2.1 and Personal Access Tokens sections for clarity

1.1.5 (2026-03-27)

Features

  • The MCP server now supports the Streamable HTTP transport introduced in MCP 2025-03-26, including session management, proper handling of JSON-RPC notifications, and session termination via DELETE requests

Improvements

  • The server now negotiates the MCP protocol version with the client, supporting versions from 2024-11-05 through 2025-11-25 for broader AI client compatibility
  • OpenAI Codex Desktop setup guide — added step-by-step configuration instructions for the Codex Desktop app

1.1.4 (2026-03-26)

Improvements

  • MCP methods for prompts and resources no longer return errors

1.1.3 (2026-03-24)

Improvements

  • Added validator for basic health check

1.1.2 (2026-03-20)

Improvements

  • AI client configuration instructions improved

1.1.1 (2026-03-11)

Fixed

  • Fixed the issue with error during compilation (PHP7.4)

1.1.0 (2026-03-10)

Improvements

  • MCP server now accessible by simplified /mcp endpoint (/mcp/server/handle is still accessible)
  • Authorization header lookup improved

1.0.8 (2026-02-26)

Features

  • New tool - DocSearch. Modules should provide docs in markdown format placed in etc/mcp folder.

1.0.7 (2026-02-25)

Fixed

  • Fixed the issue with OAuth consent page when admin secret key is enabled

1.0.6 (2026-02-19)

Fixed

  • Error in the Stores - Configuration pages caused by incorrect layout file.

1.0.5 (2026-02-19)

Improvements

  • Full schema definition in the "schema" action for REST API tool
  • Refactoring

1.0.4 (2026-02-17)

Fixed

  • The issue with copy buttons in AI Client settings.

1.0.3 (2026-02-16)

Improvements

  • PHP8.4 compatibility.
  • Server name compatibility with different AI clients.

1.0.2 (2026-02-13)

Fixed

  • OAuth authorization redirect converting query parameters to path format, breaking redirect and resource URLs.

1.0.1 (2026-02-13)

Improvements

  • REST Service names for 3rd-party endpoints.

1.0.0 (2026-02-12)

Features

  • Initial release.