MAI Smart Assistant

Description

MAI Smart Assistant is a comprehensive AI integration plugin for WordPress that brings the power of artificial intelligence to your website. With support for multiple AI providers and a wide range of features, it’s designed to enhance your content creation, user engagement, and site automation.

Key Features

• Multi-Provider Support – Seamlessly integrate with OpenAI, Anthropic Claude, Google Gemini, X.AI Grok, and Cohere
• Intelligent Chatbot – RAG-based chatbot trained on your site content for accurate, context-aware responses, with optional streaming token-by-token replies
• MCP Server for AI Agents – Expose your WordPress site to Claude Desktop, Cursor, ChatGPT Desktop and any Model Context Protocol client via 40 secure abilities (30 from 1.1.0 + 10 new SEO abilities in 1.2.0). Per-token ability scoping lets you restrict each token to a subset (e.g. read-only, no deletes) — requires WordPress 6.9+; rest of the plugin works on 5.8+
• SEO Integration (NEW in 1.2.0) – Unified adapter for Yoast SEO, Rank Math, AIOSEO, SEOPress, The SEO Framework, Slim SEO, plus a built-in fallback. AI generates meta titles + descriptions in the post’s language; the chatbot becomes SEO-aware; 10 new MCP abilities let Claude Desktop / Cursor manage SEO; new SEO admin tab + daily AI budget cap + new mai_manage_seo capability + GDPR audit trail.
• Content Generation – AI-powered content creation throughout WordPress admin and frontend
• Automation & Scheduling – Automated content creation and updates with flexible scheduling
• Privacy & GDPR Controls – Dedicated Privacy tab with conversation retention auto-cleanup, IP/UA opt-out, optional consent gate, and native WordPress GDPR export / erase hooks
• Analytics Dashboard – Comprehensive tracking of usage, costs, and performance metrics
• Security First – Built with WordPress security best practices: proper sanitization, escaping, nonce verification, per-ability capability checks
• Performance Optimized – Lazy-loaded chatbot widget (~5.8 KB launcher on page load instead of 30 KB), intelligent response caching, rate limiting, optimized database queries

Chatbot Features

• Streaming Responses – Token-by-token streaming so visitors see replies as they’re generated; auto-falls-back to non-streaming on hosts that buffer responses
• Lazy-Loaded Widget – Only a small launcher script (~5.8 KB) is on the page until the visitor clicks; the full bundle loads on-demand to protect Core Web Vitals (INP)
• RAG (Retrieval-Augmented Generation) – Chatbot searches your site content to provide accurate answers
• Content Search Integration – Automatically finds and presents relevant posts, pages, and products
• Conversation History – Maintains context across multiple messages
• Optional Consent Gate – Inline checkbox above the input field for GDPR-friendly sites; visitor must tick it before sending; persisted per-browser in localStorage
• Customizable Appearance – Full color customization, custom avatars, and styling options
• Mobile Responsive – Works perfectly on all devices
• Optional Footer – «Powered by» footer is disabled by default; enable it only if you want to display custom branding

AI Agent / MCP Integration (NEW in 1.1.0)

The plugin acts as a Model Context Protocol server — connect Claude Desktop, Cursor, ChatGPT Desktop, Continue, Cline or any MCP client to your WordPress site and let it drive your content. Requires WordPress 6.9+ (Abilities API); on older versions the rest of the plugin keeps working unchanged and the MCP tab shows an info notice.

30 abilities, grouped by domain:

• Posts (7) – get, list (paginated/filterable), create, update, delete (trash or permanent), duplicate, set featured image. create-post and update-post auto-import external <img> URLs into your media library so AI-generated posts aren’t broken hotlinks.
• Taxonomies (6) – list taxonomies, list terms, create/update/delete terms, assign terms to posts. Works with categories, tags, and any custom taxonomy (product_cat for WooCommerce, etc.).
• Comments (5) – list/get/create/update/delete. Also covers WooCommerce reviews — set type: "review" and meta: {"rating": 5} to write the exact shape WC reads from.
• Media (3) – upload from URL (with MIME sniffing for extensionless CDN URLs), get attachment metadata, delete.
• Site introspection (2) – list post types, get site info (URL, language, timezone, WP/PHP versions). No secrets returned.
• Plugin-native (7) – search site content, generate AI text, index for RAG, list/run automation rules, list configured providers (no API keys returned), get analytics summary.

