NV Digital Open Operator System (NVoOS)

Version: 1.2.15 Release Date: 2026-11-01

See § Release History for the 12 most recent releases; every older release is in the Previous Releases table. Full detail: CHANGELOG.md.

🆕 v1.2.15 Highlights: the Astro Forge WP→Astro generator ships end-to-end (Proposal 096, MIT) — content-layer loader, sanitizer, scaffold CLI, WooCommerce storefront template, site_analyze, the 29-tool /mcp surface, and the companion standalone plugin nvoos-forge-bridge (0.1.0); the design-language import pipeline (Proposal 098 — inspired-by, never a clone) with draft/publish bridge products; Proposal 095 completes (CMS/ops slices, NDS DTCG round-trip, the /manage Design tab); the console brands from the WordPress site title and Records remote browsing ships; the npx MCP bridge gains manager-session bootstrap; the MCP gateway goes live on the official registry (0.2.0 + the PUBLIC_SITE_SLUGS privacy filter); the dictate release pipeline is fixed end-to-end. Tool count unchanged: ~355 base + ~1,378 Pro (~1,732 total; live registry authoritative). Coding-time skills 79 → 81.

MCP Specification: 2026-07-28 (Stateless Core, Full Compliance)
Maintained by NV Digital
License: GPLv3 or later
Requires: WordPress 6.0+, PHP 7.4+
Patent Status: Patent Pending (Application #19/410,504)
Documentation: Grade A (95/100) — 1,617 files across 12 directories, 108 admin screenshots, 100% feature coverage

🔍 For Reviewers & Auditors

New to this repo? Start here → docs/project/FOR_REVIEWERS.md

That document answers every common question in one place: what the project is, current security posture, what's production vs experimental, PHP version requirements, AI development methodology, compliance status, and scoping advice for a limited-budget review.

Quick links for reviewers:

• Addon Inventory — what each of 30 addons does and its status

• Security Posture — current state of all 50 audit findings

• Compliance Traceability — every .org rejection reason → commit → verification command

• AI-Assisted Development — methodology, transparency, and what to scrutinize

• Architecture Overview — component diagram and data flow

Related MCP server: WP MCP Ultimate

📑 Table of Contents

Getting Started

• 🧩 Overview

• 🎯 Our Mission

• 🛡️ Active Security Monitoring

• ⚠️ Warranty & Safe Use

• 🏗 System Architecture

• 🚀 Features

• 📦 Installation

  • 🌱 Try It on Your PC

• 🔌 What You Lose Without Third-Party Plugins

• ⚙️ Configuration Checklist

• 📚 Documentation

Core Functionality

• 🧠 Memory & Tool Stack Overview

• 🛠 Built-in tools & automations

• 🗨️ Front-end chat surfaces

• 💬 Frontend Shortcode

Addons & Extensions

• 🏗 System Architecture (covers addon ecosystem)

Orchestration & AI Features

• 🏗 System Architecture (covers orchestration, harnessing, MCP servers, memory bridge)

AI Providers & Integration

• 🧠 Language Model Providers

• 🧱 ChatKit Integration

• 🌐 Crawl4AI Integration

• 📡 Job Notification System

• 🧊 Elementor Widgets

Performance & Optimization

• ⚡ Message Bundling

• 🎯 Agentic Loop Token Management

• 🔄 Chat Performance Optimizations

• 🌐 Mesh Compute Routing

• 🔗 Federation & Discovery System

Remote MCP Setup

• 🔒 MCP Server Authentication

• 🌐 Connecting Remote MCP Clients

• 🛰 REST API Endpoints

• 🌊 SSE Streaming Support

• 📝 MCP JSON-RPC 2.0 Endpoint

• 🔑 Assistant API Credentials

• 🎫 Token Management UI

Assistant Management

• 🛠 Assistant Editor Overview

• 📊 Assistant Storage: CPT vs CCT

• ⚡ Assistant Tool Shortcuts

• 🧠 Agent Skills

• 👔 Professional & Team Layers

• 🧵 REST Chat Payloads & Attachments

Development

• 🐳 Local Development with Docker

• 🧑‍💻 Development Tooling

• 📦 NPM Packages

• 🧪 Testing & QA

• 🧩 Hooks & Filters

• 🧰 WP-CLI Commands

Reference

• 🔐 JetEngine Capability Reference

• 🛰 JetEngine REST API Reference

• 🧮 Usage Tracking

• 🧷 Attachment MIME Controls

• 🧾 Logging

• 🧾 JetEngine REST Endpoint Report Helper

• 🔌 Optional Tools & Dependencies

• ✅ Manual QA Scenarios

Changelog

• 📜 Release History

• 📋 Previous Releases

Sponsor & Support

• ❤️ Sponsor & Support

🗺 Repository Map

🧩 Overview

Real-time AI Orchestration Toolkit / Harness for Wordpress - NV oOS is a modular AI framework (Object-Oriented System) for WordPress that connects your site's data with 18 language-model providers: OpenAI, Gemini, Anthropic, DeepSeek, OpenRouter, Baseten, Kimi (Moonshot), Z.AI (GLM), DigitalOcean, NVIDIA NIM, Cloudflare Worker AI, Azure, Ollama, LM Studio, Hugging Face, and TypeSafe Jev (decision-only), plus local WebLLM and embedded engines. It allows you to create and manage AI Assistants that can interact with users, access WordPress data, and perform custom tool functions.

✨ What's New at a Glance (v1.2.15)

• 🏗 Astro Forge ships end-to-end (Proposal 096, Phases 0–4, MIT). examples/nvoos-astro-forge turns any WordPress/WooCommerce site into an Astro 7 headless frontend: the content-layer loader, the versioned sanitize-html XSS gate, the scaffold CLI, the blog + WooCommerce templates, site_analyze discovery, tokens_apply + a dependency-free WCAG contrast gate, the SEO suite (RSS/404/301 map), Pagefind search, and the /mcp tool surface (29 tools + 3 meta, dual-era, fail-closed write auth, SSRF guard) — plus the companion standalone plugin plugins/nvoos-forge-bridge 0.1.0 (HMAC rebuild webhooks, preview tokens, 23-test suite on WP 6.9 + 7.1).

• 🎨 Design-language import (Proposal 098). URL → design language → adapted, content-first theme: design_analyze/design_compare/design_plan/design_theme (SSRF-safe, WCAG-audited, DTCG + runtime-theme emission); the bridge product contract gains draft/publish status; live color-harvest fixes (#NaNNaNNaN rgba roles, on-accent ink classification).

• 🧩 Proposal 095 completes. The nvoos-astro-mcp 0.2.0 CMS/ops slices (cms_*, media_upload, site_status, preview_url, rebuild_trigger, screenshot — per-IP rate limits, audit log, design-vs-contract auth split); the NDS DTCG round-trip (nds_export + the NDS addon importer); the /manage Design System tab; the astro:build:done /mcp bundle fix; the bridge admin-SPA MIT carve-out (Q8).

• 🏷 Console branding + Records. The Complete Console brands from the WordPress site title (nav logo, browser tab, siteName through the Pro SPA config); Records remote browsing is opt-in per surface and enabled on all five command-center pages; empty detail grids fall back to the wp/v2 core fields.

• 🔌 MCP bridge sessions (npm 0.1.0-alpha.5). The npx bridge logs in via MCP_AI_LOGIN_URL + credentials and drives session-gated write surfaces (live-verified on astro.nvoos.cloud); SDK-v2 Accept/SSE protocol fixes.

• 🛡 Gateway live on the official MCP Registry. io.github.nvdigitalsolutions/nvoos-mcp-gateway v0.2.0 published (2026-11-01) after the runtime version-marker fix, the 100-char description trim, and the new PUBLIC_SITE_SLUGS privacy filter on the public /health.

• 🎤 Dictate release pipeline fixed. contents: write grant, tauri CLI + softprops release job, Apple signing env only when secrets exist, Windows exe artifact; the nvoos-dictate-v0.2.0 tag re-pushed (sub-project).

• 🐞 Dependencies. multer 2.5.0, the 2026-10-30 sweep (44 alerts incl. the astro-bridge zod 3→4 real-semantics fix), follow-redirects floor 1.16.2 (minimatch #7358 + glob #7359 deferred). Proposal 099 (ChatGPT OAuth connector) ships as docs + a 7-test PKCE e2e harness.

• 📚 Docs & skills. Two new coding-time skills — mcp-ai-wpoos-astro-forge, mcp-ai-wpoos-gateway-ops (79 → 81); the client-reference scrub; session learnings folded into astro-storefront, git-ops, and dependabot-loop. Proposals 096/098/099 shipped in-window (098 + 099 proposals-README registration deferred — recorded in the catch-up plan).

• 📦 Versioning — bumped to 1.2.15 across all version-bearing files. Pro addon: 1.2.15. No addon version moves — MCP Gateway stays 0.2.0 (the runtime marker fixed), Design System stays 0.3.0 (the importer ships app-side). Model catalog: v2026.10.03 (unchanged — zero diff). Provider count: 18 (unchanged). Addon count: 30 (unchanged). Media Worker: 3.4.0 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Security classes: 12 (unchanged). Tool count: ~355 base + ~1,378 Pro (~1,732 total — unchanged); the astro-mcp/Forge MCP tools are app-side (described, not counted); live registry authoritative. Stale build ZIPs removed: the 1.2.13 oOS set (30 files — 9 + 2 + 19); 1.2.14 stays as the fallback.

🎯 Mission: Modernizing Small to Medium Business Websites

NV oOS is specifically designed to help small to medium-sized businesses fast-track their outdated, stale, or insecure company websites to modern technology standards—without the need to add yet another wrapper around API calls. Instead, we're trying to peel back decades of API wrappers with the help of AI, providing:

• Direct AI Integration - No middleware required. Connect directly to OpenAI, Gemini, Anthropic, Hugging Face, Cloudflare Worker AI, Ollama, LM Studio, OpenRouter, and DeepSeek without custom development

• Security-First Architecture - Built-in protection against nefarious usage with active monitoring and prevention systems

• Enterprise-Grade Features - Access to capabilities typically requiring expensive custom development

• Compliance & Audit Tools - Comprehensive logging, rate limiting, and usage tracking built-in

• Zero Technical Debt - Modern codebase following WordPress standards, ready for current technology stacks

🛡 Active Security Monitoring

NV oOS actively prevents and monitors against nefarious behavior. The plugin includes:

• Nefarious Usage Monitor - Real-time detection of suspicious patterns and automatic emergency shutdown capabilities【F:includes/class-wp-mcp-ai-nefarious-usage-monitor.php†L1-L676】

• Root Security Key - Optional emergency authentication layer to prevent unauthorized reactivation after security incidents【F:docs/features/security/root-security-key.md†L1-L511】

• Granular Capability Controls - Every tool and API endpoint enforces WordPress capabilities to prevent unauthorized access

• Rate Limiting - Built-in protection against abuse with configurable limits per user, model, and time period

• Comprehensive Audit Logging - Track all API calls, tool executions, and security events for compliance and forensic analysis

• Input Sanitization & Output Escaping - All user input sanitized, all output escaped following WordPress security best practices

This is not a tool for circumventing security or promoting bad practices. Every feature is designed with security, transparency, and responsible AI usage as core principles. The plugin actively works to stop and prevent misuse before it happens.

Latest audit: See docs/operations/compliance/SECURITY_AUDIT_2026_04.md — the published summary of the April 2026 security & compliance code review (no Critical findings; 5 High items, 3 Fixed and 2 Partially Fixed). Full deliverables under docs/project/audits/2026-04/.

WordPress.org compliance hardening (May 9, 2026): docs/operations/compliance/WORDPRESS_ORG_COMPLIANCE_2026_05_09.md — findings B3, B8, B10, B13, and production vendor remap all resolved.

⚠ Warranty & Safe Use

We make every effort to keep NV oOS safe and secure — but by design, it can be destructive and resource-intensive when not properly configured.

NV oOS grants AI assistants access to powerful WordPress operations. The same capability that automates real work can cause irreversible harm if misconfigured:

• Destructive tools — bulk content deletion, user management, file writes, mass email, WP-CLI, direct database operations

• API billing exposure — uncapped AI provider calls can exhaust quotas and trigger unexpected charges

• Server resource exhaustion — concurrent agentic loops and SSE streams can saturate CPU/memory on shared hosting

Before going live: test on staging, take verified backups, apply least-privilege tool permissions, enable rate limiting, and review the system prompt of every public-facing assistant.

📄 Full details: WARRANTY.md — security commitment, "AS IS" disclaimer, destructive-operations table, resource-consumption guide, and mitigation checklist aligned with OWASP, NIST SP 800-53, ISO/IEC 27001, and the WordPress Plugin Developer Handbook.

Patent Pending

NV oOS is the subject of a pending patent application for its novel System and Method for Dynamic AI Orchestration Layer with Real-Time Capability Gating and Resource Budgeting.

Application Number: 19/410,504

The patent covers NV oOS's innovative approach to implementing sophisticated AI orchestration in WordPress's request-based PHP architecture—a platform not designed for real-time streaming, asynchronous operations, or persistent state management. This technical achievement enables enterprise-grade AI capabilities on WordPress by recreating event-driven behavior within PHP's synchronous execution model.

Key Innovations Covered:

• Dynamic resource budget allocation during streaming operations

• Capability-based access control for AI tool execution

• Registry-state-based scheduling in stateless environments

• Metrics-driven budget adjustment for real-time optimization

• Persistent-behavior illusion in request-based architectures

The orchestration layer makes NV oOS unique in the WordPress ecosystem by solving fundamental architectural limitations that prevent traditional WordPress plugins from supporting advanced AI features. See the System Architecture section below for technical details on how these innovations work together.

🏗 System Architecture

NV oOS implements a comprehensive orchestration layer for managing AI operations during real-time streaming events. The system architecture comprises:

• 18 language-model providers — OpenAI, Gemini, Anthropic, DeepSeek, OpenRouter, Baseten, Kimi (Moonshot), Z.AI (GLM), DigitalOcean, NVIDIA NIM, Cloudflare Worker AI, Azure, Ollama, LM Studio, Hugging Face, TypeSafe Jev (decision-only), plus local WebLLM + embedded engines

• ~1,732 tool classes (~355 base + ~1,378 Pro; live count via WP_MCP_AI_Tool_Registry::get_tools() is authoritative) registered through a singleton Tool Registry

• 36 REST controllers (16 base + 20 pro) under the mcp-ai/v1 namespace

• 64 service classes powering orchestration, budgets, and workflows

• 5 authentication methods — WordPress nonce, assistant credentials, mesh keys, Auth0 JWT, guest tokens

• Toolkit MCP servers — per-toolkit JSON-RPC 2.0 servers exposed under /wp-json/mcp-ai-pro/v1/mcp/{slug}; discoverable at /.well-known/mcp

• 8 inline-async-tick consumers — cooperative tick-lock pattern eliminates WP-Cron startup latency for background jobs (transcript mining, async tool executor, SaaS Apply, Crawl4AI, Docs Hub rebuild, Graphify reindex, Harness eval, Gemini Veo polling)

• 7 LLM Harness layers (+ 1 Pro) — opt-in epistemic layers A–H activated per-assistant via the LLM Harness metabox

• Orchestration Phases 1–7 — HITL approval queue, prompt-injection detector, structured output, OTel exporter, DAG builder, durable runs, triggers/webhooks, sub-agents

📖 For a detailed explanation of how NV oOS extends standard SSE and MCP protocols with novel orchestration features, see ORCHESTRATION-LAYER-ARCHITECTURE.md

Core Orchestration Layer: Overcoming PHP's Limitations

Critical Context: Most real-time AI streaming systems are built with Node.js, Python FastAPI, or Go — platforms designed for asynchronous, event-driven operations. These platforms natively support:

• Long-lived connections and persistent state

• Non-blocking I/O and parallel execution

• Event loops and asynchronous callbacks

• WebSocket protocols and SSE streaming

NV oOS achieves the same capabilities in PHP/WordPress — an environment fundamentally not designed for these patterns — through a sophisticated orchestration layer that creates a "persistent-behavior illusion":

1. Real-Time Budget Enforcement - Monitors token/memory usage during streaming, prevents exhaustion through predictive allocation

2. Capability-Based Tool Gating - WordPress role-based access control for AI tool execution

3. Predictive Optimization - Analyzes usage patterns to prevent resource overruns before they occur

4. Distributed Orchestration - Multi-provider support with policy-aware routing

5. Auditability & Compliance - Complete governance layer with logging and rate limiting

6. Cron-Based Task Orchestration - Extends orchestration to async operations with budget inheritance

Multi-Agent Orchestration Enhancement (DeepSeek V4-Inspired)

Added: January 2026 (v1.1.0)

Building upon the core orchestration layer, NV oOS now includes a sophisticated multi-agent coordination framework inspired by DeepSeek V4's orchestration patterns:

Key Components:

• Agent Role System - Four specialized roles (Planner, Executor, Critic, Specialist) with role-specific capabilities

• Team Composition - Automated team assembly based on task requirements and profession expertise

• Coordinated Workflows - Multi-step workflows with agent delegation, result aggregation, and validation

• Team CPT Integration - Persistent team configurations with orchestration modes (single/sequential/parallel/swarm)

• Profession-Based Discovery - 296 professions auto-assigned agent roles via intelligent seeding across 17 knowledge bases

Example Multi-Agent Workflow:

// 1. Compose research team (planner + executors + critic)
$orchestrator = new WP_MCP_AI_Agent_Team_Orchestrator();
$team = $orchestrator->compose_team( array( 'task_type' => 'research' ) );

// 2. Execute coordinated workflow
// Planner decomposes task → Executors research subtasks → 
// Communication service aggregates → Critic validates quality
$result = $orchestrator->execute_team_workflow( $team, $task, $context );

Documentation:

• See Multi-Agent Orchestration for complete technical details

• See DEEPSEEK-V4-README.md for documentation suite overview

• See DEEPSEEK-V4-USAGE-GUIDE.md for practical examples

Why This Architecture Is Novel: Overcoming PHP's Limitations

• Event loops and background workers

PHP/WordPress, by contrast, is fundamentally request-based:

• Every HTTP request spawns a new process that dies after responding

• I/O operations block execution

• No persistent memory between requests

• No native event loop or async coordination

NV oOS solves this by implementing an orchestration layer that creates a "persistent-behavior illusion" — effectively recreating Node.js's event loop behavior within WordPress's synchronous, request-based architecture. This architectural compensation is the system's core technical innovation:

This makes NV oOS patent-worthy as a technical workaround — it achieves sophisticated AI orchestration in an environment specifically not designed for such patterns. See ORCHESTRATION-LAYER-ARCHITECTURE.md for the complete technical analysis.

Computer-Implemented Resource Management

The system operates as a computer-implemented method executing on a processor with memory, performing:

1. Dynamic Resource Budget Allocation: The orchestration layer dynamically allocates token and memory budgets to tool execution requests based on real-time system capacity and operation requirements. The WP_MCP_AI_Resource_Manager continuously monitors server resources (PHP memory limits, execution time constraints) and automatically adjusts operational parameters.

2. Capability-Based Access Control: Tool execution endpoints enforce granular capability-based access controls. Each tool in the registry declares required WordPress capabilities, and the REST API controller validates user permissions before allowing execution. This ensures secure, policy-driven access to all operations.

