Details: Written by: Docs Cybersalt; Category: Changelog; Published: 04 November 2026

Release history for MCP for AcyMailing. For install and usage instructions see the documentation.

📋 MCP for AcyMailing - Changelog

v1.0.3 2026-11-04

Security release. Update as soon as you can if anyone other than your Super Users has MCP for J access.

Every tool now applies AcyMailing's own permissions. The AI can no longer do more than the Joomla account it acts for could do in AcyMailing itself. Each tool needs AcyMailing's Access Administration Interface permission and access to the page it belongs to, such as Subscribers, Lists or Emails. Before this, any account with MCP access could use every tool. See Permissions.
set_acym_config can't change the edition or licence settings by using different capitals. The block on level and the licence settings could be avoided by writing a name like LEVEL with create: true. Names must now be plain ASCII, and a different-case copy of a real setting is refused.
More secrets are hidden. The DKIM private key and passphrase and the stored sending-method settings no longer appear in get_acym_config or query_acym_table, and can't be written.
Settings that affect the server are off limits. sendmail_path, cron_savepath, uploadfolder, allowed_files and php_overrides can't be changed through MCP. Access control rows (acl_*) and the SMTP and bounce host, port and username need a Super User, because a changed SMTP host would be handed the stored password.

If a non-Super User connects an AI app: AcyMailing lets only Super Users into its pages by default, so that account now gets a clear refusal until a Super User allows its group in AcyMailing, under Configuration, Security, Access control.

The package now includes LICENSE.txt. The manifest already pointed to it.
Messages and the plugin description use the core's current name, "CS MCP for J" ("MCP for J" in the Components menu). No tool behaves differently because of this.

New name: shows as "System - MCP for AcyMailing" in Extensions → Plugins (was "System - MCP for Joomla: AcyMailing (Starter) add-on"), following the Joomla Extensions Directory's naming rules. Only the displayed name changed: the plugin's element, folder and update channel are the same, so updates keep working.
Licence notice: every PHP file now carries a GPL notice (GNU General Public License version 2 or later).
Manifest: removed the non-standard <php_minimum> element. Joomla never read it from there. The minimum PHP version is still published by the update server, which is where Joomla checks it.
No tool behaves differently.

check_acym_eventbooking_sync now checks the right plugin. It looked at an old AcyMailing 5 tag plugin that adds nobody to any list, so a site could be told "enabled" while the real sync was off, or the other way round. It now reports Joomdonation's Events Booking - AcyMailing plugin, its default lists, whether the checked list is one of them, and whether registrants must opt in first.

Reports events that feed no list. The report counts the published events that feed the checked list, feed only other lists, or feed no list at all, with upcoming events first. Still read-only.

First release: 33 tools in 6 groups for AcyMailing by Acyba: lists, subscribers, campaigns, sending, reports and diagnostics. It covers everything AcyMailing Starter can do, on every edition.
Nothing mails anyone by accident: confirmation, welcome and goodbye emails are off unless asked for, and queuing a campaign needs a dry run, a confirmation and the exact recipient count.