{"id":396319,"date":"2026-11-03T19:51:30","date_gmt":"2026-11-03T19:51:30","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/isto-intents-holder\/"},"modified":"2026-11-03T20:12:04","modified_gmt":"2026-11-03T20:12:04","slug":"isto-intents-holder","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/isto-intents-holder\/","author":23596685,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.6","stable_tag":"1.0.6","tested":"7.1.4","requires":"6.7","requires_php":"8.1","requires_plugins":null,"header_name":"Isto Intents Holder","header_author":"AutoIsto s. r. o.","header_description":"Lets AI assistants (ChatGPT, Claude and others) ask your listing site to keep looking for a car or a home for a person. The person confirms on your site with their own e-mail; you send the matching listings. Implements the Isto Intents consent-link interface.","assets_banners_color":"","last_updated":"2026-11-03 20:12:04","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/istointents.org\/wordpress\/","header_author_uri":"https:\/\/istointents.org\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":56,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.5":{"tag":"1.0.5","author":"autoisto","date":"2026-11-03 19:50:55","revision":3782536},"1.0.6":{"tag":"1.0.6","author":"autoisto","date":"2026-11-03 20:12:04","revision":3782554}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.5","1.0.6"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[2353,9983,4527,242115,2199],"plugin_category":[],"plugin_contributors":[290553],"plugin_business_model":[],"class_list":["post-396319","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-car-dealer","plugin_tags-classifieds","plugin_tags-mcp","plugin_tags-real-estate","plugin_contributors-autoisto","plugin_committers-autoisto"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/isto-intents-holder.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"\n

People increasingly ask an AI assistant \u2014 ChatGPT, Claude and others \u2014 to find them a used car or a flat. Isto Intents Holder<\/strong> lets such an assistant ask your<\/em> listing site to keep looking for that person, under an open interface (Isto Intents, consent-link profile).<\/p>\n\n

    \n
  1. The assistant sends your site the wish in the person's own words (\"estate car, petrol, up to 15 000 EUR\") \u2014 and nothing else: no name, e-mail or phone.<\/li>\n
  2. Your site answers with a link to its own confirmation page. The person enters their e-mail there, ticks the consent and confirms it from the e-mail (double opt-in).<\/li>\n
  3. Once an hour the plugin compares every confirmed wish with your newest listings and e-mails those that fit, each once, with a link to stop. The assistant can show the same listings, and every link leads to your listing page.<\/li>\n<\/ol>\n\n

    The person stays your visitor and your subscriber. Contact data is entered only on your site.<\/p>\n\n

    Features<\/strong><\/p>\n\n

      \n
    • MCP server (Streamable HTTP) with the four tools of the consent-link profile: intent_publish_intent<\/code>, intent_get_intent<\/code>, intent_list_matches<\/code>, intent_withdraw_intent<\/code>.<\/li>\n
    • Confirmation page (shortcode [isto_intents_consent]<\/code>, created on activation) with double opt-in; a link opened by a mail scanner confirms nothing.<\/li>\n
    • Holder descriptor at \/.well-known\/isto-intents.json<\/code>, so assistants and the Isto Intents Registry can find you by country and category.<\/li>\n
    • Matching against any post type, with an optional price field; replace it with your own search through the isto_intents_holder_find_matches<\/code> filter.<\/li>\n
    • No setup for the listings of Motors, Car Dealer (Potenza), Auto Listings, Houzez, RealHomes, WP Residence, WP Pro Real Estate 7, Estatik, Essential Real Estate and Easy Property Listings: the plugin recognises their post type, price and address fields, and the currency where the theme or plugin states one. Where they let a seller withhold the price, a withheld price is never passed on; where they mark a listing as sold, it is not sent.<\/li>\n
    • A private price limit is sealed the moment it arrives (libsodium secretbox, under a key of your site) and opened only in memory to filter your listings: it is never returned to the assistant, never shown on a page and never stored as a number.<\/li>\n
    • Limits per network, and a separate limit for the signed calls of the Isto Intents forwarder.<\/li>\n
    • Privacy tools: export and erasure of a person's wishes; the e-mail address is deleted as soon as a wish ends; deactivating the plugin ends every wish (nothing would run to stop or expire them); deleting the plugin deletes all its data.<\/li>\n
    • The confirmation page sends Referrer-Policy: no-referrer<\/code>, because its address carries a one-time token. Keep analytics and tracking scripts off that page: tools that record the full page address would record the token.<\/li>\n
    • E-mails through wp_mail()<\/code>, so your SMTP plugin applies.<\/li>\n
    • Translations: English, Slovak, Czech, German, Hungarian, Polish.<\/li>\n<\/ul>\n\n

