Jordy Meow

<p><strong>Chagency</strong> is the first chatbot to ship directly on top of the new AI Client introduced in WordPress 7.0 — <code>wp_ai_client_prompt()</code>, Connectors, and the Abilities API. Every prompt flows through WordPress core, every provider is a Connector you already configured under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connectors</strong>, and every action it exposes is a registered Ability that other plugins (and other AI agents) can call.</p>
<p>There is no other plugin on wordpress.org that builds on <code>wp_ai_client_prompt()</code> today. Chagency is the reference case: a small, native chatbot that proves the framework works, ships zero vendor SDKs, and grows alongside the Abilities API into a real agent.</p>
<p>It runs in the WordPress admin and, when you turn it on, on every page of your public site. The name (chat + ai + ency) is meant as a small bridge between the new AI primitives shipped with WordPress and the broader world of chat and agents. It starts as a chatbot today and turns into an agent tomorrow, without a rename.</p>
<h3>🪨 Built on WordPress, period</h3>
<p>Chagency relies entirely on what WordPress 7 ships in core:</p>
<ul>
<li><code>wp_ai_client_prompt()</code>, the AI Client API.</li>
<li><code>wp_get_connectors()</code>, the Connectors API.</li>
<li><code>wp_register_ability()</code> / <code>wp_get_ability()</code>, the Abilities API.</li>
<li><code>@wordpress/components</code>, <code>@wordpress/element</code>, <code>@wordpress/boot</code>, the Gutenberg toolkit.</li>
</ul>
<p>That is the entire dependency surface. <strong>No bundled AI vendor SDKs, no third-party JavaScript libraries beyond the Gutenberg stack, no telemetry, no phone-home.</strong> The plugin stays small on purpose: fewer moving parts means less friction, fewer security holes, less to break when WordPress, browsers, or providers change.</p>
<p>You will need at least one AI provider plugin (e.g. <em>AI Provider for Anthropic</em>, <em>AI Provider for Google</em>, <em>AI Provider for OpenAI</em>) to talk to a model. That is WordPress 7’s architecture: providers are separate plugins that register a Connector. They are not a Chagency dependency.</p>
<p>💡 <strong>Tip:</strong> For the smoothest setup, install <a href="https://wordpress.org/plugins/ai-engine/" rel="ugc">AI Engine</a>. It registers every AI provider it manages as a Connector, so a single configuration covers all your WordPress 7 AI plugins (including Chagency). Every request then flows through one clean, unified system.</p>
<h3>🪄 What you get</h3>
<ul>
<li>A floating chat panel pinned to the bottom-right of every page (admin and / or public site, controlled by two independent toggles).</li>
<li>A single settings page under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Chagency</strong>, with the bare minimum: where to show the chatbot, the chat title, the greeting, the system instruction, and the model preference.</li>
<li>Live updates: flipping a toggle in Settings shows or hides the launcher immediately on the same page, no reload needed.</li>
<li>Per-provider <strong>Test</strong> buttons that fire a canary prompt and report round-trip time.</li>
<li>Conversation persistence in your browser’s localStorage, scoped per user.</li>
<li>Placeholder expansion (<code>{user_name}</code>, <code>{site_name}</code>, <code>{current_page}</code>, <code>{current_url}</code>, <code>{user_role}</code>, <code>{site_url}</code>) so the assistant always knows who and where it is.</li>
<li>Exposed as an Ability (<code>chagency/send-message</code>) so other plugins, MCP clients, and AI agents can invoke Chagency directly.</li>
</ul>
<h3>🚀 Getting started</h3>
<ol>
<li>Install and activate <strong>Chagency</strong>.</li>
<li>Install and configure at least one AI provider plugin under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connectors</strong> (we recommend <a href="https://wordpress.org/plugins/ai-engine/" rel="ugc">AI Engine</a>, which exposes all its providers as Connectors at once).</li>
<li>Click the chat launcher in the bottom-right of any admin page and start talking.</li>
<li>Want it on the public site too? Open <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Chagency</strong> and flip the second toggle.</li>
</ol>
<h3>🙋 Frequently Asked Questions</h3>
<h4>Why “Chagency”?</h4>
<p>It’s a portmanteau of <em>chat</em>, <em>AI</em>, and a bit of <em>agent</em>. Not “agency” in the sense of a marketing shop. The plugin starts as a minimal chatbot for the new WordPress 7 AI framework and grows alongside the Abilities API into a true agent.</p>
<h4>Does it need WordPress 7?</h4>
<p>Yes. It uses <code>wp_ai_client_prompt()</code>, <code>wp_get_connectors()</code>, and the Abilities API, all added in WordPress 7.0. On older versions it refuses to boot and tells you why.</p>
<h4>Which AI providers are supported?</h4>
<p>Whatever you configure under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connectors</strong>. Chagency is provider-agnostic. Anthropic, Google, OpenAI, or any third-party Connector are treated equally.</p>
<h4>Can visitors on the front end use it?</h4>
<p>Yes. Open <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Chagency</strong> and turn on <em>Show on the public site</em>. The chat then appears for every visitor, signed in or not.</p>
<h4>Does it store my conversations?</h4>
<p>No. Conversations live only in your own browser (localStorage, per user). Hit <em>Reset</em> in the panel to clear them. Nothing is stored server-side.</p>
<h4>Can I use it as a building block in my own plugin?</h4>
<p>Yes. The <code>chagency/send-message</code> Ability is registered on <code>wp_abilities_api_init</code> and can be called with <code>wp_get_ability( 'chagency/send-message' )->execute( array( 'message' => '...' ) )</code>.</p>
<h3>Source code</h3>
<p>The unminified React / JavaScript source is shipped inside the plugin folder under <code>src/</code>, alongside the compiled output in <code>build/</code>. Public source repository: https://github.com/jordymeow/chagency</p>
<p>To rebuild from source:</p>
<pre><code>pnpm install && pnpm run build
</code></pre>
<p>The build is <code>@wordpress/scripts</code> (webpack) with no custom plugins or transforms.</p>


