GDS Assistant WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

AI chat assistant built into the WordPress admin. Talk to it in natural language to manage your site — create pages, edit content, run audits, handle translations, and more.

What it does

• Chat with AI in your admin — a floating chat widget on every admin page. Ask it to do things like "create a draft campaign page" or "find all pages with broken links" and it actually does them using your site's real data.
• Multiple AI providers — supports Claude (Anthropic), GPT (OpenAI), Gemini (Google), Mistral, Groq, xAI, and DeepSeek. Pick the model that fits the task — cheap and fast for quick queries, powerful for complex operations. Switch mid-conversation.
• Skills — save reusable prompts as skills (like macros). Create them through the chat or in WP Admin under Tools > AI Skills. Invoke with /skill-name. Each skill can have a preferred model — e.g. use a cheap model for lookups, a smart one for content creation.
• Conversation history — past chats are saved and searchable. Pick up where you left off. See how much each conversation cost.
• Cost tracking — live token count and estimated cost displayed as you chat. Price indicators ($-$$$$) next to each model so you know what you're spending.
• Works with your content — the assistant can list, create, update, and delete posts, pages, products, media, translations, forms, blocks, and more. It sees your actual site structure and uses real WordPress APIs.

Built on assistant-ui for the chat UI, WordPress 7 AI support and Connectors for availability/credential discovery, and the WordPress Abilities API for tool execution.

Requirements

• PHP >= 8.3
• WordPress >= 7.0
• generoi/gds-mcp (provides WordPress tools)
• At least one AI provider API key configured

Installation

composer install
npm install
npm run build
wp plugin activate gds-assistant

Configuration

Configure provider credentials through WordPress 7 Connectors where available. Legacy environment variables remain supported for the streaming chat providers.

Environment Variables

Set API keys for the providers you want to use, or configure matching WordPress connector credentials. The chat widget only loads if AI support is enabled and at least one provider is configured.

Provider API Keys

Each provider checks WordPress connector credentials first, then legacy env var names:

Other Settings

# Optional — override the default provider (first available is used otherwise)
GDS_ASSISTANT_DEFAULT_PROVIDER=anthropic

# Optional — default max output tokens (default: 4096)
GDS_ASSISTANT_MAX_TOKENS=4096

Example .env

# Anthropic (Claude) — primary provider. Prefer Settings > Connectors on WordPress 7.
GDS_ASSISTANT_ANTHROPIC_KEY=sk-ant-api03-...

# OpenAI — secondary provider
GDS_ASSISTANT_OPENAI_KEY=sk-proj-...

# Gemini — cheap option for quick queries
GDS_ASSISTANT_GEMINI_KEY=AIza...

Available Models

Models are grouped by provider in the chat widget dropdown. Only providers with configured API keys appear.

Filters

Architecture

LLM Providers

Three provider implementations ship out of the box:

• AnthropicProvider — Claude models with streaming + advisor tool support
• OpenAiCompatibleProvider — Covers OpenAI, Mistral, Groq, xAI, and DeepSeek (same API format, different base URLs)
• GeminiProvider — Google Gemini with function calling

The ProviderRegistry auto-discovers available providers from env vars and exposes them to the frontend model selector. Add custom providers via the gds-assistant/register_providers action.

Tool Bridge

Tools are sourced from WordPress Abilities API via AbilitiesToolProvider. The ToolProviderInterface allows registering additional tool sources. Hook into gds-assistant/register_tools to add providers.

Remote MCP servers

The assistant can pull in tools from external Model Context Protocol servers (e.g. Asana, Figma, in-house MCPs). Each configured server's tools appear in the tool list as mcp_{server}__{tool} and route through McpToolProvider.

Configuration — register servers via the gds-assistant/mcp_servers filter or the GDS_ASSISTANT_MCP_SERVERS env var (JSON, same shape):

add_filter('gds-assistant/mcp_servers', function ($servers) {
    $servers['asana'] = [
        'url'   => 'https://mcp.asana.com/sse',
        'label' => 'Asana',
        'auth'  => ['type' => 'oauth', 'scopes' => ['default']],
    ];

    $servers['internal'] = [
        'url'  => 'https://mcp.internal.example/mcp',
        'auth' => ['type' => 'bearer', 'env' => 'INTERNAL_MCP_TOKEN'],
    ];

    return $servers;
});

Supported auth modes:

OAuth connect flow:

1. Configure the server via filter/env
2. Go to AI Assistant → Settings — configured servers appear in the "MCP Servers" section
3. Click Connect → the plugin discovers the auth server (RFC 9728 / RFC 8414), registers a client if needed, and redirects you to the provider's authorize page
4. After you approve, the callback at /wp-json/gds-assistant/v1/mcp/{name}/callback exchanges the code for tokens and stores them. Tokens are refreshed transparently on 401.

Server names must match [a-z0-9_]+ (used in the tool-name namespace and callback URL).

Token scope:

• OAuth servers — tokens are per-user. Each admin connects their own upstream account (Asana, Figma, etc.) so tool calls act on behalf of whoever is chatting. Stored in user_meta with autoload off.
• Bearer servers — the token comes from config/env, so it's inherently site-wide. All admins share it.
• Server metadata (auth endpoints, DCR client_id/client_secret) is site-wide in wp_options — one registration per WP install, reused across users.

Encryption at rest: access_token, refresh_token, and any DCR-issued client_secret are encrypted with AES-256-GCM keyed from wp_salt('auth') (HKDF-SHA256). This is defense in depth, not a boundary — an attacker with DB access typically has wp-config.php too — but it stops casual DB dumps/backups/logs from leaking usable upstream-service tokens.

Streaming

The chat endpoint (POST /wp-json/gds-assistant/v1/chat) streams Server-Sent Events (SSE). The entire agentic loop runs server-side in a single SSE connection. No WebSockets required.

Storage

• Conversations: {prefix}_gds_assistant_conversations — messages, token usage, per-user
• Audit log: {prefix}_gds_assistant_audit_log — every tool execution with input/result
• Cleanup: Daily WP-Cron prunes old records based on gds-assistant/retention_days

Skills

Reusable prompt templates stored as a custom post type (assistant_skill). Invoke via /slug in the chat. Manage in WP Admin under Tools > AI Skills, or ask the assistant to create them.

Development

composer install
npm install
npm run build          # Production build
npm run start          # Watch mode
composer lint          # Check PHP code style
composer lint:fix      # Fix PHP code style
npm run lint           # Check JS/CSS code style
npm run lint:fix       # Fix JS/CSS code style

Testing

npx @wordpress/env start
composer test:wp-env
npx @wordpress/env stop

License

MIT