Title: Flavors Engine – MCP Server for Claude & ChatGPT, plus 151 Elementor Widgets & Theme Builder
Author: flavorswp
Published: September 16, 2026
Last modified: September 16, 2026
---
Search plugins
# Flavors Engine – MCP Server for Claude & ChatGPT, plus 151 Elementor Widgets & Theme Builder
By [flavorswp](https://profiles.wordpress.org/flavorswp/)
[Download](https://downloads.wordpress.org/plugin/flavors-engine.1.0.0.zip)
* [Details](https://wordpress.org/plugins/flavors-engine/#description)
* [Reviews](https://wordpress.org/plugins/flavors-engine/#reviews)
* [Installation](https://wordpress.org/plugins/flavors-engine/#installation)
* [Development](https://wordpress.org/plugins/flavors-engine/#developers)
[Support](https://wordpress.org/support/plugin/flavors-engine/)
## Description
Flavors Engine is two things in one plugin, and you can use either half on its own.
**A WordPress MCP server.** It turns your site into an MCP (Model Context Protocol)
server, so the AI client you already use – Claude, Cursor, Codex, Copilot and others–
can build in it directly instead of handing you code to paste. Pages, block-editor
content, menus, taxonomies, media, users, settings: one prompt from you becomes
hundreds of typed calls from the agent, each checked against your own WordPress
capabilities and the active safety profile before it runs. Built on the WordPress
Abilities API and the official MCP Adapter.
**An Elementor widget library.** 151 widgets and a full theme builder for headers,
footers, single templates and archives, with display conditions deciding where each
one applies. WooCommerce template types are included, so a store’s shop, product,
cart and checkout pages can be built as templates; the WooCommerce widgets that
fill them are part of Flavors Engine Pro.
**Elementor is not required.** The MCP server runs on any site – Bricks, Divi, Oxygen,
a block theme, or headless. If Elementor is not installed, the widget half simply
does not load and the plugin says so once, in a dismissible notice. Install Elementor
later and the widgets appear.
No AI model is bundled and none is needed on the server: your MCP client brings
its own model access, and every policy decision is enforced here, on your install.
#### What the MCP server can do
97 abilities on a fresh install, and 130 once Elementor is active. All grouped and
individually switchable:
* **Content** – list, search, read, create, update, trash, restore and delete posts,
pages and public custom post types. Creation is draft-first: a missing or malformed
status resolves to `draft` before any capability check, so nothing publishes
by accident.
* **Taxonomies** – discover taxonomies, read and write terms, assign them to content.
* **Media** – import from a URL, edit metadata and alt text, set and clear featured
images, attach and detach.
* **Comments** – read and moderate, with commenter email and IP withheld below `
moderate_comments`.
* **Menus** – create, rename, reorder, and assign to theme locations.
* **Revisions, Users, Site** – revision restore, privacy-minimised user reads,
an explicit settings allowlist.
* **Plugins and themes** – search the WordPress.org directory, activate, deactivate,
update and switch, each with an explicit confirmation flag.
* **Gutenberg** – block-editor content through staged pending changes and browser
finalization, because core blocks are validated by the editor’s own JavaScript
and cannot be written headlessly.
* **Design library, Skills, Changes, Diagnostics** – typed design tokens, reusable
skills that also register as MCP prompts, a redacted change ledger with rollback,
and scoped health checks.
#### Safety
Three profiles: **Read Only** blocks every state change. **Production Safe** (the
default) allows normal content, design and commerce work and blocks raw PHP, WP-
CLI, filesystem and database access. **Developer Full Access** enables the privileged
surfaces, and critical calls still require explicit confirmation.
On top of the profile, your WordPress capabilities still apply, individual abilities
can be switched off, writes are rate-limited per credential, and supported changes
are recorded in a change ledger you can roll back.
#### Authentication
OAuth 2.1 with PKCE, with every authorization listed under Connected Apps so it
can be revoked individually. Application Passwords as a fallback for clients that
cannot run a browser flow. Neither is a product licence: no activation key, entitlement
check or subscription service is involved.
#### The widget library
Headings, buttons, info boxes, tabs, accordions and toggles, galleries and sliders,
carousels, testimonials, team and pricing tables, counters, charts, post grids and
lists, navigation, social, and form stylers for Contact Form 7, Mailchimp, login
and search.
The theme builder is a header and footer builder as well as a template builder:
ten template types – header, footer, single, archive, search results, 404, popup,
loop item, template part and login – each with display conditions deciding where
it applies. None of them is reserved for a paid version.
#### What Flavors Engine Pro adds
Pro is a separate plugin from flavorswp.com. It does not unlock anything in this
download; everything here is already running.
