Another week, another exciting release. We've just shipped cryptographic code signing on every GravityKit plugin update, the first WordPress plugin company we know of to do this. In a year where supply-chain attacks have hit major plugins like Smart Slider 3 Pro, this means tampered updates can never reach your site, even if our delivery channel were compromised. From idea to live in three weeks, thanks to our head of development Vlad, who is humble enough that he didn't even want his name on the announcement post (which he largely wrote!).
In this edition:
📣 Announcement: Plugin updates are now cryptographically verified
🤖 The prompt: We built the WordPress MCP we actually wanted
✍️ From the blog: How to build an inventory management system
🧰 Updates to the ’Kit
📣 ANNOUNCEMENT
GravityKit products now give you a stronger reason to trust what you install
Every GravityKit plugin update is now cryptographically verified before installation. Tampered packages are blocked before unpacking, protecting your site from supply-chain attacks automatically.
The last few months haven't been kind to WordPress plugin users. Smart Slider 3 Pro, WowShipping Pro, and others were all hit by supply-chain attacks where the vendor's own plugin update channel delivered malicious code to paying customers' sites! Roughly 900,000 sites were exposed in just one of those incidents. Customers who did everything right (kept their plugins up to date) were the ones who got compromised.
We didn't want that to be possible with anything we ship to you.
So as of last month, every GravityKit plugin install and update is cryptographically verified before WordPress unpacks it. Think of it as a tamper-evident seal: the moment a package is altered (anywhere along the route from us to your site), the seal breaks and the install is refused. Nothing unpacks. Your existing files are untouched. There's nothing to configure on your end and no setting to flip. It just runs.
As far as we can tell, no other commercial WordPress plugin has shipped install-time signature verification as part of their normal update flow. We thought the gap was overdue to close, so we closed it. We hope it becomes the norm across the ecosystem!
If you've installed one of the 20+ WordPress MCPs out there, pointed Claude or ChatGPT at a WordPress site, and asked it to edit a page, you've probably seen block markers stripped, "this block contains unexpected or invalid content" warnings everywhere, and structural blocks collapsed into freeform HTML.
It's not the agent's fault.
The standard WP REST API was built for humans posting whole articles, and most WordPress MCPs are thin wrappers around it. So the agent reads the entire post_content, mutates a string, and rewrites the entire page (dissolving half the block tree in the process!).
We got tired of that, so we built Block MCP, and as of this week it's public 🎉
Block MCP exposes Gutenberg content as a structured, addressable block tree instead of raw HTML. The agent can change a single heading without rewriting the page. Every block carries a stable gk_ref UUID that survives sibling shifts, so multi-turn edit chains don't have to re-fetch between calls.
Every write creates a WordPress revision for one-call rollback. And there's a server-side tier policy where you decide which blocks agents are allowed to write and what to suggest as replacements when they reach for something legacy.
We benchmarked it against two of the most popular WordPress MCPs in the wild, asking Claude to complete different tasks that require block manipulation. AI Engine Pro (a paid product) performed admirably, but was still much slower than the Block MCP on average. The other contender, built as a thin wrapper around the WordPress REST API, failed on every task.
Block MCP is free and open source. If you're building anything that lets an AI touch a WordPress page, this is the tool you want to be using.
In this tutorial, Casey shows you how to build a WordPress inventory management system with Gravity Forms and GravityView. Track stock, edit quantities from the front end, and skip the expensive SaaS tools!
🧰 UPDATES TO THE ’KIT
Here are the plugins that got updates since our last newsletter:
If you've been kicking the tires on the GravityView 3.0 beta, we'd genuinely love to hear what you think. And if you haven't given it a spin yet, here's where to start.
Until next time Zack with GravityKit
Get this every Friday
One short email a week: new releases, practical Gravity Forms tutorials, and subscriber-only discounts.
