fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Abilities/Ability.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Abilities;
 
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * One capability of the MCP server, registered with the WordPress Abilities API.
  */

src/Abilities/AbilityRegistrar.php

@@ -11,6 +11,8 @@ use LIT\MCP\Server\RequestContext;
 use Throwable;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Registers all abilities of available integrations with the Abilities API and
  * wraps them with the role gate and neutral error handling.

src/Abilities/Annotations.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Abilities;
 
+defined('ABSPATH') || exit;
+
 /**
  * The MCP annotations of an ability (Ability::annotations()), in three presets. "readonly"
  * drives the "nur lesen" group switch (ExposurePolicy::disabledByReadonly()) and, with

src/Abilities/Cursor.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Abilities;
 
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Opaque offset cursor for list tools (spec §8.1, §11.3).
  */

src/Abilities/Errors.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Abilities;
 
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Factory for the error objects abilities return.
  *

src/Abilities/ExposurePolicy.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Abilities;
 
+defined('ABSPATH') || exit;
+
 /**
  * Decides per ability whether it is a direct MCP tool, only reachable through the
  * adapter's meta-tools, or disabled (spec §4.3). Ability::isDirect() is the default.

src/Abilities/FollowUp.php

@@ -7,6 +7,8 @@ namespace LIT\MCP\Abilities;
 use LIT\MCP\Log;
 use Throwable;
 
+defined('ABSPATH') || exit;
+
 /**
  * Runs a step after a write has already succeeded (listeners, change log): a failure
  * there must not turn the saved change into an error. It is logged and reported as warning.

src/Abilities/JsonMap.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Abilities;
 
 use stdClass;
 
+defined('ABSPATH') || exit;
+
 /**
  * PHP encodes an empty array as JSON [] – for schema type "object" the client
  * must see {}. WordPress' output validation accepts stdClass for objects.

src/Abilities/Rev.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Abilities;
 
 use WP_Post;
 
+defined('ABSPATH') || exit;
+
 /**
  * Short hash used as optimistic-lock handle ("rev", spec §5.3).
  */

src/Abilities/Rollback.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Abilities;
 
 use Throwable;
 
+defined('ABSPATH') || exit;
+
 /**
  * Runs the undo steps of a failed write. Every step runs, even after an earlier one failed;
  * a step fails by throwing. The caller turns the collected messages into the log detail and

src/Abilities/Text.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace LIT\MCP\Abilities;
 
+defined('ABSPATH') || exit;
+
 /**
  * Small text helper shared by every summary that must stay bounded in size (outlines, node
  * summaries, the rendered-page excerpt): extracts are a fixed-size preview, never an unbounded

src/Abilities/ToolResult.php

@@ -6,6 +6,8 @@ namespace LIT\MCP\Abilities;
 
 use InvalidArgumentException;
 
+defined('ABSPATH') || exit;
+
 /**
  * Uniform success result of every writing ability (spec §8.1).
  * The adapter returns it as structuredContent plus JSON text.

src/Abilities/WriteFailed.php

@@ -8,6 +8,8 @@ use RuntimeException;
 use Throwable;
 use WP_Error;
 
+defined('ABSPATH') || exit;
+
 /**
  * Thrown by write paths when saving failed after something may already have been
  * written. getMessage() is the internal detail for the PHP error log; $reason is the