3. Registry-State-Based Scheduling: The WP_MCP_AI_Tool_Registry maintains tool availability state and schedules execution based on policy constraints. Tools are loaded conditionally based on dependency availability, and execution is scheduled according to assistant configuration and user permissions.

4. Metrics-Driven Budget Adjustment: The system continuously monitors execution metrics (memory usage, API response times, token consumption) and adjusts resource budgets in response to prevent resource exhaustion and reduce latency. The WP_MCP_AI_Token_Budget_Manager implements safety margins and dynamic chunking to prevent API limit overruns.

System Components

The system comprises a processor and memory storing instructions that:

• Monitor real-time resource availability through PHP runtime introspection

• Enforce capability checks at REST endpoint boundaries

• Schedule tool execution through a centralized registry

• Adjust token and memory budgets based on detected system metrics

• Maintain operation logs for audit and optimization

This architecture is embodied in non-transitory computer-readable media (PHP source files) that, when executed by a web server processor, cause the system to perform the complete resource management workflow. The implementation prioritizes stability, security, and efficient resource utilization across diverse hosting environments.

Symfony Process Integration (December 2025)

NV oOS Pro addon integrates the Symfony Process component for secure external command execution. This modern framework replaces direct exec() calls in 6 Pro tools and 2 supporting services, providing:

• Enhanced Security: Proper argument escaping and command validation

• Timeout Management: Configurable timeouts with graceful handling

• Better Error Handling: Comprehensive exception catching and WordPress-friendly error reporting

• Process Control: Real-time output streaming and cancellation support

Migrated Tools & Services:

• FFmpeg operations (video frame extraction, metadata reading)

• Python rembg (background removal)

• WP-CLI execution

• Meta AI Jukebox (music generation)

• Supporting services for video and audio processing

The Process Service (WP_MCP_AI_Process_Service) provides WordPress-friendly wrappers with WP_Error integration, making external process execution consistent with WordPress coding standards.【F:includes/services/class-wp-mcp-ai-process-service.php†L1-L220】【F:docs/history/2025/implementations/symfony-phases/SYMFONY_PHASE2B_PROCESS_INTEGRATION.md†L1-L100】

📜 Release History

The 12 most recent releases are documented in full below. Every older release has a one-line summary in the Previous Releases table, and complete per-release detail lives in CHANGELOG.md.

v1.2.15 — November 01, 2026

Astro Forge Ships End-to-End, Design-Language Import, Gateway Live on the MCP Registry

• 🏗 Astro Forge (Proposal 096, Phases 0–4, MIT). examples/nvoos-astro-forge turns any WordPress/WooCommerce site into an Astro 7 headless frontend: the WP REST client (_fields/_embed pruning, explicit truncated), the content-layer loader, the versioned sanitize-html allowlist (the mandatory XSS gate before set:html), the scaffold CLI, the blog + WooCommerce templates (wc/v3 consumer-key auth from .env), site_analyze discovery, tokens_apply + a dependency-free WCAG contrast gate, the SEO suite (RSS/404/_redirects 301 map), SmartImage (same-host through Astro Image, external passthrough), Pagefind search, and the /mcp tool surface — 29 tools + 3 meta, dual-era, single-source registry, fail-closed write auth, an SSRF guard — plus setup_wizard, the AES-256-GCM vault, octokit deploys, and the generated pipeline. The companion standalone plugin plugins/nvoos-forge-bridge 0.1.0 ships HMAC rebuild webhooks + single-use preview tokens with a 23-test suite on WP 6.9 + 7.1 (sub-project, own track).

• 🎨 Design-language import (Proposal 098). URL → design language → adapted, content-first theme: design_analyze/design_compare/design_plan/design_theme (SSRF-safe fetcher, deterministic analyzer, WP theme.json + GitHub-trees source modes, opt-in rendered capture, WCAG audit, DTCG + runtime-theme emission); the bridge product contract gains draft/publish status (drafts 404 publicly); live fixes for #NaNNaNNaN rgba roles and on-accent ink classification (#7334).

• 🧩 Proposal 095 completes (#7318/#7320/#7322/#7323/#7325). nvoos-astro-mcp 0.2.0 gains the CMS slice (cms_* + media_upload), the ops slice (site_status/preview_url/rebuild_trigger/screenshot), state-file durability, per-IP rate limits, an audit log, request context, and the design-vs-contract auth split; the NDS DTCG round-trip (nds_export + the NDS addon's importer) and the /manage Design System tab ship; the /mcp bundle survives production builds via the astro:build:done integration; the bridge admin SPA carries its own MIT grant (Q8); the browser rebrand e2e fixed the env-snapshot 401 and the promo-island race.

• 🏷 Console branding + Records (#7321/#7324/#7326/#7327/#7330). The console brands from the WordPress site title (nav logo, browser tab, siteName through the Pro SPA config); Records remote browsing is opt-in per surface and enabled on all five command-center pages; empty detail grids fall back to the wp/v2 core fields.

• 🔌 MCP bridge sessions (npm 0.1.0-alpha.5, #7328). MCP_AI_LOGIN_URL + credentials bootstrap a manager session for the published npx bridge (cookies attached to every upstream request, one 401/403 re-establishment) — live-verified against astro.nvoos.cloud; SDK-v2 Accept/SSE-unwrap protocol fixes.

• 🛡 Gateway live on the official MCP Registry (#7345–#7349). io.github.nvdigitalsolutions/nvoos-mcp-gateway v0.2.0 published (2026-11-01) after the runtime version-marker fix (the health test now pins the package.json contract), the 100-char description trim, the PUBLIC_SITE_SLUGS privacy filter on the public /health (typo warns, never fatal), and the logo asset.

• 📝 Proposal 099 + PKCE harness (#7361/#7362). The ChatGPT OAuth connector plan (Auth0 AS half, DCR + S256 mandates — awaiting owner decisions) ships as docs; the hermetic PKCE e2e harness drives the real client sequence through an in-process fake AS (7 tests; 27/27 OAuth group; static keys keep working — dual mode).

• 🎤 Dictate release pipeline fixed (#7351/#7353/#7354/#7356 + main twins). contents: write, tauri CLI + softprops release job, Apple signing env only when the secrets exist, Windows exe artifact; the nvoos-dictate-v0.2.0 tag re-pushed (sub-project).

• 🛠 Dependencies + skills. multer 2.5.0 (#7308); the 2026-10-30 sweep — 44 alerts incl. the astro-bridge zod 3→4 migration's real .refine()-on-undefined semantics fix (#7311); follow-redirects floor 1.16.2 (5 manifests; minimatch #7358 + glob #7359 deferred). Two new coding-time skills (mcp-ai-wpoos-astro-forge, mcp-ai-wpoos-gateway-ops — 79 → 81) + the client-reference scrub + session learnings folded into astro-storefront/git-ops/dependabot-loop.

• 📦 Versioning — bumped to 1.2.15 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.15. No addon version moves in-window (MCP Gateway stays 0.2.0 — runtime marker fixed; Design System stays 0.3.0 — importer ships app-side; the Astro Bridge license column corrected to Mixed in-window). Media Worker: 3.4.0 (unchanged). Model catalog: v2026.10.03 (unchanged — zero diff). Tool count: ~355 base + ~1,378 Pro (~1,732 total — unchanged) — zero registry diffs in-window (the astro-mcp 20 + Forge MCP 29+3 tools are app-side, described-not-counted; live registry authoritative). Provider count: 18 (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Coding-time agent skills: 79 → 81. Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.13 oOS set (30 files — 9 + 2 + 19); the 1.2.14 set stays as the current fallback.

v1.2.14 — October 30, 2026

Astro Storefront Lands, Bridge Rename + /manage Cookie-Auth Restored, F&B Multi-Connection, Gateway Policy Layer

• 🛰 Astro storefront lands end-to-end (Proposals 092 + 095). The bridge renames to Astro Bridge 1.0.1 (nvoos-astro-bridge; data-layer identifiers deliberately unchanged) and gains the standalone Astro CMS /manage surface — sign-in through the contract's own auth routes (no admin proxy), a managers section, and WooCommerce as a product source behind the same nvoos-commerce/v1 envelope. REST cookie-auth restored on single-site HTTPS: WP's REST pipeline force-logs-out cookie sessions before the callback runs, so the bridge re-resolves the session inside its permission callbacks (AuthSupport) and mints /auth/nonce for the restored session — the /manage 401/403 outage fixes, verified live. The Astro Design System token pipeline (DTCG core → semantic → component, light/dark, CI drift gate) and nvoos-astro-mcp (/mcp, SDK v2 dual-era, fail-closed write auth) ship alongside; the mirror deploy loop hardens (BFF admin-proxy rewrites, SSR base precedence, serve.mjs runtime libs, esbuild JS API builds).

• 🍽 F&B multi-connection Drive routing (Proposal 093). Per-table connection_id + folder_id source mapping with the Table Sources review panel (Scan & propose, tiered apply/discard) — cross-connection joins work, and the panel's apply/discard buttons fire (nested-form fix).

• 🔑 Google Workspace fallback + restricted-assistant settings grant. Calendar/Gmail auto-resolve the only enabled Remote Sites connection; the assistant editor gains a synthetic "settings" grant row honoured by Gmail, Drive, Calendar, FlowHub, QuickBooks, and iSAMS — fail-closed unchanged without it.

• 🛡 MCP gateway policy & governance layer (Proposal 094, gateway 0.2.0). W3C traceparent propagation, per-tool token-bucket quotas scoped (key × site × tool) with RFC 9558 headers, tool/scope deny-lists — env/Git-configured, zero new dependencies, fail-closed.

• 🧩 Commerce tabs regrouped. EZuite ERP / Shopify Sync / FlowHub render as subtabs of E-Commerce (subtab_of); register_tab() merges over existing definitions so re-registrations never drop structural keys.

• 🐞 Fixed. Front-end asset leaks on visitor pages (quick-actions, cron-status.css, markup Konva); OKF neighbour ordering deterministic (concept_id sort); fast-uri (16 alerts) + undici advisories closed.

• 📚 Docs & skills. Proposals 092/093/094/095 (093 + 094 registered this pass). Three new coding-time skills: mcp-ai-wpoos-astro-storefront, mcp-ai-wpoos-git-ops, mcp-ai-sdk-v2-server-ops (76 → 79); six updated in place. Stale 1.2.12 build ZIPs removed (30 files); 1.2.13 stays as the fallback.

v1.2.13 — October 27, 2026

Dify Parity Gap-Fill, Console Pagination & Role Gating, OAuth + Remote Sites Hardening

• 🔄 Dify parity gap-fill (PRs #7246, #7247, Proposal 091). Workflow DSL export/import — the new WP_MCP_AI_Workflow_DSL_Codec with the DSL v1 envelope (dsl_version), validation findings (errors block / warnings don't), credential redaction by default, canonicalization, and the accept_legacy_json() backward-compat gate; DSL-aware REST routes (dry_run, dsl string input, source: native|dify) + POST /orchestration/workflows/export by source; wp mcp-ai workflow export|import|validate; the base admin DAG-builder UI; the Pro DSL bridge (presets export directly + one-way best-effort Dify import with honest foreign stubs); Pro SPA export buttons + the dry-run findings import panel. Prompt versioning lite — WP_MCP_AI_Prompt_Versions (immutable snapshots, versioned restores, explicit production promotion, 50-version cap, hooks) + GET/POST /mcp-ai/v1/assistants/{id}/prompt-versions[/{v}/restore|promote] + WP-CLI + the Pro version-picker metabox. Ordered fallback chains — the lib/core ProviderRouter gains fallback chains, provider cooldowns, Retry-After honoring; assistant meta wins over the global default; Pro SPA picker. Observability — the gen_ai.* span emitter (OTel GenAI conventions) + opt-in off-by-default OTLP exporter; the transcript-post-meta annotation store + REST controller; the new export_annotation_dataset Pro tool + AI Observability dashboard + wp-admin Analytics section. Skipped per plan: sandboxed agent OS / cloud marketplace.

• 🛡 OTLP endpoint deny-list (PR #7251). DENIED_OPTIONS (wp_mcp_ai_otlp_endpoint) checked before the wp_mcp_ai_* prefix allowlist in the Pro update_option tool — the tracing sink stays out of AI-tool reach even for manage_options sessions (DifyTap CVE-2026-41947 class, defense in depth); admin configuration via the wp_mcp_ai_otlp_endpoint filter or WP-CLI; test pin asserts wp_mcp_ai_forbidden_option for an admin.

• 📄 Console pagination + loading states + role gating (PRs #7239, #7255, #7259). One accessible pager (USWDS / W3C APG: nav landmark, native buttons, aria-current, disabled boundaries, polite "Showing X–Y of Z" live region, page-size selector, ellipsis collapse) with true totals on every server-side-paged table; the /approvals envelope returns the pending-queue depth + offset; the remote records proxy forwards page and reports totals; a phpcbf guard protects the persisted lowercase wordpress literal. Keep-previous-data loading states (dimmed stale rows, aria-busy nav, inline spinner). Non-admin console users no longer hit admin-only routes: HITL bar mounts only when isAdmin && hasApprovals, and the Assistants page hides add/edit/delete (read-only list, matching the server contract).

• 🔑 Session identity + Breeze exclusions (PR #7257). New GET /mcp-ai/v1/session/me (session identity + capability map without core's list_users gate on users/me?context=edit; 401 without a valid auth cookie; no-store). The console mints its nonce from /session/nonce first — cached /dashboard/ HTML can no longer supply a stale nonce — and the users/me 403 fallback propagates its recovered nonce + capabilities into the runtime (author-role "Cookie check failed" wall closed). New includes/integrations/class-wp-mcp-ai-breeze-cache-integration.php excludes /dashboard/ + /wp-admin/ from breeze_exclude_urls (self-gated on BREEZE_VERSION, filterable) so session-bearing HTML is never served from cache.

• 🔗 OAuth + Remote Sites hardening (PRs #7240, #7242, #7244, #7258). redirect_uri encoding — add_query_arg() leaves array values unencoded, so authorize URLs sent the redirect_uri value with a raw &; every builder now rawurlencode()s the value + scope (Pro Remote Sites starts + Gmail direct link, WP_MCP_AI_Google_OAuth_Service, the base OAuth-manager fallback; CG Pro + CG-AI platform mirrors byte-identical; verified live on scm.nvdigital.solutions — redirect_uri_mismatch resolved). Bare-URL fallback — handle_actions() routes state + code/error returns with no oauth_handler through the per-service state transient (all eight flows; Composio excluded; CSRF posture unchanged). Drive auto-fallback — search_drive/get_drive_file auto-resolve the only enabled Remote Sites Drive connection when settings credentials are absent (ambiguity error lists candidates; settings credentials keep priority); the settings page shows a neutral status instead of the misleading red box. Assistant scoping — all 12 connection families honor the assistant's Remote Site Connections allowlist (filtered discovery, *_connection_not_enabled 403s, *_settings_not_allowed refusals, Drive folder-scope enforcement via bounded BFS, fail closed); CG Pro mirrors carry the same gates.

• 📚 Docs & skills. Proposal 092 — the Astro Storefront Layer (NV-authored, MIT-licensed nvoos-astro-velocity headless storefront for the Payload-shaped contract; contract-invariant across the WP → Laravel migration; retire-at-parity posture; 4-phase plan; five open owner decisions Q1–Q5). In-window skill updates: plugin (OAuth bare-URL + encoding root cause), spa-ui (jsdom gotchas #6/#7 + live-console staleness playbook), test-suite (pattern #85), schedule-anything-ops (stale-nonce failure class + zero-backend-requests fact) — the catch-up adds the pagination pattern, the REST-contract baseline extensions, and the toolkit-audit class 11.

• 🧪 Tests. New suites: tests/test-workflow-dsl.php (315 lines), tests/test-prompt-versions.php, tests/test-annotation-store.php, tests/test-fallback-chain-meta.php, tests/test-genai-spans.php, tests/test-otlp-exporter.php, tests/test-breeze-cache-integration.php, addons/pro/tests/test-export-annotation-dataset-tool.php, addons/pro/tests/test-pro-workflow-dsl-bridge.php, addons/pro/tests/test-google-drive-assistant-scoping.php (11), addons/pro/tests/test-remote-connections-assistant-scoping.php (22); extended: tests/test-drive-read-tools.php (fallback), tests/test-remote-sites-admin.php (OAuth encoding + bare-URL), tests/test-site-creator-tools.php (OTLP pin).

• 🧩 Sub-projects. nvoos-content-graph-ai (Track C RAG) — plugin chunking, hybrid RRF search, a local score-based reranker (default), a RAGAS-style hit-test runner, and the searchHybrid tool + CLI (own track, described-not-counted). nvoos-content-graph-pro — the OAuth encoding + bare-URL fallback and the scoping gates mirror byte-identical (text-domain swap). ZIP builds — nvoos-content-graph-ai-v1.0.4 + nvoos-content-graph-ai-platform-v2.0.0 ZIPs built in-window (build-only; version bumps landed in earlier windows).

• 📦 Versioning — bumped to 1.2.13 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.13. No addon version moves in-window. Media Worker: 3.4.0 (unchanged). Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~355 base + ~1,378 Pro (~1,732 total — +1 Pro: export_annotation_dataset) — the only in-window registry registration; lib/core/src/Tool/ gained zero tools (dual-layer rule) and the CG-AI searchHybrid is sub-project-owned; live registry authoritative. Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Coding-time agent skills: 76 (unchanged — four skills updated in place). Security classes: 12 (unchanged — the Breeze integration is includes/integrations/, not a security class). Stale build ZIPs removed: the 1.2.11 oOS set (30 files — 9 + 2 + 19); the 1.2.12 set stays as the current fallback.

v1.2.12 — October 25, 2026

Magic Login, Native Addon Islands, Tool Picker & Commerce Console Surfaces

• 🔑 Magic-link (passwordless) sign-in (PRs #7206, #7208). New opt-in WP_MCP_AI_REST_Magic_Login_Controller (POST /mcp-ai/v1/magic-login/request + /confirm, off by default → routes 404): ~256-bit CSPRNG tokens stored SHA-256-hashed in transients, 15-minute single-use expiry, one outstanding link per user, uniform anti-enumeration responses, transient rate limits (3/identifier/15 min, 10/IP/hour), wp_login on confirm, link target always the configured app origin. Deliberately unauthenticated by design (the documented /session/nonce exception) — a named permission callback still enforces the feature flag + IP/HTTPS posture. A Magic Link Sign-In settings subtab exposes both fields (settings-registry-first reads with a standalone-option fallback); the console gains Password/Magic-link tabs + a #/magic-login?token=… consumer; authors can sign in even when users/me?context=edit 403s (nonce re-mint + view-context retry, #7224). 7 controller tests / 38 assertions.

• 🏝 Native addon islands replace iframes (PR #7213, Proposal 087). #/docs, #/media, and #/documents mount Docs Hub / Media Studio / Document Editor as native islands against their local REST APIs: the built docs-hub IIFE is vendored byte-identical into spa-v2 (window.NVoosDocsHub.mountDocsHub + MemoryRouter), the media/document apps lazy-load via new *Asset/*Css config endpoints, and the postMessage auth bridge is gone (origin-checked headless credentials). The docs page gains a Docs Hub / OKF Knowledge source toggle over the new mcp-ai-pro/v1/okf/docs adapter (bundle-prefixed slugs, server-side cross-link rewriting per OKF v0.2 §6.1, rehype-slug TOC, prev/next). Filter semantics change: the three wp_mcp_ai_pro_spa_*_url filters now take wp-json REST bases.

