AI Content & SEO Assistant

=== AI Content & SEO Assistant === Contributors: abedintech Tags: claude, chatgpt, ai-assistant, mcp, seo Requires at least: 6.0 Tested up to: 7.0 Requires PHP: 7.4 Stable tag: 4.0.1 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

Let Claude, ChatGPT, Grok, Copilot or Cursor safely edit your content, Elementor pages and SEO — with approvals, an audit log and one-click revoke.

== Description ==

AbedinTech MCP Connector turns your WordPress site into a Model Context Protocol (MCP) server, so the AI assistant you already use can read and update your site when you ask it to — over the officially supported OAuth flow, with a safety net designed for real production sites.

Claude, ChatGPT, Grok, GitHub Copilot, Cursor, Zed and Gemini CLI all connect natively; the Connect screen has step-by-step setup for each. Anything that cannot sign in — the xAI API, n8n, Zapier, a script of your own — gets a named connection token instead, scoped to exactly what you allow.

= One-click, secret-free connection =

No API keys to copy, no tokens in URLs. Paste your site's connector address into Claude once, click Connect, and approve the connection on your own site (a "Login with Google"-style consent screen, served by this plugin). Access tokens are short-lived, refresh tokens rotate automatically, everything is stored hashed, and you can revoke any connection with one click.

= What the AI can do (when you allow it) =

• Create, edit, and manage posts and pages
• Edit Elementor pages safely: view page structure, find & replace text (with preview), swap images, change element settings, clone pages as drafts, and undo the last edit — automatic backup before every change
• Update SEO meta (Yoast SEO or Rank Math): titles, descriptions, keywords
• Read Google Search Console & Analytics (GA4) — top queries, top pages, page movers (what slipped / what's rising), and traffic summaries — so the AI can decide what to fix from your real data, then fix it (read-only access to Google; you connect it once and can disconnect anytime)
• Import and search media
• Produce a site maintenance report (updates, comments, versions)
• Advanced: call any registered WordPress REST route as the connected user

= Built-in safety net =

• Approval queue — publishing, deleting, page-builder and admin-level changes wait for your approval in wp-admin (with an email notice)
• Permission scopes — decide whether connections may read, write content, manage media, or touch admin areas
• Read-only mode — one checkbox makes the whole connector look-but-don't-touch
• Audit log — every action recorded (client, tool, arguments, IP), exportable as CSV
• Rate limiting and an optional IP allowlist (Anthropic's published range pre-filled)
• Health checks that verify SSL, endpoint reachability, and security-plugin conflicts

= External services =

This plugin runs as an authenticated API endpoint on your own site that AI clients you explicitly authorize (e.g. claude.ai) connect to. It does not send your content anywhere on its own — every outbound request is triggered by you or by an authorized client, and each one is recorded in the Activity log. The services it can contact are:

1. Claude / MCP clients (claude.ai): the "Copy address & open Claude" button opens claude.ai in your browser; after you authorize a client it connects to your site's MCP endpoint to make the requests you approve. See Anthropic's terms and privacy policy at https://www.anthropic.com/legal.

2. QuickChart (quickchart.io): the optional create_chart tool sends the chart labels and numeric values you provide to QuickChart's public image API to render a chart PNG, which is then imported into your Media Library. No request is made to QuickChart unless the create_chart tool is used. QuickChart's terms and privacy information are at https://quickchart.io/.

3. Importing media from a URL: when an authorized client uses upload_media_from_url, your site fetches the URL you/it specify server-side (with SSRF protections) and stores the file locally. The destination is whatever URL was supplied.

