Site Agent 0.4.1 is out, and the biggest change is how agents connect. OAuth connections are now on by default, so you can add your site's endpoint to Claude, ChatGPT or any OAuth-capable MCP client without pasting an Application Password anywhere.

You approve each client on a WordPress consent screen and pick the tool groups it can use. If you turned OAuth off on purpose, Site Agent keeps your choice.

What changed:

• Tools → Site Agent now leads with OAuth. Application Passwords sit in a "not recommended" section with a warning.
• The settings screen warns you when OAuth is off, when URL authentication is on and when Application Passwords made tool calls in the last 30 days.
• site-context tells the agent how it's connected. On an Application Password or an authenticated URL, the agent gets a warning to pass on to you, asking you to reconnect with OAuth.
• A new Plugin skills panel lists the plugins that hand agents their own skill (GT Extensions for FluentCart, GT Page Blocks Builder and GT Link Manager) and shows which are active on your site.
• Fixed: plugin skill descriptions showed stray quote marks in list-skills.

If your agent still connects through an authenticated URL with an Application Password in it, reconnect with OAuth and revoke that password. That URL ends up in logs and chat history.

Update from Dashboard → Updates, or get the ZIP from the Site Agent page. It's free. Full notes are in the changelog.

If an MCP client fails to connect through OAuth, reply here with the client's name and the error it shows.

Kick this space off: what's running your site right now?

Theme, hosting, caching, SEO plugin, forms, the lot. Mine: Marketers Delight on a VPS with FlyingPress and Cloudflare APO in front, Rank Math for SEO, and my own Core Forms for forms.

No judgment on page builders. Mostly.