• 🎛 Registry-backed assistant tool picker (PRs #7221, #7232, Proposal 088). A WAI-ARIA combobox + grouped listbox ToolPicker replaces the comma text field: name/description/slug search, category groups, removable chips, capability colour coding, creatable raw-slug entry, add-all/clear, loading/error/retry; unknown slugs are preserved and flagged. Backend (additive): handle_tools_list() emits per-tool flags (+ _fields allowlist), and a new scope=all opt-out lets the picker fetch the full registry — unscoped requests keep resolving the default assistant (the MCP contract), token-bound credentials stay pinned, cache keys include scope. Assistant payload contract unchanged.

• 🔌 Console Connections page (PR #7220). WP_MCP_AI_Pro_Remote_Sites_REST_Controller at mcp-ai-pro/v1/remote-sites (manage_options-gated): list with redacted secrets + has_credentials, a 32-type /types catalogue, create/partial-update (blank secrets keep stored values)/delete/test; the console-only #/connections page (Command Centers → Channels) adds the type-catalogue wizard, test-before-trust results, status chips, destructive confirmation, dark-mode-correct tokens (#7225), a fixed wp-admin deep link, and the base-settings Gmail aggregated as base-gmail (with its name on the pseudo connection, #7229). 15 REST + 7 client tests; docs/features/remote-sites.md section added.

• 🛒 Commerce toolkit console surfaces (PR #7231, Proposal 089). Four WooCommerce-gated commerce feature flags + content_records; four schema-driven settings sections (safety buffer, reconciliation cadence, rate cap) on new registry tabs with kill-switch filters for the four wp-admin toolkit pages; a read-only mcp-ai-pro/v1/commerce/sync-runs bridge over the shared Sync Log Manager; a remote_site proxy against wordpress-type Remote Sites (structured 404/403/400/502, zero credential echo); product/post/page records entities with a meta-in-REST registrar that skips schema-free post types. SPA: CommerceToolkitPage (Overview/Settings/Sync Runs, SitePicker) on /ecommerce /ezuite /shopify-sync /flowhub /products /content + the SettingsForm extraction. 13 REST tests. Deferred by design (tracked W16e/W16f/W16g): 4f dashboard widgets, remote records browsing, 5b retirement, 6b deep-links.

• 📐 Tool-schema bounds sweep (PRs #7210, #7211). The remaining wp_mcp_ai_mcp_schema_compliance Site Health findings are cleared: the new WP_MCP_AI_Tool_Schema_Helper bounds 763 id/amount/total-style integer fields to the JSON-safe 2^53−1 ceiling (always an honest bound — no invented semantic caps), 8 legacy flat maps gain type: object, and 7 root-anyOf tools move the combinator into a single-branch allOf. New tests/test-tool-schema-helper.php + a registry-wide auditor canary (fails on any root_type_missing / root_combinator_with_properties / unsafe_integer_range). Zero tool-count change. The two outbound-booking files' single-line arrays expanded (whitespace-only).

• 🧑‍💻 Console fixes. Professions meta invisible (#7219) — the CPT now declares custom-fields support (raw meta box hidden) and register_meta_in_rest() grants it to every records entity, so the whole Records surface reads meta over wp/v2; the destructive "Replace All" no longer orphans team members (the new relink_members_after_profession_replace() seam re-resolves through the pre-delete ID → slug map). Records 404 on Posts/Pages (#7233) — get_post_type_rest_base() resolves the registered route base (post → posts), carried by both remote proxy endpoints. Settings contract (#7215) — numeric selects round-trip as ints, sanitization matches RAW option keys (slug keys no longer silently rejected), (stored) options for unlisted values, phantom __hidden__ tab gone. Docs island (#7215/#7218) — full-bleed + host token bridge + live theme sync; the previously reverted header tighten re-landed. Dark mode (#7225/#7226) — real spa-v2 tokens on Connections; --nvoos-chip-bg/--nvoos-muted defined in all three theme blocks (transparent chips + themed borders). Paper Store (#7206/#7207) — #/paper-store management page (collections, search, JSON-validated modal, two-step delete) with the paperStore endpoint on both apps. UX — assistants skeleton, team-fetch error + abort guard, inline master-detail records, workflows grid containment, mobile gutters.

• 🧪 Tests. New suites: tests/rest/test-rest-magic-login-controller.php (7), tests/test-remote-sites-rest.php (15/378), tests/rest-api/test-commerce-console-surface.php (13), tests/rest-api/test-rest-records-schema.php, tests/test-team-member-relink.php, tests/test-tool-schema-helper.php + the schema-auditor canary; the settings-tab-order test re-pinned for the commerce tabs (#7234). CI-order hardening: the auto-categorize tests pin a deterministic DI-router mock (#7214), the lazy addon stubs are excluded from discovery (#7223), and the media-studio/document-editor classes are class_exists() self-guarded (#7216).

• 📚 Docs & skills (PRs #7209, #7217, #7227, #7230). Proposal 090 — G9 decision #15 (Laravel for the standalone stack, FastAPI plan retained as fallback) + the v1.4.0 Laravel adapter spike plan (P1–P7 pass criteria, 6-week timeline, flip conditions F1–F4). spa-ui gains the spa-v2 ↔ console wiring map + the "my spa-v2 fix doesn't show in the console" checklist + theme tokens + the island token bridge; spa-rest-contract gains bug class 13 (failure masquerades as empty) + the named-permission-callback rule + the settings-schema coercion taxonomy; test-suite gains patterns 80/81/44.

• 🧩 Sub-projects. docs-hub / media-studio / document-editor sources gain the island APIs + rebuilt dists without version bumps (docs-hub 0.5.3, media-studio 0.6.1, document-editor 0.2.0 — own tracks, flag-not-edited); the shipped build/ ZIPs stay current and the island surfaces ride the vendored spa-v2 bundles until each addon's next release.

• 📦 Versioning — bumped to 1.2.12 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.12. No addon version moves in-window. Media Worker: 3.4.0 (unchanged). Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~355 base + ~1,377 Pro (~1,731 total — unchanged) — zero registry registrations in-window (live registry authoritative). Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Coding-time agent skills: 76 (unchanged — three skills updated in place). Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.10 oOS set (30 files — 9 + 2 + 19); the 1.2.11 set stays as the current fallback.

v1.2.11 — October 24, 2026

Velocity Caching, SSE Offload, Console Login & a Fix Wave

• 🗂 Velocity caching layers + backend shared-cache opt-in (PR #7197). Both Velocity apps (examples/nvoos-complete-velocity + examples/schedule-anything-velocity) now keep browser/CDN/edge load off WordPress: index.html serves no-cache + weak ETag (304 revalidation), hashed /assets/* are public, max-age=31536000, immutable, unversioned root files (favicon) get 1-day caching + ETag, and gzip/brotli serves from an in-memory file cache with Vary: Accept-Encoding. The default-deny proxy micro-cache stores proxied GETs only when WordPress itself declares Cache-Control: public + explicit max-age/s-maxage with no Set-Cookie/Vary: Cookie — nonce + SSE endpoints (no-store) can never be cached; X-WP-Nonce is stripped from cached entries; knobs NVOOS_PROXY_CACHE=0 / NVOOS_PROXY_CACHE_MAX_TTL (300 s). Backend: GET /mcp-ai/v1/features emits Cache-Control: public, max-age=60, s-maxage=60 and the new WP_MCP_AI_REST_Cache_Control opts out of WP 6.9's authenticated no-cache injection only when the response explicitly declares public caching. Both sync workflows smoke-assert the contract; e2e-validated against the live oos-wp site.

• ⏳ SSE long-run offload — Proposal Phase 4b (PR #7199). Streams nearing proxy idle-read timeouts (~75 s default, filter wp_mcp_ai_sse_offload_elapsed_seconds, 0 = off) hand the remaining agentic work to the background job queue and close with a job_offload event. The new WP_MCP_AI_Chat_Stream_Offload_Worker (chat_stream_continuation, 240 s cap, notifier heartbeats) restores the extended snapshot (assistant_config, iteration, max_iterations, agentic_cost_accumulator, pending_tool_calls, continuation_kind) and delivers via the session frame buffer (chat:resumed). Terminal failures record handle_job_failed() + a chat:error frame and throw (queue row failed), with session fallbacks in the payload. Both clients (chat.js + spa-v2's window CustomEvent nvoos:job_offload) surface the offload and watch the job bus. Pre-existing fix folded in: content_format_templates seeding deferred init → wp_loaded (PHP 8 $wp_rewrite null warning on fresh boots). New tests/rest/test-sse-stream-offload.php (9/43).

• 🔐 Complete Console login, sign-out, and session-expiry gate (PRs #7190, #7192, #7196). Branded in-app sign-in (LoginScreen + login.ts replay the wp-login form against the same-origin proxy; OWASP-uniform errors, visible labels, 16px inputs, a11y password toggle, double-submit prevention); a global 401/403 → sign-in gate in fetch-wrapper.ts (plus a jQuery mirror for the Content Graph explorer); in-app sign-out that scrapes the log-out nonce (now accepting the &-escaped form) and actually kills the session; the z-index coverage + favicon fixed.

• 🔌 Console REST bridges fixed on front-end requests (PR #7189). Four bridges silently degraded outside admin context (/workflow-presets empty catalogue, workflow-builder node exec 501, ops webhooks array(), command-center success: false) because their provider classes were admin-gated — the rest_console_bridges module now eager-requires them (dormant constructors) and the command-center gains a lazy load_provider() seam; missing providers return 501 WP_Errors. Pinned by tests/rest-api/test-rest-console-bridges.php (7/7 with eager-include pins).

• 👥 Profession ballooning fixed (PR #7191). The stale wp_count_posts() cache hid that "Update Professions" already heals the database (core only invalidates on status transitions; the reseed paths publish-to-publish + force-delete). WP_MCP_AI_Profession_Repository::clear_cache() invalidates the counts cache; the Data Management panel busts before reading + shows a "Duplicates Detected — run Update Professions" status (Update preserves assistant links); the seeder matches by slug instead of duplicate-inserting. Mirrored into the Content Graph AI platform plugin; pinned by tests/test-profession-reseeding.php (15/15) + an AJAX healing e2e.

• 🛠 Console dashboards, Security Center, and workflows (PR #7193). /dashboards/schema ships a disabled map (label/icon/description + the gating flag, via the new effective_flag_key() seam) and the page renders a guided empty state; the Security Center renders structured UI (nvoos-chart dial + grade, quick wins, grouped posture checks, security-header badges, snapshot timestamps) from the pure posture-utils.ts (11 tests); the workflow canvas gains a node config editor (NodeEditor.tsx) for tool/action/agent nodes. 368/368 spa-v2 + 79/79 console vitest; 15/102 dashboards PHPUnit.

• 🐛 Crash + continuity fixes (PRs #7196, #7201, #7200, #7202). The command-center 500 — merge_logger_activity_entries() was static but called instance helpers via $this — now self:: + static helpers (regression-pinned). The chat continuation re-entry normalizes null router responses to a logged WP_Error (wp_mcp_ai_continuation_invalid_response), fixing the CI TypeError — with a regression pin that reproduces it. Console mobile: ≤782px gutters trimmed, the dock goes full-width ≤1440px, and the status-bar ☰ drives a real overlay drawer. Eleven risky tests repaired (68 tests / 209 assertions green on WP 6.9 + 7.1).

• 🛡 Dependency advisory sweep (PR #7195). In-major patches across 21 npm trees close 67 of 74 alerts: @vitest/mocker ≥4.1.12 <5 (24), dompurify ^3.4.17 (18), sharp ^0.35.5 (5), ip-address ≥10.7.4 (2), vite → ^6.4.4 for nvoos-dictate + nvoos-vite-demo (16), esbuild via the vite bump (2). Tracked bundles rebuilt (root chat-bundle/markdown were stale at dompurify 3.4.13; canvas-toolkit, chat-spa, pro-spa → 3.4.17). Deferred as tracked issues: #7090 (@ai-sdk/provider-utils 3.x), #7089 (react-router 7), #7194 (glib/gtk-rs).

• 📚 Docs (PR #7203). Proposal 086 — chat frontend transport abstraction (BYOK backend): a ChatTransport + ChatFeatureAdapters seam so the chat UI runs against any backend (default NvOosRestTransport zero-behavior refactor, DataStreamTransport for foreign SDKs, null/in-memory adapters, packages/nvoos-chat-ui extraction, a reference provider-SDK backend); five open decisions with recommended defaults.

• 🧩 Sub-projects. nvoos-content-graph 1.0.12 upload prep (#7198 — the memory-graph bridge seams #7145 + guest-token read-route fix #7155 folded in with the full version sweep, re-verification + PCP; ZIP at build/nvoos-content-graph-v1.0.12.zip); docs-hub checked — no shipped changes since 0.5.3. Content Graph AI platform: profession fixes mirrored + the v2.0.0 standalone ZIP built.

• 📦 Versioning — bumped to 1.2.11 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.11. No addon version moves in-window. Media Worker: 3.4.0 (unchanged). Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~355 base + ~1,377 Pro (~1,731 total — unchanged) — zero registry registrations in-window (live registry authoritative). Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Coding-time agent skills: 76 (unchanged — four skills updated in place). Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.9 oOS set (30 files — 9 + 2 + 19) + the superseded content-graph v1.0.11 ZIP.

v1.2.10 — October 23, 2026

Console Migration Phase 5b–5d, Crash Fixes, Storage Meter & Advisory Sweep

• 🧭 Admin-surface console migration Phase 5b–5d + polish (Proposal 084, PR #7180). The orphaned WP_MCP_AI_REST_Cost_Manager + WP_MCP_AI_REST_Analytics_Manager controllers now register in includes/bootstrap/loader.php (Phase 5b) and power the real Analytics page (cost trend, provider donut, top tools/users — manage_options-gated, wrapping the existing service layers); the Unified Blueprints page bridges behind GET /mcp-ai-pro/v1/blueprints as a searchable install catalogue (5c); the Agent Command Center absorbs into the console Dashboard (5d, fail-soft KPI + activity). Console-wide polish: a semantic DataTable (sortable headers, master–detail expandable rows, sticky header, scroll containment, zebra striping) replaces the div-list tables; standardized primary/danger buttons; a grouped collapsible sidebar (ConsoleSidebar + nav-features: Workspace / Automation / Command Centers / Insights / Admin) with the W3C disclosure pattern, persisted state, and default-Workspace-expanded.

• 🧩 Crash fixes + settings + chat dock (PR #7184). The blueprints 500 — the admin_blueprints module gated the page class behind context => 'admin', so its static catalogue seams fataled on front-end REST; the class loads unconditionally now (only init() stays is_admin()), pinned by an 11-test REST suite. React error #310 (hooks after early returns) fixed on Schedule Manager, Workflows, Pro Ops, and Orchestration Stats — with a permanent react-hooks/rules-of-hooks ESLint gate that caught 21 latent violations across 4 files. The settings page gains section cards per tab (the schema's previously unused section/section_id), cross-tab search with breadcrumbs, a sticky save footer, and dirty-field indicators. The chat dock: mode-synced conversation-list collapse (docked starts collapsed, full-page open — boot-synced to avoid a first-frame flash), the visible status-bar ☰ toggle, a light/dark theme switch, a stacked composer (textarea no longer squashed to 31px), and drag-resize on the textarea itself.

• 💾 Server transcript storage meter (PR #7185). The status-bar "Sessions: X KB" meter measured same-origin localStorage keys that can never exist for the server-side transcript store. WP_MCP_AI_Transcript_Repository::get_storage_bytes() aggregates per-user payload lengths (0 when the CCT is unavailable), GET /mcp-ai/v1/chat-transcripts carries storage_bytes, and the StatusBar prefers the server figure with a localStorage fallback for older installs.

• 🛡 Dependency advisory sweep (PR #7186). markdown-it → 14.3.3 (ReDoS + O(n²), bounded override — 6 alerts), @modelcontextprotocol/sdk → 1.32.0 (gateway exact pin, 22/22 — 8 alerts), launch-editor floor → 2.14.2 (2 alerts) — 14 of 16 open alerts closed; the vite pair already fixed on the alpha line.

• 🔨 Full tracked-bundle rebuild (PR #7182). Lockfile-only advisory bumps (#7175, #7106) had left tracked bundles silently stale for 13 days — the full artifact tree rebuilt (16 files: the three generate-* worker bundles, chat bundles, SPA dists, TMA entries, drift manifest); spa-v2 + complete-velocity rebuilt byte-identical same-day.

• 🚀 Standalone SPA endpoint sync (PR #7181). The Vite mirror gains the three canonical ProSpaEndpoints keys (cost, blueprints, commandCenter) and points analytics at the core mcp-ai/v1/analytics namespace (matching the canonical PHP config) — the Velocity build gate's TS2739 fixed.

• 📚 Docs & skills (PRs #7178, #7183, #7185). The spa-ui skill gains a "Rebuild discipline" subsection (lockfile-movement staleness signature, the vendor never-commit rule, the revert-on-shared-branch play, merge discipline) and the dependabot-loop skill gains Step 7 (rebuild tracked bundles); the Schedule Anything ops skill gains the Cloudways Anti-Bot Protection (Imunify360 WebShield) failure class — symptom signature, the pdata/wsidchk clues, the diagnostic ladder, and the fix — cross-referenced from the Complete Console deploy runbook; the spa-rest-contract skill gains bug class 11 (wrong-store meters) + the storage_bytes baseline; the test-suite skill documents the run-tests-docker.sh silent dump-autoload fallback.

• 🧪 Tests (PRs #7184, #7185). Regression pins for the blueprints REST surface (11 tests / 103 assertions), the cost/analytics/command-center REST surfaces (17 tests), the loading → loaded transitions on the four hook-order pages, the transcript-storage suite (3 tests), and the useTranscripts storageBytes parsing/fallback cases.

• 📦 Versioning — bumped to 1.2.10 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.10. No addon version moves in-window (Schedule Anything Platform stays 0.1.2). Media Worker: 3.4.0 (unchanged — verified across package.json + both health/status surfaces). Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~355 base + ~1,377 Pro (~1,731 total — unchanged) — zero registry registrations in-window (the cost/analytics managers are REST controllers; live registry authoritative). Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Coding-time agent skills: 76 (unchanged — five skills updated in place). Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.8 oOS set (30 files — 9 + 2 + 19).

v1.2.9 — October 22, 2026

Complete Console App + Admin Console Migration, SA Visibility & New REST Routes

• 🖥 NV oOS Complete Console Velocity app (Proposal 083, PRs #7150, #7154). A new standalone Cloudways Velocity app (examples/nvoos-complete-velocity/) serving the full spa-v2 admin surface for Complete customers — build-time composition via the @nvoos/pro-spa-v2 Vite alias (no spa-v2 fork), cookie auth through the proven same-origin BFF proxy (serve.mjs, no connection screen), and a Schedule Anything-format shell: dashboard home, one route-split page per addon, a collapsible nav rail, and a persistent chat dock (single ChatPage instance — conversations keep streaming while browsing).