Chagency


Nobody cares. Or maybe some do. I do! 😼 The first and only chatbot (as of today) to use the AI Client that ships with WordPress (from v7). This chatbot is perfect for testing the AI Client and the AI providers built for it.


The 1st and only chatbot to use the AI Client

The first chatbot built natively on the WordPress 7 AI Client. No bundled SDKs, no third-party JavaScript, no telemetry.

lightsyncpro

tagteamdesign

<p>WordPress stores API keys in your database in plain text by default. If your database is compromised through SQL injection, a backup leak, or a vulnerable plugin, every API key is exposed. WordPress 7.0’s new Connectors API stores AI provider keys the same way (core ticket #64789).</p>
<p><strong>Syncific Vault fixes this.</strong> Your API keys are moved to an encrypted vault hosted off-site. Your WordPress database stores only a reference — the real key is injected at request time and never persists locally.</p>
<p><strong>One vault for all your AI plugins.</strong> Store your API keys in Syncific Vault — not in your database. Paste the secure placeholder into AI Engine, ClassifAI, Elementor AI, or any plugin that needs it. When you rotate a key with your provider, update it once in Syncific Vault — every plugin gets the new key instantly.</p>
<h4>How it works</h4>
<ol>
<li>Paste your API key in the Syncific Vault settings page</li>
<li>The key is encrypted and sent to the Syncific Vault (AES-256, never in your database)</li>
<li>A secure placeholder key is generated — paste it into your other plugins’ settings</li>
<li>When any plugin makes an API call, Syncific Vault intercepts it and injects the real key</li>
<li>Other plugins work normally — they don’t know the key was swapped</li>
<li>If your database is dumped or compromised, no API keys are exposed</li>
</ol>
<h4>Supports any AI API key</h4>
<ul>
<li><strong>AI providers:</strong> OpenAI, Anthropic, Google AI, OpenRouter</li>
<li><strong>Any API</strong> that uses header-based authentication (custom domain support included)</li>
</ul>
<h4>Security</h4>
<ul>
<li>Keys encrypted with AES-256 in an isolated vault file — not a database</li>
<li>Vault file stored outside the web root with strict file permissions</li>
<li>Patent-pending broker architecture (US App. No. 19/440,404)</li>
<li>Keys never stored in wp_options, wp_postmeta, or any WordPress table</li>
<li>In-memory key retrieval only — credentials are not persisted in any WordPress storage layer (database, transients, or options)</li>
<li>One-click key rotation — update a key once, every plugin gets the new key instantly</li>
<li>Rate-limited vault access (60 requests/minute per site)</li>
<li>Fails open by design — vault outages never break your WordPress site, though AI features dependent on protected keys will fail authentication until the vault is reachable again</li>
</ul>
<h4>Protects against</h4>
<ul>
<li>Database dumps and backup file exposure</li>
<li>SQL injection attacks</li>
<li>Compromised plugins that read wp_options</li>
<li>Unauthorized phpMyAdmin or database client access</li>
<li>Hosting provider data breaches</li>
</ul>
<h4>External Service</h4>
<p>This plugin relies on the <strong>Syncific Vault API</strong>, an external broker service operated by <a href="https://syncific.com" rel="nofollow ugc">Syncific</a>, to store and retrieve encrypted API keys. All requests are sent to the broker endpoint at <code>https://lightsyncpro.com/wp-json/lsp-broker/v1/</code> — the broker host that Syncific operates for this service.</p>
<p><strong>What the service does:</strong> Syncific Vault provides encrypted off-site storage for API keys. Keys are encrypted with AES-256 and stored in an isolated vault file on the Syncific broker server (<code>lightsyncpro.com</code>) — not in your WordPress database.</p>
