{"id":294968,"date":"2026-04-21T16:48:10","date_gmt":"2026-04-21T16:48:10","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/aicom-ai-commander\/"},"modified":"2026-10-21T19:19:11","modified_gmt":"2026-10-21T19:19:11","slug":"aicom","status":"publish","type":"plugin","link":"https:\/\/hy.wordpress.org\/plugins\/aicom\/","author":13647991,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"3.22.2","stable_tag":"3.23.1","tested":"7.1.3","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"AICOM - AI Commander","header_author":"dudaster","header_description":"Let AI agents control your site via MCP. API key auth, scope control, safety locks, audit logging and 87 tools for WP, WooCommerce, Elementor.","assets_banners_color":"16181d","last_updated":"2026-10-21 19:19:11","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/aicom\/","header_author_uri":"https:\/\/profiles.wordpress.org\/dudaster\/","rating":5,"author_block_rating":0,"active_installs":60,"downloads":4941,"num_ratings":1,"support_threads":1,"support_threads_resolved":1,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"dudaster","date":"2026-04-21 16:48:18","revision":3512072},"2.0.0":{"tag":"2.0.0","author":"dudaster","date":"2026-04-21 16:49:09","revision":3512073},"2.0.1":{"tag":"2.0.1","author":"dudaster","date":"2026-04-23 11:50:12","revision":3513781},"2.0.10":{"tag":"2.0.10","author":"dudaster","date":"2026-04-27 12:27:13","revision":3516450},"2.0.11":{"tag":"2.0.11","author":"dudaster","date":"2026-04-28 05:28:16","revision":3516981},"2.0.2":{"tag":"2.0.2","author":"dudaster","date":"2026-04-23 12:31:25","revision":3513809},"2.0.3":{"tag":"2.0.3","author":"dudaster","date":"2026-04-23 16:12:14","revision":3513995},"2.0.4":{"tag":"2.0.4","author":"dudaster","date":"2026-04-23 16:20:28","revision":3514006},"2.0.5":{"tag":"2.0.5","author":"dudaster","date":"2026-04-23 16:28:05","revision":3514013},"2.0.8":{"tag":"2.0.8","author":"dudaster","date":"2026-04-27 08:39:22","revision":3516215},"2.0.9":{"tag":"2.0.9","author":"dudaster","date":"2026-04-27 11:10:16","revision":3516352},"2.1.0":{"tag":"2.1.0","author":"dudaster","date":"2026-05-04 11:56:37","revision":3522321},"2.1.1":{"tag":"2.1.1","author":"dudaster","date":"2026-05-04 13:19:31","revision":3522404},"2.2.0":{"tag":"2.2.0","author":"dudaster","date":"2026-05-05 12:01:07","revision":3523309},"2.3.0":{"tag":"2.3.0","author":"dudaster","date":"2026-05-09 05:38:19","revision":3527017},"2.4.0":{"tag":"2.4.0","author":"dudaster","date":"2026-05-09 07:46:41","revision":3527066},"2.7.0":{"tag":"2.7.0","author":"dudaster","date":"2026-05-09 11:37:17","revision":3527176},"2.9.0":{"tag":"2.9.0","author":"dudaster","date":"2026-05-09 13:54:40","revision":3527237},"2.9.1":{"tag":"2.9.1","author":"dudaster","date":"2026-05-10 06:46:48","revision":3527597},"2.9.2":{"tag":"2.9.2","author":"dudaster","date":"2026-05-10 07:28:31","revision":3527613},"3.1.0":{"tag":"3.1.0","author":"dudaster","date":"2026-05-10 15:13:27","revision":3527853},"3.10.0":{"tag":"3.10.0","author":"dudaster","date":"2026-08-15 08:03:16","revision":3648279},"3.11.0":{"tag":"3.11.0","author":"dudaster","date":"2026-08-17 12:43:00","revision":3651157},"3.11.1":{"tag":"3.11.1","author":"dudaster","date":"2026-08-20 12:26:00","revision":3656822},"3.12.0":{"tag":"3.12.0","author":"dudaster","date":"2026-08-20 20:10:57","revision":3657740},"3.13.0":{"tag":"3.13.0","author":"dudaster","date":"2026-08-27 14:10:06","revision":3669021},"3.14.0":{"tag":"3.14.0","author":"dudaster","date":"2026-08-31 10:17:37","revision":3673860},"3.15.0":{"tag":"3.15.0","author":"dudaster","date":"2026-09-03 15:08:13","revision":3679948},"3.2.0":{"tag":"3.2.0","author":"dudaster","date":"2026-05-11 11:05:58","revision":3528600},"3.22.1":{"tag":"3.22.1","author":"dudaster","date":"2026-10-12 14:25:48","revision":3741863},"3.22.2":{"tag":"3.22.2","author":"dudaster","date":"2026-10-13 17:38:36","revision":3744566},"3.23.0":{"tag":"3.23.0","author":"dudaster","date":"2026-10-15 18:23:04","revision":3749120},"3.23.1":{"tag":"3.23.1","author":"dudaster","date":"2026-10-21 19:19:11","revision":3758959},"3.3.0":{"tag":"3.3.0","author":"dudaster","date":"2026-05-14 12:45:23","revision":3531992},"3.5.0":{"tag":"3.5.0","author":"dudaster","date":"2026-05-15 11:42:20","revision":3532952},"3.6.0":{"tag":"3.6.0","author":"dudaster","date":"2026-05-15 15:03:35","revision":3533131},"3.6.1":{"tag":"3.6.1","author":"dudaster","date":"2026-05-15 15:45:38","revision":3533181},"3.7.0":{"tag":"3.7.0","author":"dudaster","date":"2026-05-18 16:03:13","revision":3535947},"3.8.0":{"tag":"3.8.0","author":"dudaster","date":"2026-05-26 20:49:43","revision":3549774},"3.8.1":{"tag":"3.8.1","author":"dudaster","date":"2026-05-27 07:51:57","revision":3550250},"3.8.2":{"tag":"3.8.2","author":"dudaster","date":"2026-05-27 08:39:26","revision":3550321},"3.8.3":{"tag":"3.8.3","author":"dudaster","date":"2026-05-27 12:25:57","revision":3550638},"3.8.4":{"tag":"3.8.4","author":"dudaster","date":"2026-06-09 11:19:20","revision":3565885},"3.8.5":{"tag":"3.8.5","author":"dudaster","date":"2026-06-10 19:50:38","revision":3568013},"3.8.6":{"tag":"3.8.6","author":"dudaster","date":"2026-06-12 16:56:59","revision":3570340},"3.8.7":{"tag":"3.8.7","author":"dudaster","date":"2026-06-15 15:00:39","revision":3573325},"3.8.8":{"tag":"3.8.8","author":"dudaster","date":"2026-06-15 16:39:11","revision":3573449},"3.8.9":{"tag":"3.8.9","author":"dudaster","date":"2026-06-18 19:13:29","revision":3577746},"3.9.0":{"tag":"3.9.0","author":"dudaster","date":"2026-07-01 12:23:43","revision":3592665},"3.9.1":{"tag":"3.9.1","author":"dudaster","date":"2026-08-11 11:41:21","revision":3641885}},"upgrade_notice":{"2.0.0":"<p>Complete rewrite. After upgrading, re-generate all API keys \u2014 the key format has changed and old keys are not valid.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3535945,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3535945,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3535945,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3536705,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3536705,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","2.0.0","2.0.1","2.0.10","2.0.11","2.0.2","2.0.3","2.0.4","2.0.5","2.0.8","2.0.9","2.1.0","2.1.1","2.2.0","2.3.0","2.4.0","2.7.0","2.9.0","2.9.1","2.9.2","3.1.0","3.10.0","3.11.0","3.11.1","3.12.0","3.13.0","3.14.0","3.15.0","3.2.0","3.22.1","3.22.2","3.23.0","3.23.1","3.3.0","3.5.0","3.6.0","3.6.1","3.7.0","3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.8.7","3.8.8","3.8.9","3.9.0","3.9.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3550152,"resolution":"1","location":"assets","locale":"","width":1280,"height":800},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3550152,"resolution":"2","location":"assets","locale":"","width":1280,"height":800},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3550152,"resolution":"3","location":"assets","locale":"","width":1280,"height":800},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3550152,"resolution":"4","location":"assets","locale":"","width":1280,"height":800},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3550152,"resolution":"5","location":"assets","locale":"","width":1280,"height":800},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3550152,"resolution":"6","location":"assets","locale":"","width":1280,"height":800}},"screenshots":{"1":"<strong>Dashboard<\/strong> \u2014 Real-time server status, MCP endpoint URL, lock state indicator, today's request count broken down by result, and list of active modules.","2":"<strong>API Keys<\/strong> \u2014 Generate keys with granular scopes (read, write, manage per module), optional IP allowlist, expiry date, and scope presets. View all keys with last-used date and status.","3":"<strong>Audit Logs<\/strong> \u2014 Full request history grouped into named sessions, with a per-day activity chart colour-coded by tool class. Filter by date, key, tool, or session. One-click session restore.","4":"<strong>Safety Controls<\/strong> \u2014 Soft Lock, Hard Lock, and Working Hours Schedule. Set which days and hours agents are allowed to operate; outside those hours the site locks automatically. Includes the full Lock Permission Matrix.","5":"<strong>Modules<\/strong> \u2014 Overview cards for all active modules (WordPress Core, Media, Users, Backup, Sessions, Accessibility, Skills, WooCommerce, Elementor, Polylang, WPML, Yoast, SEOPress, Clautron) with status and registered tools.","6":"<strong>Backups<\/strong> \u2014 Overview of all post, term, and Elementor page snapshots created automatically before AI agent edits: total count, storage used, activity by period, and auto-cleanup status. The Sessions with Snapshots panel lists every session with a one-click <strong>Restore session<\/strong> button; the Backup Snapshots tab lists every individual snapshot with its session, tool class, and a one-click restore button."