• 🧭 Admin-surface console migration, Phases 0–4d (Proposal 084, PRs #7164, #7166). WP_MCP_AI_Feature_Flags + GET /mcp-ai/v1/features gate the console nav (fail-open); Approvals/Slash Commands/Triggers/Portability/Security/Teams ports with per-page wp-admin kill-switches; a schema-driven Settings engine (/settings/schema + /settings/values, dirty-diff saves, secret masking); ops/diagnostics/token-manager pages + GET /mcp-ai-pro/v1/ops/overview; Schedule Manager (P9) + Workflow Builder (ReactFlow canvas) + records/dashboards/calendar/F&B/channels/media-ops pages. A REST contract parity audit fixed nine client/server mismatches — including the assistants GET/PUT routes that broke the edit form. Phase 5 (retirement soak + kill-switch flips) remains.

• 📅 Schedule Anything full visibility (PR #7147 — platform 0.1.1 → 0.1.2). The builder palette now reads the live registry via GET /mcp-ai-pro/v1/sa-tools (paged light rows, server search + group facet — replaces a hardcoded 19-tool fixture); GET /toolkits returns tier/platform_active/entitled (server-decided, greys out of-tier toggles); the missing flowhub + shopify-sync toolkit rows are back; multisite admins gain sa_manage_workspace idempotently; preset filters use server facet dropdowns + load-more; same-state toggles are a successful no-op.

• ⚙ New base settings/features routes (PRs #7157, #7164). GET/POST /mcp-ai/v1/settings (SPA-shaped { success, data }, secrets masked as the admin placeholder, whitelisted sanitize + key mapping + clamps), GET /mcp-ai/v1/features, GET /mcp-ai/v1/teams, and the settings schema/values pair.

• 🛡 Opt-in debug logging (PR #7161). The JetEngine CCT hot path no longer logs a debug event per request; debug-level events gate behind enable_debug_logging (default off) while errors/warnings/criticals stay always-on; the CG Pro logger port mirrors the gate and degrades to a safe no-op standalone.

• 🔗 Memory-graph bridge seams (PR #7145). trace_memory_provenance resolves its bridge/DB walker through three filters and walks DERIVED_FROM/OBSERVED_BY/MEMBER_OF (not the never-populated RECALLS) with a new kind field; the RRF fusion stream resolves its bridge via wp_mcp_ai_memory_rrf_graph_bridge; the Content Graph plugin self-declares as the bridge (no CG version bump — release prep is a follow-up).

• 🧩 Console reliability (PRs #7174, #7176, #7163). Six 404ing mcp-ai-pro/v1 console routes fixed by a context-free rest_console_bridges registry module (the admin-context gate never fired for the front-end SPA); the schedule picker moves to its own /schedules/selectable route (last-registrant-wins collision fixed); dashboards and nav gate on toolkit toggles (disabled toolkits vanish server-side); loading states replace empty-then-loaded flashes on Assistants/Tools/Settings/Records/Dashboards/Channels.

• 🧾 SPA REST contract fixes (PRs #7156, #7155). The tools-list client maps the real { tools, total } envelope (route additively returns slug + required_capability); the knowledge-graph visual-config fetch sends the wp_rest nonce (cookie-mode 401 fixed); the Content Graph guest branch validates through the real guest-token layer; transcript 404s mean "fresh session".

• 🚀 Schedule Anything Velocity deploy chain (PRs #7146, #7148, #7151). Missing CSS assets fixed (asset-closure gate + 404-loudly serve.mjs, MIME-verified in the sync workflow); React 18.3 → 19.1.0 as a documented Pattern-B deviation; the complete-console mirror's build scripts are no-op shims with dependencies stripped (Velocity deploy fixed).

• 📉 Build & dependencies (PRs #7167, #7168, #7175, #7144, #7171, #7173, #7165). The Pro zip stops shipping root examples/ (−5.4 MB); vite → 8.2.4 across the 9 alerted manifests + schedule-anything-spa 6.4.4, hono ≥4.13.11, follow-redirects ≥1.16.1 (alerts 1336–1377); the dictate workflows install the real rustup arch targets (tauri lipo-merges the universal bundle); the standalone SPA's @xyflow/react lockfile + paths/aliases fixed.

• 📚 Docs & skills (PRs #7162, #7170, #7169, #7172, #7160, #7153). New mcp-ai-wpoos-spa-rest-contract skill (75 → 76) canonizes the REST contract audit (seven bug classes, audit path, fix decision rules, validation matrix); spa-ui gains the Tailwind v4 tracked-dist loop, the Pattern-B React 19 checklist, and the clean-install lockfile gotcha; content-graph-spa + schedule-anything-ops updated; README sponsor section + FUNDING.yml activated (VS16 anchor fixed); Proposal 085 (Funiq Velocity storefront) is docs-only.

• 🧪 Tests (PRs #7149, #7174). The order-dependent tenant-isolation failure is fixed (option reset in setUp()); phpunit.xml.dist drops its no-op source excludes (the 70 GB Rust target/ walk no longer hangs suite startup); the console-bridge registration is regression-pinned.

• 📦 Versioning — bumped to 1.2.9 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.9. Schedule Anything Platform: 0.1.1 → 0.1.2 (#7147). Media Worker: 3.4.0 (unchanged). Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~355 base + ~1,377 Pro (~1,731 total — unchanged) — zero registry registrations in-window (sa-tools + the settings/features/ops routes are REST surfaces, not tools; live registry authoritative). Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged). Coding-time agent skills: 75 → 76 (+mcp-ai-wpoos-spa-rest-contract). Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.7 oOS set (30 files) + the superseded Schedule Anything Platform v0.1.1 ZIP.

v1.2.8 — October 19, 2026

Schedule Anything API + Single-Site Mode, F&B Worker Offload & MCP OAuth Hardening

• 📅 Schedule Anything presets + toolkits API (PR #7124, Proposal 081). Four mcp-ai-pro/v1 routes (rest_schedule_anything module): GET /toolkits + POST /toolkits/{slug}/toggle (server-side tier entitlements via the platform's SA_Toolkit_Manager, 403 sa_toolkit_not_entitled), GET /presets + /presets/{id} (12 presets across 6 toolkits), and idempotent POST /presets/{id}/install (replay returns the original schedule). Schedule records leaving REST are redacted (redact_schedule_for_public() — credential-bearing fields stripped), and the SPA builder payload aligns with the server contract (sonner error surfacing).

• 🏠 Schedule Anything Platform single-site mode (PR #7134, Proposal 082 — addon 0.1.0 → 0.1.1). No more activation wp_die on non-multisite: sole-tenant self-provisioning (tier default enterprise, filter sa_single_site_tier), a manage_options capability seam for SPA REST, 409 sa_cannot_offboard_sole_tenant, a SA_SAAS_API_KEY-gated heartbeat, and a 17-case suite wired into the root PHPUnit run via a self-guarding addon tests bootstrap.

• 🏭 F&B ingest × media-worker offload (PR #7114, Proposal 079 + Appendix B). The worker's POST /api/ingest/parse returns the F&B {columns, rows} matrix contract (XLSX/CSV/TSV/JSON/JSONL/PDF/photo; .xls/.ods → 503 capability_unavailable with local fallback), /api/image/batch gains the files[N] contract + per-file tolerance; the F&B loader parses heavy formats sidecar-first with local PhpSpreadsheet/PdfParser fallbacks; optimise_images_batch and the OCR-service PDF path offload; opt-in ocr_vision_fallback rung.

• 🛡 MCP OAuth authorize hardening (PR #7133). Exact-string redirect URI matching (RFC 9700 — the wildcard bypass is gone), registration-time URI validation, a nonce-bound consent page before any code is issued, unknown-scope rejection, and token-endpoint redirect_uri matching — Pro addon + the byte-identical Content Graph Pro mirror (19-test suites, 114 adjacent assertions on WP 6.9 + 7.1).

• 🖥 WP-CLI integration gaps closed (PR #7135). The dead mcp-ai content command registers again; a canonical WP_MCP_AI_Pro_Toolkit_Settings_Map (40 toolkits) fixes "Unknown toolkit key" for 11 real settings keys; toolkit enable|disable are manage_options-gated (--yes); new foundry/para/qms/mcp-app/fnb commands with the integration CLIs discovered via wp help mcp-ai.

• 💬 Chat composer vertical expansion + collapsible toolbar (Proposal 080, PRs #7113, #7116, #7118–#7120). Auto-grow 1→3 lines (field-sizing: content + fallback), iOS keyboard reflow (interactive-widget=resizes-content, dvh chain, useVisualViewport), a Zed-style drag-resize divider (clamped + persisted), a focus composer, an in-place collapsing desktop toolbar, a mobile toolbar row, and three pre-existing a11y lint failures fixed — 202 vitest tests green.

• 📧 Gmail body hydration + attachment text (PR #7110). HTML-only empty_parts emails hydrate via body.attachmentId before normalization; attachments return extracted text (PDFs via smalot/pdfparser, text/csv/json, actionable errors for scanned PDFs); unpadded base64url re-padding fixed.

• 🍽 F&B fixes (PRs #7108–#7112). Excel serial dates (46023 = 2026-01-01) no longer read as Unix epoch (the 1970-01 collapse that blanked every trend chart); the universal reader honors the operator's table_map; the raw-row import keeps non-canonical columns; resume/retry imports persist a resumeCursor; progress placeholders render.

• 🎙 Dictation macOS verification + universal builds (PRs #7122, #7123, #7137). A macos-latest boot-smoke job (30 s boot-residency gate + headless --mcp engine probe), an interactive tmate session workflow (scripts/macos-matrix-remote.sh), and one universal arm64+x86_64 artifact (lipo merged, both slices boot-verified) replacing the per-arch DMGs.

• 🚀 Schedule Anything Velocity app (PRs #7125, #7126, #7131). examples/schedule-anything-velocity/ serves the prebuilt SPA with the proven proxy core (no CORS config); a root server.js ESM shim satisfies Velocity PM2's default entry; the sync-token secret renamed NVOOS_SA_VELOCITY_REPO_TOKEN (GitHub caps secret names at 40 chars). The platform plugin's Requires Plugins header is dropped so the oos-complete bundle activates (core matches the dependency against the folder slug — three distribution slugs; #7132).

• 🔗 Dependencies (PRs #7106, #7121). handlebars 4.7.9 → 4.7.10 (GHSA-8r5x-fm3f-whwj); the Schedule Anything SPA joins every SPA zip build + release gate.

• 📚 Docs & skills (PRs #7115, #7128, #7129). New mcp-ai-schedule-anything-ops skill (74 → 75); the dictation-app skill gains the macOS remote verification loop; Pro tool coverage manifest regenerated (1,387 classes).

• 📦 Versioning — bumped to 1.2.8 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.8. Schedule Anything Platform: 0.1.0 → 0.1.1 (#7134). Media Worker: 3.4.0 (unchanged — the new ingest route ships without a worker bump). Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~355 base + ~1,377 Pro (~1,731 total — unchanged) — zero registry registrations in-window (#7135's commands are WP-CLI, #7124's surface is REST, #7114's client is a service; live registry authoritative). Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base + 41 Pro (unchanged — the dictation-app bundled copy re-synced byte-identical). Coding-time agent skills: 74 → 75 (+mcp-ai-schedule-anything-ops). Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.6 oOS set (30 files) + the superseded Schedule Anything Platform v0.1.0 ZIP.

v1.2.7 — October 17, 2026

F&B Universalisation, Sinhala TTS, and the Pro SPA Multi-Page Expansion

• 🍽️ Food & Beverage universalisation + open-format ingestion (PRs #7094–#7096, Proposal 078). The F&B toolkit moves from a single-tenant demo to a universal product: WP_MCP_AI_Fnb_Tenant_Profile de-couples currency (canonical neutral metric keys with legacy *_lkr aliases for the 20/20 oracle), render() de-venues both assistant surfaces via token substitution, demo_mode => false, and a new WP_MCP_AI_Fnb_Report_Exporter (DomPDF-first PDF + html_to_pdf fallback + CSV) powers fnb_export_report (+1 Pro). The universal reader scores a single Drive folder to table roles; the multi-format loader + Observation/terminology-map layer and a read-only Ingest & Review dashboard complete the ingestion track; an analytics dashboard adds KPI tiles + trend charts + panel tables.

• 🗣 Sinhala-native TTS (PR #7099). generate_sinhala_speech (+1 base) closes the generate_openai_speech gap (OpenAI voices are English-optimized, Google Cloud TTS has no si-LK voice) via SpeechGen (si-LK), Hugging Face facebook/mms-tts-sin, or a custom webhook; wired into the media_generation preset, with a teacher-assistant-sri-lanka.md system-prompt + tool pack.

• 🧩 Pro SPA multi-page expansion (PRs #7078–#7080). #/docs, #/media, and #/documents frame the Docs Hub / Media Studio / Document Editor SPAs in sandboxed iframes (mirroring #/knowledge-graph), with filterable docsHub/mediaStudio/documentEditor endpoints and nav-* commands; the standalone app defaults docsHub to the console docs hub.

• 🎙 Dictation-app skill bundling (PR #7077). mcp-ai-wpoos-dictation-app ships inside includes/bundled-skills/ and the bin/sync-agent-skills.php allowlist (base bundled 76 → 77).

• 🛡 Tool-schema hardening (PRs #7087, #7100, #7104). Per-property boolean required hoisted to the top-level array (both ChatOrchestrator + REST build_tools_payload()) and empty properties emitted as {} (seven no-arg tools + the central Tool_Schema_Auditor + the CG-AI mirror), fixing DeepSeek 400s.

• 🔍 Google Workspace unification + native Sheets (PRs #7097, #7101, #7105). search_gmail/search_drive delegate to the shared clients (fixing the google_workspace/email_imap rejection); get_drive_file reads native Google Sheets via the Sheets API v4 (sheet_name, tabs, row_count); extract_google_error_message() surfaces the real 403 cause.

• 📊 F&B reliability (PRs #7091, #7092, #7102, #7103). Recoverable unknown-metric errors (Levenshtein closest-ID suggestion), complete-by-default + resumable imports (25,000-row cap), header-dictionary metric resolution + covers fallbacks + fixed-height KPI charts, and a WPCS indentation pass.

• 👥 Team-member tool invocation (PR #7088). invoke_team_member() resolves profession slugs through build_tools_payload() (proper {type,function} definitions + attention/capability inheritance).

• 🔐 Framed SPA credential auth + surface fix (PRs #7075, #7076, #7085). Headless Bearer cred_… auth for framed Media Studio/Document Editor (capability-gated to the issuing user), the broken home-URL iframe fallback removed, and keep-alive hub tabs.

• 🔗 Dependency (PR #7074). @modelcontextprotocol/sdk 1.30.1 → 1.31.0 in the mcp-wordpress-gateway (GHSA-6qxp-vccf-f47h).

• 📚 Docs & skills (PRs #7081, #7082, #7084, #7086, #7093). design-performance-audit Flatsome + post-deploy sync, four more skill refreshes + Proposal 075, a Cloudflare 520 troubleshooting entry, the nvoos-dictate lockfile sync, and the Pro coverage-manifest regeneration.

• 📦 Versioning — bumped to 1.2.7 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.7. No addon version moves in-window. Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~355 base + ~1,377 Pro (~1,731 total — +1 base +1 Pro) — generate_sinhala_speech (#7099) + fnb_export_report (#7094); live registry authoritative; lib/core/sub-project tools never counted. Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 77 base (+mcp-ai-wpoos-dictation-app) + 41 Pro. Coding-time agent skills: 73 → 74 (+mcp-ai-wpoos-toolkit-ingestion; -universalisation self-bookkept at #7094). Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.5 oOS set (30 files — see §2.5).

v1.2.6 — October 14, 2026

Drive OAuth Restored, F&B Reliability, OCR vLLM & the Dictation Browser Agent

• 🔐 Google Drive OAuth restored (PR #7053). The #6981 narrowing to the non-sensitive drive.file scope silently broke search_drive, get_drive_file, and the F&B tools for pre-existing content — a per-file scope that can't see anything the app didn't create. drive.readonly is restored as the default alongside drive.file, behind the unchanged wp_mcp_ai_google_drive_oauth_scope filter; the CG-AI-platform OAuth manager mirrors it (sub-project, flag-not-edited).

• 🍽 Food & Beverage reader reliability (PRs #7057, #7060, #7061, #7062). The Sheets reader assumed one Drive file per table; real clients use a single workbook. The WP_MCP_AI_Pro_Google_Drive_Client gains Sheets-API-v4 helpers (get_sheet_values()/get_sheets_metadata()) and the reader resolves table IDs to worksheet tabs with fuzzy matching (case/underscore/hyphen/substring) + a preserved split-file fallback. A DEMO_WORKBOOK_ID fallback + workbook_id() accessor fix the fresh-install file-lookup break; the spreadsheets.readonly OAuth scope + maybe_annotate_sheets_error() surface the real Sheets scope failure instead of a misleading split-file "not found". A new WP_MCP_AI_Fnb_Csv_Exporter (workbook → CSV-per-table with an admin export button) and the 18-table demo dataset (~10,700 rows) now ship in data/*.csv (the tests/ path was stripped from release builds).

• 🔒 Drive connection fixes (PR #7051). The WP_MCP_AI_Inline_Async_Tick_Trait double-declaration fatal in the harness eval scheduler (the non-once Composer classmap load raced a later require_once); Drive 400 responses now log the full body (so invalid_grant vs invalid_client is finally visible); folder_id can now be cleared (preserve only when the key is absent — the always-posted empty string was mistaken for an omission).

• 🔍 Self-hosted OCR vLLM contract (PR #7055). WP_MCP_AI_Self_Hosted_OCR_Client::ocr_images() emitted the SGLang dialect while every operator surface directs users to deploy vLLM — so the no-repeat-ngram processor was never engaged and long documents looped on coordinate tokens. Rewritten to the vLLM OpenAI-compatible shape (model = HF id; skip_special_tokens + ngram_size/window_size + DeepSeek's whitelist_token_ids under extra_body.vllm_xargs); base + CG Pro mirror byte-identical.

• 🤖 Dictation browser agent + FastConformer (PRs #7041, #7043–#7050). The agent feature drives a real browser over CDP (chromiumoxide) from dictated/typed instructions — a ReAct loop, a six-variant verdict model with real read-back, an origin-guarded safety gate + sensitive-field masking + async HITL Approve/Deny, and the brain model now correctly uses settings.agent.model (never the shared cleanup/TTS model). A second local STT engine (fastconformer nemo_ctc) ships; an explicit CleanupConfig.polish_enabled master switch replaces the wait_for_llm_ms > 0 gate (the 0 default used to silently disable polish); model download/install hardened (.download moved out of the install dir, 5× staging-swap retry, spawn_blocking install).

• 🧭 NV oOS multi-SPA hub + Pro SPA v2 fixes (PRs #7063, #7066, #7064, #7072). A new GET /mcp-ai-pro/v1/spa-surfaces discovery endpoint (WP_MCP_AI_Pro_SPA_Surfaces_Controller, gated on shortcode_exists()/class_exists()) + the dictate app's "NV oOS" multi-surface hub. The Pro SPA v2 last-message-save + assistant-memory regressions are fixed (#7066); the tool-shortcuts/slash-commands/OKF drawers now accept guest/bearer/assistant-credential auth via the new trait-wp-mcp-ai-spa-credential-auth.php (they were cookie-only → 401 inside the dictate iframe, #7072).

• 🔗 Dependency (PR #7059). shell-quote bumped to >=1.11.0 (resolving 1.12.0) across the root + saas-controller + Pro SPA manifests, closing the GHSA-pqg4-j6r4-53mv command-injection alert in three lockfiles.

