codevera

<p>WordPress 7.0 introduced the Abilities API. Any active plugin can register an ability and the WordPress AI feature can then invoke it, consuming whatever credits or tokens your AI provider charges per call. By default every registered ability is exposed, and there is no built-in way to see what is exposed or to limit it.</p>
<p>Codevera AI Access Control adds a single settings screen that lists every plugin which has registered AI abilities, grouped by source plugin, and lets you allow or block each plugin as a whole or each individual ability.</p>
<p><strong>How it works:</strong></p>
<ol>
<li>The plugin watches every call to <code>wp_register_ability()</code> and records which plugin made the call.</li>
<li>The Settings -> Codevera AI Access screen groups those abilities by source plugin so you can see at a glance what is exposed.</li>
<li>Untick a plugin or a single ability and save. From the next request onwards, the AI feature can no longer see or invoke it.</li>
</ol>
<p><strong>Free:</strong></p>
<ul>
<li>Per-plugin and per-ability granular controls</li>
<li>Automatic detection of newly installed plugins that register AI abilities, with an in-admin notification so you can review them</li>
<li>Tamper-detect signature on the saved settings, with a fail-closed mode that blocks every non-core ability if the settings option is modified outside the plugin</li>
<li>Filter-level enforcement that neutralises a blocked ability before WordPress constructs it, plus a registry sweep that removes blocked abilities from the listings</li>
<li>Self-check that re-attaches the enforcement hooks on init, admin_init and rest_api_init if another plugin removes them</li>
<li>Search and filter inside each plugin card so large registries stay readable</li>
<li>No external requests, no telemetry, no licence checks</li>
<li>Works on multisite (per-site settings)</li>
<li>Translation ready</li>
</ul>
<p><strong>Works well for:</strong></p>
<ul>
<li>Sites where editorial staff use the WordPress AI feature and you want strict control over what context the AI can pull in</li>
<li>Agency sites where new plugins are installed regularly and you want to review their AI exposure before letting them in</li>
<li>Privacy-sensitive sites that need an explicit allow list of which plugins may expose data to an AI provider</li>
<li>Compliance-driven environments that need an auditable record of which plugins have been allowed to register AI abilities</li>
</ul>
<p><strong>Under the hood:</strong></p>
<ul>
<li>Uses only the official Abilities API surface: <code>wp_register_ability_args</code>, <code>wp_abilities_api_init</code>, <code>wp_unregister_ability</code></li>
<li>Source attribution from <code>debug_backtrace()</code> of the file that called <code>wp_register_ability</code>, normalised to a plugin slug</li>
<li>HMAC-SHA256 signature on the settings option, keyed to a <code>CVAIAC_SECRET</code> constant or <code>AUTH_SALT</code> fallback</li>
<li>No frontend assets shipped, all code runs in admin and on the AI Abilities REST routes</li>
<li>No database tables, just two options in <code>wp_options</code></li>
</ul>
<h3>External Services & Privacy</h3>
<p>This plugin does not contact any external service. It reads only local WordPress data. No telemetry, no analytics, no licence checks, no remote update checks beyond what WordPress core itself performs.</p>
<p>The plugin stores two options in the <code>wp_options</code> table:</p>
<ul>
<li><code>cvaiac_settings</code> – your allow and block selections, signed with an HMAC-SHA256 signature</li>
<li><code>cvaiac_ability_sources</code> – a map of ability name to source plugin slug, populated automatically as plugins register their abilities</li>
<li><code>cvaiac_schema_version</code> – an integer that records the storage format version, used for migration</li>
</ul>
<p>No personal data, no visitor data, and no AJAX requests to remote services.</p>
<p>When the plugin is uninstalled, all three options are removed.</p>
<h3>Support</h3>
<p>Email info@codevera.ai for support, bug reports, or feature requests. Include your WordPress version, PHP version, a list of other plugins that register AI abilities, and a description of the issue with steps to reproduce.</p>
<h3>Technical Requirements</h3>
<p>Minimum:</p>
<ul>
<li>WordPress 7.0 (required for the Abilities API)</li>
<li>PHP 7.4</li>
</ul>
<p>Recommended:</p>
<ul>
<li>WordPress 7.0 or higher</li>
<li>PHP 8.0 or higher</li>
</ul>
<h3>Privacy & Security</h3>
<p>The plugin does not collect or transmit any personal data. The settings option is stored locally and signed with an HMAC keyed to a site-specific secret. The source-tracker option contains only plugin slugs and ability names that are already public to any code running on the site.</p>
<p>Form submissions use a nonce and require the <code>manage_options</code> capability. The enforcement hooks run on every request that loads the Abilities API, so blocking takes effect from the next request after a setting is saved.</p>
<p>This plugin defends against opportunistic interference such as another plugin writing directly to the settings option, removing the enforcement hooks, or re-registering an ability that has already been blocked. It does not claim to be a security boundary against a fully hostile plugin that has code execution in the same PHP process. The safest practice is still to only install plugins you trust.</p>
<h3>Links</h3>
<ul>
<li>Website: https://codevera.ai</li>
<li>Support: info@codevera.ai</li>
</ul>