}},"plugin_section":[262246],"plugin_tags":[2353,232494,569,242115,23853],"plugin_category":[],"plugin_contributors":[82305],"plugin_business_model":[],"class_list":["post-294968","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-ai","plugin_tags-ai-agent","plugin_tags-automation","plugin_tags-mcp","plugin_tags-rest-api","plugin_contributors-dudaster","plugin_committers-dudaster","plugin_support_reps-dudasist"],"banners":{"banner":"https:\/\/ps.w.org\/aicom\/assets\/banner-772x250.png?rev=3536705","banner_2x":"https:\/\/ps.w.org\/aicom\/assets\/banner-1544x500.png?rev=3536705","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/aicom\/assets\/icon.svg?rev=3535945","icon":"https:\/\/ps.w.org\/aicom\/assets\/icon.svg?rev=3535945","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/aicom\/assets\/screenshot-1.png?rev=3550152","caption":"<strong>Dashboard<\/strong> \u2014 Real-time server status, MCP endpoint URL, lock state indicator, today's request count broken down by result, and list of active modules."},{"src":"https:\/\/ps.w.org\/aicom\/assets\/screenshot-2.png?rev=3550152","caption":"<strong>API Keys<\/strong> \u2014 Generate keys with granular scopes (read, write, manage per module), optional IP allowlist, expiry date, and scope presets. View all keys with last-used date and status."},{"src":"https:\/\/ps.w.org\/aicom\/assets\/screenshot-3.png?rev=3550152","caption":"<strong>Audit Logs<\/strong> \u2014 Full request history grouped into named sessions, with a per-day activity chart colour-coded by tool class. Filter by date, key, tool, or session. One-click session restore."},{"src":"https:\/\/ps.w.org\/aicom\/assets\/screenshot-4.png?rev=3550152","caption":"<strong>Safety Controls<\/strong> \u2014 Soft Lock, Hard Lock, and Working Hours Schedule. Set which days and hours agents are allowed to operate; outside those hours the site locks automatically. Includes the full Lock Permission Matrix."},{"src":"https:\/\/ps.w.org\/aicom\/assets\/screenshot-5.png?rev=3550152","caption":"<strong>Modules<\/strong> \u2014 Overview cards for all active modules (WordPress Core, Media, Users, Backup, Sessions, Accessibility, Skills, WooCommerce, Elementor, Polylang, WPML, Yoast, SEOPress, Clautron) with status and registered tools."},{"src":"https:\/\/ps.w.org\/aicom\/assets\/screenshot-6.png?rev=3550152","caption":"<strong>Backups<\/strong> \u2014 Overview of all post, term, and Elementor page snapshots created automatically before AI agent edits: total count, storage used, activity by period, and auto-cleanup status. The Sessions with Snapshots panel lists every session with a one-click <strong>Restore session<\/strong> button; the Backup Snapshots tab lists every individual snapshot with its session, tool class, and a one-click restore button."}],"raw_content":"<!--section=description-->\n<p><strong>AICOM - AI Commander<\/strong> connects your WordPress site to any AI agent via MCP (Model Context Protocol) or OpenAPI. Use your existing AI subscription \u2014 Claude Code, OpenAI Codex, ChatGPT Custom GPTs, Copilot Studio, Dify, n8n, OpenClaw, Celine, Goose, or any MCP-compatible client \u2014 to manage content, build pages, run audits, and automate repetitive tasks, all without leaving your AI interface.<\/p>\n\n<p>No more copy-pasting between your AI assistant and the WordPress dashboard. Describe what you want, and your agent does it \u2014 safely, with a full record of every action.<\/p>\n\n<h4>Content Management<\/h4>\n\n<p>Create, update, and publish posts, pages, and custom post types directly from your AI agent. Build and duplicate Elementor pages, manage menus, upload media, update taxonomies, translate content with Polylang or WPML, and handle bulk SEO fields \u2014 titles, meta descriptions, robots directives, social previews \u2014 with <strong>Yoast SEO or SEOPress<\/strong>, whichever is active on your site. All in a single conversation. What used to take hours of dashboard work can be delegated to your AI in minutes.<\/p>\n\n<h4>Safety You Control<\/h4>\n\n<p>AICOM puts you in charge at every level:<\/p>\n\n<ul>\n<li><strong>Scope-based API keys<\/strong> \u2014 each key grants access only to the operations you explicitly allow. One key for read-only content review, another for full publishing access.<\/li>\n<li><strong>Soft Lock \/ Hard Lock<\/strong> \u2014 freeze all write operations (Soft) or block everything except public tools (Hard) with one click from the admin bar or Safety page.<\/li>\n<li><strong>Working Hours Schedule<\/strong> \u2014 automatically apply Soft or Hard Lock outside your configured working hours and days. Agents can't make changes at night or on weekends unless you explicitly override it.<\/li>\n<li><strong>Dry-run mode<\/strong> \u2014 test any operation before it runs. See exactly what would change without touching live data.<\/li>\n<li><strong>Confirm flag<\/strong> \u2014 destructive operations require an explicit <code>\"confirm\": true<\/code> parameter. Accidental deletions are prevented by design.<\/li>\n<\/ul>\n\n<h4>Backup &amp; Restore<\/h4>\n\n<p>AICOM automatically snapshots a post, term, or Elementor page\/template right before your agent updates, trashes, deletes, or edits it \u2014 no extra step required, even if the agent never calls a backup tool itself. If something goes wrong, restore the exact previous version in one call, or undo an entire session at once: the Snapshots page lists every session that touched content, with a one-click <strong>Restore session<\/strong> button that reverts every post, term, and Elementor page it modified \u2014 including Elementor Theme Builder display conditions. Backups are stored in the database and can be cleaned up automatically based on age or total size.<\/p>\n\n<h4>Full Audit Trail<\/h4>\n\n<p>Every request is logged: timestamp, remote IP, API key label, tool used, parameters, result, and response time. Logs are grouped into <strong>named sessions<\/strong> \u2014 when an agent opens a session, all its actions are recorded together so you can review, replay, or undo an entire workflow at once. The Audit Logs page includes a session activity chart and a direct Restore button for each session.<\/p>\n\n<h4>Built for Reliable Automation<\/h4>\n\n<p>AICOM speaks strict MCP JSON-RPC: every successful call returns a <code>content<\/code> field for full client compatibility, protocol errors use standard integer codes, and errors from a tool that actually ran are reported as <code>isError<\/code> so your agent can see and react to them. Pass an <code>idempotency_key<\/code> on any write call and a retried request (dropped connection, flaky client) returns the original result instead of repeating the action \u2014 no duplicate posts from an accidental double-send. Responses are hardened against corrupted output, so your agent always gets valid JSON back.<\/p>\n\n<h4>Works Well With Small &amp; Local Models<\/h4>\n\n<p>Not every AI agent is Claude or GPT-4 class. AICOM is built to stay usable even for smaller, local, or context-constrained models:<\/p>\n\n<ul>\n<li><strong><code>tools\/search<\/code><\/strong> \u2014 keyword search over tool names and descriptions, tuned for models that don't know exact tool names: handles full-sentence queries (\"how do I add a photo to my page\"), common synonyms (shop \u2192 WooCommerce, translate \u2192 Polylang\/WPML), typo tolerance, and plurals.<\/li>\n<li><strong><code>tools\/describe<\/code><\/strong> \u2014 fetch one tool's full parameter schema by exact name, on demand \u2014 pairs with <code>tools\/search<\/code> so a model never has to load the entire tool catalog just to find what it needs.<\/li>\n<li><strong>Compact Tool List<\/strong> (per API key) \u2014 an optional setting that strips parameter descriptions from <code>tools\/list<\/code> to cut context size by roughly a third, while always keeping every parameter's name, type, and whether it's required \u2014 a model can still build a correct call without the extra explanatory text. Off by default; capable models see the full list as before.<\/li>\n<li><strong>Scoped discovery<\/strong> \u2014 <code>tools\/list<\/code> only ever shows the tools a key can actually call. A key without WooCommerce access never sees WooCommerce tools, so a smaller model isn't wading through options it's not allowed to use anyway.