• 📦 Versioning — bumped to 1.2.6 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.6. No addon version moves in-window. Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~354 base + ~1,376 Pro (~1,730 total — unchanged) — zero registry diff in-window (no class-wp-mcp-ai-tool-* registrations; #7063's spa-surfaces is a REST endpoint and #7062's CSV exporter is a service, both non-tool). Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 76 base + 41 Pro (unchanged). Coding-time agent skills: 72 (unchanged — no new skills in-window). Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.4 oOS root set (30 files — see §2.5).

v1.2.5 — October 13, 2026

GTmetrix × WPCode Toolkit, Food & Beverage Phase 9 & the Hardened Dictation App

• 🚀 GTmetrix × WPCode performance toolkit (PR #7026, Proposal 068). +24 Pro tools — a 23-tool gtmetrix_* set (start/monitor/retest, report + Lighthouse-audit + resource-summary reads, browser/location/simulated-device listing, alert + page-tag + monitoring management, and generate_wpcode_snippet) plus the read-only list_wpcode_snippets on a shared WP_MCP_AI_Pro_WPCode_Snippet_Repository (extracted zero-behavior-change from create_wpcode_snippet, conditional_logic support). Deterministic CWV/grade/weight scoring with a 41-check standalone oracle, a credit-aware Action Scheduler poller + CPT snapshot store surviving GTmetrix's 1-month retention, a Basic-auth client with 429 backoff + sensitive-resource hard-blocks, and gtmetrix_install_wpcode_fix drafts-only/chat-restricted. Five schedule + two workflow presets, an assistant pack + wp mcp-ai pro gtmetrix seed-assistant, full 7-surface registration + regenerated coverage manifests. Deferred (plan §8): WP 7.1 second pass, live-key smoke test, proposals-README status.

• 🍽 Food & Beverage Phase 9 (PR #7032). +10 Pro tools — five transactional-table CPT backends (mcp_ai_fnb_sale|purchase|stock|waste|booking behind enable_fnb_native_storage, with idempotent upserts + before/after hooks) read by metrics/reports unchanged through a WP_MCP_AI_Fnb_Cpt_Reader; the ACT-tier fnb_import_table Sheet/CSV→CPT bridge (dry-run, idempotent); and nine fnb_pr_* purchase-request tools running the approval lifecycle on the QMS engine (preconditions via wp_mcp_ai_qms_state_preconditions, PO numbering PR-YYYYMM-###, release-signature relaxation). The four A1–A4 assistants ship as unified Blueprints; a new top-level F&B Management menu (CRM/PM pattern) with five CPT screens + a dashboard + settings link. Deferred: Phase 10 chat/social/booking wiring, reference-table CCT fields, Appendix A10.

• ⚙️ F&B admin menu + module-registry fix (PR #7029). tools/food-beverage/init.php was dead code — fnb was missing from the Pro Module Registry's conditional_toolkits/dir_map, so the admin menu never registered (tools still worked via the central map). A new F&B settings page + the CRM-style enable gate land; the 21 shipped tools now surface correctly. design-...-toolkit-creation case study updated to eleven registration surfaces.

• 🍱 F&B assistant-pack seeding + CSV guidance (PR #7033). The truncated WP_MCP_AI_Fnb_Assistant_Seeder completed (seed(), portability-engine load, image-tool add) so the one-click Seed assistant packs admin button and the wp mcp-ai pro fnb seed-assistants CLI share identical semantics; CSV data-directory guidance + a read-only status row (configured/exists/is-directory/readable/writable).

• 🎙 Dictation companion app hardened (examples/nvoos-dictate, PRs #7017, #7020, #7021, #7025). The live-capture stream-hold regression (cpal Stream dropped on return → zero callbacks), the stuck-Alt hotkey (synthetic key-up after unhook), adaptive energy-VAD with a real-signal fallback, and the model re-download OpenOptions write-access bug fixed; whisper+parakeet now build into one binary (vendored whisper-rs-sys static CRT); a Diagnostics page + mic input-device picker ship. Deferred: auto-restart watchdog, loopback meeting audio.

• 🔐 Dictation follow-up: credentials + macOS + whisper speed (PR #7027). whisper release speed fixed (RTF 5.2 → 0.36 via whisper-rs-sys/force-debug); version 0.1.0 → 0.2.0; a Windows Credential Manager backend (win_cred.rs writing CRED_PERSIST_LOCAL_MACHINE) replaces keyring 3.6.3's broken CRED_PERSIST_ENTERPRISE path (write-then-read-back verification); the macOS port proposal (068) lands as a plan doc.

• 🍬 macOS port (P5, PR #7030). cfg-gated PTT (permission-free Cmd+Opt+Space toggle + opt-in CGEventTap hold), a TCC permissions layer with System Settings deep links, CoreGraphics paste, ScreenCaptureKit meeting audio via a Swift sidecar (NDJSON), per-app cleanup profiles (NSWorkspace frontmost detection), Info.plist/entitlements, and a macos-latest CI job. Not yet verified on real Mac hardware (CI has no audio/screen/permission hardware).

• 🤖 Local LLM polish, video input & licensing (PR #7037, Proposals 071/072). lm_studio/ollama Stage-2 cleanup providers on a shared local_openai transport; DecodedMedia + a chunker demux MKV/MP4(MOV)/WebM without FFmpeg (transcribe_media/summarize_media IPC); nvoos-dictate + the two SPA demos marked proprietary NV Digital (license = "proprietary"/"UNLICENSED", LICENSE.txt/NOTICE.md/.reuse/dep5).

• 👁 Vision object detection + VLM label polish (PRs #7039, #7040, Proposals 075/076). Opt-in ONNX-YOLO detection (yolov11n default, yolov8n fallback) with SORT/ByteTrack tracking and a click-to-select pin overlaid on the webview canvas, plus an opt-in Qwen2.5-VL label-polish layer (crop → base64 PNG to LM Studio/Ollama) that re-labels the closed-vocabulary detector's low-confidence/misnamed boxes. Deferred: MediaPipe-hand, ByteTrack low-confidence recovery, biometric identity.

• 👤 Standalone SPA login presets (PR #7031). HOME-selected deploy-specific login pages (cookie-dev-proxy / application-password / assistant-credential / preconfigured) with runtime NVOOS_* env injection through serve.mjs (secret-free startup logging, < escaping) and an opt-in NVOOS_AUTO_CONNECT kiosk mode.

• 🐞 Coverage & contract drift (PRs #7035, #7036). The three model-foundry exporters' produces handoff side corrected to null (corpus schema identifiers aren't ID-handoff keys); the enable_webchat_integration toolkit count fixed (36 → 37); the Pro coverage manifest regenerated (+ wp-mcp-ai-fnb-assistant-seeder).

• 📝 Docs & skills (PRs #7015, #7016, #7019, #7023, #7024, #7028, #7038). Two new coding-time skills (71 → 72: mcp-ai-artcraft-ops — ArtCraft MCP reverse-engineering/rebuild guide; design-performance-audit — the GTmetrix → WPCode optimization pipeline) + Rust editor config (Zed + VS Code) + proposal docs 068/070/071/072/074/075/076 + the 1.2.4 readme.txt/README gap closure (#7019, which also encoded the check against recurrence in the updates skill). Sub-project: nvoos-content-graph 1.0.11 prep for wp.org (#7014 — own changelog/readme/POT track, flag-not-edited).

• 📦 Versioning — bumped to 1.2.5 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.5. No addon version moves in-window (content-graph 1.0.11 + CG-AI-platform 2.0.0 ZIP rebuilds are sub-project/build-only). Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~354 base + ~1,376 Pro (~1,730 total — +34 Pro) — the 24-tool GTmetrix toolkit (#7026) + the 10-tool F&B Phase 9 wave (#7032); live registry authoritative; lib/core/sub-project tools never counted. Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 76 base + 41 Pro (unchanged — the two new skills are coding-time only). Coding-time agent skills: 71 → 72. Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.3 oOS root set (see §2.5).

v1.2.4 — October 12, 2026

MCP Quirk Hardening, Chart Recipes, Model Foundry Phase 1 & the Content Graph SPA Page

• 🛡 MCP client-quirk hardening (PR #7007, Proposal 066). Every advertised tools/list schema now carries a root type: object and hazardous schemas are skipped-with-reason instead of dropping the whole catalog (bracketed property names, >20 KB schemas, root combinators, >64-char slugs — the new WP_MCP_AI_Tool_Schema_Auditor); nvoos_get_profile attaches structuredContent whenever its outputSchema is advertised (Codex turns declared-outputSchema text-only results into errors); the registry fires wp_mcp_ai_mcp_tools_list_changed (once per request) backing listChanged; JetEngine MCP + MCP App discovery caches cap at the server ttlMs and invalidate on notifications/tools/list_changed; the CG-AI standalone mirror ports the hardening. Site Health direct test + debug field; 44 new tests on WP 6.9 + 7.1.

• 📈 nvoos-chart recipe rendering (PRs #7003, #7005). Fenced nvoos-chart JSON renders as real HTML/CSS charts on all three chat surfaces (no SVG/canvas/CDN) — 29 types (v1's bar/column/line/area/dot/donut/heatmap + v2's histogram, box, strip, stem, violin, pie, waffle, unit, diverging, lollipop, dumbbell, slope, bullet, pyramid, waterfall, candlestick, gantt, sparkline, radial, dial, race, grid); invalid fences degrade to escaped code blocks; sanitisation by construction (extracted before marked/DOMPurify, createElement + textContent); resource caps (40 labels / 12 series / 120 points / 240 cells); theme-adaptive, dark-mode-aware, prefers-reduced-motion; grouped-bar rendering fixed. +1 base tool create_chart_fence (server-side validator mirror) + the design-chart-recipes skill + byte-identical conformance fixtures across the three suites. Deferred (plan §12): race replay, SPA CSV copy, render_chart_preview REST, mermaid spike, a11y scan.

• 🧠 Model Foundry Phase 1 — Corpus Foundry (PR #7008, Proposal 067). +3 Pro tools — export_trajectory_corpus (harness traces → OpenAI tool-calling rows), export_preference_pairs (DPO rows, R4, min_margin skip), export_plugin_docs_corpus (docs-hub uploads or a symlink-safe validated dir → docs_v1 rows with per-document provenance) — behind the new deactivatable model_foundry Pro module + the ai_ml preset. The WP_MCP_AI_Corpus_Governance engine is consent fail-closed (_wp_mcp_ai_training_consent; caps → exact → fuzzy → opt-in semantic dedup → PII scrub → deterministic content-hash holdout split → R12 provenance → guarded sharded write — holdout rows never enter train.jsonl; skip-never-truncate). Consent UI ships in Phase 3 (wp_mcp_ai_model_foundry_assistant_consented until then); Phases 0/2–6 deferred in the implementation plan. mcp-ai-wpoos-model-foundry skill + docs/features/model-foundry.md.

• 🗺 Content Graph explorer page in the Pro SPA (PR #6998). #/knowledge-graph in the admin surface + standalone Vite app — the plugin's Cytoscape explorer vendored with a documented wrapper-only delta (IIFE → exported factory, jQuery-namespaced listeners, destroy() teardown, body byte-identical to upstream); jQuery bundled into the lazy 213 KB-gzip chunk. The CG plugin gains a read-only GET /graph/visual-config route + assistant-credential read auth (write routes stay manage_options-only — sub-project track, flag-not-edited; its own changelog/readme.txt updated in-window). Trade-off: the admin IIFE grows 563 KB → 1.2 MB — entry split deferred.

• 🌐 Standalone SPA deploy & auth hardening (PRs #6999, #7000, #7002, #7004, #7006). Cookie-mode login re-scoped through the proxy (absolute wp-login.php form actions/redirect_to broke cross-host deploys — serve.mjs buffers only the login page and rewrites them to the app origin; the Vite dev proxy mirrors it); the vendored explorer's $.ajax calls carry bearer/basic/guest/worker auth via a new ajaxPrefilter (no vendored changes — byte-identity preserved); tsconfig paths + CI build-verify unblock the Velocity deploy; serve.mjs gains a #!/usr/bin/env node shebang (Velocity executes the entry through sh) + a server.on('error') handler with an EADDRINUSE hint; the Velocity doc gains the entry-path callout.

• 🛡 SPA static-server headers (PR #7009). X-Content-Type-Options: nosniff + Strict-Transport-Security: max-age=86400 on the static branch only (ramp to 31536000 after a clean week; no includeSubDomains/preload); CSP Report-Only template ships commented (the inline Cloudflare challenge script would break script-src 'self').

• 🍽 F&B toolkit toggle restored (PR #7010). enable_fnb_toolkit was defined but never listed in the features subtab group — render() only outputs fields in the active group, so the checkbox never appeared and the toolkit couldn't be enabled from the UI. Added to the subtab fields + memory map (64 MB) + footer counter; regression test; toolkit-count expectation 35 → 36.

• 📝 Docs & skills (this pass). User-directed partial @since reconciliation — the literal @since 2.x.0 placeholder family (never recorded in OI-1) corrected to its true shipped versions (1.1.43/1.1.51/1.1.54/1.2.4, blame-verified, incl. three @deprecated lines) and the new model-foundry 1.6.0 + chart-fence 1.4.0 tags corrected to 1.2.4 — the mcp-apps 1.9.x module family and all historical OI-1 groups stay parked (issue #5968). Coding-time skills 66 → 69 in-window (design-chart-recipes, mcp-ai-wpoos-content-graph-spa, mcp-ai-wpoos-model-foundry); AGENTS.md + copilot-instructions updated by the introducing PRs, the README repo-map fold-in + the §1.5 design-* 34 → 35 correction land here; in-window spa-ui/content-graph-spa/test-suite skill edits reconciled.

• 📦 Versioning — bumped to 1.2.4 across all version-bearing files (plugin header, WP_MCP_AI_VERSION, WP_MCP_AI_PRO_VERSION, package.json, readme.txt Stable tag). Pro addon: 1.2.4. No addon version moves in-window (content-graph 1.0.10, CG-AI 1.0.4, CG-AI-platform 2.0.0 ZIP rebuilds — build-only, unchanged). Model catalog: v2026.10.03 (unchanged — zero catalog diff). Tool count: ~354 base + ~1,342 Pro (~1,696 total — +1 base +3 Pro) — create_chart_fence (#7005) + the three model-foundry exporters (#7008); live registry authoritative; lib/core/sub-project tools never counted. Provider count: 18 chat providers (unchanged). Addon count: 30 (unchanged). Bundled skills: 76 base + 41 Pro (unchanged). Coding-time agent skills: 66 → 69. Security classes: 12 (unchanged). Stale build ZIPs removed: the 1.2.2 oOS root set (6 files — 3 ZIPs + 3 .sha256; the 1.2.3 set stays until the 1.2.4 ZIPs build).

📋 Previous Releases

🚀 Features

Note: Some features require third-party plugins (WooCommerce, JetEngine, Elementor, etc.). See 🔌 What You Lose Without Third-Party Plugins for details.

Assistant & conversation tools

• 🧠 Create AI Assistants via a custom post type (mcp_ai_assistant)

• 👔 Professional & Team Templates - Deploy assistants from ~311 pre-built profession templates spanning 12 industry categories, or create entire teams of specialists with one click. Includes backend testing for professions, teams, and assistants before public deployment.

• 🚀 Getting Started Wizard - Guided 4-step onboarding (/wp-admin/admin.php?page=wp-mcp-ai-getting-started) that walks new users through provider setup and use-case selection. Selecting a preset (Content Creator, Customer Support, E-commerce, SEO & Research, Developer Copilot, Media & Creative Studio, Site Administrator, or General Purpose) seeds a fully-configured assistant with tools, system prompt, and tuned temperature — ready to use immediately.【F:includes/admin/class-wp-mcp-ai-onboarding-wizard.php†L1-L53】【F:assets/js/onboarding-wizard.js†L1-L303】

• 🔄 Automatic synchronization to JetEngine Custom Content Types when available (CPT → CCT)

• 💬 Chat interface via [mcp_ai_chat assistant="ID"]

• 🧰 Per-assistant defaults for model, temperature, system prompt, and knowledge attachments with permission-aware download URLs

• ⚡ Build reusable prompt shortcuts with optional tool targeting and inline descriptions so operators can trigger common tasks with one click.【F:includes/assistants/class-wp-mcp-ai-assistant-cpt.php†L893-L1048】【F:includes/class-wp-mcp-ai-shortcode.php†L430-L693】【F:assets/js/chat.js†L600-L666】

• 🧊 Elementor widgets for embedding chat surfaces, onboarding content, and MCP dashboards inside Elementor

Language routing & knowledge management

• 🔁 Route conversations through OpenAI or Gemini using a provider-aware language model router

• 🎯 Enhanced Gemini API integration: list models dynamically, count tokens for budget management, create embeddings for RAG/semantic search, and streaming support for real-time responses【F:docs/reference/api/gemini/gemini-api-enhancements.md†L1-L100】

• 🧠 Assistant knowledge base management with Media Library files and optional vector store IDs

• 📚 OKF (Open Knowledge Format v0.1) engine with 6 MCP tools for curated, deterministic knowledge with cross-link navigation — complementary to vector/RAG stores

• 🔎 Perform lightweight web searches (DuckDuckGo or Brave) without leaving the assistant conversation

• 🌐 Crawl4AI job runner tool for large-scale content gathering workflows

Media generation & transcription

• 🔊 Generate speech audio via OpenAI's Text-to-Speech API and save the result to the Media Library

• 🎵 Generate instrumental music using Google Gemini Lyria with controls for genre, mood, tempo, and instrumentation

• 🎨 Generate on-brand imagery with OpenAI's Images API, honouring the configured response format (including GPT-Image-1's url responses) and storing the files as WordPress attachments

• 🖼️ Generate images with Cloudflare Workers AI using Stable Diffusion, Flux-2 Dev, Leonardo AI (Lucid Origin, Phoenix 1.0), and other text-to-image models with configurable dimensions and generation parameters

• 🖼️ Vectorize raster images (PNG, JPEG, WebP, GIF) to SVG format using @neplex/vectorizer with configurable quality settings - perfect for logos and icons

• 🎨 Comprehensive graphic editing with Graphic Editor Plus combining local operations (logo overlay, smart resize) and AI-powered features (style transfer, background removal, enhancement)

• 🏗️ Pro: Generate professional architectural drawings (floor plans, elevations, sections) with building codes, dimensions, and material specifications - designed for construction professionals

• 🎧 Transcribe or translate uploaded audio with OpenAI's speech-to-text endpoints

Commerce & finance workflows

• 🛍 WooCommerce-aware tools (fetch orders or products, requires WooCommerce)

• 📊 Finance-ready QuickBooks Online reporting tool for surfacing Profit and Loss, Balance Sheet, and other statements inside assistant conversations【F:includes/tools/class-wp-mcp-ai-tool-get-quickbooks-report.php†L15-L214】【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L906-L955】

• 🖥️ Pro: QuickBooks Desktop sync via QODBC relay API — connect to QuickBooks Desktop through a Windows relay server for data synchronization

• 🛒 Pro: Shopify integration with auto-resolved connections — connection_id auto-resolved from assistant context, covering products, orders, customers, inventory, and catalog tools

• 🚗 Pro: Vehicle estimation tools — VIN decode (NHTSA vPIC), image-to-repair-estimate pipeline, and car wash package pricing engine (always available)

• 📸 Pro: Listing image download tools — bulk-download Google Maps, Facebook, and Instagram business listing images into the Media Library or ZIP

