Unaib Amir

WordPress and PHP dev, 14 years. Pivoting to AI engineering, WordPress is the launchpad. Building agent tools that respect permissions.

[Unaib Amir @unaibamir]

Just shipped a free WordPress plugin. 🚀
Agent Abilities for MCP lets AI agents (Claude, ChatGPT, Cursor) run real tasks on your site over MCP. Posts, WooCommerce, SEO, 150+ abilities.
Safe by default: every ability is off until you allow it. 🔐
Demo 👇
https://t.co/etIEN8D4rn

[Unaib Amir @unaibamir]

Claude Sonnet 5 was set to jump from $2/$10 to $3/$15 per million tokens tomorrow.
Anthropic just cancelled the hike instead.

I run agentic coding sessions where output tokens dwarf input. Holding $10 steady matters more than any input discount rivals are advertising.

[Unaib Amir @unaibamir]

PHP 8.6 Beta 1 shipped Aug 13, locking in partial application, clamp(), and Duration.
No new idea gets in after this, however good it is.

I've missed deadlines chasing "one more thing" for years. The freeze ships software. I still don't hold my own dates that well.

[Unaib Amir @unaibamir]

https://t.co/Yd6mMSfKqv

[Unaib Amir @unaibamir]

Ten review rounds on my WordPress plugin all said ship.

A traffic simulation found the bug they all missed: marking a comment already approved as approved reported failure. Passing review isn't proof of correctness, only proof nothing you tested was wrong.

[Unaib Amir @unaibamir]

WordPress fires a permission filter after my plugin's own check returns, not before.

That filter can flip my denial into a grant, and no code I write runs after it.

I can't out-code a hook that fires after mine. I documented the trust boundary instead.

[Unaib Amir @unaibamir]

https://t.co/Yd6mMSfKqv

[Unaib Amir @unaibamir]

2,431 unit tests. Two full review loops. A browser pass. All missed it.

A traffic simulation against real WordPress data found 31 more. Every HIGH one predated the release being tested.

Free WordPress plugin, already running on 80+ live sites.

[Unaib Amir @unaibamir]

A permission check said two department names did not match.

They were the same word, different case. My comparison function only folds ASCII.

PHP's strcasecmp never learned the alphabet past A-Z. mb_strtolower plus === is the fix, always, for anything a person typed.

[Unaib Amir @unaibamir]

The plugin, if you want a look: https://t.co/Yd6mMSfKqv

[Unaib Amir @unaibamir]

https://t.co/cGcd2i1TpV silently truncates a plugin readme's Changelog section above 5,000 words.Mine hit 7,380. Nobody told me, I found it in the import log.

Grouped the fixes into summaries instead of one bullet each. Down to 3,180 words, now on my release checklist.

[Unaib Amir @unaibamir]

@PovilasKorop True that. But sometimes $200 plan feels less.

[Unaib Amir @unaibamir]

Here we go again!

[Unaib Amir @unaibamir]

@ardent__dev for me, its cloudflare.

[Unaib Amir @unaibamir]

Pest's install base doubled in two years: 39 million, up from 18 million.PHPUnit still holds half of PHP devs. Neither number picks your framework.

I moved three codebases to Pest this year for the syntax, not the coverage. Adoption charts track momentum, not correctness.

[Unaib Amir @unaibamir]

https://t.co/Yd6mMSfKqv

[Unaib Amir @unaibamir]

A redaction filter in my plugin keeps secrets away from any AI agent reading the store.

It was built to catch 'password' and 'pwd'. It let 'passwd' straight through, untested.

Fixed now. I still don't know how many older filters share the same blind spot.

[Unaib Amir @unaibamir]

@PovilasKorop Unfortunately, mainly the client work. But I have to agree: working with two LLMs, one executor and one reviewer, work like a charm.

[Unaib Amir @unaibamir]

https://t.co/Yd6mMSfKqv

[Unaib Amir @unaibamir]

https://t.co/9RyLEk1Xmn excludes a plugin outright if even one query word is missing from its listing.
The word "AI" is nowhere in mine. A rival with my install count outranks me on "claude" since that word sits in its title.
Distribution problem, not a quality one.

[Unaib Amir @unaibamir]

More on what I'm building here: https://t.co/Yd6mMSfKqv

[Unaib Amir @unaibamir]

I ran "wordpress mcp server plugin" through Claude's web search.
It described my plugin's exact feature set, then named a different plugin as the source. 🤦‍♂️

153 abilities, off by default, every call audited: my words, credited to a competitor's own directory listing.