<\/li>\n<\/ul>\n\n<h4>Reusable Skills<\/h4>\n\n<p>Let your agent turn a workflow it just performed into a saved, reusable recipe. After finishing a session, AICOM can suggest saving what was done \u2014 the exact sequence of tool calls, rules, and expected inputs \u2014 as a named <strong>Skill<\/strong>. Next time a similar task comes up, the agent fetches the Skill and follows it, instead of re-figuring out the same multi-step process from scratch. Skills are versioned (every edit keeps a full revision history), matched by similarity before creating a duplicate, and scoped like any other capability \u2014 a key needs <code>manage.skills<\/code> to create or edit one.<\/p>\n\n<h4>Accessibility Audits \u2014 New in v3.2.0<\/h4>\n\n<p>AICOM now includes a dedicated <strong>Accessibility module<\/strong> so your AI agent can audit and fix WCAG issues across your entire site \u2014 no external tools or services required:<\/p>\n\n<ul>\n<li><strong>Site report<\/strong> \u2014 instantly see how many images are missing alt text across your entire media library, with a ranked preview of the top offenders and a percentage score.<\/li>\n<li><strong>Post audit<\/strong> \u2014 scan any post or page for heading hierarchy errors (missing H1, skipped heading levels), images without alt text, and links with non-descriptive anchor text (\"click here\", \"read more\"). Each issue is rated by severity and the post receives an overall accessibility score from 0 to 100.<\/li>\n<li><strong>Fix in place<\/strong> \u2014 set alt text on any media library image in one call. Pass an empty string to correctly mark it as decorative (<code>aria-hidden<\/code>). Full dry-run support so you can preview changes before saving.<\/li>\n<li><strong>Screenshot before &amp; after<\/strong> \u2014 combine AICOM's audit tools with your AI agent's browser capabilities to capture a visual record of the page before and after remediation.<\/li>\n<\/ul>\n\n<p>A typical AI-driven accessibility workflow: run the site report, get the list of problem images, let the agent analyse each image visually and write descriptive alt text, apply the fixes \u2014 then run the audit again to confirm the score improved. All in one session, with a full audit trail.<\/p>\n\n<h4>Supported Modules<\/h4>\n\n<ul>\n<li><strong>WordPress Core<\/strong> \u2014 posts, pages, custom post types, terms, meta, options, menus, plugins<\/li>\n<li><strong>Media<\/strong> \u2014 upload, update, delete media; direct file system access<\/li>\n<li><strong>Users &amp; Roles<\/strong> \u2014 create, update, manage users and role assignments<\/li>\n<li><strong>Backup<\/strong> \u2014 automatic snapshots for posts, terms, and Elementor pages\/templates before every write; session-wide restore<\/li>\n<li><strong>Sessions<\/strong> \u2014 named audit sessions with grouped action history<\/li>\n<li><strong>Accessibility<\/strong> \u2014 site-wide alt text audit, post-level WCAG check, alt text fixes<\/li>\n<li><strong>WooCommerce<\/strong> <em>(optional)<\/em> \u2014 products, categories, settings<\/li>\n<li><strong>Elementor<\/strong> <em>(optional)<\/em> \u2014 page creation from template, widget inspection, theme builder conditions<\/li>\n<li><strong>Polylang<\/strong> <em>(optional)<\/em> \u2014 translations, language assignment, string management, and one-call bilingual post pair creation<\/li>\n<li><strong>WPML<\/strong> <em>(optional)<\/em> \u2014 translation language assignment and translation-group linking for posts and taxonomy terms<\/li>\n<li><strong>Yoast SEO<\/strong> <em>(optional)<\/em> \u2014 read and write SEO titles, meta descriptions, Open Graph and Twitter card fields; bulk audit across all posts in one session<\/li>\n<li><strong>SEOPress<\/strong> <em>(optional)<\/em> \u2014 read and write SEO titles, meta descriptions, robots directives, canonical URLs, Open Graph and Twitter card fields; bulk audit across all posts in one session<\/li>\n<li><strong>Skills<\/strong> <em>(optional)<\/em> \u2014 save, version, and run reusable multi-step workflows<\/li>\n<li><strong>Clautron<\/strong> <em>(optional)<\/em> \u2014 capability catalog with a machine-readable manifest per capability (version, requirements, scopes, effects, reversibility), install\/update\/inspect\/deactivate lifecycle, blueprint management, primitive verification, event analytics<\/li>\n<li><strong>ECS<\/strong> <em>(optional)<\/em> \u2014 Ele Custom Skin color schemes, font schemes, custom looks<\/li>\n<\/ul>\n\n<h4>Who is this for?<\/h4>\n\n<ul>\n<li><strong>Content teams<\/strong> using Claude, ChatGPT, or any AI assistant who want it to publish and update WordPress content directly<\/li>\n<li><strong>Agencies<\/strong> managing multiple client sites and wanting AI-assisted workflows with a full paper trail<\/li>\n<li><strong>Developers<\/strong> building AI-powered WordPress tools or automation pipelines<\/li>\n<li><strong>Accessibility specialists<\/strong> who want to audit and remediate WCAG issues at scale with AI assistance<\/li>\n<li><strong>Claude Code users<\/strong> \u2014 point AICOM as an MCP server from your terminal and control WordPress alongside your code<\/li>\n<li><strong>OpenAI Codex users<\/strong> \u2014 connect Codex to your site via AICOM's MCP endpoint and let it manage content as part of your dev workflow<\/li>\n<li><strong>ChatGPT, Copilot Studio, Dify, n8n users<\/strong> \u2014 import the OpenAPI schema URL into any OpenAPI-compatible client; all tools are discovered automatically with Bearer auth<\/li>\n<li><strong>OpenClaw \/ Celine \/ Goose users<\/strong> \u2014 native MCP connector, works out of the box<\/li>\n<\/ul>\n\n<h4>How it works<\/h4>\n\n<p>AICOM exposes a secure HTTP endpoint on your WordPress site. Your AI agent sends structured MCP requests, AICOM authenticates the request, checks scopes and lock state, executes the operation, logs it, and returns a structured response.<\/p>\n\n<pre><code>AI Agent \u2192 AICOM Endpoint \u2192 WordPress\n<\/code><\/pre>\n\n<h4>API Key Scopes<\/h4>\n\n<p>Each API key is granted specific scopes \u2014 you control exactly what each AI agent can and cannot do. Dozens of granular scopes are available, grouped by area:<\/p>\n\n<pre><code>read.wp, `write.wp.posts`, `delete.wp.posts`, `manage.taxonomies`, `manage.meta`, `manage.media`, `manage.files`, `manage.wordpress.settings`, `manage.plugins`, `manage.backups`, `manage.a11y`, `manage.users`, `manage.roles`, `manage.skills`, plus one `read.*`\/`manage.*` pair per optional integration (WooCommerce, Elementor, Polylang, WPML, Yoast, SEOPress, Clautron). Built-in presets (Content Assistant, Translator, SEO Editor, Site Maintenance, Full Admin, and more) bundle the right scopes for a common role in one click \u2014 see the full list and descriptions on the **API Keys** page.\n<\/code><\/pre>\n\n<h4>Endpoint<\/h4>\n\n<p><strong>REST API:<\/strong>\n    POST \/wp-json\/aicom\/v1\/mcp<\/p>\n\n<p><strong>Fallback<\/strong> (no mod_rewrite required):\n    POST \/?aicom=1<\/p>\n\n<p><strong>Health check:<\/strong>\n    GET \/?aicom=1<\/p>\n\n<h4>Authentication<\/h4>\n\n<pre><code>Authorization: Bearer aicom_XXXXXXXX_&lt;secret&gt;\n<\/code><\/pre>\n\n<p>or:<\/p>\n\n<pre><code>X-API-Key: aicom_XXXXXXXX_&lt;secret&gt;\n<\/code><\/pre>\n\n<h4>MCP Request Example<\/h4>\n\n<pre><code>{\"jsonrpc\":\"2.0\",\"method\":\"tools\/call\",\"params\":{\"name\":\"wp.posts.list\",\"arguments\":{\"post_type\":\"post\",\"posts_per_page\":10}},\"id\":1}\n<\/code><\/pre>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>aicom<\/code> folder to <code>\/wp-content\/plugins\/<\/code> or install directly from <strong>Plugins \u2192 Add New<\/strong> by searching for \"AICOM\"<\/li>\n<li>Activate the plugin via <strong>Plugins \u2192 Installed Plugins<\/strong><\/li>\n<li>Go to <strong>AICOM \u2192 API Keys<\/strong> and click <strong>Generate New Key<\/strong><\/li>\n<li>Give the key a label (e.g. \"OpenClaw agent\") and select the scopes you want to grant<\/li>\n<li>Copy the key immediately \u2014 it will not be shown again<\/li>\n<li>Point your AI agent or MCP client to <code>https:\/\/yoursite.com\/wp-json\/aicom\/v1\/mcp<\/code><\/li>\n<li>Pass the key as <code>Authorization: Bearer &lt;your-key&gt;<\/code> in every request<\/li>\n<\/ol>\n\n<p><strong>Apache note:<\/strong> If the Authorization header is stripped by your server, add this line to <code>.htaccess<\/code>:<\/p>\n\n<pre><code>SetEnvIf Authorization \"(.*)\" HTTP_AUTHORIZATION=$1\n<\/code><\/pre>\n\n<p><strong>Safety tip:<\/strong> Start with <strong>Soft Lock<\/strong> enabled to limit the agent to read-only operations, then unlock once you're confident in the integration.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20make%20my%20site%20publicly%20accessible%20to%20anyone%3F\"><h3>Does this plugin make my site publicly accessible to anyone?