REIKA Agent

Free, open-source WordPress plugin that connects WordPress to AI agents: MCP connector, signed admin abilities, Blueprint installer, llms.txt, instant navigation, GitHub auto-updates. Formerly Agentic Autopilot (and WP Autopilot / REIKA Site Kit). Built and used by REIKA; GPL-2.0-or-later, contributions welcome.

Everything is off until enabled in Settings → REIKA Agent.

Blueprint repo

Blueprint is a gateway that connects a WordPress site to any GitHub repo to install and keep updated a set of plugins and themes. Use it to bootstrap new sites quickly from a pre-configured base.

Blueprint does not import settings itself. Config import is handled by each plugin's own import tool, a script, or an AI agent.

How it works

1. Point Blueprint to a GitHub repo (yours or anyone's public repo).
2. The repo contains a catalog.json at the root (or a custom path) listing plugins and themes:

   [
     {
       "type": "plugins",
       "slug": "acf",
       "name": "ACF",
       "version": "6.8.0",
       "main_file": "acf.php",
       "location": "plugins/acf.zip"
     },
     {
       "type": "config",
       "slug": "yoast-settings",
       "name": "Yoast SEO settings",
       "location": "config/yoast.json",
       "for": "wordpress-seo",
       "notes": "Import in Yoast > Tools > Import"
     }
   ]

3. In Settings → REIKA Agent → Blueprint, connect a repo. Each package is a standard WordPress .zip (plugin or theme with top folder = slug).
4. Optionally enable auto-install (daily) or auto-update. Exclude individual items as needed.
5. Blueprint injected items into WordPress' update checks; the Plugins/Themes screens show updates normally.

Configuration

• Repository: GitHub repo (owner/name), public or private (with token).
• Branch/Ref: Optional; uses the repo's default branch if empty.
• Catalog Path: Relative path to catalog.json (default: catalog.json).
• Auto Install: Automatically install missing items daily.
• Activate After Install: Activate plugins upon install (themes are never auto-activated).
• Auto Update: Automatically update managed items if a new version is available.
• AI Agents: Expose Blueprint abilities to MCP clients (Claude, ChatGPT…) so agents can list, install, and fetch config files.

Upgrading from Agentic Autopilot

1. Install the reika-agent.zip release and activate REIKA Agent. Settings (including Blueprint and its saved token) migrate automatically.
2. Deactivate and delete Agentic Autopilot. While both are active, REIKA Agent shows a notice and does not load its modules.
3. If the standalone REIKA MCP abilities plugin is active, deactivate it before enabling the Abilities module (same config and log are reused).

Developer back-compat: the old constants AGENTIC_AUTOPILOT_GITHUB_CLIENT_ID and AGENTIC_AUTOPILOT_BLUEPRINT_TOKEN and the old filters agentic_autopilot_mcp_status, agentic_autopilot_llms_txt, agentic_autopilot_github_client_id still work. New names: REIKA_AGENT_* and reika_agent_*.

Pause guard

If the legacy REIKA Blueprint plugin is active, REIKA Agent's Blueprint pauses automatically to prevent two updaters fighting over the same items. Deactivate the REIKA plugin to let REIKA Agent take over.

Catalog format (catalog.json)

Each item in the JSON array:

• type (required): "plugins", "themes", or "config".
• slug (required): Item slug (alphanumeric, dashes, dots, underscores).
• name (required): Human-readable name.
• version (required for plugins/themes): Semantic version (e.g., "1.0.0").
• main_file (required for plugins): Main plugin file (e.g., "acf.php").
• location (required): Relative path in the repo (must be .zip for plugins/themes).
• for (optional, config only): Which plugin this config is for.
• notes (optional): Import instructions.

Validation: Blueprint validates every item and skips invalid ones, showing warnings on the admin page.

AI agent abilities

When enabled, Blueprint exposes three abilities for AI agents:

• reika-agent/blueprint-list: List all items and config files.
• reika-agent/blueprint-install: Install a plugin or theme.
• reika-agent/blueprint-get-config: Fetch a config file for import.

Requires the Abilities API (WordPress 6.9+).

Install / update

Download the latest release zip and upload it in Plugins → Add New → Upload. After that, new GitHub releases show up in Dashboard → Updates like any other plugin (core Update URI mechanism).