      External services<\/h3>\n\n

      This plugin connects to the Isto Intents Registry<\/strong> at istointents.org, operated by AutoIsto s. r. o., and only when an administrator presses one of two buttons on Settings \u2192 Isto Intents<\/strong>:<\/p>\n\n

        \n
      • Check readiness<\/strong> sends your site's host name to https:\/\/istointents.org\/registry\/v0\/check<\/code>. The registry then reads your public descriptor and calls your public MCP server once with a test wish, which it withdraws at once.<\/li>\n
      • Submit to the registry<\/strong> sends your site's host name to https:\/\/istointents.org\/registry\/v0\/submit<\/code>. The registry lists your host and re-checks your public descriptor and MCP server about every six hours.<\/li>\n<\/ul>\n\n

        Nothing else is sent: no data about people, wishes, users or visitors. Registry terms: https:\/\/istointents.org\/registry\/terms\/ \u00b7 Privacy: https:\/\/istointents.com\/privacy\/<\/p>\n\n

        AI assistants and the Isto Intents forwarder (istointents.com) call your site's public MCP endpoint on their own; the plugin answers them but does not contact them. Forwarding terms: https:\/\/istointents.org\/forwarding\/terms\/<\/p>\n\n\n

          \n
        1. Upload the plugin and activate it. It creates its tables, a published confirmation page (kept out of the sitemap, noindex, empty without a link) and an hourly task. Nothing is published in the descriptor or the MCP server yet.<\/li>\n
        2. Go to Settings \u2192 Isto Intents<\/strong>: your name, a role contact address, country, categories, languages and the post type of your listings (and the price field, if you have one). With one of the themes or plugins named above, the post type and price are recognised and the settings page says so. Contact and country are required and never filled in for you; until you save them, the descriptor and the MCP server answer 404 and the settings page says what is missing.<\/li>\n
        3. Press Check readiness (with a trial run)<\/strong>, then Submit to the registry<\/strong>.<\/li>\n<\/ol>\n\n

          Requirements: HTTPS; for \/.well-known\/isto-intents.json<\/code> pretty permalinks and WordPress at the root of the domain (otherwise the settings page links the descriptor, which you save as a file).<\/p>\n\n\n

          \n

          Does the AI assistant get the person's e-mail?<\/h3><\/dt>\n

          No. The tools take no contact data and refuse any argument they do not declare. The person types the e-mail on your confirmation page.<\/p><\/dd>\n

          How does it decide which listings fit?<\/h3><\/dt>\n

          By default a listing fits when its title, text and categories contain enough words of the wish \u2014 all of them for one or two words, otherwise at least half \u2014 none of the words the wish rules out (\"without diesel\") and its price is within the stated limit. Listings that contain more of the words are sent first. Numbers it cannot place (a year, a mileage) are reported to the assistant as not understood. Developers replace the matching with the isto_intents_holder_find_matches<\/code> filter.<\/p><\/dd>\n

          How is the private price limit protected?<\/h3><\/dt>\n

          It is sealed on receipt with libsodium's secretbox (XSalsa20-Poly1305), which WordPress ships, and the database holds only the sealed value. The key is created on activation and stored apart from the settings, never autoloaded. To keep it out of the database altogether, put define( 'ISTO_INTENTS_HOLDER_SEAL_KEY', '<64 hex characters>' );<\/code> in wp-config.php before you activate the plugin: a copy of the database then opens no limit. Changing the key later makes the limits sealed before unreadable; those wishes are then not searched at all (nothing above a limit is ever sent), and the settings page says how many.<\/p><\/dd>\n

          Does the plugin contact any outside service?<\/h3><\/dt>\n

          Only when an administrator presses one of the two buttons on the settings page. See \"External services\" below.<\/p><\/dd>\n\n<\/dl>\n\n\n

          1.0.6<\/h4>\n\n
            \n
          • The package in the WordPress.org directory now contains the bundled PHP library (lib\/). Version 1.0.5 from the directory stopped with a fatal error on activation; the ZIP from istointents.org was not affected.<\/li>\n<\/ul>\n\n

            1.0.5<\/h4>\n\n
              \n
            • A private price limit is sealed on receipt, as the Isto Intents specification requires (\u00a74.2): the database holds only a sealed value (libsodium secretbox), and the number exists only in memory while your listings are filtered. Limits stored by earlier versions are sealed on the first request after the update, and their plain columns are dropped.<\/li>\n
            • The seal key is created once and stored apart from the settings, never autoloaded; or define ISTO_INTENTS_HOLDER_SEAL_KEY<\/code> in wp-config.php so that a copy of the database alone opens no limit. A wish whose limit can no longer be opened (because the key changed) is not searched, and the settings page says how many.<\/li>\n
            • The personal-data export still contains the limit, unsealed for that export only. Deleting the plugin deletes the seal key too.<\/li>\n<\/ul>\n\n