<\/h3><\/dt>\n<dd><p>No. Every request must include a valid API key. Keys are bcrypt-hashed in the database and scoped \u2014 each key only has access to the specific operations you explicitly grant it. Without a valid key, the endpoint returns 401 Unauthorized.<\/p><\/dd>\n<dt id=\"does%20it%20work%20without%20mod_rewrite%20or%20pretty%20permalinks%3F\"><h3>Does it work without mod_rewrite or pretty permalinks?<\/h3><\/dt>\n<dd><p>Yes. The fallback endpoint <code>\/?aicom=1<\/code> works on any server configuration, with or without pretty permalinks or Apache mod_rewrite.<\/p><\/dd>\n<dt id=\"is%20it%20compatible%20with%20woocommerce%2C%20elementor%2C%20polylang%2C%20wpml%2C%20yoast%2C%20and%20seopress%3F\"><h3>Is it compatible with WooCommerce, Elementor, Polylang, WPML, Yoast, and SEOPress?<\/h3><\/dt>\n<dd><p>Yes. Each plugin's tools are loaded automatically only if the corresponding plugin is active \u2014 and, for a key with the <strong>Compact Tool List<\/strong> setting on, only if the calling key actually has the scope to use them. If WooCommerce is not installed, no WooCommerce tools appear in the tool list or audit log. Polylang and WPML can't both be meaningfully active on the same install (they're alternative translation plugins), but AICOM detects whichever one you're running and exposes the matching tools automatically \u2014 same for Yoast vs. SEOPress.<\/p><\/dd>\n<dt id=\"can%20i%20restrict%20an%20ai%20agent%20to%20read-only%20access%3F\"><h3>Can I restrict an AI agent to read-only access?<\/h3><\/dt>\n<dd><p>Yes, in two ways: (1) assign only <code>read.wp<\/code> scopes to the API key, or (2) enable <strong>Soft Lock<\/strong> or <strong>Hard Lock<\/strong> mode from the Safety page \u2014 this blocks write and destructive operations site-wide regardless of key scopes.<\/p><\/dd>\n<dt id=\"what%20is%20the%20difference%20between%20soft%20lock%20and%20hard%20lock%3F\"><h3>What is the difference between Soft Lock and Hard Lock?<\/h3><\/dt>\n<dd><p><strong>Soft Lock<\/strong> permits <code>public<\/code>, <code>discovery<\/code> and <code>read<\/code> class tools only \u2014 agents can browse and read content but cannot write, delete or change settings. <strong>Hard Lock<\/strong> permits only <code>public<\/code> tools (like <code>server.status<\/code>) \u2014 the site is effectively frozen from an AI perspective. Hard Lock overrides Soft Lock.<\/p><\/dd>\n<dt id=\"can%20i%20test%20operations%20before%20they%20actually%20run%3F\"><h3>Can I test operations before they actually run?<\/h3><\/dt>\n<dd><p>Yes. Send <code>\"dry_run\": true<\/code> in your request parameters. The operation will be validated and simulated but no data will be changed. The audit log will record it as a dry run.<\/p><\/dd>\n<dt id=\"does%20my%20agent%20need%20to%20remember%20to%20back%20things%20up%20before%20making%20changes%3F\"><h3>Does my agent need to remember to back things up before making changes?<\/h3><\/dt>\n<dd><p>No. AICOM automatically snapshots a post, term, or Elementor page before your agent updates, trashes, deletes, or edits it \u2014 this happens at the plugin level regardless of what the agent does or forgets to do. You can restore any individual snapshot, or undo an entire session (every post, term, and Elementor page it touched) in one click from the Snapshots page.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20my%20ai%20agent%20sends%20the%20same%20write%20request%20twice%3F\"><h3>What happens if my AI agent sends the same write request twice?<\/h3><\/dt>\n<dd><p>Pass an <code>\"idempotency_key\"<\/code> in the request arguments. If AICOM sees the same key again \u2014 from a dropped connection, a retry, or a duplicate send \u2014 it returns the original result instead of repeating the action, so you never end up with two copies of the same post from one intended change.<\/p><\/dd>\n<dt id=\"does%20it%20log%20what%20ai%20agents%20do%3F\"><h3>Does it log what AI agents do?<\/h3><\/dt>\n<dd><p>Yes. Every request is logged to the audit log with timestamp, remote IP, API key label, tool name, parameters, result summary, and response duration. The log is accessible from <strong>AICOM \u2192 Audit Logs<\/strong> and can be filtered by date, key, or tool name.<\/p><\/dd>\n<dt id=\"what%20is%20mcp%20%28model%20context%20protocol%29%3F\"><h3>What is MCP (Model Context Protocol)?<\/h3><\/dt>\n<dd><p>MCP is an open standard created by Anthropic for connecting AI models to external tools and data sources. AICOM implements the MCP standard so any MCP-compatible AI client \u2014 Claude, OpenClaw, and others \u2014 can communicate with your WordPress site natively without custom integrations.<\/p><\/dd>\n<dt id=\"is%20this%20plugin%20free%3F\"><h3>Is this plugin free?<\/h3><\/dt>\n<dd><p>Yes, completely free and open source under the GPL-2.0-or-later license.<\/p><\/dd>\n<dt id=\"can%20i%20restrict%20which%20ip%20addresses%20can%20use%20an%20api%20key%3F\"><h3>Can I restrict which IP addresses can use an API key?<\/h3><\/dt>\n<dd><p>Yes. Each API key has an optional IP allowlist. If set, requests from any other IP will be rejected even if the key is valid.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>3.23.1<\/h4>\n\n<ul>\n<li>Fixed: <code>wp.cache.purge<\/code> now needs only <code>write.wp.posts<\/code> (not <code>manage.wordpress.settings<\/code>), so content-only API keys can call it, and it's reported to AICOMBase as reversible \u2014 it never touches content, so it no longer makes an otherwise-undoable session un-undoable just by having run. It also no longer flushes the shared object cache network-wide on a multisite install.<\/li>\n<li>Fixed: a rare stale read right after an Elementor widget update, seen on some multisite installs with a persistent object cache \u2014 the page read back its own old data for a few minutes before catching up. Elementor reads now bypass any cached post-meta entry and go straight to the database; saves also clear the full post-meta cache bucket afterward, not just the fields Elementor itself tracks.<\/li>\n<\/ul>\n\n<h4>3.23.0<\/h4>\n\n<ul>\n<li>New: <code>wp.cache.purge<\/code> tool \u2014 clears the site's caching plugin (LiteSpeed Cache, WP Fastest Cache, W3 Total Cache, WP Super Cache, WP Rocket, WP-Optimize, Autoptimize \u2014 whichever is active), via each plugin's own documented purge API. A no-op if none is active. Call it after a change a visitor would otherwise keep seeing a stale cached version of.<\/li>\n<li>New: \"Connect to AICOMBase\" is now offered earlier \u2014 one of Dudee's first three options (instead of only at the very end of his full tour), and its own button on the native WordPress dashboard widget (hidden once already connected).<\/li>\n<\/ul>\n\n<h4>3.22.2<\/h4>\n\n<ul>\n<li>Fixed: connecting to AICOMBase could fail with a generic \"Could not start the connection\" on hosts without the native <code>sodium<\/code> PHP extension (WordPress's pure-PHP sodium_compat fallback refuses to securely wipe a key from memory and throws, which crashed the request). The wipe is now best-effort instead of fatal.<\/li>\n<\/ul>\n\n<h4>3.22.1<\/h4>\n\n<ul>\n<li>Fixed: Dudee's guided tour now walks through each admin page's own sections (not just a one-line summary), circling the whole section and picking \"Next\" to actually move between pages and tabs \u2014 pages, tabs, and sections now all behave the same way, instead of some advancing in place and others requiring a manual click.<\/li>\n<li>Fixed: a tall section (e.g. a very long table) could push Dudee and his message on top of each other; the tour could also appear to \"reset\" on an admin page where tabs are separate links rather than in-page JS tabs (Snapshots) \u2014 both are now handled correctly.<\/li>\n<li>Fixed: his message panel is more transparent, so it blocks less of the page behind it, and if there's no room above a target it now tries beside him \u2014 left or right, whichever side has room, never on top of wp-admin's own menu, and never covering the very section he's circling \u2014 before falling back to stacking above or below; a cramped stack can no longer run his message off the bottom of the screen, and his pointing hand now aims around his own message instead of through it.<\/li>\n<\/ul>\n\n<h4>3.22.0<\/h4>\n\n<ul>\n<li>New: Dudee, a small guide on AICOM's own admin pages. He says hello once, offers a short tour of the AICOM menu, and on the AICOMBase page shows how to connect, step by step. He runs entirely in your browser and contacts no outside server; all he keeps is, per user, whether he said hello, how the tour went and whether you hid him. \"Don't show Dudee again\" hides him for good (Help brings him back). Only on AICOM pages, only for administrators. To turn him off for everyone: <code>define( 'AICOM_DUDEE', false );<\/code> in wp-config.php, or the <code>aicom_dudee_enabled<\/code> filter.