Details: Written by: Docs Cybersalt; Category: Changelog; Published: 04 November 2026

Release history for MCP for JCE. For install and usage instructions see the documentation.

📋 MCP for JCE - Changelog

v1.0.4 2026-11-05

Security release. Update as soon as you can if anyone other than your Super Users has MCP for J write access.

No HTML in profile names, descriptions or component lists. These were stored exactly as sent, and JCE's profile list prints a profile's name without escaping it, so a tag saved as a name would run in the browser of whoever opened that list. JCE's own save strips tags from these fields. create_jce_profile, update_jce_profile, duplicate_jce_profile and set_jce_profile_assignment now refuse them.
Settings are encoded the way JCE encodes them. set_jce_profile_params stored values as sent. It now encodes special characters as JCE's own save does, and the response lists the settings it changed.

Security release. Update as soon as you can if anyone other than your Super Users has MCP for J access.

Every tool now applies JCE's own permissions. The AI can no longer do more than the Joomla account it acts for could do in JCE itself. Each tool needs JCE's Access Component permission, plus Editor Profiles for profile work or Editor Global Configuration for the settings read. Super Users pass as before. Before this, any account with MCP access could use every tool, including ones that change what an editor profile can upload. See Permissions.
API keys in profile settings are masked. get_jce_profile, get_jce_profile_params and the change report from set_jce_profile_params now show credential settings, such as the AI Assistant plugin's apikey, as [redacted]. They're still stored as set.

Works with JCE 3. JCE 3 moved its plugin list and manifests, so on JCE 3.0 list_jce_plugins came back empty, get_jce_plugin found nothing, and toolbar names were reported or refused as unknown. The tools now read both JCE 3's and JCE 2's locations.

If a non-Super User connects an AI app: that account now needs those permissions in JCE's Options, on the Permissions tab, and gets a clear refusal until a Super User allows its group.

The package now includes LICENSE.txt.
Messages and the plugin description use the core's current name, "CS MCP for J" ("MCP for J" in the Components menu).

New name: shows as "System - MCP for JCE" in Extensions → Plugins (was "System - MCP for Joomla - JCE"), following the Joomla Extensions Directory's naming rules. The plugin's element, folder and update channel are the same, so updates keep working.
Licence notice: every PHP file now carries a GPL notice (GNU General Public License version 2 or later).
Manifest: removed the non-standard <php_minimum> element. The minimum PHP version is still published by the update server.
No tool behaves differently.

Clears Joomla's caches after install (the PSR-4 autoload map, opcache and Joomla's cache groups). A plugin installed after the autoload map was written is not in it, which could produce an HTTP 500 shortly after installing.
Never takes the site down when MCP for J is missing. Installed on a site without it, the add-on no longer enables itself. If it is enabled anyway, it stays inert instead of failing every request.

First release: 21 tools for JCE editor profiles, including the read-only security audit.