4. Health check: your site calls its own URL to verify reachability.

Google Insights (optional, off until you set it up): if you connect it, the site talks to Google's OAuth and API endpoints (accounts.google.com, oauth2.googleapis.com, searchconsole.googleapis.com, analyticsdata.googleapis.com) using your own Google Cloud OAuth client, to READ Search Console and Analytics data you own. Access is read-only; the plugin never writes to your Google account. Only a refresh token is stored (encrypted) on your site, and you can disconnect at any time, which deletes it. Google's terms and privacy policy apply: https://policies.google.com/privacy

== Installation ==

1. Plugins → Add New → Upload Plugin → upload the .zip → Activate.
2. Open MCP Connector in the wp-admin menu.
3. Click Run health checks and fix anything marked ⚠️ (usually SSL).
4. Click Copy address & open Claude, then in Claude add a custom connector and paste the address. Leave the OAuth fields empty — registration is automatic.
5. Click Connect in Claude, then Approve on your site.
6. Tune the safety net under MCP Connector → Permissions.

== Frequently Asked Questions ==

= Which AI apps can connect? =

Any MCP-compatible client that supports remote servers with OAuth — including Claude (web, desktop, and mobile via custom connectors) and Claude Code.

= Does this work with free Claude accounts? =

Yes. Custom connectors are available on all claude.ai plans (Free allows one custom connector).

= Is my site data sent anywhere automatically? =

No. The plugin only responds to requests from clients you have explicitly authorized, and you can see every request in the Activity log.

= What if the AI tries something risky? =

With the approval safety net on (default), publishing, deleting, Elementor changes, and admin-level actions are held in a queue until you approve them in wp-admin. You get an email when something is waiting.

= Does it work with Elementor Free and Pro? =

Yes — the Elementor tools operate on standard Elementor page data and work with both. An automatic backup is taken before every AI edit, with an undo tool.

= What happens when I uninstall? =

Deleting the plugin removes its database tables (tokens, logs, approvals) and all settings. Connections stop working immediately.

= Does it support multisite? =

Yes. Network-activate it and every sub-site gets its own isolated connector — separate connections, approvals, audit log, and settings, with no data shared between sites. A Network Admin overview shows every site's status at a glance, and new sub-sites are set up automatically. You can also activate it on a single site as usual.

= Why are some REST/OAuth endpoints publicly reachable? (note for reviewers) =

The plugin implements the Model Context Protocol over OAuth 2.1, so a few endpoints must be reachable without a prior WordPress login, exactly as the specs require. The MCP endpoint uses permission_callback => __return_true because authentication (Bearer-token validation) happens inside the handler so it can return the RFC 9728 401 + WWW-Authenticate challenge that OAuth clients rely on for discovery — no data is served without a valid grant. The OAuth Dynamic Client Registration (RFC 7591) and token endpoints, and the two discovery documents (RFC 8414 / RFC 9728), are public by protocol design; each handler validates its own input. All content/admin actions additionally pass through WordPress capability checks, scope checks, and the owner approval queue, and every call runs as the WordPress user who authorized the connection. These design choices are documented inline in the code (see the REVIEWER NOTE comments in ai-content-seo-assistant.php and class-abedin-mcp-server.php).

== Screenshots ==

1. Connect Claude, ChatGPT, Grok, Copilot or Cursor — with setup steps for each
2. Skills: exactly what your assistant is told about your site, in full
3. Approvals queue — changes wait for you, described in plain language
4. The consent screen you approve on your own site
5. Decide what each assistant may do, per connection
6. A full audit trail of every change, with CSV export

== Changelog ==

Recent releases are summarised below. The complete history, in full, ships with the plugin as changelog.txt.

= 4.0.1 =

Corrections to 4.0.0, each with a test that fails without the fix.

Your assistant could be told an out-of-date version of your own approval settings for up to an hour after you changed them. The rules themselves were always enforced correctly; it was the description of them that lagged.

Sites built entirely from pages — which is most business sites — were wrongly told they had no published content. Length guidance was missing on Japanese, Chinese, Korean and Thai sites, and slightly wrong on French, Spanish and Polish.

Deleting the plugin now removes everything it created. Ten pieces of leftover data had accumulated over four releases.

= 4.0.0 — "Works with your AI, and knows your site" =

Connect ChatGPT, Grok, Copilot, Cursor and the rest. The Connect screen has step-by-step setup for eleven assistants, including the menu path inside each product. ChatGPT needed two read-only tools before it would accept any site at all; your site now offers them, and they only ever read published content.