<p><strong>What data is sent and when:</strong></p>
<ul>
<li><strong>When you store a key:</strong> Your site URL, a hash of your site URL, a per-site authentication token, a single-use verification nonce, the API domain, the API key, a label, and the authentication header name are sent to the broker (<code>lightsyncpro.com</code>) via HTTPS. The broker then calls your site back once at <code>/wp-json/svault/v1/verify</code> to confirm site ownership before binding the key.</li>
<li><strong>When a plugin makes an API call to a protected domain:</strong> Your site URL hash, per-site token, and the API domain are sent to the broker (<code>lightsyncpro.com</code>) to retrieve the real key. The key is held in PHP memory only for the duration of the request and is never written to your database.</li>
<li><strong>When you remove a key (or uninstall the plugin):</strong> Your site URL hash, per-site token, and the API domain are sent to the broker (<code>lightsyncpro.com</code>) to remove the key from the vault.</li>
</ul>
<p>No other user data, site content, or visitor information is ever transmitted.</p>
<p><strong>Service links:</strong></p>
<ul>
<li><a href="https://syncific.com/terms.html" rel="nofollow ugc">Syncific Terms of Service</a></li>
<li><a href="https://syncific.com/privacy.html" rel="nofollow ugc">Syncific Privacy Policy</a></li>
</ul>
<h4>Supported AI Providers</h4>
<p>Syncific Vault includes preset support for the following AI provider APIs. <strong>This plugin does not connect to these services directly.</strong> They are the destination domains whose API keys are protected by Vault. When another plugin on your site makes a request to one of these domains, Syncific Vault intercepts the request and injects the protected key. The traffic to these providers originates from your other plugins (such as AI Engine, ClassifAI, or any plugin you’ve configured), not from Syncific Vault itself.</p>
<ul>
<li><strong>OpenAI</strong> (api.openai.com) — <a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms of Use</a> | <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a></li>
<li><strong>Anthropic</strong> (api.anthropic.com) — <a href="https://www.anthropic.com/legal/consumer-terms" rel="nofollow ugc">Consumer Terms</a> | <a href="https://www.anthropic.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a></li>
<li><strong>Google AI / Gemini</strong> (generativelanguage.googleapis.com) — <a href="https://ai.google.dev/gemini-api/terms" rel="nofollow ugc">API Terms</a> | <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a></li>
<li><strong>OpenRouter</strong> (openrouter.ai) — <a href="https://openrouter.ai/terms" rel="nofollow ugc">Terms</a> | <a href="https://openrouter.ai/privacy" rel="nofollow ugc">Privacy</a></li>
</ul>
<p>You may also add any other domain through the “Add Custom Domain” option in the plugin settings. Whatever domain you add becomes a protected destination — your other plugins continue to send requests to that domain as they normally would, and Syncific Vault transparently provides the credentials.</p>
<h4>Free and open source</h4>
<p>Syncific Vault is completely free. No limits on the number of keys you can protect.</p>
<h4>Made by Syncific</h4>
<p>Syncific Vault is built by the team behind <a href="https://syncific.com" rel="nofollow ugc">Syncific</a> — the creative asset sync platform. The same patent-pending broker architecture that protects OAuth credentials for Lightroom, Figma, Canva, and Dropbox now protects your API keys.</p>


Syncific Vault — API Key Protection & Security

Encrypt your AI API keys and keep them out of the WordPress database — one secure vault for WordPress 7.0 Connectors and every AI plugin.

Chagency vs Syncific Vault — API Key Protection & Security