<\/li>\n<li>Translations: Dudee speaks every language bundled with the plugin (de_DE, es_ES, fr_FR, nl_NL, pt_BR, pt_PT, ro_RO).<\/li>\n<\/ul>\n\n<h4>3.21.1<\/h4>\n\n<ul>\n<li>Fix: a false \"Credential anomaly\" (authorization replay) when AICOMBase woke the site several times in a row. The check-in lock wasn't atomic, so simultaneous check-ins processed the same command and the second one tripped the replay guard. The lock is now atomic, and each command is claimed by id before it runs \u2014 a command delivered twice runs once and is skipped quietly. A real replay (an already-used authorization on a different command) is still reported.<\/li>\n<\/ul>\n\n<h4>3.21.0<\/h4>\n\n<ul>\n<li>Image descriptions can now be undone: a11y.set_image_alt and media.update_meta take an automatic backup of the image (post + meta) before writing, so restoring the session puts the old alt text, title and caption back \u2014 and removes an alt text that didn't exist before. Both tools are now reported as reversible to AICOMBase.<\/li>\n<li>Session restore applies the same protection against serialized PHP objects in backed-up meta as single-backup restore.<\/li>\n<\/ul>\n\n<h4>3.20.0<\/h4>\n\n<ul>\n<li>AICOMBase connector: AICOM now does nothing for AICOMBase outside a session AICOMBase opened \u2014 every task an AI agent was given runs in one named, described AICOM session (all its backups together), exactly like agents connected directly. These sessions are listed in AICOM \u2192 Activity \u2192 Sessions with an \"AICOMBase\" badge, and can be closed or restored there; AICOMBase can also close or restore them (signed commands). Remote work without an open session is refused (NO_ACTIVE_SESSION). Database 5.0.<\/li>\n<\/ul>\n\n<h4>3.19.0<\/h4>\n\n<ul>\n<li>AICOMBase connector: the heartbeat now reports which scopes this site allows for AICOMBase-issued work (AICOMBase menu \u2192 allowed scopes), so AICOMBase can show unapproved scopes as unavailable when creating keys. Sends scope ids only \u2014 no content.<\/li>\n<\/ul>\n\n<h4>3.18.0<\/h4>\n\n<ul>\n<li>AICOMBase connector: a new signed \"wake\" ping so a remote task starts almost immediately instead of waiting for the next scheduled heartbeat (which, on a quiet site, depends on WP-Cron firing from real traffic and can lag several minutes). Uses the exact same authorization-token format and verifier as remote task execution \u2014 no new credentials, single-use like everything else. Purely a latency optimization: if it's never received, the normal heartbeat still delivers the same work, nothing about what runs or what's authorized changes.<\/li>\n<\/ul>\n\n<h4>3.17.0<\/h4>\n\n<ul>\n<li>New: optional AICOMBase connector (AICOMBase menu). Connect this site to AICOMBase to monitor it, view AICOM activity and run centrally authorized tasks. AICOM works exactly as before if you never connect, or if AICOMBase is unreachable.<\/li>\n<li>Identity: a per-site Ed25519 key pair is generated locally with libsodium; the private key is encrypted at rest and never leaves the site. Your WordPress admin password and AI API keys are never sent to AICOMBase. Pairing is confirmed by you in AICOMBase; the AICOMBase public key is pinned on the site.<\/li>\n<li>Signed heartbeat every minute (WP-Cron <code>aicom_minute<\/code>, plus a throttled admin fallback) with versions, health, lock state and a capability hash. No site content is transmitted.<\/li>\n<li>Capability inventory: AICOM's tools are grouped into capabilities (Content, Media, SEO, Commerce, Languages\u2026) with real scopes, risk, reversibility and input schemas, uploaded when AICOMBase asks or when the set of tools changes.<\/li>\n<li>Remote tasks are executed only after verifying a short-lived signed authorization (pinned key, audience, expiry, single-use nonce) AND your local policy: the requested scopes must be inside the \"Local policy for AICOMBase work\" list (critical scopes off by default). Violations are refused and reported as a <code>scope_rejected<\/code> security event. Locks and pause always win; tasks run under a fresh AICOM session with a short-lived internal key.<\/li>\n<li>Durable local event queue (DB schema 4.9) reports sessions, actions, security and lock events in batches; credential-shaped values are scrubbed before anything is sent.<\/li>\n<li>Internal inspections (privacy, security, technical, accessibility) return only the evidence an audit needs.<\/li>\n<li>Credential rotation with overlap, remote pause \/ soft lock \/ hard lock, and revoke (wipes the pairing) \u2014 all audited in the AICOM log.<\/li>\n<\/ul>\n\n<h4>3.16.0<\/h4>\n\n<ul>\n<li>New: Capability Contract for Clautron \u2014 3 new tools (<code>clautron.capability.inspect<\/code>, <code>clautron.capability.update<\/code>, <code>clautron.capability.deactivate<\/code>) on top of a machine-readable manifest per capability (version, platform\/version requirements, required scopes, declared effects, reversibility). Requirements and scopes are validated before Clautron ever compiles anything, independent of the tool's own static scope.<\/li>\n<li><code>clautron.capability.inspect<\/code> reports whether a capability is installed, its installed vs. available version, compatibility, and which lifecycle actions actually work right now (not just what the capability declares in principle).<\/li>\n<li><code>clautron.capability.update<\/code> re-syncs an installed capability to its manifest's current version in place, without creating a duplicate.<\/li>\n<li><code>clautron.capability.deactivate<\/code> stops a capability without touching any data it wrote while active \u2014 the response says so explicitly (<code>data_preserved<\/code>, <code>residual_effects<\/code>). Reinstalling afterward reactivates the same capability instead of creating a new one.<\/li>\n<li><code>clautron.blueprint.smoke_test<\/code> verification is no longer a fixed, hardcoded checklist \u2014 each Clautron primitive now declares its own check, and any primitive without one is reported explicitly instead of being silently skipped.<\/li>\n<\/ul>\n\n<h4>3.15.0<\/h4>\n\n<ul>\n<li>New: WPML module \u2014 11 tools for reading and writing WPML translation data (wpml.status, wpml.languages.list, wpml.post.get_language\/set_language\/get_translations\/link_translation\/unlink_translation, and the same 5 for wpml.term.*). Verified directly against WPML's own documented integration hooks. Requires WPML core (sitepress-multilingual-cms) with at least a second language configured. String Translation (site string translation) is a known gap, not yet included.<\/li>\n<li>The \"Translator\" API key preset, and a new \"SEO Editor\" preset, now detect which translation\/SEO plugin is actually active (Polylang and\/or WPML; Yoast and\/or SEOPress) and grant scopes for whatever's really installed, instead of assuming one specific plugin.<\/li>\n<\/ul>\n\n<h4>3.14.0<\/h4>\n\n<ul>\n<li>New: SEOPress module \u2014 9 tools for reading and writing SEOPress SEO meta (seopress.post.get\/set, seopress.post.social.get\/set, seopress.posts.bulk_get for audits, seopress.term.get\/set, seopress.site.get). Meta keys and value formats verified directly against SEOPress's own source. Requires SEOPress plugin (free or pro).<\/li>\n<li>New \"Translator\" API key preset with every scope a full Polylang translation workflow needs \u2014 posts, meta, taxonomies, media, and both Polylang scopes \u2014 deliberately excluding language creation (which isn't exposed as an AICOM capability at all).<\/li>\n<li>Every built-in API key preset now includes the ability to create and update Skills (<code>manage.skills<\/code>), so a key provisioned from any preset can save reusable workflows without a separate scope grant.<\/li>\n<li>Fixed a real bug: SEOPress tool calls failed with \"Required plugin not active\" despite the module being active \u2014 the router's dependency check was a hand-duplicated copy of the module-detector's active-plugin list that had drifted out of sync. Consolidated onto a single source of truth (<code>AICOM_Module_Detector::is_dependency_active()<\/code>), also removing an equivalent duplicate in <code>aicom.recipes<\/code>' module-gating (which had already silently drifted for the ecs_pro case) and the tool-class taxonomy literals scattered across the lock matrix and idempotency\/session gating.