* **Plugin-aware MCP abilities** for other builders and plugins – Bricks, Divi,
Oxygen, Breakdance, Beaver Builder, Etch, WPBakery, Spectra, Astra, GeneratePress,
WooCommerce, ACF, Pods, Metabox, JetEngine, Gravity Forms, Fluent Forms, WPForms,
Yoast, Rank Math and more.
* **Agent memory and an approval queue** – the agent remembers your conventions
between sessions, and changes can wait for your approval before they land.
* **Forms suite** – form builder, submission storage, conditional logic, SMTP and
payments.
* **WooCommerce widgets and modules** – product, cart, checkout and account widgets,
variation swatches, checkout field manager, abandoned cart and more.
* **Animation pack** – GSAP-powered scroll and text widgets, which cannot ship
here because the GreenSock licence is not GPL-compatible.
### External Services
This plugin contacts no external service on its own. Every service below is reached
only when you act: by pressing a button, by connecting an AI client, or by adding
a widget and entering your own API key for it. A default install, with nothing configured,
makes no outbound request at all.
**Google Fonts** – On the Design screen, when a saved design names a font your browser
does not have installed, the preview shows a note explaining that it is not displaying
the design’s real fonts, alongside a **Preview with Google Fonts** button. Pressing
that button loads a stylesheet from `https://fonts.googleapis.com` so the preview
can render the font. Nothing is requested until you press it, nothing is requested
on your site’s front end, and no data about your site or your visitors is sent –
the request contains the font name and, as with any browser request, your IP address
and user agent. Google’s terms: https://policies.google.com/terms – Google’s privacy
policy: https://policies.google.com/privacy
**The WordPress.org plugin directory** – The `search-extensions` and `get-extension`
abilities query `https://api.wordpress.org` for plugin and theme information, exactly
as your WordPress dashboard does. These run only when an AI client you have connected
calls them. WordPress.org’s privacy policy: https://wordpress.org/about/privacy/
**Openverse** – The `search-images` ability queries `https://api.openverse.org`
for openly licensed photographs, the same catalogue the block editor’s own openly-
licensed media search uses. It runs only when an AI client you have connected calls
it, the request contains only your search terms and filters, and no account or API
key is involved. The ability returns links; it does not download anything. A file
is only fetched and added to your Media Library if you then ask for `import-media-
url`, which downloads from whichever URL is passed to it. Openverse is a WordPress.
org project. Openverse terms of service: https://docs.openverse.org/terms_of_service.
html – Openverse privacy policy: https://openverse.org/privacy
The remaining services are reached only by widgets you place on a page, and only
after you enter your own API key or access token for them. None of them is contacted
on a default install, because without your credential the request is never made.
**Mailchimp** – The Mailchimp Form widget sends a subscription to `https://.
api.mailchimp.com` when a visitor submits the form, where `` is the data-centre
suffix of your own API key. This one sends visitor data: the email address the visitor
typed, and any merge fields your form collects, together with your API key. It runs
only on a form you added and configured with your key. Mailchimp’s terms: https://
mailchimp.com/legal/terms/ – Mailchimp’s privacy policy: https://mailchimp.com/legal/
privacy/
**YouTube Data API** – The YouTube TV widget and the YouTube mode of the Social
Feed widget request channel and video listings from `https://www.googleapis.com/
youtube/v3/`, using a Google API key you supply. The request contains your key and
the channel or playlist you configured. Responses are cached, and no visitor data
is sent. Google’s terms: https://policies.google.com/terms – Google’s privacy policy:
https://policies.google.com/privacy – YouTube API Services terms: https://developers.
google.com/youtube/terms/api-services-terms-of-service
**The YouTube player (loaded in the visitor’s browser)** – A page containing the
YouTube TV widget loads YouTube’s iframe player API from `https://www.youtube.com/
iframe_api` and embeds the player itself from youtube.com. This is the only script
this plugin loads from another domain, and it has to be: YouTube’s terms require
the player API to be served from their domain rather than bundled. It happens in
the visitor’s browser, on pages where you placed the widget, and it gives YouTube
the visitor’s IP address and user agent as any embed does – nothing is sent from
your server. Google’s terms: https://policies.google.com/terms – privacy policy:
https://policies.google.com/privacy – YouTube API Services terms: https://developers.
google.com/youtube/terms/api-services-terms-of-service
**Instagram** – The Instagram mode of the Social Feed widget requests your own recent
media from `https://graph.instagram.com`, using an Instagram access token you supply.
