內容簡介
Flavors Engine 是一款多功能的 WordPress 外掛，結合了 MCP 伺服器與 Elementor 小工具庫，讓使用者能夠直接在網站上使用 AI 客戶端進行內容創建，同時提供 151 種小工具和主題建構器，簡化網站設計與管理。
【主要功能】
• 轉換網站為 MCP 伺服器，支援多種 AI 客戶端
• 提供 151 種 Elementor 小工具，無需安裝 Elementor
• 完整的主題建構器，支援 WooCommerce 模板
• 97 種能力可供使用，130 種在 Elementor 啟用後
• 安全性設定，提供多種使用者權限配置
外掛標籤
開發者團隊
② 後台搜尋「Flavors Engine – MCP Server for Claude & ChatGPT, plus 151 Elementor Widgets & Theme Builder」→ 直接安裝（推薦）
原文外掛簡介
Flavors Engine is two things in one plugin, and you can use either half on its own.
A WordPress MCP server. It turns your site into an MCP (Model Context Protocol) server, so the AI client you already use – Claude, Cursor, Codex, Copilot and others – can build in it directly instead of handing you code to paste. Pages, block-editor content, menus, taxonomies, media, users, settings: one prompt from you becomes hundreds of typed calls from the agent, each checked against your own WordPress capabilities and the active safety profile before it runs. Built on the WordPress Abilities API and the official MCP Adapter.
An Elementor widget library. 151 widgets and a full theme builder for headers, footers, single templates and archives, with display conditions deciding where each one applies. WooCommerce template types are included, so a store’s shop, product, cart and checkout pages can be built as templates; the WooCommerce widgets that fill them are part of Flavors Engine Pro.
Elementor is not required. The MCP server runs on any site – Bricks, Divi, Oxygen, a block theme, or headless. If Elementor is not installed, the widget half simply does not load and the plugin says so once, in a dismissible notice. Install Elementor later and the widgets appear.
No AI model is bundled and none is needed on the server: your MCP client brings its own model access, and every policy decision is enforced here, on your install.
What the MCP server can do
97 abilities on a fresh install, and 130 once Elementor is active. All grouped and individually switchable:
Content – list, search, read, create, update, trash, restore and delete posts, pages and public custom post types. Creation is draft-first: a missing or malformed status resolves to draft before any capability check, so nothing publishes by accident.
Taxonomies – discover taxonomies, read and write terms, assign them to content.
Media – import from a URL, edit metadata and alt text, set and clear featured images, attach and detach.
Comments – read and moderate, with commenter email and IP withheld below moderate_comments.
Menus – create, rename, reorder, and assign to theme locations.
Revisions, Users, Site – revision restore, privacy-minimised user reads, an explicit settings allowlist.
Plugins and themes – search the WordPress.org directory, activate, deactivate, update and switch, each with an explicit confirmation flag.
Gutenberg – block-editor content through staged pending changes and browser finalization, because core blocks are validated by the editor’s own JavaScript and cannot be written headlessly.
Design library, Skills, Changes, Diagnostics – typed design tokens, reusable skills that also register as MCP prompts, a redacted change ledger with rollback, and scoped health checks.
Safety
Three profiles: Read Only blocks every state change. Production Safe (the default) allows normal content, design and commerce work and blocks raw PHP, WP-CLI, filesystem and database access. Developer Full Access enables the privileged surfaces, and critical calls still require explicit confirmation.
On top of the profile, your WordPress capabilities still apply, individual abilities can be switched off, writes are rate-limited per credential, and supported changes are recorded in a change ledger you can roll back.
Authentication
OAuth 2.1 with PKCE, with every authorization listed under Connected Apps so it can be revoked individually. Application Passwords as a fallback for clients that cannot run a browser flow. Neither is a product licence: no activation key, entitlement check or subscription service is involved.
The widget library
Headings, buttons, info boxes, tabs, accordions and toggles, galleries and sliders, carousels, testimonials, team and pricing tables, counters, charts, post grids and lists, navigation, social, and form stylers for Contact Form 7, Mailchimp, login and search.
The theme builder is a header and footer builder as well as a template builder: ten template types – header, footer, single, archive, search results, 404, popup, loop item, template part and login – each with display conditions deciding where it applies. None of them is reserved for a paid version.
What Flavors Engine Pro adds
Pro is a separate plugin from flavorswp.com. It does not unlock anything in this download; everything here is already running.