<\/li>\n<\/ul>\n\n<h4>3.13.0<\/h4>\n\n<ul>\n<li><strong>Critical fix<\/strong>: removed all PHP 8.0+ only syntax (<code>match<\/code> expressions, <code>str_contains<\/code>\/<code>str_starts_with<\/code>\/<code>str_ends_with<\/code>, a union return type) that had crept into the codebase despite the plugin declaring <code>Requires PHP: 7.4<\/code> \u2014 on real PHP 7.x hosting this caused a hard parse error on plugin load, taking down the entire site's admin. Verified clean with <code>php -l<\/code> under real PHP 7.4, not just a newer local environment. Reported by a user running on shared hosting; thank you.<\/li>\n<li>New tool <code>tools\/search<\/code>: keyword search over tool names\/descriptions, tuned for weak\/local models that don't know exact tool names \u2014 handles full-sentence queries, common synonyms (e.g. \"photo\" \u2192 featured image, \"shop\" \u2192 WooCommerce), typo tolerance, and plurals.<\/li>\n<li>New tool <code>tools\/describe<\/code>: fetch one tool's full definition by exact name \u2014 the on-demand counterpart to <code>tools\/search<\/code>, useful when you already know the name but not the parameters.<\/li>\n<li>New per-key setting <strong>Compact Tool List<\/strong> (API Keys \u2192 Create\/Edit): for small\/local models, <code>tools\/list<\/code> drops each parameter's description text to cut context size, while always keeping name\/type\/<code>required<\/code> for every tool (read and write alike) so a call can still be built correctly. Each tool's own top-level description (including worked examples) is never shortened. Off by default \u2014 capable models see the same full list as before.<\/li>\n<li>Fixed <code>skills.run<\/code> not delivering the skill's <code>steps<\/code>\/<code>rules<\/code>\/<code>input_schema<\/code>\/<code>permissions<\/code> to MCP clients that only read the <code>content<\/code> field (rather than the optional <code>structuredContent<\/code>, which isn't sent unless the client negotiates a newer protocol version) \u2014 the full workflow now always lands in <code>content<\/code> too.<\/li>\n<li>Hardened session enforcement: a write\/destructive\/admin_sensitive call sent immediately after <code>session.open<\/code> now retries the active-session check briefly instead of failing outright, and the resulting <code>NO_ACTIVE_SESSION<\/code> error (on the rare case it's still not visible) is now marked <code>retryable<\/code>.<\/li>\n<li>New <strong>IP Rate Limits<\/strong> section (Safety page): see every IP currently blocked by the failed-authentication rate limiter, with time remaining, and unban one on demand instead of waiting out the cooldown.<\/li>\n<li>Fixed the Audit Logs \"Today\"\/\"7 days\"\/\"30 days\"\/\"Year\" filters computing their date boundary in the site's local calendar day but comparing it against UTC-stored timestamps \u2014 on a site with a non-zero UTC offset this could silently return zero results for a period that actually had activity. Timestamps in the Audit Logs table are now also shown in a clearer <code>date \/ time<\/code> format.<\/li>\n<\/ul>\n\n<h4>3.12.0<\/h4>\n\n<ul>\n<li>Fixed a bug where <code>tools\/list<\/code> invoked as an ordinary tool call (rather than the standard <code>tools\/list<\/code> request) was missing the required <code>content<\/code> field, causing strict MCP clients to reject it.<\/li>\n<li><code>tools\/list<\/code> now only shows the tools an API key can actually call \u2014 a key without a given scope no longer sees (and can't waste a round-trip on) tools it would immediately get denied for. Every tool list is scoped to the calling key's real permissions.<\/li>\n<li>Errors rejected before a tool runs now include a <code>retryable<\/code> hint, so an agent can tell whether hammering the same call again could ever help, instead of assuming the server is unreachable.<\/li>\n<li>New tool <code>pll.create_bilingual_pair<\/code>: create a translated draft, set its language, link it to the source post, optionally assign a category and featured image, and verify every step \u2014 all in one call. Works from an existing source post, or from scratch (pass <code>source_language<\/code> + <code>source_post_title<\/code> to create both language versions in a single call, with no pre-existing post needed).<\/li>\n<li><code>dry_run<\/code> and <code>idempotency_key<\/code> are now documented directly in every eligible tool's schema, instead of being accepted but invisible \u2014 some strict MCP clients validate outgoing calls against the schema and would silently refuse to send an undocumented parameter.<\/li>\n<li><code>wp.posts.create<\/code> now reports <code>requested<\/code>\/<code>persisted<\/code>\/<code>verified<\/code> so you can see exactly what WordPress actually stored versus what was asked for (e.g. a duplicate slug getting a \"-2\" suffix). Extended the same pattern to <code>wp.posts.update<\/code>, <code>wp.terms.create<\/code>, <code>wp.terms.update<\/code>, <code>wp.meta.set<\/code>, and <code>wp.meta.set_many<\/code>.<\/li>\n<\/ul>\n\n<h4>3.11.1<\/h4>\n\n<ul>\n<li>Fixed a critical <code>tools\/list<\/code> compatibility bug: a tool with no parameters (e.g. <code>session.close<\/code>, <code>pll.languages.list<\/code>) serialized its empty schema as <code>[]<\/code> instead of <code>{}<\/code>. Strict MCP clients (Pydantic-based, including Hermes) reject the <em>entire<\/em> tool list over this single type mismatch, breaking tool discovery \u2014 and every tool call \u2014 completely. Reported and diagnosed with a full client-side validation log from a user; thank you.<\/li>\n<li>Removed a non-standard <code>class<\/code> field that was present on every tool in <code>tools\/list<\/code> since v3.8.8. It was never part of the MCP Tool schema and could trip the same kind of strict-client rejection; the same information is now exposed the spec-compliant way via <code>annotations<\/code> (<code>readOnlyHint<\/code>\/<code>destructiveHint<\/code>), only included when the negotiated protocol version supports it.<\/li>\n<li>Added automated regression tests that check the raw <code>tools\/list<\/code> response body for both issues, across both supported protocol versions, so a future change can't silently reintroduce either one.<\/li>\n<\/ul>\n\n<h4>3.11.0<\/h4>\n\n<ul>\n<li><code>wp.posts.update<\/code> and <code>wp.terms.update<\/code> no longer report <code>updated: true<\/code> when no actual field was supplied \u2014 they now return <code>updated: false<\/code> with a clear warning, and <code>changed_fields<\/code> listing exactly what changed when something did.<\/li>\n<li>Parameter aliasing extended (<code>slug<\/code>, <code>media_id<\/code>) and now reported back in the response as <code>_aliases_applied<\/code>, so you can see exactly what the plugin auto-corrected instead of it happening silently.<\/li>\n<li>Read-after-write verification added to the write paths where a silent mismatch is realistic: assigning\/removing post terms, attaching media\/setting a featured image, and every Polylang write tool (set language, link\/unlink translations, string translations). Each now re-reads the actual state and reports <code>requested<\/code>\/<code>persisted<\/code>\/<code>verified<\/code>, with a warning if they don't match \u2014 catches cases like WordPress re-assigning a default category, or Polylang silently rejecting a language change.<\/li>\n<li><code>session.open<\/code> now reports <code>available_scopes<\/code> and <code>missing_scopes<\/code> for the key, scoped to the site's active modules, so an agent can tell upfront whether it has what it needs for a task like a translation workflow \u2014 before it starts, not after hitting a scope error partway through.<\/li>\n<li>Polylang translation tools now include a full JSON example and the canonical 6-step workflow order (create draft, set language, link translations, assign translated category, set featured image, verify) directly in their tool descriptions.<\/li>\n<\/ul>\n\n<h4>3.10.0<\/h4>\n\n<ul>\n<li>Automatic pre-write snapshots: posts, terms, and Elementor pages\/templates now get a safety snapshot before every update, trash, delete, or field edit \u2014 automatically, even if the agent never calls a backup tool itself.<\/li>\n<li>New \"Sessions with Snapshots\" panel on the Snapshots page \u2014 restore every post, term, and Elementor page touched during a session back to its pre-session state with one click. Now also restores Elementor Theme Builder display conditions correctly.<\/li>\n<li>MCP responses now always include a <code>content<\/code> field on successful tool calls, for full compatibility with strict MCP clients.<\/li>\n<li>Clearer error handling: errors rejected before a tool runs (auth, scope, session, lock) use a standard JSON-RPC integer error code; errors from a tool that actually ran and failed are now reported as <code>isError<\/code> with a description, so agents can see and react to them directly.