              1.0.4<\/h4>\n\n
                \n
              • The listings of ten widely used themes and plugins for car dealers and estate agencies are recognised without any setting: Motors, Car Dealer (Potenza), Auto Listings, Houzez, RealHomes, WP Residence, WP Pro Real Estate 7, Estatik, Essential Real Estate and Easy Property Listings. The plugin reads their post type, the price (the sale price where there is one), the address fields and the currency where they state one (an ISO code, or a sign that names one currency: \"$\" alone is not guessed); the settings page shows what was recognised, and a post type or price field you choose still wins.<\/li>\n
              • A price the seller withholds (WP Pro Real Estate 7, Estatik, Essential Real Estate, Easy Property Listings) is never read, so it is never e-mailed or returned to an assistant. Listings that Motors or Easy Property Listings mark as sold, let or withdrawn are not sent.<\/li>\n
              • The price-field help text says what an empty field now means.<\/li>\n<\/ul>\n\n

                1.0.3<\/h4>\n\n
                  \n
                • A private price limit is described truthfully: it is used only to filter your listings, never returned to the assistant and never shown on a page, and it is stored in your database (it is not encrypted, and the word \"sealed\" is gone).<\/li>\n
                • Deactivating the plugin ends every active wish and forgets drafts: after deactivation nothing would expire them or let people stop them.<\/li>\n
                • The confirmation page sends Referrer-Policy: no-referrer<\/code> and is left out of the core sitemap (wp-sitemap.xml).<\/li>\n
                • The personal-data export contains everything stored with the address (also the nice-to-have, the buy-by date, the private limit, when the wish was created and when consent was given); erasure deletes the wishes completely instead of keeping their text for another day.<\/li>\n
                • The MCP server refuses calls whose Origin header is another site (MCP Streamable HTTP requirement); assistants and the forwarder send none.<\/li>\n
                • The MCP server names itself isto-intents-holder<\/code> (with your site name as title and your address as websiteUrl) instead of a name built from the host, which read \"127.0.0.1.nip.io-intents\" on a local install.<\/li>\n
                • IPv6 addresses are limited per \/48 instead of \/64, and expired drafts and wishes are cleaned up at most once a minute instead of on every request.<\/li>\n
                • The confirmation e-mail no longer quotes the wish: it names your site and carries the link, and the wish itself is shown on the page the link opens. Whoever creates a draft can no longer put their own text into an e-mail sent from your domain.<\/li>\n
                • Confirmation e-mails are capped per address (3 a day) and in total (100 an hour), on top of the cap per network, so rotating networks cannot turn the confirmation page into a way to mail strangers.<\/li>\n
                • The plugin no longer prints any inline styles: the standalone HTML document (only for sites without WordPress) moved to its own class, which the plugin does not ship.<\/li>\n
                • Files are located with plugin_dir_path()<\/code> only; the fallback to the source repository's directory layout is gone.<\/li>\n<\/ul>\n\n

                  1.0.2<\/h4>\n\n
                    \n
                  • Nothing is published until the settings are saved: the descriptor and the MCP server answer 404 until a contact and a country are entered. The contact is no longer filled in with the administrator's e-mail, there is no default country, and the registry listing is opt-in.<\/li>\n
                  • The visitor address comes from REMOTE_ADDR, or from CF-Connecting-IP behind Cloudflare. X-Forwarded-For and X-Real-IP are no longer accepted (any caller can write them); a stored choice of either falls back to REMOTE_ADDR.<\/li>\n
                  • Matching: a listing needs all words of a one- or two-word wish, otherwise at least half of them, instead of every word; listings with more of the words are sent first. A word after \"not \/ without \/ bez \/ ohne \u2026\" excludes a listing instead of being required.<\/li>\n<\/ul>\n\n

                    1.0.1<\/h4>\n\n
                      \n
                    • Passes the WordPress.org Plugin Check: the plugin loads the library with its own autoloader and no longer ships the plain-PHP entry points (autoload.php, the PDO adapter, the front controller); translations load through WordPress itself, so WordPress 6.7 or newer is required.<\/li>\n<\/ul>\n\n

                      1.0.0<\/h4>\n\n
                        \n
                      • First release: consent-link profile 1.0 of Isto Intents.<\/li>\n<\/ul>","raw_excerpt":"Lets AI assistants ask your listing site to keep looking for a car or a home. The person confirms on your site; you e-mail the listings that fit.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/396319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=396319"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/autoisto"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=396319"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=396319"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=396319"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=396319"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=396319"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=396319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}