DVEX CONNECTOR 0.3.2 — PUBLIC DEVELOPMENT PREVIEW
WordPress 6.2+, PHP 7.4+, HTTPS, administrator access, and a compatible MCP client.

INSTALL
WordPress > Plugins > Add New > Upload Plugin. Upload the ZIP without extracting.
Activate on a test/staging site first. No API credentials are included in the ZIP.
Existing users: back up first; use Replace current with uploaded. Do not delete or
uninstall the old plugin. Avoid deactivating it because this revokes OAuth settings.

OAUTH SETUP
1. In your compatible MCP client, locate its exact HTTPS OAuth callback URL.
2. WordPress > Settings > DVEX MCP: enter that callback and save the OAuth client.
3. Copy the newly generated client ID into your MCP client. Client secret: empty
   (this is a predefined public OAuth client using PKCE S256).
4. Set the MCP endpoint to https://YOUR-SITE/wp-json/dvex/v1/mcp. Use the exact
   endpoint shown on the DVEX MCP settings screen if WordPress is in a subdirectory.
5. Start OAuth in your client, sign into WordPress, inspect the scopes and approve.
6. Verify connection_status, then create and review a draft before publishing.
Tokens expire after one hour; reconnect when needed. Refresh tokens and dynamic
client registration are not supported. Client plan/access/compatibility varies.
Saving OAuth settings again rotates the client ID and revokes old connections.
Settings > DVEX Connector contains a legacy bridge token; it is not needed for MCP.
Do not paste access tokens, passwords, or other credentials into AI chats.

TOOLS
connection_status, read_posts, create_draft, wordpress_read, wordpress_write,
wordpress_delete, set_navigation. Capabilities and OAuth scopes apply.
Content: posts/pages, drafts, publishing/scheduling, taxonomy, excerpts and slugs.
Media: edit EXISTING attachment metadata and assign existing featured images only.
Navigation: native menus where supported, plus DSS Sports Social dss-topnav override.
Trash: posts/pages only, permission required, blocked if Trash retention is disabled.
No permanent deletion, new binary file uploads, arbitrary code execution, plugin
installation/updates, arbitrary site options, custom fields or SEO integration.

PRIVACY
The plugin runs on your server. Your selected MCP client receives requested content,
including accessible drafts. Review that provider's privacy terms. There is no
DVEX telemetry endpoint or bundled site credential. Access data is held in local
WordPress options/transients. Deactivate to revoke OAuth configuration; uninstall
cleans plugin options and token records. Ordinary WordPress/hosting logs may apply.

VERSION 0.3.2
Packaging/documentation cleanup; guards Trash calls when retention is disabled.
Does not modify any live site or its OAuth settings merely by downloading.
Earlier 0.3.1 publishing has been used by the owner. This exact public package
still needs staging integration testing; no independent security certification.
Support and setup: https://dvex.dwpn.net/dvex-connector/