<\/li>\n<li>New opt-in <code>idempotency_key<\/code> argument on write\/destructive tools \u2014 pass the same key on a retried call and AICOM returns the original result instead of repeating the action (e.g. no duplicate post from a dropped connection and retry).<\/li>\n<li>MCP protocol version is now negotiated from the client's request instead of hardcoded, so responses match what each client actually supports.<\/li>\n<li>Hardened against corrupted responses: a stray notice from another active plugin, or an unexpected server error, can no longer produce a broken response \u2014 agents always get back valid JSON.<\/li>\n<li>Tested up to WordPress 7.1.<\/li>\n<\/ul>\n\n<h4>3.9.1<\/h4>\n\n<ul>\n<li>Renamed \"Connect AI Agents\" admin page\/menu to \"Manage API Keys\" for clarity.<\/li>\n<li>Sidenav footer now shows a red \"New version available\" notice with a link to the Plugins page when an update is available.<\/li>\n<li>Fixed <code>manage.polylang.settings<\/code> being unusable: it was required by <code>pll.term.set_language<\/code> and <code>pll.string.set<\/code> but was never registered as a grantable scope, so no API key \u2014 not even Full Admin \u2014 could hold it.<\/li>\n<li>Relabeled Polylang scopes for clarity: <code>manage.polylang<\/code> is now \"Manage Polylang Post translations\" and <code>manage.polylang.settings<\/code> is \"Manage Polylang Term &amp; String translations\", each with a tooltip explaining exactly what it does and does not allow.<\/li>\n<\/ul>\n\n<h4>3.9.0<\/h4>\n\n<ul>\n<li>Fixed OpenAPI schema compatibility with ChatGPT Custom GPT Actions: upgraded spec from 3.0.0 to 3.1.1, serialized empty parameter objects as <code>{}<\/code> instead of <code>[]<\/code>, and added <code>components.schemas<\/code> required by strict validators. Thanks allanantoni for the detailed report and fix.<\/li>\n<\/ul>\n\n<h4>3.8.9<\/h4>\n\n<ul>\n<li>JSON repair for malformed payloads from local AI models (literal control characters, trailing commas, UTF-8 BOM).<\/li>\n<li><code>rest_pre_dispatch<\/code> intercept bypasses WordPress JSON validation so weak models can connect without \"rest_invalid_json\" errors.<\/li>\n<li>New <code>session.status<\/code> tool \u2014 check whether a session is open before calling <code>session.open<\/code>, avoiding SESSION_ALREADY_OPEN errors.<\/li>\n<li><code>TOOL_NOT_FOUND<\/code> now includes fuzzy name suggestions (\"Did you mean: wp.posts.create?\") to guide models that hallucinate tool names.<\/li>\n<li>Educational parameter warnings: unknown parameter names are flagged with the correct name and a usage example; aliases (<code>status<\/code>, <code>content<\/code>, <code>post_id<\/code>) are resolved automatically with a hint.<\/li>\n<li>Truncated API key detection with character count in the error message.<\/li>\n<li>Split <code>manage.polylang<\/code> scope: post language assignment and translation linking remain under <code>manage.polylang<\/code>; string translations and term language\/linking now require the new <code>manage.polylang.settings<\/code> scope.<\/li>\n<\/ul>\n\n<h4>3.8.8<\/h4>\n\n<ul>\n<li>Full MCP <code>inputSchema<\/code> now returned in <code>tools\/list<\/code> \u2014 each tool includes parameter types, descriptions, and required flags so models can call tools correctly without prior knowledge.<\/li>\n<li>Compact tool list (name + class only) available via shorthand <code>tools<\/code> or <code>list_tools<\/code> method for small-context models.<\/li>\n<li>Detect <code>method:\"tools\/wp.posts.create\"<\/code> pattern and return a corrected JSON-RPC example.<\/li>\n<li>Explicit error when <code>tools\/call<\/code> is sent without a <code>name<\/code> field.<\/li>\n<\/ul>\n\n<h4>3.8.7<\/h4>\n\n<ul>\n<li>Server-side discoverability for weak local AI models: new <code>aicom.recipes<\/code> tool returns step-by-step task recipes filtered to the key's actual permissions and active modules.<\/li>\n<li>Compact <code>initialize<\/code> instructions \u2014 three exact steps with copy-paste JSON-RPC format.<\/li>\n<li><code>session.status<\/code> registered as a discovery tool (no session required, no scope required).<\/li>\n<\/ul>\n\n<h4>3.8.6<\/h4>\n\n<ul>\n<li>New read-only scopes for Polylang, WooCommerce, and Elementor \u2014 grant an agent the ability to inspect data from these integrations without giving it write access.<\/li>\n<li>The Connect AI Agents form shows a small \"included automatically\" note under each read scope when its matching manage scope is ticked, so the implication is visible.<\/li>\n<\/ul>\n\n<h4>3.8.5<\/h4>\n\n<ul>\n<li>Fixed audit log table missing <code>session_id<\/code> column on fresh installs \u2014 every request was failing the INSERT silently, leaving the Activity tab empty. The fix repairs existing installs automatically on update.<\/li>\n<li>New AICOM-Only Mode (Safety page, default off) \u2014 blocks Application Passwords, XML-RPC, and unsigned REST writes so AI agents can only modify the site through AICOM. Recommended at onboarding.<\/li>\n<\/ul>\n\n<h4>3.8.4<\/h4>\n\n<ul>\n<li>MCP standard handshake \u2014 <code>initialize<\/code>, <code>notifications\/initialized<\/code>, and <code>ping<\/code> now return spec-compliant responses, so strict MCP clients can connect.<\/li>\n<li>Onboarding wizard pre-selects a new General option marked Recommended \u2014 works with any MCP-aware agent without per-client config.<\/li>\n<li>Clearer error message when a write is attempted without an active session.<\/li>\n<\/ul>\n\n<h4>3.8.3<\/h4>\n\n<ul>\n<li>New General tab in the Key Created modal \u2014 paste-ready snippet that explains the endpoint, fallback, and the browser-header workaround for 401s.<\/li>\n<li>New Discard key button next to Done \u2014 revoke a freshly-created key in one click if you change your mind.<\/li>\n<li>Translation polish across all 7 bundled locales.<\/li>\n<\/ul>\n\n<h4>3.8.2<\/h4>\n\n<ul>\n<li>Translations bundled for Dutch, German, French, Spanish, Portuguese (Portugal &amp; Brazil), and Romanian \u2014 628 strings each, informal address throughout.<\/li>\n<\/ul>\n\n<h4>3.8.1<\/h4>\n\n<ul>\n<li>Fixed an onboarding CSS rule that cropped the WordPress admin under the top toolbar on every page.<\/li>\n<\/ul>\n\n<h4>3.8.0<\/h4>\n\n<p><strong>New<\/strong><\/p>\n\n<ul>\n<li>First-run onboarding wizard.<\/li>\n<li>Interactive Help page with per-client setup snippets.<\/li>\n<li>WordPress dashboard widget.<\/li>\n<li>Per-key Working Hours.<\/li>\n<li>Task-oriented quick start cards on the dashboard.<\/li>\n<\/ul>\n\n<p><strong>Polish<\/strong><\/p>\n\n<ul>\n<li>Renamed pages, client picker + Test Connection in the Key Created modal, classic pagination on Activity logs, glossary tooltips, and many smaller refinements throughout.<\/li>\n<\/ul>\n\n<h4>3.7.0<\/h4>\n\n<p><strong>Brand refresh<\/strong><\/p>\n\n<ul>\n<li>New visual identity: lowercase <strong>a<\/strong>i<strong>com<\/strong> wordmark, ink + cream + coral palette.<\/li>\n<li>New plugin icon (animated SVG) and updated WordPress.org banner.<\/li>\n<li>Refined admin UI: warmer surfaces, accent only where it matters, monochrome menu icon that follows your admin color scheme.<\/li>\n<\/ul>\n\n<p><strong>Compatibility<\/strong><\/p>\n\n<ul>\n<li>Tested with WordPress 7.0.<\/li>\n<\/ul>\n\n<h4>3.6.1<\/h4>\n\n<p><strong>Security<\/strong><\/p>\n\n<ul>\n<li>Fixed security issues.<\/li>\n<\/ul>\n\n<h4>3.6.0<\/h4>\n\n<p><strong>Security<\/strong><\/p>\n\n<ul>\n<li>Fixed security issues.<\/li>\n<\/ul>\n\n<h4>3.5.0<\/h4>\n\n<ul>\n<li>New: JSON-RPC 2.0 batch support \u2014 send multiple tool calls in a single request as a top-level JSON array; each item is dispatched independently and responses are returned as an array. Notifications (items without id) are processed but excluded from the response per spec.<\/li>\n<li>New: Skills detail view \u2014 click Details in the action menu to see a full readable breakdown of a skill (input schema, steps, rules, tags, permissions) with an Export JSON button.<\/li>\n<li>New: Skills import \u2014 paste a skill JSON definition directly in the admin UI to create a draft skill without calling the MCP API.<\/li>\n<li>New: Skills archive &amp; restore \u2014 archived skills are now visible in the list with Restore and Delete actions.<\/li>\n<li>Improvement: Audit Logs \u2014 merged the separate Logs and Filters tabs into a single Logs tab; the filter form is always visible at the top.<\/li>\n<li>Improvement: API Keys \u2014 preset action icons (rename \u270f, duplicate \u2750, delete \u2715) are now grouped horizontally with CSS tooltips on hover.