Codevera AI Access Control

Decide which plugins are allowed to expose their abilities to the WordPress AI feature. Block any plugin, or any single ability, with one click.

Jordy Meow

<p><strong>Chagency</strong> is the first chatbot to ship directly on top of the new AI Client introduced in WordPress 7.0 — <code>wp_ai_client_prompt()</code>, Connectors, and the Abilities API. Every prompt flows through WordPress core, every provider is a Connector you already configured under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connectors</strong>, and every action it exposes is a registered Ability that other plugins (and other AI agents) can call.</p>
<p>There is no other plugin on wordpress.org that builds on <code>wp_ai_client_prompt()</code> today. Chagency is the reference case: a small, native chatbot that proves the framework works, ships zero vendor SDKs, and grows alongside the Abilities API into a real agent.</p>
<p>It runs in the WordPress admin and, when you turn it on, on every page of your public site. The name (chat + ai + ency) is meant as a small bridge between the new AI primitives shipped with WordPress and the broader world of chat and agents. It starts as a chatbot today and turns into an agent tomorrow, without a rename.</p>
<h3>🪨 Built on WordPress, period</h3>
<p>Chagency relies entirely on what WordPress 7 ships in core:</p>
<ul>
<li><code>wp_ai_client_prompt()</code>, the AI Client API.</li>
<li><code>wp_get_connectors()</code>, the Connectors API.</li>
<li><code>wp_register_ability()</code> / <code>wp_get_ability()</code>, the Abilities API.</li>
<li><code>@wordpress/components</code>, <code>@wordpress/element</code>, <code>@wordpress/boot</code>, the Gutenberg toolkit.</li>
</ul>
<p>That is the entire dependency surface. <strong>No bundled AI vendor SDKs, no third-party JavaScript libraries beyond the Gutenberg stack, no telemetry, no phone-home.</strong> The plugin stays small on purpose: fewer moving parts means less friction, fewer security holes, less to break when WordPress, browsers, or providers change.</p>
<p>You will need at least one AI provider plugin (e.g. <em>AI Provider for Anthropic</em>, <em>AI Provider for Google</em>, <em>AI Provider for OpenAI</em>) to talk to a model. That is WordPress 7’s architecture: providers are separate plugins that register a Connector. They are not a Chagency dependency.</p>
<p>💡 <strong>Tip:</strong> For the smoothest setup, install <a href="https://wordpress.org/plugins/ai-engine/" rel="ugc">AI Engine</a>. It registers every AI provider it manages as a Connector, so a single configuration covers all your WordPress 7 AI plugins (including Chagency). Every request then flows through one clean, unified system.</p>
<h3>🪄 What you get</h3>
<ul>
<li>A floating chat panel pinned to the bottom-right of every page (admin and / or public site, controlled by two independent toggles).</li>
<li>A single settings page under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Chagency</strong>, with the bare minimum: where to show the chatbot, the chat title, the greeting, the system instruction, and the model preference.</li>
<li>Live updates: flipping a toggle in Settings shows or hides the launcher immediately on the same page, no reload needed.</li>
<li>Per-provider <strong>Test</strong> buttons that fire a canary prompt and report round-trip time.</li>
<li>Conversation persistence in your browser’s localStorage, scoped per user.</li>
