內容簡介
FlavourSuite AI 使您的 WordPress 網站具備 AI 代理功能，透過安全且結構化的工具讓 AI 代理（如 Claude、Cursor 和 ChatGPT）可以查詢您的網站，而不是隨意抓取頁面或猜測 REST API。
【主要功能】
• 提供 Model Context Protocol (MCP) 伺服器
• 嚴格的安全性設計，預設為關閉
• 每個工具調用需經過權限檢查
• 代理需以真實 WordPress 用戶身份認證
• 變更提案需經過管理者批准
• 完整的審計追蹤功能
外掛標籤
開發者團隊
原文外掛簡介
FlavourSuite AI makes your WordPress site agent-ready: it exposes a Model Context Protocol (MCP) server so AI agents like Claude, Cursor, and ChatGPT can query your site through safe, structured tools instead of scraping pages or guessing at your REST API.
It is built on the WordPress core Abilities API (WordPress 6.9+) and the official wordpress/mcp-adapter, so it speaks the same standards WordPress itself is adopting — no proprietary protocol, no lock-in.
Security first
Off by default. Installing the plugin exposes nothing. The MCP endpoint only exists after an administrator turns it on under Settings → FlavourSuite AI.
Every tool call is permission-checked. Agents authenticate as a real WordPress user — via a connection token, an Application Password, or OAuth 2.1 with PKCE for cloud clients — and each tool enforces that user’s capabilities (manage_options, read, manage_woocommerce, …). There is no anonymous access, ever. Connected agents are listed in settings and can be revoked in one click.
Scoped credentials. Connection tokens are named, individually revocable, optionally expiring, and accepted only on the MCP endpoint — the rest of the REST API rejects them. Give each agent its own, and a leaked config costs you that agent’s access rather than the whole account. Only a SHA-256 hash is stored, so a database dump yields nothing usable.
Rate limited. Tool calls are capped per user per minute so a runaway agent gets a 429 instead of exhausting your server, and the public OAuth endpoints are capped more tightly per IP.
Agents propose, you approve. No tool writes to your live site. Agents can propose changes (Additional CSS, post/page content), which land as pending change requests under Tools → Agent Changes — you review a before/after diff and approve, reject, or later roll back each one. Propose tools are additionally off by default, and read-only tools have per-tool switches too.
Audit trail. The settings screen shows who called which tool, when, and whether it succeeded, and exports to CSV. Arguments and results are never stored.
No data leaves your site. The plugin makes no external requests and needs no API keys. Agents connect to you.
Tools in this version
Site overview — WordPress/PHP versions, active plugins, content counts (administrators only).
List recent posts — recent published entries of any public post type.
Search content — full-text search across public content with snippets.
Site policies — privacy, terms, returns, shipping, FAQ and contact pages with their text, so agents answer pre-sale and trust questions from your real policies.
WooCommerce store overview — product and order counts by status, currency, WooCommerce version (shop managers only; no customer data). Registered automatically when WooCommerce is active. WooCommerce also supplies its configured terms and refund pages to the site-policies tool.
FluentCRM tools — when FluentCRM 3.0+ is active, its own read-only CRM context, campaigns, and automations tools appear on this server (contact-level tools are deliberately excluded here; FluentCRM’s dedicated MCP server carries the full set).
Get custom CSS — read the current Additional CSS so proposals start from reality.
Propose custom CSS change (off by default) — stage a full replacement of the Additional CSS as a pending change request with a reviewable diff.
Propose content edit (off by default) — stage a new title and/or content for a post or page, same review flow.
List change requests — agents can check whether their proposals were approved, rejected, applied, or rolled back.
Agents propose, you approve
The propose tools never touch your live site. Each proposal stores the current state alongside the desired state, and applying it re-checks both the reviewer’s capabilities and staleness — if a human edited the CSS or the post after the proposal was made, the apply is refused instead of overwriting that work. Applied changes keep their before-state for one-click rollback, and content edits are additionally covered by core revisions.
Works with any agent
MCP is model-agnostic, so the model behind your agent is irrelevant to this plugin — Claude, GPT, Gemini, DeepSeek, Qwen, Kimi, GLM, Llama, Mistral, anything routed through OpenRouter, or a model running locally on your own machine. What matters is the client, and the settings screen generates a ready-to-paste recipe for each one:
Command line — Claude Code, Codex CLI, OpenCode.
Editors — Cursor, VS Code (Copilot), Cline, Roo Code, Windsurf.
Cloud clients — Claude (web and desktop connectors) and ChatGPT connect over OAuth 2.1: they discover the site automatically and you approve the connection in wp-admin, with no password to copy anywhere.
Apps with a settings screen — Cherry Studio, ChatWise, 5ire, LibreChat, Dify, n8n and similar: paste the endpoint and one header.
Everything else — a stdio bridge recipe (mcp-remote) covers agents that cannot speak HTTP directly, including LM Studio, Goose and most self-hosted or open-source clients.
Works with your stack
Integrations are detected automatically: if WooCommerce is active its tools appear, if not they don’t — no configuration, no errors. More integrations are on the way.