Plugin-aware MCP abilities for other builders and plugins – Bricks, Divi, Oxygen, Breakdance, Beaver Builder, Etch, WPBakery, Spectra, Astra, GeneratePress, WooCommerce, ACF, Pods, Metabox, JetEngine, Gravity Forms, Fluent Forms, WPForms, Yoast, Rank Math and more.
Agent memory and an approval queue – the agent remembers your conventions between sessions, and changes can wait for your approval before they land.
Forms suite – form builder, submission storage, conditional logic, SMTP and payments.
WooCommerce widgets and modules – product, cart, checkout and account widgets, variation swatches, checkout field manager, abandoned cart and more.
Animation pack – GSAP-powered scroll and text widgets, which cannot ship here because the GreenSock licence is not GPL-compatible.
External Services
This plugin contacts no external service on its own. Every service below is reached only when you act: by pressing a button, by connecting an AI client, or by adding a widget and entering your own API key for it. A default install, with nothing configured, makes no outbound request at all.
Google Fonts – On the Design screen, when a saved design names a font your browser does not have installed, the preview shows a note explaining that it is not displaying the design’s real fonts, alongside a Preview with Google Fonts button. Pressing that button loads a stylesheet from https://fonts.googleapis.com so the preview can render the font. Nothing is requested until you press it, nothing is requested on your site’s front end, and no data about your site or your visitors is sent – the request contains the font name and, as with any browser request, your IP address and user agent. Google’s terms: https://policies.google.com/terms – Google’s privacy policy: https://policies.google.com/privacy
The WordPress.org plugin directory – The search-extensions and get-extension abilities query https://api.wordpress.org for plugin and theme information, exactly as your WordPress dashboard does. These run only when an AI client you have connected calls them. WordPress.org’s privacy policy: https://wordpress.org/about/privacy/
Openverse – The search-images ability queries https://api.openverse.org for openly licensed photographs, the same catalogue the block editor’s own openly-licensed media search uses. It runs only when an AI client you have connected calls it, the request contains only your search terms and filters, and no account or API key is involved. The ability returns links; it does not download anything. A file is only fetched and added to your Media Library if you then ask for import-media-url, which downloads from whichever URL is passed to it. Openverse is a WordPress.org project. Openverse terms of service: https://docs.openverse.org/terms_of_service.html – Openverse privacy policy: https://openverse.org/privacy
The remaining services are reached only by widgets you place on a page, and only after you enter your own API key or access token for them. None of them is contacted on a default install, because without your credential the request is never made.
Mailchimp – The Mailchimp Form widget sends a subscription to https://
YouTube Data API – The YouTube TV widget and the YouTube mode of the Social Feed widget request channel and video listings from https://www.googleapis.com/youtube/v3/, using a Google API key you supply. The request contains your key and the channel or playlist you configured. Responses are cached, and no visitor data is sent. Google’s terms: https://policies.google.com/terms – Google’s privacy policy: https://policies.google.com/privacy – YouTube API Services terms: https://developers.google.com/youtube/terms/api-services-terms-of-service
The YouTube player (loaded in the visitor’s browser) – A page containing the YouTube TV widget loads YouTube’s iframe player API from https://www.youtube.com/iframe_api and embeds the player itself from youtube.com. This is the only script this plugin loads from another domain, and it has to be: YouTube’s terms require the player API to be served from their domain rather than bundled. It happens in the visitor’s browser, on pages where you placed the widget, and it gives YouTube the visitor’s IP address and user agent as any embed does – nothing is sent from your server. Google’s terms: https://policies.google.com/terms – privacy policy: https://policies.google.com/privacy – YouTube API Services terms: https://developers.google.com/youtube/terms/api-services-terms-of-service
Instagram – The Instagram mode of the Social Feed widget requests your own recent media from https://graph.instagram.com, using an Instagram access token you supply. The request contains your token and a post count. Responses are cached, and no visitor data is sent. Instagram’s terms: https://help.instagram.com/581066165581870 – Meta’s privacy policy: https://privacycenter.instagram.com/policy
OpenWeatherMap – The plugin registers a weather proxy endpoint that requests current conditions from https://api.openweathermap.org for a location you configure, using an OpenWeatherMap API key you supply. The widget that uses it is part of Flavors Engine Pro, so on this plugin alone the endpoint exists but nothing calls it; it is listed here because the code ships. Responses are cached and no visitor data is sent. OpenWeatherMap’s terms: https://openweathermap.org/terms – privacy policy: https://openweather.co.uk/privacy-policy
The AI client’s own domain, during sign-in (OAuth Client ID Metadata) – When an AI client connects and identifies itself with an https URL as its client id, the plugin fetches that URL once to read the client’s metadata document (its name, its redirect addresses), caches the result, and uses it to decide whether the sign-in may proceed. The host contacted is therefore the client’s, not ours, and which host that is depends on which client you connect. The request is a plain GET with no body and no data about your site beyond the fact that it was made; redirects are validated one hop at a time and private or loopback addresses are refused. Nothing is fetched until you connect a client that uses this form of identifier. For Claude, that host is claude.ai or claude.com – Anthropic’s terms: https://www.anthropic.com/legal/consumer-terms – privacy policy: https://www.anthropic.com/legal/privacy
Your own site (self-diagnostics, not an external service) – The Troubleshoot screen checks that the MCP endpoint, the OAuth discovery documents and the REST API are reachable by requesting them from your own site’s address, and it sends a handful of AI-client user agents at one of those addresses to detect a hosting bot filter that would block real clients. Every one of these requests goes to your own domain. They are listed here because they are outbound HTTP requests and a reader auditing the code will see them; no third party is involved and no data leaves your server.