Connection tokens, for the things that cannot sign in — the xAI API, n8n, Zapier, a script you wrote. Named, scoped to what you tick, acting as a user you choose, optionally expiring, and individually revocable. The old single all-or-nothing key still works but is now deprecated.

Skills: ten briefings covering writing, SEO, planning, design, development, accessibility and how approvals work here. They are written from your own site, so an assistant knows which SEO plugin you use, how long your posts run, what your headlines look like, and which of the changes it is about to propose will stop and wait for you. All switched on, nothing to configure, and every word readable on the new Skills screen. A skill is advice, never permission.

= 3.10.0 — "Approve it right here" =

Assistants that support it can put a link to a waiting approval in front of you, in the app you are already using. It requires you to be signed in to your own site, so an assistant can never use it to approve its own request. Bulk jobs — rewriting links across two hundred pages, alt text across a hundred images — now report progress instead of looking frozen.

= 3.9.0 — "Why won't it connect?" =

The Connection Doctor: a panel that reads your own connection history to find where attempts stop, with twenty-three findings naming what to change and, where the fix lives somewhere you cannot reach, a message you can forward to your host. It separates what it knows from what it suspects, and reports a check that could not run as exactly that rather than as a failure. Also fixes five causes of a connection breaking after it had been working.

= 3.8.0 — "Words a person can read" =

Plain English in place of database values, in your site's own timezone. Every action now has a sentence describing what it would do. Approvals became a review queue: what content is touched, a diff of what changes, bulk approve and deny, and a confirmation step in front of anything irreversible. Eight menu items became four groups. Accessibility: a label on every control, WCAG AA contrast, and wide tables that stack readably on a phone.

= 3.7.1 =

An audit found twelve places where what the plugin did and what it said it did had come apart. Nothing new is advertised here; several things that were already advertised are now true.

= 3.7.0 — "Permissions & policy" =

Per-connection permissions, a policy screen, per-tool rate limits, and a tool pack registry so add-ons can extend the connector.

= 3.6.1 =

Fail closed. Paths that could fall back to a permissive default when something went wrong now stop instead.

= 3.6.0 =

Surgical content editing, a Rank Math FAQ block manager, approval queue list and cancel, one-call data charts, and a white-label client report.

Older releases are in changelog.txt.

== Upgrade Notice ==

= 4.0.1 = Fixes three faults in 4.0.0: your assistant could be told out-of-date approval settings for up to an hour after you changed them; sites built only from pages were wrongly told they had no content; and length guidance was missing or wrong outside English. Recommended if you are on 4.0.0.

= 4.0.0 = Connect ChatGPT, Grok, Copilot and Cursor, with setup steps for each. Adds connection tokens for tools that cannot sign in: named, scoped and individually revocable. Adds Skills, ten briefings written from your own site so an assistant knows your conventions before it starts. No action needed.

= 3.10.0 = Assistants that support it can show you a link to a waiting approval without you leaving the conversation. It requires you to be signed in, so an assistant cannot approve its own request. Bulk jobs now report progress instead of looking frozen. No action needed.

= 3.9.0 = Adds the Connection Doctor: it reads your connection history to find where attempts stop and what to change, with a message you can forward to your host. Also fixes five causes of a connection breaking after it was working. No action needed on update.

= 3.6.0 = Adds surgical content editing (patch_content), a Rank Math FAQ block manager, approval-queue controls (list/cancel), one-call data charts, and a white-label client report. Remove and re-add your Claude connector once after updating so the new tools appear.

= 3.5.0 = Adds the v3.4 + v3.5 tool packs: GSC optimization suite, AI-crawler + llms.txt controls, JSON-LD schema, editorial calendar/scheduling, bulk alt-text, 301 redirects + a 404 log, and revision restore. Remove and re-add your Claude connector once after updating so the new tools appear.

= 3.3.0 =