# Vendored dependencies

This directory holds third-party PHP libraries bundled into the plugin so it
installs as a zip → activate experience with **no Composer step** required.

Both libraries are PSR-4 and loaded by the plugin's own autoloader
(`includes/Core/Autoloader.php`), which maps their namespaces directly to the
paths below. We deliberately bypass each library's own `Autoloader.php` /
`composer install` bootstrap.

## Contents

### `wordpress/mcp-adapter/`
- Source: https://github.com/WordPress/mcp-adapter
- License: GPL-2.0-or-later (`LICENSE.md`)
- Pinned commit: `7cc42a0c1de1937bea6ca9cea56d1b0818e94632` (2026-05-20)
- Upstream version: 0.5.0
- Namespace: `WP\MCP\`
- Files vendored: `includes/` (PSR-4 source only — no plugin bootstrap, no tests)

### `wordpress/php-mcp-schema/`
- Source: https://github.com/WordPress/php-mcp-schema
- License: GPL-2.0-or-later (`LICENSE.md`)
- Version: v0.1.1 (pulled via mcp-adapter's composer.lock at the pinned commit)
- Namespace: `WP\McpSchema\`
- Files vendored: `src/` (PSR-4 source only)
- Why bundled: hard runtime dependency of mcp-adapter (JSON Schema DTOs for every
  MCP protocol message). Vendoring it removes the Composer step.

## How to upgrade

1. `git clone https://github.com/WordPress/mcp-adapter.git` to a temp dir
2. Inside, `composer install --no-dev`
3. Copy `includes/` over our `vendor/wordpress/mcp-adapter/includes/` (preserving
   our `index.php` files at each level)
4. Copy `vendor/wordpress/php-mcp-schema/src/` over our
   `vendor/wordpress/php-mcp-schema/src/`
5. Update the pinned commit hash and version numbers above
6. Smoke-test: load any plugin admin page on a WP 6.9+ site and confirm no
   "class not found" errors in the log

## Security notes

- `WP_MCP_AUTOLOAD` is defined as `false` in `includes/MCP/Bootstrap.php` before
  mcp-adapter loads. This tells mcp-adapter's bundled `Autoloader.php` to no-op
  instead of trying to require a non-existent `vendor/autoload.php`.
- Every directory has an `index.php` silence-is-golden stub.
- mcp-adapter is only instantiated on WP 6.9+ (checked at runtime in
  `includes/MCP/Compatibility.php` via `function_exists( 'wp_register_ability' )`).