Skip to main content
Changelog & Versions

MCP Plugin for Joomla - Users

Users 1.1.1 (latest release)
Saturday, 17 October 2026 Buy a licence
Security
  • Looking up an account by username or e-mail now answers the same way whether the account exists or not, unless the caller can manage users.
Users 1.1.0
Friday, 16 October 2026
Security
  • Writing to other accounts, user groups and access levels now requires access to the Users manager (core.manage on com_users), as in the Joomla administrator, and group assignments are checked against the caller's own rights. Editing one's own profile is unchanged.
Users 1.0.3
Monday, 05 October 2026
Fixed
  • User custom field values with a structure (subform rows, structured third-party types) are now stored as Joomla does (JSON) instead of being broken into "Array" rows, and are returned decoded by get_user.
Users 1.0.2
Thursday, 10 September 2026
Changed
  • Release notes are now in English and shown in Joomla's Update view (changelog URL).
Users 1.0.1
Sunday, 06 September 2026
Added
  • Language packs de-DE, es-ES, it-IT, nl-NL, pt-BR: translation of the plugin labels and its parameters.
Users 1.0.0
Friday, 04 September 2026
Added
  • 25 MCP tools across 4 scopes: users.read (search_users, get_user, get_users_overview, list_user_fields, check_user_permissions), users.write (create_user, update_user, set_user_groups, block_user, activate_user, require_password_reset, send_password_reset_email, delete_user, reset_user_mfa), access.read (list_user_groups, get_user_group, get_access_level), access.write (create/update/delete_user_group, create/update/delete_access_level).
  • Per-tool Joomla ACL gate (core.manage / create / edit / edit.state / delete on com_users) + core Super User rule re-applied before each call.
  • "Protect Super Users" option (default yes): even a Super User token cannot touch other Super Users or core.admin groups via MCP.
  • No password ever transits: creation = server-side random password + required reset + standard reset email (token link). The "new user" email from the User - Joomla plugin (clear-text password) is neutralized during creation.
Note
  • Requires the com_sensomcp component (MCP engine). Premium plugin, sold separately.
  • reset_user_mfa is disabled by default (plugin option + tool policy).