AI agents (MCP)

The official WordPress MCP Adapter plugin lets AI agents (Claude, ChatGPT, Cursor…) discover and use WordPress' native capabilities over the Model Context Protocol. REIKA Agent includes a one-click button to download and activate the adapter from its official GitHub releases.

How it works:

1. In Settings → REIKA Agent, the MCP Adapter section shows the current status.
2. Click Download & activate MCP Adapter to fetch and enable it.
3. The adapter is kept automatically updated from GitHub releases (disabled by default, toggle to enable).
4. AI clients sign in as a WordPress user with an Application Password.
5. Only abilities marked public are exposed, and WordPress permission checks apply.
6. The default MCP endpoint is {site}/wp-json/mcp/mcp-adapter-default-server.

No code is bundled. The MCP Adapter is downloaded from its official releases. Once it lands in the WordPress.org plugin directory, the core plugin updater takes over and the automation here is disabled.

Requires WordPress 6.9+ (the Abilities API). If WordPress core ships MCP built-in, the button disappears and nothing is installed.

Admin abilities: connect your own MCP server

Optional module (Features → "Let your AI assistant manage this site"). Adds abilities reika/option-get, reika/option-update, reika/plugin-install, reika/audit-log (manage_options; plugin install also needs install_plugins/activate_plugins). Any MCP server can use them, not only REIKA's: connect it under Admin abilities → Connected MCP servers with a name, its Ed25519 public key and, optionally, its IPs.

Every request to /wp-json/mcp/... or /wp-json/wp-abilities/... must be signed by one connected server:

The usual WordPress auth (Application Password) still applies. Mode Testing logs unsigned calls and lets them through; switch to Protected once the audit log shows your calls as ok.

Create a key pair and sign (Node 18+):

const { generateKeyPairSync, createHash, randomBytes, sign } = require('node:crypto');
const { publicKey, privateKey } = generateKeyPairSync('ed25519');
console.log('public key for WordPress:', publicKey.export({ format: 'der', type: 'spki' }).subarray(-32).toString('base64'));

function signedHeaders(body) {              // body = the exact JSON string you send
  const ts = String(Math.floor(Date.now() / 1000));
  const nonce = randomBytes(18).toString('base64url');
  const msg = `reika-v1\n${ts}\n${nonce}\n${createHash('sha256').update(body).digest('hex')}`;
  return { 'X-Reika-Ts': ts, 'X-Reika-Nonce': nonce, 'X-Reika-Sig': sign(null, Buffer.from(msg), privateKey).toString('base64') };
}

Keep the private key on your server only. A reference client is REIKA MCP's src/wpSign.ts (github.com/askreikaco/reika-mcp). Kill switch, rate limit, automatic backups of changed options and masking of secrets in outputs apply to every server.

Develop

• One feature per class in includes/; each reads its toggle from Reika_Agent_Settings::get() and adds nothing when off.
• Prefer configuring WordPress core or the existing plugin over shipping new front-end code.
• Release: bump Version in reika-agent.php, REIKA_AGENT_VERSION, Stable tag + changelog in readme.txt, then publish a GitHub release tagged vX.Y.Z with an attached reika-agent.zip (folder reika-agent/).

Planned: submission to the WordPress.org plugin directory (the GitHub updater is removed for that build).

Compatibility promise (zero-break updates)

Updates must never break a site. Every change follows these rules:

• Settings are forever. Option keys are never renamed or removed. New settings get a default, and saved settings are always merged over the defaults. Renames ship with an automatic migration that is safe to run many times.
• Hooks are forever. Public filters and actions (reika_agent_*) keep working. A replaced hook keeps calling the old one with a deprecation notice for at least one major version.
• Every feature is opt-in and isolated. Each module boots separately. An unexpected error in one is logged and the rest of the site keeps working.
• Updates check requirements. Update offers carry the release's own "Requires at least" and "Requires PHP", so WordPress refuses an update the site cannot run. WordPress also rolls back an automatic update that causes a fatal error.
• Third-party code updates carefully. The MCP Adapter auto-updates only for bug-fix releases (same major.minor). Bigger jumps wait for an admin.
• CI proves it. Every pull request is linted on PHP 7.4 and the newest PHP. It also upgrades the latest release to the new code on a real WordPress, on the oldest and newest supported versions, and checks that settings, pages, /llms.txt and the settings screen still work.
• Semantic versioning. Patch = fixes, minor = new opt-in features, major = only with a migration path. Nothing is removed without a deprecation period.