The request contains your token and a post count. Responses are cached, and no visitor
data is sent. Instagram’s terms: https://help.instagram.com/581066165581870 – Meta’s
privacy policy: https://privacycenter.instagram.com/policy
**OpenWeatherMap** – The plugin registers a weather proxy endpoint that requests
current conditions from `https://api.openweathermap.org` for a location you configure,
using an OpenWeatherMap API key you supply. The widget that uses it is part of Flavors
Engine Pro, so on this plugin alone the endpoint exists but nothing calls it; it
is listed here because the code ships. Responses are cached and no visitor data
is sent. OpenWeatherMap’s terms: https://openweathermap.org/terms – privacy policy:
https://openweather.co.uk/privacy-policy
**The AI client’s own domain, during sign-in (OAuth Client ID Metadata)** – When
an AI client connects and identifies itself with an https URL as its client id,
the plugin fetches that URL once to read the client’s metadata document (its name,
its redirect addresses), caches the result, and uses it to decide whether the sign-
in may proceed. The host contacted is therefore the client’s, not ours, and which
host that is depends on which client you connect. The request is a plain GET with
no body and no data about your site beyond the fact that it was made; redirects
are validated one hop at a time and private or loopback addresses are refused. Nothing
is fetched until you connect a client that uses this form of identifier. For Claude,
that host is claude.ai or claude.com – Anthropic’s terms: https://www.anthropic.
com/legal/consumer-terms – privacy policy: https://www.anthropic.com/legal/privacy
**Your own site (self-diagnostics, not an external service)** – The Troubleshoot
screen checks that the MCP endpoint, the OAuth discovery documents and the REST
API are reachable by requesting them from your own site’s address, and it sends
a handful of AI-client user agents at one of those addresses to detect a hosting
bot filter that would block real clients. Every one of these requests goes to your
own domain. They are listed here because they are outbound HTTP requests and a reader
auditing the code will see them; no third party is involved and no data leaves your
server.
**AI model providers** – This plugin bundles no AI model and contacts no model provider.
Your MCP client connects directly to your site and brings its own model access;
the plugin never sees a provider API key. The MCP endpoint is self-hosted and there
is no relay.
**AI client sign-in addresses (no request is made)** – The Connect screen shows
the sign-in address of the AI client you choose, and the OAuth flow lists that client’s
callback address as an allowed redirect target. For Claude those addresses are on
the claude.ai and claude.com domains; other clients have their own. These are destinations
your own browser is sent to when you press “connect”, and addresses the plugin checks
a returning request against. The plugin itself never opens a connection to any of
them, and no data is sent to them by the plugin. They are listed here only because
the addresses appear in the code and a reader should know why. Anthropic’s terms:
https://www.anthropic.com/legal/consumer-terms – privacy policy: https://www.anthropic.
com/legal/privacy
### Source Code
Everything in this plugin is readable source except the third-party libraries listed
below, and this section is where to find the source for each compressed file.
**This plugin’s own code.** All PHP is source. Under `assets/`, every minified file
ships beside the unminified file it was built from (`x.min.js` next to `x.js`),
and `SCRIPT_DEBUG` makes WordPress load the readable one. Nine scripts have no separate
minified twin because none was ever built: they were inherited as single-line files
with no build step, so they ship reformatted in place, and each carries a header
saying exactly that. Note that `assets/js/library/` is not exclusively third-party:`
aos`, `gradient-bg`, `shape-divider`, `tabs` and `list-actions` are this plugin’s
own code and each ships with its readable source beside the minified file.
**The chat interface.** `includes/assets/chat/index.js` is compiled from `src/chat/
index.tsx`, which ships inside this plugin. Build it with the `@wordpress/scripts`
toolchain that `package.json` declares:
```
npm install && npm run build:chat
```
**Third-party libraries.** Each is shipped in the minified form its own project
distributes. The readable source for every one is published by that project at the
address below, which is also where any modification should be taken from.
* **Slick Carousel** – MIT – https://github.com/kenwheeler/slick (carousel and
slider widgets)
* **Prism** – MIT – https://github.com/PrismJS/prism (code-highlight widget)
* `assets/js/library/table.min.js` is five libraries concatenated and minified,
all MIT, listed in the file’s own header and here:
- **DataTables** – https://github.com/DataTables/DataTables
- **DataTables Buttons** – https://github.com/DataTables/Buttons
- **JSZip** – https://github.com/Stuk/jszip
- **pdfmake** – https://github.com/bpampuch/pdfmake
- **jquery-csv** – https://github.com/typeiii/jquery-csv
* The Lottie animation widget ships three MIT libraries:
- **lottie-web** – https://github.com/airbnb/lottie-web
- **lottie-interactivity** – https://github.com/LottieFiles/lottie-interactivity
- **lottie-player** – https://github.com/LottieFiles/lottie-player
* **Jarallax** – MIT – https://github.com/nk-o/jarallax (the parallax background
extension; `assets/js/library/parallax-bg.min.js`)
* **Animate.css** 4.1.1 – MIT – https://github.com/animate-css/animate.css (entrance
animations)
* **AOS** (Animate On Scroll) – MIT – https://github.com/michalsnik/aos (scroll-
triggered animations; the bundled file is a reduced reimplementation, readable
as shipped)
Masonry and imagesLoaded are not bundled: the plugin uses the copies WordPress core
itself ships and registers. GreenSock (GSAP) is not bundled either – its licence
is not GPL-compatible, so the widgets that need it are not part of this plugin.