Slash Commands & Workflow Automation ⭐ NEW

• ⚡ 8 Core Commands: /help, /next-task, /ship, /clean-content, /optimize-perf, /sync-docs, /workflow - Command-line style interface for content management

• 🔄 Workflow Orchestrator: Multi-step workflow execution with state management, conditional logic, and human-in-the-loop checkpoints

• 🛠️ 21 Pro Toolkit Commands: Specialized commands for E-commerce (6), Social Media (6), and Video Production (6) toolkits

• 🎯 7 Automated Workflows: Pre-built workflow templates for abandoned cart recovery, social media campaigns, video marketing, inventory management, and more

• 🔐 Security: Capability-based authorization, rate limiting, comprehensive audit logging

• 💡 Integration: JavaScript autocomplete, REST API endpoint, WP-CLI support

• Documentation → | Pro Commands →

Chat Channels & Messaging Integration ⭐ NEW

• 💬 Chat Channels Toolkit (47 Tools): Integrate with 11 platforms - Telegram, WhatsApp, Slack, Discord, Microsoft Teams, Facebook Messenger, Apple Messages for Business, Google Chat/Spaces, Twitter/X, Office 365 (Outlook + OneDrive), iCloud Drive

• 📧 Office 365 Integration ⭐ NEW: Send and retrieve Outlook mail, list/download/upload OneDrive files via Microsoft Graph API (5 tools)

• ☁️ iCloud Drive Integration ⭐ NEW: List, download, and upload iCloud Drive files via a configurable gateway service (3 tools)

• 🌐 Unified Broadcasting: Send messages across multiple platforms simultaneously with unified_channel_broadcast tool

• 🏠 WebChat Rooms: Custom post type for real-time collaborative chat rooms with AI assistant assignment

• 📝 Message Persistence: JetEngine CCT integration for permanent message history

• 🔊 WebRTC Support: Self-hosted WebRTC signaling via WordPress REST API for voice/video

• 🤖 AI-Powered Rooms: Assign dedicated assistants to chat rooms for automated support

• Chat Channels Guide → | WebChat Setup →

Communications & outreach

• ✉️ Mailjet-powered outbound email automation with granular capability enforcement and sender defaults configurable in the MCP settings.【F:includes/tools/class-wp-mcp-ai-tool-send-mailjet-email.php†L19-L405】【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L1008-L1054】

• 📅 Google Workspace automations for creating calendar events and searching connected Gmail inboxes directly from assistant workflows.【F:includes/tools/class-wp-mcp-ai-tool-create-google-calendar-event.php†L1-L200】【F:includes/tools/class-wp-mcp-ai-tool-search-gmail.php†L1-L200】

• 🧾 JetFormBuilder orchestration for listing forms, reviewing submissions, and proxying REST calls on behalf of assistants (requires JetFormBuilder)

• 📚 JetEngine REST route reference tool for surfacing endpoint metadata inside AI workflows

• 🧱 Ready for extension with ChatKit integration

Integrations, security & controls

• 🔧 Tool Registry for registering PHP functions callable by the AI

• ⚙️ JetEngine integration for dynamic content queries (requires JetEngine)

• 🔌 JetEngine 3.8 MCP Server Bridge ⭐ NEW - JSON-RPC 2.0 client bridges NV oOS into JetEngine's native MCP Server with 7 new Pro tools for CPT/taxonomy/meta field creation, relations management, site context grounding, and prompt template access. MCP-first dispatch with REST v2 fallback.

• 🤝 Agent-to-Agent (A2A) Protocol ⭐ NEW - Full A2A protocol making NV oOS assistants discoverable and interoperable with any A2A-compliant agent. /.well-known/agent.json discovery, JSON-RPC 2.0 server with task state machine, A2A client for remote agent delegation, push notification webhooks.

• 📊 Agent Command Center ⭐ NEW - Unified agent management dashboard with 7 tabs: Overview (KPI cards, live status), Activity Log, Active Tasks, Approvals (human-in-the-loop), Analytics (Chart.js with real per-agent metrics), Uptime & Health, and Strategy (efficiency scoring with recommendations).

• 💬 Floating Chat Bubble ⭐ NEW - Configurable floating chat bubble widget for Elementor and Gutenberg. 4 position variants, 3 sizes, bounce/pulse animations, dark mode, WCAG focus states, sessionStorage persistence.

• 🧷 Granular control over allowed attachment MIME types for chat uploads

• 🔐 Secure REST API endpoints

• 🔑 Root Security Key - Optional wp-config.php constant that can be enabled during emergency shutdown to require authentication before re-initializing the plugin. Provides an additional layer of protection against unauthorized reactivation after security incidents.【F:docs/features/security/root-security-key.md†L1-L511】【F:includes/class-wp-mcp-ai-root-security-key.php†L1-L360】

• 🛰 Assistant directory endpoint that advertises MCP tool/resource capabilities and negotiates Server-Sent Events handshakes for clients such as LM Studio or Claude Desktop.【F:includes/class-wp-mcp-ai-rest.php†L520-L666】【F:includes/class-wp-mcp-ai-rest.php†L1690-L1772】

• 📝 Full JSON-RPC 2.0 MCP endpoint (/mcp) for standards-compliant remote client communication

• 🔑 Configurable API credentials and defaults for OpenAI, Gemini, and Anthropic (with subscription tier support for Team/Enterprise plans and custom base URLs)

• 🤖 ChatGPT’s connector beta currently requires an Auth0 tenant; the plugin’s assistant credentials are compatible with LM Studio, Claude, and other MCP clients that support bearer headers directly.【F:docs/reference/api/mcp-server-authentication.md†L22-L46】

• 🌐 Mesh networking for distributed compute pooling across multiple WordPress sites. Server-to-server architecture enables anonymous and authenticated users to benefit from shared AI resources, budget pooling, and workload distribution across 100+ trusted peer sites. Backend assistants coordinate mesh operations via secure inter-site keys while maintaining user attribution and audit trails for compliance.【F:docs/features/federation/mesh-compute-pooling.md†L1-L615】【F:includes/tools/class-wp-mcp-ai-tool-query-remote-site.php†L1-L237】

• 🔗 Federation & Discovery - Decentralized AI capability network allowing WordPress sites to publish their capabilities via well-known endpoints (/.well-known/ai-peer) and discover peer sites through directory services. Supports peer registration, health verification, search & ranking by capability/region/policy, and automatic cron-based health monitoring. Enable federation to join the network or run your own directory service for private peer discovery.【F:docs/features/federation/federation-discovery.md†L1-L511】【F:FEDERATION-IMPLEMENTATION-SUMMARY.md†L1-L381】

• 🧾 Optional logging of chat interactions, tool executions, and API errors

• 🧮 Built-in per-user usage tracking for provider/model billing summaries

• 🧩 Developer hooks and filters for integrating custom behaviours

• ⏱ Per-site request timeout control with sensible minimum enforcement

• 🗑 Toggleable uninstall cleanup to purge stored assistants and settings automatically

Performance & reliability

• ⚡ Client-side message bundling (800ms window) to reduce API calls and server load【F:docs/user-guides/chat/message-bundling-feature.md†L1-L80】

• 🎯 Intelligent token overflow handling with automatic model switching (gpt-4.1-mini → Gemini 2.0 Flash)【F:docs/features/tools/presets/high-token-tool-handling.md†L1-L80】

• 📡 Server-Sent Events (SSE) support for real-time streaming responses and job notifications【F:docs/features/streaming/ENABLE-SSE-STREAMING.md†L1-L100】

• 🌊 Real-time job status updates via SSE streaming and webhook notifications for async operations【F:docs/features/async-jobs/job-notification-system.md†L1-L100】

• 🔧 Symfony Process Component - Modern process execution framework replacing direct exec() calls in Pro addon tools for enhanced security, timeout management, and error handling【F:includes/services/class-wp-mcp-ai-process-service.php†L1-L220】【F:docs/history/2025/implementations/symfony-phases/SYMFONY_PHASE2B_PROCESS_INTEGRATION.md†L1-L100】

• 🔄 Server-side WP-Cron polling for long-running tasks (Crawl4AI, background jobs)

• 💾 Chat history persistence with localStorage (24h) and optional JetEngine CCT storage【F:docs/user-guides/chat/chat-history-persistence.md†L1-L50】

• ⚙️ Optimized settings page with external CSS stylesheet (240 lines added to admin-settings.css) and request-level caching for improved admin performance【F:assets/css/admin-settings.css†L1-L984】【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L27-L32】

Settings Management ⭐ NEW

• 🔧 Robust Settings System - 7-step save process with automatic backups, validation, and cache management ensures settings persist correctly across all tabs and subtabs【F:includes/admin/class-wp-mcp-ai-settings-dashboard.php†L262-L410】

• 🔍 Health Check - Run 6 diagnostic checks to verify settings integrity, provider configuration, and system status with GOOD/WARNING/CRITICAL status indicators【F:includes/admin/sections/class-wp-mcp-ai-section-advanced.php†L1500-L1650】

• 💾 Export Settings - Download all plugin settings as timestamped JSON files for backup or migration to other sites【F:docs/admin-guides/settings-management.md†L40-L80】

• 📤 Import Settings - Upload and validate settings from previously exported backups with automatic pre-import backup and 5-step validation【F:docs/admin-guides/settings-management.md†L85-L135】

• 🗑️ Clear Cache - One-click clearing of static cache, object cache, and transients when settings changes don't take effect【F:docs/admin-guides/settings-management.md†L140-L165】

• ↩️ Reset to Defaults - Safely reset all settings to default values with automatic backup before reset【F:docs/admin-guides/settings-management.md†L170-L200】

• 🔒 Security - File size validation (max 5MB), MIME type checking, JSON validation, and comprehensive input sanitization【F:includes/admin/class-wp-mcp-ai-settings-dashboard.php†L970-L1030】

• 📊 Automatic Backups - Every save operation creates a timestamped backup (keeps last 5) for emergency recovery【F:includes/admin/class-wp-mcp-ai-settings-dashboard.php†L285-L295】

• 🛡️ Data Protection - 3-layer protection (section filtering, merge strategy, sensitive key filtering) prevents accidental data loss when saving from tabs/subtabs【F:docs/admin-guides/settings-management.md†L230-L280】

• 📖 Pro Toolkits - Enable and configure 8 specialized Pro toolkits (650+ tools) including Project Management, Document Generation, Health & Wellness, CRE Debt & Securitization, and more【F:docs/admin-guides/pro-settings-toolkits.md†L1-L650】

➡️ Complete Documentation: Settings Management Guide | Quick Reference | Visual UI Guide | Pro Toolkits Guide

🧠 Memory & Tool Stack Overview

Model defaults

Global settings capture the default provider, model, and timeout used when assistants are created, ensuring every conversation inherits stable generation behaviour until explicitly overridden. These defaults ship with sensible values for OpenAI and Gemini out of the box and can be tailored from the NV oOS settings screen.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L36-L77】

Base knowledge

Each assistant can preload Media Library files and optionally link to an external vector store, giving the model persistent project context before a chat begins. Editors manage these knowledge sources from the assistant post type via the “Base Knowledge” meta box, which supports multiple attachments and vector store identifiers.【F:includes/assistants/class-wp-mcp-ai-assistant-cpt.php†L892-L1002】

Available tools

The tool registry boots with a curated catalogue of content, commerce, automation, and research utilities, then exposes hooks so developers can register their own providers. During initialisation the registry loads each bundled tool class—ranging from JetEngine accessors to Crawl4AI jobs and Mailjet automations—and makes them callable within conversations.【F:includes/class-wp-mcp-ai-tool-registry.php†L74-L220】

Chat-client Memory Drawer

The chat front-end exposes a persistent Memory Drawer (assets/js/chat-memory-drawer.js) with three tabs:

• Memories — browse, pin, and delete stored context items; 🧠 badge auto-appears on any assistant message that used a memory tool.

• Scope — set the active wing/room scope for subsequent memory operations in the current session.

• Audit — lazy-loaded audit trail from WP_MCP_AI_REST_Chat_Memory_Controller::audit().

The drawer is wired to the REST proxy at /mcp-ai/v1/chat-memory/ and receives real-time updates via the memory_event SSE frame emitted by the agentic loop. Pagehide auto-capture stores the session state before tab close. Two gates control access: site-wide filter wp_mcp_ai_chat_memory_enabled and per-user meta wp_mcp_ai_chat_memory_enabled. Full reference: docs/features/memory/chat-client-integration.md.

Retroactive Transcript Mining

WP_MCP_AI_Transcript_Mining_Job retrospectively extracts memories from past chat transcripts. Enqueue a job via POST /mcp-ai/v1/transcript-mining/jobs (admin-only), poll progress with GET /jobs/{id}, or cancel with POST /jobs/{id}/cancel. Full reference: docs/features/memory/transcript-mining.md.

LLM Harnessing Subsystem

Seven opt-in per-request layers (includes/harness/) improve response quality without changing existing tool behaviour. Activated per-assistant via the LLM Harness metabox. Layers: A Prompt/Cue → B Reasoning Trace → C Tool Routing → D Retrieval → E Self-Refine → F Memory Scoping + PII Filter → G Eval Scheduler. Pro Layer H exports fine-tune curricula as OpenAI JSONL. Full reference: docs/features/llm-harness.md.

Workflow families & tool combos

The core plugin ships with a centrally registered tool catalogue that lets assistants mix and match capabilities into cohesive workflows without additional coding. Teams can chain authoring, media, research, commerce, marketing, and operational tools to deliver end-to-end outcomes inside a single conversation.

• Content & knowledge production – Combine submit_document_prompt, search_content, and search_attachments to gather source material, then follow up with save_post, create_wpcode_snippet, or get_rankmath_seo for structured drafting and optimisation.

• Media generation & transcription – Pair generate_openai_image, generate_gemini_image, vectorize_image, or graphic_editor_plus with generate_openai_speech and transcribe_openai_audio to build multimedia assets that flow into editorial or marketing outputs. Use vectorize_image to convert logos to scalable vectors, and graphic_editor_plus for comprehensive image editing with both local and AI-powered operations.

• Research & situational awareness – Chain discovery helpers like web_search, run_crawl4ai_job, reliefweb_reports, get_gdacs_events, and get_nhc_active_storms to assemble briefing packs before drafting follow-up actions.

• Commerce & finance operations – Use WooCommerce and finance tools such as create_woo_product, get_woo_products, get_woo_recent_orders, crawl4ai_price_lookup, get_import_duty, and quickbooks_report to coordinate merchandising, pricing, and bookkeeping reviews.

• Marketing & analytics insights – Combine measurement tools including google_analytics_report, get_google_business_insights, get_facebook_instagram_insights, get_linkedin_insights, and get_tiktok_insights to guide campaigns and reporting.

• Publishing & outreach automations – Trigger distribution via post_facebook_instagram, post_google_business_update, post_linkedin_update, post_tiktok_video, send_group_email, send_mailjet_email, send_telegram_message, send_whatsapp_message, and schedule_notify_sms once plans are ready.

• Integrations & scheduling – Connect external systems with create_google_calendar_event, search_gmail, list_jetengine_rest_routes, invoke_jetengine_route, and run_openai_external_action as part of larger automations.

• Operations & diagnostics – Close the loop with create_cron_job, list_cron_jobs, get_cron_job, delete_cron_job, check_wp_cli, purge_cache, purge_cloudflare_cache, purge_varnish_cache, get_site_summary, get_site_health, get_system_logs, get_update_status, and OpenAI usage/log review helpers for monitoring and maintenance.

• Automation & scheduling workflows – Agents can autonomously schedule background tasks with create_cron_job, monitor scheduled operations via list_cron_jobs and get_cron_job, and clean up outdated automations with delete_cron_job. Combine with cache management tools (purge_cache, purge_cloudflare_cache, purge_varnish_cache) to orchestrate content publishing workflows where agents schedule posts, then automatically invalidate caches at publication time.

🛠 Built-in tools & automations

The assistant registry ships with a comprehensive catalogue of editorial, marketing, commerce, and operational helpers. The tables below outline every bundled tool and the slug assistants call when orchestrating workflows.

Content & knowledge workflows

Media generation & transcription

Research & situational awareness

Commerce & finance operations

Marketing & analytics insights

Publishing & outreach

Integrations & scheduling

Operations & diagnostics

What the Cron Manager means to AI agents

The Cron Management Suite transforms AI assistants from reactive responders into proactive automation orchestrators. By providing full control over WordPress's background task scheduler, agents can:

Autonomous Task Scheduling

• Schedule content publishing workflows to go live at optimal times without human intervention

• Automate recurring maintenance tasks like cache clearing, database optimization, or backup operations

• Coordinate multi-step operations that span hours or days by chaining scheduled hooks

Intelligent Monitoring & Self-Management

• List and inspect all scheduled tasks to understand what automation is currently active

• Audit who created each task and when it's scheduled to run next

• Identify and remove outdated or redundant scheduled tasks to maintain system health

Real-World Agent Workflows

1. Content Calendar Automation - An agent helping with content strategy can schedule posts to publish at researched optimal engagement times, set up recurring social media cross-posts, and schedule follow-up email campaigns.

2. Site Maintenance Orchestration - When troubleshooting performance issues, agents can schedule off-peak cache purges, coordinate database cleanup tasks, and set up recurring health check notifications.

3. Business Process Automation - Agents can schedule recurring report generation, periodic data syncs with external systems, and automated backup verification checks.

Technical Implementation The cron manager tracks all scheduled tasks in wp_mcp_ai_cron_jobs option with full audit trails including:

• Job ID for unique identification

• Hook name and sanitized arguments

• Schedule type (single-run or recurring interval)

• Creation timestamp and user attribution

• Next execution time for monitoring

Jobs are automatically pruned when they complete (single-run) or are manually removed (recurring), keeping the tracking database clean. All cron operations require manage_options capability, ensuring only authorized users can delegate automation authority to agents.【F:includes/class-wp-mcp-ai-cron-manager.php†L12-L280】

Each tool inherits the assistant context and authenticated user from the REST layer, making it easy to layer custom permissions or extend behaviour via the documented filters and actions.【F:includes/class-wp-mcp-ai-rest.php†L236-L360】【F:includes/class-wp-mcp-ai-rest.php†L1124-L1198】

Need per-tool prerequisites or capability callouts? Consult docs/reference/tools/tool-reference.md for a detailed matrix of every bundled integration.

Tool Status Labels

The Tools Manager page displays status labels beside tool names to indicate their development stage and stability:

Status labels are displayed as 3-letter abbreviations (e.g., "STA" for stable, "BET" for beta) to keep the UI compact.

Important: Tools marked with the bug status are automatically disabled when the plugin loads. This prevents problematic tools from being used until issues are resolved. Administrators can manually re-enable them from the Tools Manager if needed for testing.

Status labels are managed via the tool-status.txt file in the repository. To assign a status label to a tool:

1. Open docs/tool-status.txt in a text editor

2. Add a line in the format: tool_slug = status_label

3. Save the file - changes appear immediately in the Tools Manager

Example:

create_post = stable
web_search = beta
generate_openai_image_validated = experimental
problematic_tool = bug

This file-based approach allows quick status updates without code changes, making it easy for maintainers to reflect tool maturity as development progresses. The automatic disabling of buggy tools provides an additional safety layer to prevent issues in production environments.