Security model:

• Bearer-token authentication with SHA-256-hashed storage. Plaintext shown exactly once at creation, never again.
• Three-layer permissions: (1) token validates at transport; (2) per-token ability allowlist — if the token wasn’t granted access to that specific tool, the AI client never sees it in tools/list and tools/call is rejected; (3) per-ability WordPress capability check runs against the user the token is bound to.
• Destructive operations (delete-post / delete-term / delete-media / delete-comment / force: true) are MCP-annotated so client UIs prompt for confirmation.
• Sideload helper blocks private/loopback IPs (RFC1918, 127.0.0.1, 169.254.169.254 cloud-metadata, etc.) to prevent SSRF, and caps download size at 25 MB.

The plugin admin includes step-by-step setup guides for Claude Desktop (incl. Microsoft Store install), Claude.ai web, ChatGPT Desktop, Cursor, Continue (VS Code/JetBrains), Cline, and a generic raw-HTTP section for custom integrations.

SEO Integration (NEW in 1.2.0)

Drive SEO across whichever SEO plugin you already use — the plugin auto-detects which is active and uses its native APIs/postmeta. You keep your existing Yoast / Rank Math / AIOSEO settings; the plugin reads and writes them.

Supported SEO plugins:

• Yoast SEO (postmeta + indexable rebuild — tested against Yoast 27.8)
• Rank Math (postmeta + serialized robots translation — tested against Rank Math 1.0.272)
• All in One SEO (AIOSEO) (REST primary + $wpdb fallback for AIOSEO 4.9.8+)
• SEOPress (postmeta + string-or-empty robots pattern)
• The SEO Framework (legacy Genesis postmeta)
• Slim SEO (single serialized postmeta)
• Native fallback — built-in minimal SEO when no third-party plugin is installed, so AI-generated SEO works on greenfield sites

Key SEO features:

• AI meta generation — generate title (60 char hard cap) + description (158 char) suggestions from post content or a focus keyphrase. Modes: both / title-only / description-only / alternatives (1-5 variants). Multilingual via WPML / Polylang / get_locale() — LLM writes in the post’s language.
• Anti-prompt-injection pipeline — post content stripped, capped at 2000 chars, wrapped in delimiters; LLM is explicitly told not to follow instructions inside the content block. Comments are never sent to the AI.
• Chatbot SEO awareness — type «improve SEO of post:42» or «write a meta description for /pricing» in the chatbot; it loads the current SEO state and asks the LLM to suggest changes (stage-then-confirm, never auto-applies).
• 10 new MCP abilities — mai/seo-detect-plugin, mai/seo-get, mai/seo-update, mai/seo-analyze, mai/seo-generate-meta, mai/seo-suggest-keyphrase, mai/seo-set-robots, mai/seo-list-by-status, mai/seo-bulk-update (max 25, destructive-annotated), mai/seo-bulk-generate (max 25). Bulk + robots ops require the new mai_manage_seo capability.
• SEO admin tab — status banner showing detected adapter + version, adapter selection dropdown (when multiple SEO plugins are active), daily AI generation budget cap (default 100 calls/UTC day, 0 = unlimited).
• GDPR audit trail — every AI-driven or MCP-driven SEO change records {timestamp, source, model, provider, token_id, fields} into postmeta. Exported through Tools → Export Personal Data as the new «SEO change audit trail» group.

