MAI Smart Assistant

Description

MAI Smart Assistant is a comprehensive AI integration plugin for WordPress that brings the power of artificial intelligence to your website. With support for multiple AI providers and a wide range of features, it’s designed to enhance your content creation, user engagement, and site automation.

Key Features

• Multi-Provider Support – Seamlessly integrate with OpenAI, Anthropic Claude, Google Gemini, X.AI Grok, and Cohere
• Intelligent Chatbot – RAG-based chatbot trained on your site content for accurate, context-aware responses, with optional streaming token-by-token replies
• MCP Server for AI Agents – Expose your WordPress site to Claude Desktop, Cursor, ChatGPT Desktop and any Model Context Protocol client via 30 secure abilities. Per-token ability scoping lets you restrict each token to a subset (e.g. read-only, no deletes) — requires WordPress 6.9+; rest of the plugin works on 5.8+
• Content Generation – AI-powered content creation throughout WordPress admin and frontend
• Automation & Scheduling – Automated content creation and updates with flexible scheduling
• Privacy & GDPR Controls – Dedicated Privacy tab with conversation retention auto-cleanup, IP/UA opt-out, optional consent gate, and native WordPress GDPR export / erase hooks
• Analytics Dashboard – Comprehensive tracking of usage, costs, and performance metrics
• Security First – Built with WordPress security best practices: proper sanitization, escaping, nonce verification, per-ability capability checks
• Performance Optimized – Lazy-loaded chatbot widget (~5.8 KB launcher on page load instead of 30 KB), intelligent response caching, rate limiting, optimized database queries

Chatbot Features

• Streaming Responses – Token-by-token streaming so visitors see replies as they’re generated; auto-falls-back to non-streaming on hosts that buffer responses
• Lazy-Loaded Widget – Only a small launcher script (~5.8 KB) is on the page until the visitor clicks; the full bundle loads on-demand to protect Core Web Vitals (INP)
• RAG (Retrieval-Augmented Generation) – Chatbot searches your site content to provide accurate answers
• Content Search Integration – Automatically finds and presents relevant posts, pages, and products
• Conversation History – Maintains context across multiple messages
• Optional Consent Gate – Inline checkbox above the input field for GDPR-friendly sites; visitor must tick it before sending; persisted per-browser in localStorage
• Customizable Appearance – Full color customization, custom avatars, and styling options
• Mobile Responsive – Works perfectly on all devices
• Optional Footer – “Powered by” footer is disabled by default; enable it only if you want to display custom branding

AI Agent / MCP Integration (NEW in 1.1.0)

The plugin acts as a Model Context Protocol server — connect Claude Desktop, Cursor, ChatGPT Desktop, Continue, Cline or any MCP client to your WordPress site and let it drive your content. Requires WordPress 6.9+ (Abilities API); on older versions the rest of the plugin keeps working unchanged and the MCP tab shows an info notice.

30 abilities, grouped by domain:

• Posts (7) – get, list (paginated/filterable), create, update, delete (trash or permanent), duplicate, set featured image. create-post and update-post auto-import external <img> URLs into your media library so AI-generated posts aren’t broken hotlinks.
• Taxonomies (6) – list taxonomies, list terms, create/update/delete terms, assign terms to posts. Works with categories, tags, and any custom taxonomy (product_cat for WooCommerce, etc.).
• Comments (5) – list/get/create/update/delete. Also covers WooCommerce reviews — set type: "review" and meta: {"rating": 5} to write the exact shape WC reads from.
• Media (3) – upload from URL (with MIME sniffing for extensionless CDN URLs), get attachment metadata, delete.
• Site introspection (2) – list post types, get site info (URL, language, timezone, WP/PHP versions). No secrets returned.
• Plugin-native (7) – search site content, generate AI text, index for RAG, list/run automation rules, list configured providers (no API keys returned), get analytics summary.

Security model:

• Bearer-token authentication with SHA-256-hashed storage. Plaintext shown exactly once at creation, never again.
• Three-layer permissions: (1) token validates at transport; (2) per-token ability allowlist — if the token wasn’t granted access to that specific tool, the AI client never sees it in tools/list and tools/call is rejected; (3) per-ability WordPress capability check runs against the user the token is bound to.
• Destructive operations (delete-post / delete-term / delete-media / delete-comment / force: true) are MCP-annotated so client UIs prompt for confirmation.
• Sideload helper blocks private/loopback IPs (RFC1918, 127.0.0.1, 169.254.169.254 cloud-metadata, etc.) to prevent SSRF, and caps download size at 25 MB.