AI model providers – This plugin bundles no AI model and contacts no model provider. Your MCP client connects directly to your site and brings its own model access; the plugin never sees a provider API key. The MCP endpoint is self-hosted and there is no relay.
AI client sign-in addresses (no request is made) – The Connect screen shows the sign-in address of the AI client you choose, and the OAuth flow lists that client’s callback address as an allowed redirect target. For Claude those addresses are on the claude.ai and claude.com domains; other clients have their own. These are destinations your own browser is sent to when you press “connect”, and addresses the plugin checks a returning request against. The plugin itself never opens a connection to any of them, and no data is sent to them by the plugin. They are listed here only because the addresses appear in the code and a reader should know why. Anthropic’s terms: https://www.anthropic.com/legal/consumer-terms – privacy policy: https://www.anthropic.com/legal/privacy
Source Code
Everything in this plugin is readable source except the third-party libraries listed below, and this section is where to find the source for each compressed file.
This plugin’s own code. All PHP is source. Under assets/, every minified file ships beside the unminified file it was built from (x.min.js next to x.js), and SCRIPT_DEBUG makes WordPress load the readable one. Nine scripts have no separate minified twin because none was ever built: they were inherited as single-line files with no build step, so they ship reformatted in place, and each carries a header saying exactly that. Note that assets/js/library/ is not exclusively third-party: aos, gradient-bg, shape-divider, tabs and list-actions are this plugin’s own code and each ships with its readable source beside the minified file.
The chat interface. includes/assets/chat/index.js is compiled from src/chat/index.tsx, which ships inside this plugin. Build it with the @wordpress/scripts toolchain that package.json declares:
npm install && npm run build:chat
Third-party libraries. Each is shipped in the minified form its own project distributes. The readable source for every one is published by that project at the address below, which is also where any modification should be taken from.
Slick Carousel – MIT – https://github.com/kenwheeler/slick (carousel and slider widgets)
Prism – MIT – https://github.com/PrismJS/prism (code-highlight widget)
assets/js/library/table.min.js is five libraries concatenated and minified, all MIT, listed in the file’s own header and here:
DataTables – https://github.com/DataTables/DataTables
DataTables Buttons – https://github.com/DataTables/Buttons
JSZip – https://github.com/Stuk/jszip
pdfmake – https://github.com/bpampuch/pdfmake
jquery-csv – https://github.com/typeiii/jquery-csv
The Lottie animation widget ships three MIT libraries:
lottie-web – https://github.com/airbnb/lottie-web
lottie-interactivity – https://github.com/LottieFiles/lottie-interactivity
lottie-player – https://github.com/LottieFiles/lottie-player
Jarallax – MIT – https://github.com/nk-o/jarallax (the parallax background extension; assets/js/library/parallax-bg.min.js)
Animate.css 4.1.1 – MIT – https://github.com/animate-css/animate.css (entrance animations)
AOS (Animate On Scroll) – MIT – https://github.com/michalsnik/aos (scroll-triggered animations; the bundled file is a reduced reimplementation, readable as shipped)
Masonry and imagesLoaded are not bundled: the plugin uses the copies WordPress core itself ships and registers. GreenSock (GSAP) is not bundled either – its licence is not GPL-compatible, so the widgets that need it are not part of this plugin.
Server-side PHP dependencies are managed with Composer and declared in composer.json; each carries its own LICENSE file inside vendor/.
