Files
WP-LIT-MCP/src/Abilities/Annotations.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

34 lines
1.1 KiB
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP\Abilities;
defined('ABSPATH') || exit;
/**
* The MCP annotations of an ability (Ability::annotations()), in three presets. "readonly"
* drives the "nur lesen" group switch (ExposurePolicy::disabledByReadonly()) and, with
* "destructive", the Art column of the Tools tab (ruling S47).
*/
final class Annotations
{
/** @return array{readonly: bool, destructive: bool, idempotent: bool} Reads only. */
public static function read(): array
{
return ['readonly' => true, 'destructive' => false, 'idempotent' => true];
}
/** @return array{readonly: bool, destructive: bool, idempotent: bool} Writes, removes or overwrites nothing. */
public static function write(bool $idempotent): array
{
return ['readonly' => false, 'destructive' => false, 'idempotent' => $idempotent];
}
/** @return array{readonly: bool, destructive: bool, idempotent: bool} Removes or overwrites something. */
public static function destructive(bool $idempotent): array
{
return ['readonly' => false, 'destructive' => true, 'idempotent' => $idempotent];
}
}