🗨 Front-end chat surfaces

NV oOS ships multiple ways to embed assistants on the front end:

• Classic chat shortcode – [mcp_ai_chat] renders the bundled interface with attachment uploads, tool invocation feedback, and optional guest access via allow_guests="true". When guest mode is enabled, the shortcode provisions a temporary token and injects it into the JavaScript bootstrap so visitors without WordPress accounts can continue chatting while still respecting capability checks and attachment safety limits.【F:includes/class-wp-mcp-ai-shortcode.php†L132-L258】【F:includes/class-wp-mcp-ai-shortcode.php†L188-L226】

• Floating chat bubble ⭐ NEW – A configurable floating button that sits at a screen corner and opens a chat panel powered by the [mcp_ai_chat] shortcode. Available as both an Elementor widget and a Gutenberg block. Supports 4 position variants, 3 sizes, auto-open delay, session persistence, dark mode, and WCAG keyboard navigation.【F:includes/elementor/class-wp-mcp-ai-elementor-chat-bubble-widget.php†L1-L200】【F:includes/blocks/chat-bubble/block.json†L1-L50】

• Elementor widgets – Drop the chat UI anywhere Elementor is active, pair it with intro/FAQ blocks, and surface dashboard telemetry without custom code. The chat widget mirrors the shortcode controls (including allow_guests), and companion widgets expose onboarding content, usage timers, provider quick links, and activity feeds for operational views.【F:includes/elementor/class-wp-mcp-ai-elementor-widget.php†L79-L138】【F:includes/class-wp-mcp-ai-elementor-integration.php†L48-L98】【F:includes/elementor/class-wp-mcp-ai-elementor-chat-intro-widget.php†L47-L140】【F:includes/elementor/class-wp-mcp-ai-elementor-chat-usage-timer-widget.php†L48-L226】【F:includes/elementor/class-wp-mcp-ai-elementor-dashboard-activity-feed-widget.php†L48-L167】

Guest tokens are honoured by the REST endpoints through the X-WP-MCP-AI-Guest header or guest_token parameter, allowing the chat shortcode and Elementor widget to make authenticated requests on behalf of public visitors without exposing persistent credentials.【F:includes/class-wp-mcp-ai-rest.php†L289-L307】【F:includes/class-wp-mcp-ai-rest.php†L2088-L2104】

Chat History Persistence

The chat interface automatically persists conversation history to the browser's localStorage, preventing data loss when users navigate away or refresh the page. Conversations are:

• Automatically saved after each user message and assistant response

• Automatically restored when returning to the chat page (within 24 hours)

• Stored per assistant so different assistant conversations remain separate

• Server-side storage available with JetEngine - See note below about optional JetEngine integration

Server-Side Chat Transcript Storage (Requires JetEngine)

⚠️ Third-Party Plugin Required: JetEngine (not included with NV oOS)

Without JetEngine, chat conversations are only stored in browser localStorage (client-side, 24-hour retention). To enable permanent server-side chat transcript archiving:

1. Install and activate the JetEngine plugin (third-party, paid plugin from Crocoblock)

2. Enable the Custom Content Types module in JetEngine settings

3. NV oOS will automatically provision the ai_chat_transcripts CCT for permanent storage

What you get with JetEngine:

• ✅ Permanent server-side chat transcript storage

• ✅ Cross-device conversation access

• ✅ Admin visibility into chat history

• ✅ Database-backed chat logs for compliance/auditing

Without JetEngine:

• ⚠️ Chat history only stored in browser localStorage

• ⚠️ Limited to 24-hour retention

• ⚠️ No cross-device synchronization

• ⚠️ Lost if browser data is cleared

See docs/user-guides/chat/chat-history-persistence.md for complete details on the persistence mechanism, data structure, and troubleshooting.

📦 Installation

ℹ️ Plugin Directory Status
This plugin is currently pending approval in the WordPress Plugin Directory. We are committed to maintaining high quality and security standards throughout the review process. You can install the plugin manually from our GitHub repository or wait for the official WordPress Plugin Directory listing.

🚀 Getting Started Wizard
After activating the plugin, you'll be redirected to a 4-step setup wizard that walks you through connecting an AI provider, choosing a use case, and creating your first assistant — all in under 2 minutes. The wizard creates fully-configured assistants with tools, system prompts, and tuned temperatures so your site is working out of the box. You can access the wizard any time at NV oOS → Getting Started or directly at /wp-admin/admin.php?page=wp-mcp-ai-getting-started.

🌱 Try It on Your PC

No live site. No API costs. No risk. The primary way to test NV oOS is a one-command demo that boots WordPress and the Complete bundle locally via WordPress Playground and wires the chat to your local Ollama — no API key, no server, and no prompts leave your machine.

⚡ Fastest: One Command (Playground + Local Ollama)

One-time prerequisites:

1. Install Ollama and pull a model:

   ollama pull llama3.1:8b

2. Allow the local origin, then restart Ollama:

   • Windows: setx OLLAMA_ORIGINS "https://playground.wordpress.net,http://localhost,http://127.0.0.1", then quit Ollama from the system tray and relaunch it.

   • macOS / Linux: OLLAMA_ORIGINS="https://playground.wordpress.net,http://localhost,http://127.0.0.1" ollama serve

Then run this command (requires Node.js 20+):

npx -y @wp-playground/cli@3.1.54 server --blueprint=https://raw.githubusercontent.com/nvdigitalsolutions/mcp-ai-wpoos/alpha-working/blueprints/ollama-demo.json --login

Open the printed local URL (e.g. http://127.0.0.1:9400/ollama-test-lab/). The first boot takes a few minutes while it downloads and installs the whole stack — after that you land on the Ollama Test Lab: a live status banner plus a chat that answers from your local model. Admin login: admin / password.

Full walkthrough, browser quick-preview link, and troubleshooting: docs/user-guides/playground-demo.md.

🧰 Classic 3-Step Install (Local, Studio, XAMPP, etc.)

Prefer a traditional local WordPress install? Follow the full walkthrough on the NV Digital Solutions blog: How to Test NV oOS on Your Own PC Using Local + Downloading the Plugin →

1. Install a local WordPress environment — Local by WP Engine or WordPress Studio is the easiest option (one-click install, no server config). Alternatives: XAMPP, MAMP, or DevKinsta.

2. Download the NV oOS plugin zip — grab the latest release from GitHub Releases (look for mcp-ai-wpoos-x.x.x.zip), or use the Code → Download ZIP button for the current development snapshot.

3. Upload, activate, and run the wizard — in your local WordPress dashboard go to Plugins → Add New → Upload Plugin, select the zip, activate it, and follow the 🚀 Getting Started Wizard. For a free local AI model (no API key needed), install LM Studio and point the wizard at http://localhost:1234.

🗺 Single-file auto-installer (roadmap) — A single cross-platform installer that bootstraps the entire stack automatically is on the roadmap. See the App / Plugin Distribution Proposal for current status and the plan.

Requirements

Minimum Requirements:

• WordPress 6.0+

• PHP 7.4+ (PHP 8.0+ recommended)

• MySQL 5.7+ or MariaDB 10.3+

Optional Requirements for Enhanced Features:

• Node.js 14+: Required for image vectorization tools (vectorize_image tool)

• PHP Functions: proc_open, proc_close, proc_terminate (for Node.js integration and Process Service)

  • These functions are often disabled on shared hosting for security

  • Can be enabled on Cloudways via Application Settings (see troubleshooting guide)

• JetEngine Plugin: For CCT storage and advanced content management tools

• WooCommerce: For e-commerce integration tools

• Elementor: For visual page builder widgets

Note: The plugin works without optional requirements, but some features will be disabled. See deployment troubleshooting for enabling disabled PHP functions.

For Developers (GitHub Clone)

✅ Production-Ready Repository
This repository includes production-optimized vendor dependencies with classmap-authoritative autoloading configured by default in composer.json. You can clone and activate immediately without running composer. The composer install command is only needed if you want to update dependencies or add development tools.

⚡ Use a shallow clone
A full clone of this repository is ~10 GB due to its long history. Use --depth 1 to download only the latest snapshot (~500 MB) — much faster and smaller. If you later need the full history, run git fetch --unshallow.

git clone --depth 1 https://github.com/nvdigitalsolutions/mcp-ai-wpoos.git

If you're cloning from GitHub:

Option 1: Cloudways and Managed Hosting (Recommended)

For Cloudways and similar managed hosting platforms, clone directly into the WordPress plugins directory:

# SSH into your server
# Navigate to WordPress plugins directory
cd /home/master/applications/YOURAPP/public_html/wp-content/plugins/

# Clone the repository (production-ready, no composer needed!)
# Use --depth 1 for a fast shallow clone (recommended for production)
git clone --depth 1 https://github.com/nvdigitalsolutions/mcp-ai-wpoos.git
cd mcp-ai-wpoos

# Verify you're in the correct directory
pwd  # Should show the plugins path

# Optional: Only needed for frontend asset rebuilding or development
# npm install && npm run build

# Optional: Only run if you need to update dependencies or add dev tools
# Note: Autoloader optimization is now configured by default in composer.json
# composer install --no-dev

⚠️ Cloudways Important Notes:

• Always clone directly into /home/master/applications/YOURAPP/public_html/wp-content/plugins/

• Do NOT clone elsewhere and then move/copy - this causes getcwd() failed errors

• Replace YOURAPP with your actual Cloudways application name

Option 2: Local Development or VPS

For local development or standard VPS hosting:

# Option A: Clone directly into WordPress plugins directory (recommended, production-ready!)
cd /path/to/wordpress/wp-content/plugins/
# Use --depth 1 for a fast shallow clone (recommended for production)
git clone --depth 1 https://github.com/nvdigitalsolutions/mcp-ai-wpoos.git
cd mcp-ai-wpoos
# Ready to activate! No composer or npm needed for production use.

# Option B: Clone and copy (also production-ready!)
# Use --depth 1 for a fast shallow clone (recommended for production)
git clone --depth 1 https://github.com/nvdigitalsolutions/mcp-ai-wpoos.git
cd mcp-ai-wpoos
cp -r . /path/to/wordpress/wp-content/plugins/mcp-ai-wpoos/

For Development Only:

# Only if you need to rebuild assets or modify dependencies:
npm install && npm run build
# Note: Autoloader optimization is now configured by default in composer.json
composer install --no-dev

Optional: Strip Dev Files for Production

If you are deploying via git clone to a production server with anti-malware / EDR scanning, the working tree will contain test fixtures that embed verbatim attack-payload literals (XSS canaries, SQL-injection samples, prompt-injection strings) used by the security test suite. These can occasionally trip signature-based scanners.

For a clean production tree, run the bundled strip script after cloning:

# Preview what would be removed
bin/strip-dev-files.sh --dry-run

# Remove tests/, docs/, bin/, .github/, .bmad/, .context/, examples/,
# phpunit.xml.dist, phpcs.xml.dist, dev configs, etc.
bin/strip-dev-files.sh

The script mirrors the exclusion list in .distignore (used for the WordPress.org SVN deploy) and the export-ignore rules in .gitattributes (used for GitHub-distributed ZIPs). It is idempotent and refuses to run on a working tree with uncommitted changes (override with --force).

Note: Do not run this on a development checkout — it removes the test suite, docs, and build tooling. It is intended for deploy targets that only run the plugin.

Final Steps

1. Activate Open Operator System Complete (NV oOS) from WordPress admin

2. You now have the complete version with all ~1,692 tools (~353 base + ~1,339 Pro; live count via WP_MCP_AI_Tool_Registry::get_tools() is authoritative)

What you get from the repository clone:

• ✅ The full codebase — all ~1,692 built-in tools ready to use (~353 base + ~1,339 Pro; live count via WP_MCP_AI_Tool_Registry::get_tools() is authoritative)

• ✅ Single plugin activation (not separate base + pro)

• ✅ Pro features automatically available (no separate Pro plugin to install)

Notes:

• The repository includes mcp-ai-wpoos-base.php and addons/pro/mcp-ai-wpoos-pro.php which are used for building separate distributions but do NOT appear as separate plugins when cloning

• Only the main plugin file (mcp-ai-wpoos.php) has a plugin header in the repository

• The build script adds headers to the other files when creating standalone distributions

Standard Installation

1. Upload mcp-ai-wpoos.zip to /wp-content/plugins/

2. Activate NV oOS from the WordPress admin

3. Go to Settings → NV oOS

4. Enter your OpenAI API key

5. Create a new “AI Assistant” in AI Assistants

6. Add [mcp_ai_chat assistant="123"] to a page or post

Optional: JetEngine Integration

⚠️ Third-Party Plugin (Not Included): JetEngine is a paid plugin from Crocoblock

JetEngine is completely optional - NV oOS works perfectly without it. However, if you want server-side chat transcript storage:

1. Purchase and install JetEngine separately

2. Enable the Custom Content Types module in JetEngine settings

3. NV oOS will automatically provision the ai_chat_transcripts CCT for permanent chat storage

What works WITHOUT JetEngine:

• ✅ All core AI assistant features

• ✅ Chat interface and conversations

• ✅ ~300 base tools (more with optional third-party plugins)

• ✅ MCP server functionality (/wp-json/mcp-ai/v1/)

• ✅ Browser-based chat history (localStorage, 24 hours)

• ✅ OpenAI/Gemini/Anthropic/Ollama/Hugging Face/Cloudflare integrations

What requires JetEngine:

• ❌ Server-side chat transcript storage (chat history only in browser without it)

• ❌ 5 JetEngine-specific tools (see 🔌 Optional Tools & Dependencies)

🔌 What You Lose Without Third-Party Plugins

NV oOS works perfectly with vanilla WordPress, but certain features require third-party plugins (sold separately). Here's exactly what you lose without each plugin:

Without JetEngine (Crocoblock - Paid Plugin)

Lost Features:

• ❌ AI metaboxes for JetEngine CPTs/Taxonomies - No AI assistant integration on JetEngine edit screens

• ❌ Research & Add pages - No AI-powered content creation with automatic field mapping

• ❌ Server-side chat transcript storage - Chat history only stored in browser localStorage (24 hours)

• ❌ Cross-device chat synchronization - No database-backed conversation history

• ❌ Admin chat history access - Cannot view/audit conversations from admin panel

• ❌ Assistant CCT synchronization - Assistants only in WordPress CPT (MCP server still works perfectly)

Lost Tools (5 tools):

• get_jetengine_items - Query JetEngine custom post types

• list_jetengine_rest_routes - List JetEngine REST API routes

• invoke_jetengine_route - Execute JetEngine REST operations

• get_jetformbuilder_forms - List JetFormBuilder forms (also requires JetFormBuilder)

• get_jetformbuilder_submissions - Get form submissions (also requires JetFormBuilder)

✅ Still Works: All core features, MCP server, ~300 base tools, AI conversations

Get JetEngine →

Without WooCommerce (Free Plugin)

Lost Features:

• ❌ E-commerce automation - Cannot create or manage products via AI

• ❌ Order management - Cannot query or analyze orders

• ❌ Product catalog access - Cannot search or update product data

Lost Tools (3 tools):

• create_woo_product - Build draft WooCommerce products with AI-generated descriptions, pricing, and images

• get_woo_products - Search and retrieve product catalog with pricing and stock status

• get_woo_recent_orders - Summarize recent orders with billing details and totals

Use Cases Lost: E-commerce content generation, order fulfillment assistance, product merchandising

Get WooCommerce →

Without Elementor (Freemium Plugin)

Lost Features:

• ❌ Template management - Cannot list or reference Elementor templates via AI

• ❌ Elementor widgets - Cannot use pre-built chat/dashboard widgets (shortcodes still work)

Lost Tools (2 tools):

• get_elementor_templates - List Elementor library templates with status, type, and edit links

• import_elementor_template_kit - Import Elementor template kits

Lost UI Components:

• Elementor Chat Widget

• Elementor Chat Intro Widget

• Elementor Dashboard Widgets (Tool Matrix, User Capabilities, Activity Feed, etc.)

✅ Still Works: Standard [mcp_ai_chat] shortcode, all AI features

Get Elementor →

Without Rank Math SEO (Freemium Plugin)

Lost Features:

• ❌ SEO analysis - Cannot query SEO scores or optimization recommendations

• ❌ Schema data access - Cannot retrieve structured data for posts

Lost Tools (1 tool):

• get_rankmath_seo - Get SEO scores, focus keywords, robots metadata, and schema details for posts

Use Cases Lost: AI-powered SEO content optimization, SEO audit assistance

Get Rank Math →

Without WPCode (Freemium Plugin)

Lost Features:

• ❌ Code snippet management - Cannot create or update code snippets via AI

• ❌ Custom functionality automation - Cannot automate adding hooks, filters, or custom code

Lost Tools (1 tool):

• create_wpcode_snippet - Create or update code snippets with validation and activation control

Use Cases Lost: AI-assisted custom development, automated code snippet generation

Get WPCode →

Without Simple JWT Login (Free Plugin)

Lost Features:

• ❌ JWT token generation - Cannot generate JWT bearer tokens for headless WordPress integrations

Lost Tools (1 tool):

• generate_simple_jwt_token - Generate JWT bearer tokens for authenticated API access

Use Cases Lost: Headless WordPress authentication, mobile app integration, SPA authentication

Get Simple JWT Login →

Summary: Third-Party Plugin Dependencies

Total Impact: Without these plugins, you lose 13 tools but retain ~300 base tools and all essential AI assistant functionality.

Base Version (Default)

NV oOS runs in Base Version mode by default, providing ~300 essential tools that work with vanilla WordPress without requiring any third-party plugins:

Base Version includes ~300 essential tools that work with vanilla WordPress:

• Content management (search, save posts, attachments)

• AI media generation (images via OpenAI/Gemini, speech, transcription, video)

• Research tools (web search, weather, disaster alerts)

• Site operations (health checks, logs, cron jobs, cache management)

• WordPress-native email (via wp_mail)

• Image manipulation (resize, crop, rotate, convert, vectorize to SVG)

• Graphic editing (local operations and AI-powered transformations)

• Profession and assistant management

• GitHub integration tools

• Google Maps Platform tools

Base Version excludes 31 tools requiring third-party plugins or external APIs:

• Third-party WordPress plugins (13 tools) - See 🔌 What You Lose Without Third-Party Plugins for details

  • WooCommerce tools (3)

  • JetEngine/JetFormBuilder tools (5)

  • Elementor tools (2)

  • RankMath/WPCode/Simple JWT Login tools (3)

• External API services (18 tools) - Require API credentials

  • Google services (5)

  • Social media integrations (8)

  • External messaging services (4)

  • QuickBooks (1)

Full Version Installation (Opt-in)

To enable the Full Version with all third-party integrations and external API tools, add this constant to your wp-config.php file:

define( 'WP_MCP_AI_BASE_VERSION', false );

📖 See BASE-VERSION.md for the complete tool list and customization options.

When to use Base Version:

• Starting fresh with WordPress

• Testing or development environments

• Simpler installations without external dependencies

• Sites that don't need e-commerce or advanced integrations

• Don't want to purchase/install third-party plugins

When to use Full Version:

• Production sites with WooCommerce, JetEngine, or Elementor already installed

• Sites needing social media automation (requires API credentials)

• Advanced workflows requiring external APIs

• Need server-side chat transcript storage (requires JetEngine)

📖 See detailed breakdown: 🔌 What You Lose Without Third-Party Plugins

📚 Documentation

NV oOS includes comprehensive documentation covering all aspects of the plugin. Documentation reorganized June 2026 — Unix-theory separation of concerns. All docs sorted into 12 purpose-driven directories with zero content loss.