The plugin admin includes step-by-step setup guides for Claude Desktop (incl. Microsoft Store install), Claude.ai web, ChatGPT Desktop, Cursor, Continue (VS Code/JetBrains), Cline, and a generic raw-HTTP section for custom integrations.

Content Generation

• Gutenberg Integration – AI assistant directly in the block editor
• Classic Editor Support – Seamless integration with the classic WordPress editor
• WooCommerce Integration – Generate product descriptions, features, and marketing content
• Multiple Content Types – Support for posts, pages, products, and custom post types
• Template System – Pre-built templates for common content types

Security & Performance

• WordPress Standards Compliant – Follows all WordPress.org coding and security guidelines
• SQL Injection Protection – Proper use of $wpdb->prepare() with dynamic placeholders
• XSS Prevention – All outputs properly escaped with esc_html(), esc_url(), esc_attr()
• Input Sanitization – All inputs sanitized using WordPress core functions
• Rate Limiting – Built-in protection against API abuse
• Caching System – Intelligent caching to reduce API costs and improve performance
• Local Assets – Required JavaScript libraries are bundled locally; no remote CDN assets are loaded

Supported AI Providers

• OpenAI – GPT-5.5 / GPT-5.5 Mini (latest), GPT-5 series, GPT-4.1, plus legacy GPT-4o / GPT-4 / GPT-3.5 Turbo for accounts that still have access
• Anthropic – Claude Opus 4.7 (incl. 1M-token context variant), Claude Sonnet 4.6, Claude Haiku 4.5, plus legacy Claude 3.x models
• Google Gemini – Gemini 3.5 Flash (latest), Gemini 3.1 Pro (up to 2M token context), Gemini 2.5 series, plus legacy Gemini 1.5
• X.AI – Grok 4 (latest), Grok 3 / 3 Mini, Grok 2 series, Grok Code Fast
• Cohere – Command A (2025), Command R+ / R series, plus embedding models for RAG

Model availability depends on your provider account, plan, and regional access. Configure models per-feature in the plugin settings.

Automation & Scheduling

• Intelligent Content Generation – Create blog posts, articles, and product descriptions automatically
• Advanced Scheduler – Flexible scheduling with timezone support, blackout dates, and time windows
• Queue System – Robust queue with retry logic, exponential backoff, and priority handling
• SEO Integration – Automatic SEO optimization for Yoast SEO, Rank Math, and All in One SEO
• Custom Fields – Populate ACF and JetEngine custom fields automatically
• Image Generation – DALL-E 3 integration for automated featured images with style control
• Quality Controls – Content scoring, duplicate detection, and uniqueness validation
• Budget Management – Daily and monthly cost limits with auto-pause on budget exceeded
• Failure Handling – Email notifications, automatic retries, and configurable failure behaviors
• Monitoring Dashboard – Track rule performance, costs, success rates, and execution history

Use Cases

• Customer Support – Intelligent chatbot that answers questions using your site content
• Content Marketing – Generate blog posts, product descriptions, and marketing copy
• E-commerce – Automated product descriptions and customer support
• Documentation – Interactive help system for complex products or services
• Lead Generation – Engage visitors with intelligent conversations

External Services

This plugin connects to third-party AI provider APIs to function. You must configure API keys from at least one of the following services:

OpenAI API
* Service: https://platform.openai.com/
* Privacy Policy: https://openai.com/policies/privacy-policy
* Terms of Service: https://openai.com/policies/terms-of-use
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion, embeddings creation

Anthropic API (Claude)
* Service: https://www.anthropic.com/
* Privacy Policy: https://www.anthropic.com/legal/privacy
* Terms of Service: https://www.anthropic.com/legal/terms
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion

Google Gemini API
* Service: https://ai.google.dev/
* Privacy Policy: https://policies.google.com/privacy
* Terms of Service: https://policies.google.com/terms
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion, embeddings creation

X.AI API (Grok)
* Service: https://x.ai/
* Privacy Policy: https://x.ai/legal/privacy-policy
* Terms of Service: https://x.ai/legal/terms-of-service
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion

Cohere API
* Service: https://cohere.com/
* Privacy Policy: https://cohere.com/privacy
* Terms of Service: https://cohere.com/terms-of-use
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion, embeddings creation

Important Notes:
* API keys are required to use this plugin – you must sign up with at least one provider
* All API communications use HTTPS encryption
* No data is sent to external services except the AI providers you explicitly configure
* You are responsible for compliance with each provider’s terms of service
* This plugin does not send any tracking or telemetry data to the plugin author

MCP Server endpoint (inbound — NOT an external service)

As of 1.1.0 the plugin exposes a Model Context Protocol server at /wp-json/mai-smart-assistant/v1/mcp. This endpoint is inbound only: AI desktop clients (Claude Desktop, Cursor, ChatGPT Desktop) connect to your WordPress site. No data is sent from your site to a third-party MCP host. The endpoint is disabled until you create a bearer token in MAI Smart Assistant → MCP. Each token is scoped at creation to Full access OR a subset of the 30 abilities. Every call is then gated by three layers: bearer token at transport, the per-token ability allowlist, and the WordPress capability of the user the token is bound to. Requires WordPress 6.9 or later (Abilities API) — on older WordPress versions the MCP feature silently no-ops and the rest of the plugin keeps working unchanged.

Bundled third-party PHP libraries (no Composer required)

The MCP server feature is built on two open-source libraries from the WordPress project, vendored unmodified into the plugin’s /vendor/wordpress/ directory. We use our own PSR-4 autoloader to map their namespaces — no Composer install is required, no upstream code is patched. Source attribution and licenses are also documented in vendor/README.md.

WordPress/mcp-adapter
* Source: https://github.com/WordPress/mcp-adapter
* License: GPL-2.0-or-later (compatible with this plugin’s GPLv2+)
* Pinned upstream commit: 7cc42a0c1de1937bea6ca9cea56d1b0818e94632 (2026-05-20, release 0.5.0)
* Purpose: Bridges the WordPress 6.9 Abilities API to the Model Context Protocol JSON-RPC transport
* Data transmitted: None — runs entirely as in-process PHP code; no outbound HTTP

WordPress/php-mcp-schema
* Source: https://github.com/WordPress/php-mcp-schema
* License: GPL-2.0-or-later
* Pinned upstream version: v0.1.1
* Purpose: PHP Data Transfer Objects for MCP protocol message types — required runtime dependency of mcp-adapter
* Data transmitted: None — schema/validation classes only

Privacy Policy

MAI Smart Assistant is designed with privacy in mind:

• Local Data Storage – All conversations and analytics are stored locally in your WordPress database. Nothing is sent to the plugin author.
• API Communications – The plugin communicates directly with your chosen AI providers using your API keys; data passes through their privacy policies (linked in External Services above), not ours.
• No External Tracking – We don’t collect or transmit any data to external services beyond the AI providers you configure. No analytics, no telemetry.
• MCP Server is Inbound Only – When MCP is enabled, AI clients connect to your site over an authenticated endpoint. No data is sent from your site to a third-party MCP host.
• Conversation Retention – The Privacy tab lets you set an automatic daily purge for chatbot conversations older than N days (default 90; set to 0 to keep forever).
• IP / User Agent Opt-Out – The Privacy tab lets you disable storing visitor IP and User Agent on new chatbot rows; existing rows are left untouched.
• Optional Consent Gate – You can require visitors to tick a consent checkbox before the chatbot accepts their first message. Acceptance is stored client-side (localStorage), not server-side.
• GDPR Export and Erase – The plugin registers the standard WordPress wp_privacy_personal_data_exporters and wp_privacy_personal_data_erasers hooks. Tools → Export / Erase Personal Data will include the visitor’s chatbot conversations when you look them up by email.
• Admin Purge Action – A one-click “Purge all conversations” button in the Privacy tab for full data wipes.
• User Control – You have full control over what content gets indexed (Training tab) and which features are enabled (Chatbot, Content, Automation tabs).
• Third-Party Services – See “External Services” section above for details on the AI provider APIs the plugin connects to.

Support

For support, feature requests, and bug reports, please visit our GitHub repository or contact us through the WordPress.org support forums.

Credits

MAI Smart Assistant is developed with ❤️ for the WordPress community. Special thanks to all the AI providers who make these amazing technologies accessible to developers and content creators.