Server-side PHP dependencies are managed with Composer and declared in `composer.
json`; each carries its own LICENSE file inside `vendor/`.
## Screenshots
[⌊The MCP server dashboard - safety profile, connected clients, skills and the change
ledger at a glance.⌉⌊The MCP server dashboard - safety profile, connected clients,
skills and the change ledger at a glance.⌉[
The MCP server dashboard – safety profile, connected clients, skills and the change
ledger at a glance.
[⌊The widget catalogue - all 151 widgets, modules and extensions with per-item switches;
anything off is never registered.⌉⌊The widget catalogue - all 151 widgets, modules
and extensions with per-item switches; anything off is never registered.⌉[
The widget catalogue – all 151 widgets, modules and extensions with per-item switches;
anything off is never registered.
[⌊The Theme Builder - headers, footers and templates built in Elementor, with the
display rules that decide where each applies.⌉⌊The Theme Builder - headers, footers
and templates built in Elementor, with the display rules that decide where each
applies.⌉[
The Theme Builder – headers, footers and templates built in Elementor, with the
display rules that decide where each applies.
[⌊The Abilities screen - every typed operation exposed to AI agents, grouped by
provider, each individually switchable under the active safety profile.⌉⌊The Abilities
screen - every typed operation exposed to AI agents, grouped by provider, each individually
switchable under the active safety profile.⌉[
The Abilities screen – every typed operation exposed to AI agents, grouped by provider,
each individually switchable under the active safety profile.
## Installation
1. Install and activate Flavors Engine.
2. For the MCP server: open **Flavors Engine Connect**, leave **Production Safe**
selected, choose your AI client and follow the OAuth or Application Password route.
3. For the widgets: install Elementor 3.13 or newer, then open any page in the Elementor
editor.
The MCP endpoint is:
```
https://example.com/wp-json/mcp/flavors-engine
```
## FAQ
### Do I need Elementor?
No. The MCP server is fully functional without it. Elementor is only needed for
the widget library and theme builder.
### Do I need an API key or a subscription?
No. The plugin needs no activation key and talks to no licence service. Your MCP
client supplies its own model access.
### Is my content sent anywhere?
The MCP endpoint is self-hosted; there is no relay. Your AI client connects directly
to your site.
### Is anything locked behind an upgrade?
Nothing in this download is disabled or greyed out. Flavors Engine Pro is a separate
plugin that adds plugin-aware abilities for other page builders, WooCommerce, forms,
SEO and custom fields, along with an extra widget pack.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Flavors Engine – MCP Server for Claude & ChatGPT, plus 151 Elementor Widgets &
Theme Builder” is open source software. The following people have contributed to
this plugin.
Contributors
* [ flavorswp ](https://profiles.wordpress.org/flavorswp/)
[Translate “Flavors Engine – MCP Server for Claude & ChatGPT, plus 151 Elementor Widgets & Theme Builder” into your language.](https://translate.wordpress.org/projects/wp-plugins/flavors-engine)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/flavors-engine/), check
out the [SVN repository](https://plugins.svn.wordpress.org/flavors-engine/), or
subscribe to the [development log](https://plugins.trac.wordpress.org/log/flavors-engine/)
by [RSS](https://plugins.trac.wordpress.org/log/flavors-engine/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* First release of Flavors Engine, combining the MCP server and the Elementor widget
library into one plugin.
* Elementor is an optional dependency: the MCP server runs on sites that do not
have it.
* Theme builder with header, footer, single, archive, search, 404, popup, loop
item, template part and login templates, plus display conditions. Every non-WooCommerce
theme-builder widget ships free; the WooCommerce widgets are in Pro.
* Elementor content abilities are part of the free plugin: read and write a page’s
Elementor document, and add, edit or delete a single element, over MCP.
* One accent colour and one centred container across every admin screen.
## Meta
* Version **1.0.0**
* Last updated **21 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.9 or higher **
* Tested up to **7.1**
* PHP version ** 8.0 or higher **
* Tags
* [AI](https://wordpress.org/plugins/tags/ai/)[elementor](https://wordpress.org/plugins/tags/elementor/)
[header footer builder](https://wordpress.org/plugins/tags/header-footer-builder/)
[mcp](https://wordpress.org/plugins/tags/mcp/)[theme builder](https://wordpress.org/plugins/tags/theme-builder/)
* [Advanced View](https://wordpress.org/plugins/flavors-engine/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/flavors-engine/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/flavors-engine/reviews/)
## Contributors
* [ flavorswp ](https://profiles.wordpress.org/flavorswp/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/flavors-engine/)