<\/li>\n<\/ul>\n\n<h4>3.4.0<\/h4>\n\n<ul>\n<li>New: Skills \u2014 define reusable AI procedures (steps, rules, input schema, permissions) that agents can discover, run, and propose updates to. Includes 11 MCP tools: skills.list, skills.get, skills.match, skills.compare, skills.run, skills.create, skills.activate, skills.update, skills.archive, skills.delete, skills.import, skills.suggest_from_session, skills.propose_update.<\/li>\n<li>New: Skills admin UI \u2014 four-tab panel (Skills, Suggested, Proposals, History) with kebab action menus, search, and type\/status filters.<\/li>\n<li>New: Three new API key scopes: manage.skills, read.skills, learn.skills.<\/li>\n<li>New: session.close response includes suggest_skill: true when skill suggestions are enabled, prompting the agent to offer saving the workflow as a reusable skill.<\/li>\n<\/ul>\n\n<h4>3.3.0<\/h4>\n\n<ul>\n<li>New: OpenAPI schema endpoint \u2014 GET \/wp-json\/aicom\/v1\/schema generates a live OpenAPI 3.0 spec from all registered tools.<\/li>\n<li>New: Individual tool REST endpoints \u2014 POST \/wp-json\/aicom\/v1\/tools\/{tool.name} compatible with any OpenAPI client.<\/li>\n<li>Works with ChatGPT Custom GPT Actions, Microsoft Copilot Studio, Dify, Flowise, n8n, Make.com, LangChain, Semantic Kernel, and any client that supports OpenAPI 3.0 + Bearer auth. Point at the schema URL, add your AICOM key, and all tools are discovered automatically.<\/li>\n<\/ul>\n\n<h4>3.2.0<\/h4>\n\n<ul>\n<li>New: Accessibility module \u2014 a11y.images_missing_alt, a11y.audit_post, a11y.set_image_alt, a11y.site_report tools for AI-driven WCAG remediation.<\/li>\n<\/ul>\n\n<h4>3.1.0<\/h4>\n\n<ul>\n<li>New: Working Hours Schedule \u2014 automatically apply Soft or Hard Lock outside configured working hours and days.<\/li>\n<li>The manual lock always takes precedence; the schedule only adds additional restrictions.<\/li>\n<\/ul>\n\n<h4>3.0.0<\/h4>\n\n<ul>\n<li>New: Resource Boundaries UI \u2014 configure post type, taxonomy, meta key, WP option, file path, and language restrictions per API key directly from the edit\/create form.<\/li>\n<li>New: Preset Rename \u2014 rename any custom preset in-place via a prompt dialog.<\/li>\n<li>New: Preset Duplicate \u2014 clone any custom preset; the copy appears instantly in the preset grid.<\/li>\n<\/ul>\n\n<h4>2.9.2<\/h4>\n\n<ul>\n<li>Fix: Toolbar lock buttons (Unlock \/ Soft Lock \/ Hard Lock) now work on frontend pages, not only in wp-admin.<\/li>\n<\/ul>\n\n<h4>2.9.1<\/h4>\n\n<ul>\n<li>Improvement: Session description now shown inside the expanded session card in Audit Logs (hidden when collapsed).<\/li>\n<li>Improvement: tools\/list response now includes an instructions field telling the agent whether a session is active, and prompting it to call session.open with both name and description before making changes.<\/li>\n<li>Improvement: session.open tool description updated to explicitly request a meaningful name and description from the agent.<\/li>\n<\/ul>\n\n<h4>2.9.0<\/h4>\n\n<ul>\n<li>New: Backups page redesigned into 3 tabs \u2014 Dashboard (total count, storage used, activity by period, auto-cleanup status), Cleanup Settings, and Backup Snapshots.<\/li>\n<li>New: Backup Snapshots table now shows Class badge (colour-coded by tool class) and Session column with a direct link to the corresponding session in Audit Logs, including scroll-to + highlight on arrival.<\/li>\n<li>New: Toolbar lock controls \u2014 Unlock \/ Soft Lock \/ Hard Lock buttons in the AICOM Keys dropdown; toolbar badge turns red on Hard Lock and amber on Soft Lock.<\/li>\n<li>New: Stacked bar chart in Audit Logs Sessions tab \u2014 each bar segment is colour-coded by tool class (read\/write\/destructive\/admin_sensitive); legend shown below graph.<\/li>\n<li>New: Clicking a graph bar navigates to that day's sessions via server-side filtering (log_date).<\/li>\n<li>New: Class column added to session log tables in Audit Logs.<\/li>\n<li>New: Session filter added to Audit Logs Filters tab.<\/li>\n<li>Improvement: Cleanup Settings form redesigned \u2014 each field on its own row with description on the right; fields separated by dividers.<\/li>\n<li>Improvement: Tab navigation on Backups and Audit Logs pages now uses consistent aicom-tab-bar \/ aicom-tab-btn styles matching API Keys page.<\/li>\n<li>Fix: Graph bars no longer show tool classes from orphaned logs (sessions that were deleted); uses INNER JOIN to exclude them.<\/li>\n<li>Fix: DB v4.4 \u2014 added tool_class column to wp_aicom_logs with backfill migration.<\/li>\n<\/ul>\n\n<h4>2.8.0<\/h4>\n\n<ul>\n<li>New: Named sessions \u2014 agents must call session.open(name: \"...\") before making any changes; all write operations blocked until a session is opened; sessions auto-close after 2h of inactivity.<\/li>\n<li>New: Session restore \u2014 Audit Logs \u2192 Sessions tab shows all sessions with a 30-day activity graph; click Restore to undo all backups from a session in reverse chronological order.<\/li>\n<li>New: Backup cleanup \u2014 set a max age (days) and\/or max size (MB) for automatic backup pruning; runs daily via cron.<\/li>\n<li>Improvement: Audit Logs split into Logs \/ Sessions \/ Filters tabs for easier navigation.<\/li>\n<li>Fix: session_id now correctly populated in backup rows.<\/li>\n<\/ul>\n\n<h4>2.7.0<\/h4>\n\n<ul>\n<li>New: API Key Lifecycle \u2014 optional expiry date (TTL) on any key; keys expire automatically via hourly cron; expired\/archived status badges in the key table.<\/li>\n<li>New: Archive\/Unarchive \u2014 hide inactive keys from the main list without deleting them; restore with one click (unarchived keys come back as suspended).<\/li>\n<li>New: Edit scopes \u2014 repurpose an existing key without revoking it; update scopes, IP allowlist, dry-run flag, and expiry date from a dedicated edit view.<\/li>\n<li>New: Rotate secret inside the edit form \u2014 optionally generate a fresh API key string as part of a scope-edit, with live diff preview of permission changes.<\/li>\n<li>New: Scope diff preview \u2014 while editing, the UI shows which scopes were added (+) and removed (\u2212) compared to the original key, in real time.<\/li>\n<li>New: Full i18n \u2014 all admin strings wrapped for translation; POT template generated at languages\/aicom.pot.<\/li>\n<\/ul>\n\n<h4>2.6.0<\/h4>\n\n<ul>\n<li>New: Save custom presets \u2014 name and save any scope selection as a reusable preset that appears alongside the system presets. Custom presets are stored in the database and can be deleted with one click.<\/li>\n<\/ul>\n\n<h4>2.5.0<\/h4>\n\n<ul>\n<li>New: Preset picker for key creation \u2014 6 system presets (Read-only, Content Assistant, Elementor Editor, WooCommerce Catalog, Site Maintenance, Full Admin) plus Custom mode to auto-select common scope bundles with one click.<\/li>\n<li>New: Scope tree UI \u2014 scopes now grouped into 5 categories (WordPress Core, Media &amp; Files, Users &amp; Roles, Site Configuration, Integrations) with LOW\/MED\/HIGH\/CRITICAL risk labels on every scope.<\/li>\n<li>New: Live search filter for scopes in the key creation form.<\/li>\n<li>New: Collapsible scope groups \u2014 click a group header to expand\/collapse.<\/li>\n<\/ul>\n\n<h4>2.4.0<\/h4>\n\n<ul>\n<li>New: AICOM Keys menu in the WordPress admin bar \u2014 lists all active and suspended API keys with one-click suspend\/unsuspend via AJAX (no page reload). Shows a green badge with the count of active keys. Last item links to the full API Keys management page. Works in both wp-admin and frontend toolbar.<\/li>\n<\/ul>\n\n<h4>2.3.0<\/h4>\n\n<ul>\n<li>New: elementor.page.create_from_template \u2014 create a new page by cloning Elementor data from a source page or template. Copies _elementor_data, _elementor_edit_mode, and _wp_page_template in one call. Supports dry_run and returns preview URL  \u2026<\/li>\n<\/ul>","raw_excerpt":"Use your AI subscription to manage WordPress: create Elementor pages, update content, automate tasks, and stay fully in control.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/294968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=294968"}],"author":[{"embeddable":true,"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/dudaster"}],"wp:attachment":[{"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=294968"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=294968"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=294968"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=294968"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=294968"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/hy.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=294968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}