Content Generation

• Gutenberg Integration – AI assistant directly in the block editor
• Classic Editor Support – Seamless integration with the classic WordPress editor
• WooCommerce Integration – Generate product descriptions, features, and marketing content
• Multiple Content Types – Support for posts, pages, products, and custom post types
• Template System – Pre-built templates for common content types

Security & Performance

• WordPress Standards Compliant – Follows all WordPress.org coding and security guidelines
• SQL Injection Protection – Proper use of $wpdb->prepare() with dynamic placeholders
• XSS Prevention – All outputs properly escaped with esc_html(), esc_url(), esc_attr()
• Input Sanitization – All inputs sanitized using WordPress core functions
• Rate Limiting – Built-in protection against API abuse
• Caching System – Intelligent caching to reduce API costs and improve performance
• Local Assets – Required JavaScript libraries are bundled locally; no remote CDN assets are loaded

Supported AI Providers

• OpenAI – GPT-5.5 / GPT-5.5 Mini (latest), GPT-5 series, GPT-4.1, plus legacy GPT-4o / GPT-4 / GPT-3.5 Turbo for accounts that still have access
• Anthropic – Claude Opus 4.7 (incl. 1M-token context variant), Claude Sonnet 4.6, Claude Haiku 4.5, plus legacy Claude 3.x models
• Google Gemini – Gemini 3.5 Flash (latest), Gemini 3.1 Pro (up to 2M token context), Gemini 2.5 series, plus legacy Gemini 1.5
• X.AI – Grok 4 (latest), Grok 3 / 3 Mini, Grok 2 series, Grok Code Fast
• Cohere – Command A (2025), Command R+ / R series, plus embedding models for RAG

Model availability depends on your provider account, plan, and regional access. Configure models per-feature in the plugin settings.

Automation & Scheduling

• Intelligent Content Generation – Create blog posts, articles, and product descriptions automatically
• Advanced Scheduler – Flexible scheduling with timezone support, blackout dates, and time windows
• Queue System – Robust queue with retry logic, exponential backoff, and priority handling
• SEO Integration – Automatic SEO optimization for Yoast SEO, Rank Math, and All in One SEO
• Custom Fields – Populate ACF and JetEngine custom fields automatically
• Image Generation – DALL-E 3 integration for automated featured images with style control
• Quality Controls – Content scoring, duplicate detection, and uniqueness validation
• Budget Management – Daily and monthly cost limits with auto-pause on budget exceeded
• Failure Handling – Email notifications, automatic retries, and configurable failure behaviors
• Monitoring Dashboard – Track rule performance, costs, success rates, and execution history

Use Cases

• Customer Support – Intelligent chatbot that answers questions using your site content
• Content Marketing – Generate blog posts, product descriptions, and marketing copy
• E-commerce – Automated product descriptions and customer support
• Documentation – Interactive help system for complex products or services
• Lead Generation – Engage visitors with intelligent conversations

External Services

This plugin connects to third-party AI provider APIs to function. You must configure API keys from at least one of the following services:

OpenAI API
* Service: https://platform.openai.com/
* Privacy Policy: https://openai.com/policies/privacy-policy
* Terms of Service: https://openai.com/policies/terms-of-use
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion, embeddings creation

Anthropic API (Claude)
* Service: https://www.anthropic.com/
* Privacy Policy: https://www.anthropic.com/legal/privacy
* Terms of Service: https://www.anthropic.com/legal/terms
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion

Google Gemini API
* Service: https://ai.google.dev/
* Privacy Policy: https://policies.google.com/privacy
* Terms of Service: https://policies.google.com/terms
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion, embeddings creation

X.AI API (Grok)
* Service: https://x.ai/
* Privacy Policy: https://x.ai/legal/privacy-policy
* Terms of Service: https://x.ai/legal/terms-of-service
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion

Cohere API
* Service: https://cohere.com/
* Privacy Policy: https://cohere.com/privacy
* Terms of Service: https://cohere.com/terms-of-use
* Data transmitted: User messages, site content for indexing, generation prompts
* Purpose: AI text generation, chat completion, embeddings creation

