Details: Written by: Docs Cybersalt; Category: Changelog; Published: 04 November 2026

Release history for MCP for VirtueMart. For install and usage instructions see the documentation.

📋 MCP for VirtueMart - Changelog

v1.0.4 2026-11-05

Security release. Update as soon as you can if anyone other than your Super Users has MCP for J write access.

Joomla's text filters now apply. Product, category and manufacturer text was stored exactly as sent, so an account whose text filters forbid scripts could put one on a public shop page. VirtueMart's own save filters these fields. The tools now do the same for product names and descriptions, category names and descriptions, manufacturer names and descriptions, and custom titles, and the response says which fields changed.
No HTML in plain-text fields. Meta fields, SKUs, URLs, internal notes, layouts and order status comments are refused if they contain tags, because VirtueMart's own save doesn't store tags in them either.

Security release. Update as soon as you can if anyone other than your Super Users has MCP for J access.

Every tool now applies VirtueMart's own permissions. The AI can no longer do more than the Joomla account it acts for could do in VirtueMart itself. Each tool needs VirtueMart's Access Administration Interface permission and the permission for that job on VirtueMart's Permissions tab, such as Product access, Product edit or Order status change. Super Users pass as before. Before this, any account with MCP access could use every tool, including order and customer data. See Permissions.
get_virtuemart_config no longer shows the licence key. member_access_number and any other credential-shaped setting now reads [redacted].

If a non-Super User connects an AI app: VirtueMart's permissions aren't granted to any group by default, so that account now gets a clear refusal until a Super User allows its group in VirtueMart's Options, on the Permissions tab.

The package now includes LICENSE.txt.
Messages and the plugin description use the core's current name, "CS MCP for J" ("MCP for J" in the Components menu). No tool behaves differently because of this.

New name: shows as "System - MCP for VirtueMart" in Extensions → Plugins (was "System - MCP for Joomla - VirtueMart"), following the Joomla Extensions Directory's naming rules. Only the displayed name changed: the plugin's element, folder and update channel are the same, so updates keep working.
Licence notice: every PHP file now carries a GPL notice (GNU General Public License version 2 or later).
Manifest: removed the non-standard <php_minimum> element. The minimum PHP version is still published by the update server, which is where Joomla checks it.
No tool behaves differently.

Clears Joomla's caches after install (the PSR-4 autoload map, opcache and Joomla's cache groups). A plugin installed after the autoload map was written is not in it, which could produce an HTTP 500 shortly after installing.
Never takes the site down when MCP for J is missing. Installed on a site without it, the add-on no longer enables itself, and says plainly that nothing is broken. If it is enabled anyway, it stays inert instead of failing every request, admin included.

First release: 48 tools for VirtueMart: products, categories, manufacturers, prices, stock, orders, customers, reviews and diagnostics.