Enforce the MCP admin gate independently of the adapter (1.4.3)

[trueqap]

Closes the last thread from the field report — the one I deliberately left out of #29 because it is a security layer and warranted its own review.

The problem

The adapter applies its transport check like this:

apply_filters( 'mcp_adapter_default_transport_permission_user_capability', 'read', $context );

Note the default. Mcp\TransportGuard raises it to manage_options, but only for as long as that one filter is actually applied. If it ever is not — an upstream refactor, a hook rename, or a different bundled copy of the library winning the autoload race (which already happens on every WooCommerce store) — the endpoint quietly falls back to read, which every logged-in subscriber holds.

One hook not firing = an administrator-level endpoint open to any logged-in user. And this fallback is in every adapter version, 0.5.0 included — the field report framed it as a 0.3.0 weakness, but it is not version-specific.

This matters more now that the MCP server ships enabled by default: the gate applies to every install.

The fix

Mcp\RouteGuard enforces the same capability on WordPress's own rest_pre_dispatch, so it holds regardless of which adapter is loaded or whether its filters fire.

Three deliberate scoping decisions:

• Registered before the enabled check. It only ever denies requests to our own route, so it costs nothing when the server is off — and the whole point is that it holds when something else has gone wrong, so it must not depend on our own bootstrapping getting that far.
• Matches only our server route and anything beneath it. Not another plugin's MCP endpoint (there are four more on the test store: FluentBoards/CRM/Cart/Support), and not a route that merely shares the prefix (…-other).
• Passes an existing result through. It can only ever add a denial, never override an answer another filter already produced.

Verified live

Caller	Result
Subscriber (read only — what the adapter default would admit)	403 rest_forbidden
Unauthenticated	401
Administrator	200, unaffected
FluentCRM's MCP route	untouched

Tests

RouteGuardTest — 6 cases, red before, green after, covering both allow and deny, sub-paths, the prefix near-miss, other plugins' routes, and the pass-through.

Gate: phpcs clean · PHPStan L5 no errors · 445/445.