{"id":391273,"date":"2026-10-26T04:56:21","date_gmt":"2026-10-26T04:56:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/saadpilot-ai-connector\/"},"modified":"2026-10-26T04:55:53","modified_gmt":"2026-10-26T04:55:53","slug":"saadpilot-ai-connector","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/saadpilot-ai-connector\/","author":23588835,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"4.1.2","stable_tag":"4.1.2","tested":"7.1.3","requires":"6.4","requires_php":"8.0","requires_plugins":null,"header_name":"SaadPilot AI Connector","header_author":"SAAD","header_description":"Connect AI assistants to WordPress through a private, self-hosted MCP endpoint with OAuth and safety controls.","assets_banners_color":"","last_updated":"2026-10-26 04:55:53","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/profiles.wordpress.org\/saadwaqar\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":50,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"4.1.2":{"tag":"4.1.2","author":"saadwaqar","date":"2026-10-26 04:55:53","revision":3765558}},"upgrade_notice":{"4.1.2":"<p>Reconnect AI clients after updating. This release intentionally reduces remote access to content, media and SEO.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["4.1.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[2353,529,242115,84,186],"plugin_category":[50,55],"plugin_contributors":[288562],"plugin_business_model":[],"class_list":["post-391273","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-content","plugin_tags-mcp","plugin_tags-media","plugin_tags-seo","plugin_category-media","plugin_category-seo-and-marketing","plugin_contributors-saadwaqar","plugin_committers-saadwaqar"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/saadpilot-ai-connector.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>SaadPilot AI Connector runs a Model Context Protocol (MCP) endpoint on your WordPress site. A local administrator approves each AI connection using OAuth authorization code flow with PKCE S256. The connection is limited to a fixed list of content tools and the approving user's existing content capabilities.<\/p>\n\n<p>Features:<\/p>\n\n<ul>\n<li>Create, read, update and schedule posts and pages; new content is forced to draft by default.<\/li>\n<li>List and create categories, upload JPEG\/PNG\/WebP\/GIF images and make optimized image copies.<\/li>\n<li>Edit allowlisted Yoast, Rank Math or generic SEO metadata.<\/li>\n<li>Review publish readiness, content calendars, internal links, broken links and duplicate content.<\/li>\n<li>Save up to ten bounded content snapshots in non-autoloaded WordPress database options.<\/li>\n<li>Emergency pause and disconnect controls in the local WordPress dashboard.<\/li>\n<li>OAuth scopes, resource binding, expiring access tokens, rotating refresh tokens and local rate protection.<\/li>\n<li>No vendor account, paid license, vendor quota, relay or telemetry.<\/li>\n<\/ul>\n\n<p>The remote tool catalog does not provide site settings, user management, plugin\/theme management, cron administration, arbitrary REST\/ability execution, source inspection, site-root documents or executable code management. Remote calls run with a request-local content capability ceiling; administrative and unfiltered-HTML capabilities are denied even when the approving user is an administrator or multisite super administrator. Local dashboard settings require manage_options and a WordPress nonce.<\/p>\n\n<h3>Privacy and external requests<\/h3>\n\n<p>There is no SaadPilot vendor service or telemetry. When you authorize an AI client, requested content is returned directly to that client and may be processed by its chosen AI provider. Review that provider's terms and privacy policy before connecting. OAuth records store the approving user ID, client name, registered callbacks, hashed tokens, scopes and expiration. Rate-protection transients contain salted identifiers.<\/p>\n\n<p>The broken-link checker makes limited HEAD\/GET requests to public links in the selected content only when invoked. These requests disclose your server's IP address to the destination. Media upload uses supplied bytes and the WordPress media APIs. The plugin does not download executable software.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate the plugin.<\/li>\n<li>Open Settings &gt; SaadPilot and copy the connector URL.<\/li>\n<li>Add the URL to a remote MCP client supporting OAuth dynamic client registration.<\/li>\n<li>Sign in to WordPress as an administrator and review the connection permissions.<\/li>\n<li>Approve the connection. Keep independent hosting backups.<\/li>\n<\/ol>\n\n<p>HTTPS is required for remote content calls.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"what%20changes%20after%20updating%20from%204.1.1%3F\"><h3>What changes after updating from 4.1.1?<\/h3><\/dt>\n<dd><p>The plugin revokes old OAuth clients and tokens and removes legacy HMAC credentials. Reconnect each AI client. Sensitive remote administration, background jobs, WooCommerce operations, menus, file inspection and site-document editing are removed from this edition. Refresh your client tool catalog.<\/p><\/dd>\n<dt id=\"does%20this%20grant%20full%20administrator%20access%3F\"><h3>Does this grant full administrator access?<\/h3><\/dt>\n<dd><p>No. Administrators approve the connection locally, but each remote tool is constrained to content capabilities and a fixed handler. Administrative capabilities, arbitrary routes, arbitrary callbacks and code execution are not exposed.<\/p><\/dd>\n<dt id=\"can%20it%20publish%20content%3F\"><h3>Can it publish content?<\/h3><\/dt>\n<dd><p>New content is forced to draft by default. The local administrator can change this setting. Publishing or scheduling also requires the approving user's appropriate post\/page publishing capability.<\/p><\/dd>\n<dt id=\"where%20are%20snapshots%20stored%3F\"><h3>Where are snapshots stored?<\/h3><\/dt>\n<dd><p>Snapshots are stored in the WordPress database, not downloadable PHP files. They cover posts\/pages and allowlisted SEO data, not the full website. The plugin keeps at most ten snapshots, each at most 8 MiB. Old 4.1.1 snapshot and document-backup files are not imported, executed, rewritten or deleted by this update; retain any needed recovery copies privately before manually removing old files.<\/p><\/dd>\n<dt id=\"what%20is%20removed%20on%20uninstall%3F\"><h3>What is removed on uninstall?<\/h3><\/dt>\n<dd><p>Plugin settings, clients, tokens, audit records, current database snapshots and legacy job\/approval option records are deleted. Existing WordPress content and media remain.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>4.1.2<\/h4>\n\n<ul>\n<li>Reduced remote tools to content, media, category and SEO operations.<\/li>\n<li>Removed alternate legacy REST\/HMAC paths and administrative tool modules.<\/li>\n<li>Added a request-local content permission ceiling, per-object checks and tool argument validation.<\/li>\n<li>Replaced executable snapshot\/backup storage with database content snapshots.<\/li>\n<li>Enqueued administration JavaScript and CSS through WordPress APIs.<\/li>\n<li>Invalidated existing credentials so the reduced permissions require a new connection.<\/li>\n<\/ul>","raw_excerpt":"Connect an administrator-approved AI client to content, media and SEO through WordPress-hosted OAuth and MCP.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/391273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=391273"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/saadwaqar"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=391273"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=391273"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=391273"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=391273"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=391273"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=391273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}