<li>Placeholder expansion (<code>{user_name}</code>, <code>{site_name}</code>, <code>{current_page}</code>, <code>{current_url}</code>, <code>{user_role}</code>, <code>{site_url}</code>) so the assistant always knows who and where it is.</li>
<li>Exposed as an Ability (<code>chagency/send-message</code>) so other plugins, MCP clients, and AI agents can invoke Chagency directly.</li>
</ul>
<h3>🚀 Getting started</h3>
<ol>
<li>Install and activate <strong>Chagency</strong>.</li>
<li>Install and configure at least one AI provider plugin under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connectors</strong> (we recommend <a href="https://wordpress.org/plugins/ai-engine/" rel="ugc">AI Engine</a>, which exposes all its providers as Connectors at once).</li>
<li>Click the chat launcher in the bottom-right of any admin page and start talking.</li>
<li>Want it on the public site too? Open <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Chagency</strong> and flip the second toggle.</li>
</ol>
<h3>🙋 Frequently Asked Questions</h3>
<h4>Why “Chagency”?</h4>
<p>It’s a portmanteau of <em>chat</em>, <em>AI</em>, and a bit of <em>agent</em>. Not “agency” in the sense of a marketing shop. The plugin starts as a minimal chatbot for the new WordPress 7 AI framework and grows alongside the Abilities API into a true agent.</p>
<h4>Does it need WordPress 7?</h4>
<p>Yes. It uses <code>wp_ai_client_prompt()</code>, <code>wp_get_connectors()</code>, and the Abilities API, all added in WordPress 7.0. On older versions it refuses to boot and tells you why.</p>
<h4>Which AI providers are supported?</h4>
<p>Whatever you configure under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connectors</strong>. Chagency is provider-agnostic. Anthropic, Google, OpenAI, or any third-party Connector are treated equally.</p>
<h4>Can visitors on the front end use it?</h4>
<p>Yes. Open <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Chagency</strong> and turn on <em>Show on the public site</em>. The chat then appears for every visitor, signed in or not.</p>
<h4>Does it store my conversations?</h4>
<p>No. Conversations live only in your own browser (localStorage, per user). Hit <em>Reset</em> in the panel to clear them. Nothing is stored server-side.</p>
<h4>Can I use it as a building block in my own plugin?</h4>
<p>Yes. The <code>chagency/send-message</code> Ability is registered on <code>wp_abilities_api_init</code> and can be called with <code>wp_get_ability( 'chagency/send-message' )->execute( array( 'message' => '...' ) )</code>.</p>
<h3>Source code</h3>
<p>The unminified React / JavaScript source is shipped inside the plugin folder under <code>src/</code>, alongside the compiled output in <code>build/</code>. Public source repository: https://github.com/jordymeow/chagency</p>
<p>To rebuild from source:</p>
<pre><code>pnpm install && pnpm run build
</code></pre>
<p>The build is <code>@wordpress/scripts</code> (webpack) with no custom plugins or transforms.</p>


Chagency


Nobody cares. Or maybe some do. I do! 😼 The first and only chatbot (as of today) to use the AI Client that ships with WordPress (from v7). This chatbot is perfect for testing the AI Client and the AI providers built for it.


The 1st and only chatbot to use the AI Client

The first chatbot built natively on the WordPress 7 AI Client. No bundled SDKs, no third-party JavaScript, no telemetry.

Codevera AI Access Control vs Chagency