Important Notes:
* API keys are required to use this plugin – you must sign up with at least one provider
* All API communications use HTTPS encryption
* No data is sent to external services except the AI providers you explicitly configure
* You are responsible for compliance with each provider’s terms of service
* This plugin does not send any tracking or telemetry data to the plugin author

SEO AI generation data (1.2.0+)

When you invoke an SEO generation action — either by clicking a button, by typing an SEO command in the chatbot, or by an AI agent calling mai/seo-generate-meta over MCP — the plugin sends the post’s text content (with shortcodes rendered, HTML stripped, capped at 2000 characters) to the AI provider you have configured. Post comments are NEVER sent. The plugin records an audit entry on every AI-driven SEO change ({timestamp, source, model, provider, token_id, fields[]}) under a _mai_seo_audit postmeta key, retained at the last 20 entries per post. Audit entries are surfaced through WordPress core’s Tools → Export Personal Data under the group «MAI Smart Assistant: SEO change audit trail». A daily UTC-day cap on AI generation calls is configurable in MAI Smart Assistant → SEO (default 100, range 0-10000, 0 = unlimited).

MCP Server endpoint (inbound — NOT an external service)

As of 1.1.0 the plugin exposes a Model Context Protocol server at /wp-json/mai-smart-assistant/v1/mcp. This endpoint is inbound only: AI desktop clients (Claude Desktop, Cursor, ChatGPT Desktop) connect to your WordPress site. No data is sent from your site to a third-party MCP host. The endpoint is disabled until you create a bearer token in MAI Smart Assistant → MCP. Each token is scoped at creation to Full access OR a subset of the 30 abilities. Every call is then gated by three layers: bearer token at transport, the per-token ability allowlist, and the WordPress capability of the user the token is bound to. Requires WordPress 6.9 or later (Abilities API) — on older WordPress versions the MCP feature silently no-ops and the rest of the plugin keeps working unchanged.

Bundled third-party PHP libraries (no Composer required)

The MCP server feature is built on two open-source libraries from the WordPress project, vendored unmodified into the plugin’s /vendor/wordpress/ directory. We use our own PSR-4 autoloader to map their namespaces — no Composer install is required, no upstream code is patched. Source attribution and licenses are also documented in vendor/README.md.

WordPress/mcp-adapter
* Source: https://github.com/WordPress/mcp-adapter
* License: GPL-2.0-or-later (compatible with this plugin’s GPLv2+)
* Pinned upstream commit: 7cc42a0c1de1937bea6ca9cea56d1b0818e94632 (2026-05-20, release 0.5.0)
* Purpose: Bridges the WordPress 6.9 Abilities API to the Model Context Protocol JSON-RPC transport
* Data transmitted: None — runs entirely as in-process PHP code; no outbound HTTP

WordPress/php-mcp-schema
* Source: https://github.com/WordPress/php-mcp-schema
* License: GPL-2.0-or-later
* Pinned upstream version: v0.1.1
* Purpose: PHP Data Transfer Objects for MCP protocol message types — required runtime dependency of mcp-adapter
* Data transmitted: None — schema/validation classes only

Privacy Policy

MAI Smart Assistant is designed with privacy in mind:

• Local Data Storage – All conversations and analytics are stored locally in your WordPress database. Nothing is sent to the plugin author.
• API Communications – The plugin communicates directly with your chosen AI providers using your API keys; data passes through their privacy policies (linked in External Services above), not ours.
• No External Tracking – We don’t collect or transmit any data to external services beyond the AI providers you configure. No analytics, no telemetry.
• MCP Server is Inbound Only – When MCP is enabled, AI clients connect to your site over an authenticated endpoint. No data is sent from your site to a third-party MCP host.
• Conversation Retention – The Privacy tab lets you set an automatic daily purge for chatbot conversations older than N days (default 90; set to 0 to keep forever).
• IP / User Agent Opt-Out – The Privacy tab lets …