📖 Documentation Hub

• Documentation Hub ⭐ Start here - Central navigation with organized categories

• Documentation Index - Complete map of all 1,600+ documentation files

• Architecture Overview - System architecture (18 providers, ~1,732 tool classes, 36 REST controllers)

• Request Flow Walkthrough - End-to-end chat request lifecycle trace

• Quick Reference Guide - Fast access to common tasks and commands

Essential References

• Tool Reference - All ~1,692 tools documented (~353 base + ~1,339 Pro; live count via WP_MCP_AI_Tool_Registry::get_tools() is authoritative)

• REST API Documentation - Complete API reference with examples

• Testing & Quality Report - Test results and code quality analysis

📦 Archive

• Historical Documentation — 50+ archived files from 2024-2025 development

• Docs Archive - Consolidated implementation history and superseded documentation

For New Users

• 🚀 Getting Started Wizard ⭐ NEW — 4-step guided setup that connects your AI provider, selects a use case, and creates a ready-to-use assistant in under 2 minutes. 8 presets available: Content Creator, Customer Support, E-commerce, SEO & Research, Developer Copilot, Media & Creative Studio, Site Administrator, General Purpose.

• Use Cases & Quickstart Guides ⭐ NEW - Comprehensive guide covering 7 major use cases with step-by-step quickstarts

• 5-Minute Quick Start - Get started immediately: from zero to first chat

• Setup Checklist - Step-by-step installation and configuration

• Remote Client Quickstart - Connect Claude Desktop, LM Studio, or other MCP clients

• Best Practices - Recommended usage patterns and optimization tips

For Developers

• Testing & Quality Report - Test suite results (2,106 tests, 73.4% pass rate), code quality analysis, security audit

• Code Review Master - Comprehensive code quality analysis (95/100 score)

• Action Items - Prioritized development tasks (180+ hours)

• Authentication Guide - Authentication methods and security

• MCP JSON-RPC 2.0 Endpoint - Model Context Protocol implementation

For Administrators

• Deployment Troubleshooting - Common issues and solutions

• Multisite Support - WordPress multisite configuration

• Rate Limit Protection - API rate limiting setup

• Mesh Routing Guide - Intelligent compute routing across sites and providers

• Federation & Discovery - Decentralized AI capability network with peer discovery and well-known endpoints

Performance & Optimization

• Message Bundling - Client-side message optimization

• High Token Tool Handling - Agentic loop token management

• Job Notification System - Real-time async job updates

• Chat Performance Optimizations - Complete performance guide

• Mesh Routing Guide - Intelligent compute routing across sites and providers

Historical Documentation

• Archive Directory - 95+ historical documents organized by category:

  • implementations/ - Implementation summaries and technical details

  • phases/ - Development phase documents

  • fixes/ - Bug fix summaries and issue resolutions

  • features/ - Feature documentation

  • code-reviews/ - Code review reports

  • testing/ - Test infrastructure documentation

⚙ Configuration Checklist (Action Items)

Complete these after installation to unlock every integration point:

• Add your OpenAI API key in Settings → NV oOS → OpenAI API Key so API calls are authorised.

• Add your Gemini API key in Settings → NV oOS → Gemini API Key if you plan to route assistants through Gemini.

• Confirm or override the default model via Settings → NV oOS → Default Model (gpt-4.1 ships as the default).

• Set a default Gemini model under Settings → NV oOS → Default Gemini Model when Gemini is enabled.

• Choose the default provider from Settings → NV oOS → Default Provider so new assistants know whether to use OpenAI or Gemini by default.

• Adjust the request timeout under Settings → NV oOS → Request Timeout (minimum 5 s, default 30 s) to match your hosting environment.

• Select a default assistant with Settings → NV oOS → Default Assistant so REST and shortcode requests have a fallback.

• Decide on logging with Settings → NV oOS → Enable Logging when you need verbose diagnostics.

• Monitor token usage in Settings → NV oOS → Token Usage Statistics to track API consumption across users, providers, and models for billing and budget management.

• Choose your uninstall behaviour via Settings → NV oOS → Remove Data on Uninstall if this site should purge assistants and settings during cleanup.

• Configure Crawl4AI access in Settings → NV oOS → Tools when you want the Crawl4AI tool to be available to assistants.

• Review attachment MIME overrides in Settings → NV oOS → Attachments before enabling file uploads for end users.

• Review Send Group Email permissions in Settings → NV oOS → Tools to choose the capability and recipient cap for the group email automation.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L348-L359】【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L938-L953】

• Connect Gmail under Settings → NV oOS → Tools → Connections → Gmail to enable Gmail search tools with OAuth 2.0. See Google OAuth Setup Guide for complete configuration steps.

• Connect QuickBooks Online under Settings → NV oOS → QuickBooks Company ID / API Key so the bundled reporting tool can fetch finance statements for authorised operators.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L906-L955】

• Configure Mailjet credentials in Settings → NV oOS → Mailjet API Key / Secret / From Email / From Name before enabling Mailjet-powered tools or Elementor widgets that send email on behalf of assistants.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L1008-L1054】

• Enable Federation & Discovery (Optional) in Settings → NV oOS → Federation & Discovery to publish your site's AI capabilities via /.well-known/ai-peer and optionally run a directory service for peer discovery. Configure regions, data tags, and rate limits to control how your site participates in the decentralized AI network.【F:docs/features/federation/federation-discovery.md†L1-L511】【F:FEDERATION-IMPLEMENTATION-SUMMARY.md†L1-L381】

• Configure Root Security Key (Optional) by adding define( 'WP_MCP_AI_ROOT_SECURITY_KEY', 'your-secure-key' ); to wp-config.php. This provides an additional security layer that can be enabled during emergency shutdown to require authentication before re-initializing the plugin.【F:docs/features/security/root-security-key.md†L1-L511】

• Enable Pro Dashboard (Optional) by adding define( 'WP_MCP_AI_PRO_DASHBOARD_ENABLED', true ); to wp-config.php. This activates the dedicated Pro Dashboard with ISO/IEC 27001 compliance monitoring, reporting, and management tools. See Pro Dashboard Documentation for details.

🧠 Language Model Providers (OpenAI, Gemini, Anthropic, Baseten, DeepSeek, OpenRouter, Kimi, DigitalOcean, NVIDIA NIM, Ollama, LM Studio, Hugging Face, Cloudflare)

A dedicated router transparently forwards chat completions to the active provider, allowing each request to target OpenAI, Gemini, Anthropic, DeepSeek, OpenRouter, Baseten, Kimi, DigitalOcean, NVIDIA NIM, a local Ollama instance, LM Studio, Hugging Face, or Cloudflare Worker AI while sharing the same assistant UX.【F:includes/class-wp-mcp-ai-language-model-router.php†L12-L86】 Configure the required API keys, default models, and the global default provider in Settings → NV oOS so new assistants inherit sensible defaults and administrators can switch providers without code changes.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L124-L333】【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L505-L530】 Assistants can still override provider, model, and generation parameters on a per-post basis.

Privacy & Terms: All AI providers have specific terms and privacy policies:

• OpenAI: Terms | Privacy

• Google Gemini: Terms | Privacy

• Anthropic: Terms | Privacy

• NVIDIA NIM: Terms | Privacy

• Cloudflare: Terms | Privacy

• Hugging Face: Terms | Privacy

• Ollama/LM Studio: Self-hosted (no external data transmission)

• Baseten: Terms | Privacy

LM Studio Support

LM Studio with Function Calling - Full support for OpenAI-compatible function calling with local LM Studio instances:

• OpenAI-compatible message structure preserved for tool calls

• Tools/functions can be invoked by LM Studio models (e.g., qwen/qwen3-coder-30b)

• Streaming automatically disabled when tools are present for reliable execution

• Full backward compatibility with non-tool scenarios

• Connect via JSON-RPC endpoint (recommended) or SSE streaming

• See LM Studio setup guide for configuration details

Provider Priority List & Automatic Fallback

The plugin includes an intelligent provider priority system that automatically tries alternative providers when the primary one fails or is unavailable. In Settings → NV oOS, you can:

• Drag and drop providers to set your preferred order

• Automatic fallback - if the first provider fails, the system tries the next one

• Visual management - see all available providers (OpenAI, Gemini, Anthropic, Baseten, DeepSeek, OpenRouter, Kimi, DigitalOcean, NVIDIA NIM, Ollama, LM Studio, Hugging Face, Cloudflare) in one sortable list

• Flexible prioritization - adjust based on cost, performance, or availability needs

The first provider in the list serves as the default. If any provider returns an error, the router automatically attempts the next provider in the list until one succeeds. This ensures maximum uptime and resilience without manual intervention. All fallback attempts are logged for debugging and monitoring.

Local AI with Ollama

The Ollama provider enables privacy-focused, cost-free AI processing by connecting to a local Ollama or LM Studio instance running on your server or development machine. This is ideal for:

• Privacy-sensitive deployments where data must stay on-premises

• Development and testing without incurring API costs

• Custom or fine-tuned models not available through cloud providers

• Air-gapped environments without internet access

To configure Ollama:

1. Install Ollama on your server or local machine

2. Pull a model (e.g., ollama pull llama2)

3. Navigate to Settings → NV oOS → Ollama Configuration

4. Enter your Ollama endpoint URL (default: http://localhost:11434)

5. Click "Test Connection" to verify connectivity

6. Click "Fetch Models" to see available models

7. Select a model from the list or manually enter a model name

8. Set "Default Provider" to "Ollama (Local AI)" if you want it as the system default

The Ollama client supports the standard chat completion flow and automatically normalizes responses to match the OpenAI format for downstream compatibility. Note that some advanced features like tool calling may vary depending on the specific Ollama model you're using.

OpenAI model coverage

The plugin ships with presets for OpenAI’s current Responses, Reasoning, Audio, and Image APIs so site owners can choose the right model for each workflow. Token windows describe the maximum request size (messages, attachments, and tool payloads) the OpenAI API will accept for that model, while output limits reflect the largest single response the service will stream back. Leave a safety margin below each ceiling so assistants can add system instructions, tool calls, and knowledge snippets without hitting provider limits.

Media and multimodal defaults

OpenAI regularly revises token policies and media limits, so review the model specification dashboard before rolling out new assistants or increasing attachment budgets. Updating your defaults in Settings → NV oOS keeps every assistant aligned with the latest provider guidance.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L36-L105】【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L2298-L2398】

🧱 ChatKit Integration

The ChatKit module now ships with the core NV oOS plugin, so no separate add-on installation is required. Once enabled it self-registers through ChatKit’s filter and action APIs as soon as both plugins load, exposing the mcp-ai/v1 REST namespace while advertising chat, tool invocation, attachment download, and guest token support without any manual bootstrapping. Return false from the wp_mcp_ai_chatkit_is_available filter if you need to disable the automatic registration for bespoke environments.【F:includes/class-wp-mcp-ai-chatkit-integration.php†L30-L204】【F:includes/class-wp-mcp-ai-rest.php†L16-L2104】

From the ChatKit dashboard configure the NV oOS integration and supply at least one assistant ID so ChatKit knows which conversation to join. Optional fields let you override the system prompt or preload tool shortcut payloads for operators; capability checks inherit the wp_mcp_ai_chat_capability filter, so you can align ChatKit access with the same policies used for shortcodes or REST calls.【F:includes/class-wp-mcp-ai-chatkit-integration.php†L182-L210】【F:mcp-ai-wpoos.php†L25-L72】

Consult docs/developer/integration/chatkit-integration.md for a full configuration walkthrough, JSON examples for shortcut presets, and notes on extending the definition via filters.

🌐 Crawl4AI Integration

Administrators with manage_options capabilities can run the Run Crawl4AI Job tool without any external service: when no Crawl4AI endpoint is configured the plugin performs the crawl directly on the WordPress server using the built-in HTTP client, extracts headings and text as Markdown, and records the raw HTML and response metadata for the assistant.【F:includes/tools/class-wp-mcp-ai-tool-run-crawl4ai-job.php†L32-L745】 Errors for individual URLs are captured in the response metadata so partial crawls still return useful context. When a remote Crawl4AI endpoint is configured the request now returns immediately with a task token while WP-Cron powered background polling captures the final payload and makes it available to the assistant UI once the crawl finishes.【F:includes/crawler/class-wp-mcp-ai-crawler.php†L1-L214】【F:assets/js/chat.js†L1-L2200】

Configure remote endpoints or API keys under Settings → NV oOS → Tools to tailor how the Crawl4AI integration runs across environments.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L248-L521】

Supplying a Crawl4AI base URL (and optional API key) switches the tool back to proxying crawl jobs to the remote Crawl4AI REST API, preserving backwards compatibility with existing deployments.【F:includes/tools/class-wp-mcp-ai-tool-run-crawl4ai-job.php†L206-L339】【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L248-L521】 Local environments can still feed a custom endpoint to the integration through the WP_MCP_AI_CRAWL4AI_BASE_URL or CRAWL4AI_BASE_URL environment variable when you want to test against a dedicated Crawl4AI service.【F:mcp-ai-wpoos.php†L54-L96】

📡 Job Notification System

NV oOS includes a general-purpose infrastructure for real-time notifications on async WordPress jobs, providing SSE streaming and webhook support for external integrations.【F:docs/features/async-jobs/job-notification-system.md†L1-L100】

Architecture

Async Job → WordPress Action → Job Notifier → [SSE | Webhooks]
                                                 ↓       ↓
                                            Frontend  External

Automatic Crawl4AI Integration

The system automatically hooks into Crawl4AI jobs via the wp_mcp_ai_crawl4ai_job_completed action, providing real-time status updates as crawls progress. No additional code is needed—Crawl4AI jobs automatically trigger notifications.【F:includes/crawler/class-wp-mcp-ai-crawler.php†L1-L214】

Frontend SSE Subscription

JavaScript clients can subscribe to job status updates using Server-Sent Events:

const jobId = 'crawl_abc123';
const eventSource = new EventSource(
    `/wp-json/mcp-ai/v1/jobs/${jobId}/stream?max_duration=300&poll_interval=2`
);

eventSource.addEventListener('status', (e) => {
    const status = JSON.parse(e.data);
    console.log('Job status:', status.status, status.progress);
    updateProgressBar(status.progress);
});

eventSource.addEventListener('complete', (e) => {
    const data = JSON.parse(e.data);
    console.log('Job completed:', data.final_status);
    eventSource.close();
});

Webhook Registration

External systems can receive HTTP callbacks when jobs complete:

WP_MCP_AI_Job_Notifier::register_webhook(
    'crawl_abc123',
    'https://example.com/webhook',
    array( 'completed', 'failed' )
);

➡️ See docs/features/async-jobs/job-notification-system.md for complete implementation details.

🧊 Elementor Widgets

Sites running Elementor automatically register a suite of MCP blocks so you can assemble onboarding pages, operational dashboards, and standalone chat layouts without writing markup.【F:includes/class-wp-mcp-ai-elementor-integration.php†L12-L98】 The integration only boots when Elementor is present, so non-Elementor installs avoid any overhead.【F:includes/class-wp-mcp-ai-elementor-integration.php†L29-L46】

Chat surfaces and companion blocks

• NV oOS Chat – Renders the assistant interface with the same controls exposed by the [mcp_ai_chat] shortcode, including the allow_guests toggle for minting temporary visitor tokens.【F:includes/elementor/class-wp-mcp-ai-elementor-widget.php†L17-L138】

• NV oOS Chat Bubble ⭐ NEW – Floating chat bubble that sits at a configurable screen corner and opens a chat panel powered by the existing [mcp_ai_chat] shortcode. Also available as a Gutenberg block (wp:mcp-ai-wpoos/chat-bubble). 5 control sections: Chat Settings, Bubble Settings (position/size/animation/tooltip/badge/auto-open), Panel Settings, Bubble Style, Panel Style. BEM CSS with 4 positions, 3 sizes, bounce/pulse animations, dark mode, full-screen mobile (<480px), prefers-reduced-motion, WCAG focus states. Public API at window.wpMcpAiChatBubble.【F:includes/elementor/class-wp-mcp-ai-elementor-chat-bubble-widget.php†L1-L200】【F:includes/blocks/chat-bubble/block.json†L1-L50】

• NV oOS Chat Intro – Adds a configurable hero block above the conversation with headings, talking points, and an optional call-to-action button to guide visitors before they engage the model.【F:includes/elementor/class-wp-mcp-ai-elementor-chat-intro-widget.php†L47-L190】

• NV oOS Chat FAQ – Surfaces a repeater-driven FAQ list alongside the chat so product teams can document policies and best practices in context.【F:includes/elementor/class-wp-mcp-ai-elementor-chat-faq-widget.php†L47-L150】

• NV oOS Usage & Timer – Combines a focus timer with per-user token totals, gracefully handling logged-out visitors, disabled tracking, and empty usage histories.【F:includes/elementor/class-wp-mcp-ai-elementor-chat-usage-timer-widget.php†L48-L340】

Operations dashboards

• NV oOS Tool Matrix – Pulls the tool registry, groups integrations by focus area, and highlights the required capability for each assistant tool so administrators can plan enablement safely. The Send Group Email row now mirrors the capability and recipient limit configured in the MCP settings so editorial policies stay front-of-mind.【F:includes/elementor/class-wp-mcp-ai-elementor-dashboard-tool-matrix-widget.php†L48-L440】

• NV oOS User Capability Snapshot – Summarises the signed-in operator’s profile, common capabilities, JetEngine access, and multisite memberships to support governance reviews. It also surfaces the configured Send Group Email capability and limit so administrators immediately know whether the current user can trigger bulk mail jobs.【F:includes/elementor/class-wp-mcp-ai-elementor-dashboard-user-capability-widget.php†L48-L392】

• NV oOS Theme Preview – Renders a mock conversation using the saved chat color tokens and optionally displays a legend of every branding token for quick QA during rollouts.【F:includes/elementor/class-wp-mcp-ai-elementor-dashboard-theme-preview-widget.php†L48-L198】

• NV oOS Provider Quick Links – Reuses the OpenAI usage/log tools to populate external billing and telemetry shortcuts that open in new tabs for rapid debugging.【F:includes/elementor/class-wp-mcp-ai-elementor-dashboard-provider-links-widget.php†L48-L166】

• NV oOS Activity Feed – Streams the latest MCP log entries (tool runs, chat interactions, and optional provider requests), collapsing raw context into expandable JSON blocks for deeper analysis.【F:includes/elementor/class-wp-mcp-ai-elementor-dashboard-activity-feed-widget.php†L48-L210】

🧮 Usage Tracking

Privacy-First Analytics (v1.2.0+)

The plugin includes optional, privacy-first activation tracking to help us understand plugin usage and improve development priorities. This feature is:

Privacy Features:

• ✅ No PII collected - No personal information or identifiable data

• ✅ Site URLs hashed - Non-reversible SHA-256 hash with WordPress salts

• ✅ No IP storage - IP addresses are not logged or stored

• ✅ Local dev excluded - Automatically disabled for localhost and common dev domains

• ✅ Opt-out available - Easy to disable via settings or filter hook

• ✅ GDPR compliant - Meets all privacy regulations

• ✅ Fully transparent - All code is open source and documented

Data Collected:

• Plugin variant (complete, base, pro, or core)

• Plugin version number

• WordPress version

• PHP version

• Site locale (language)

• Multisite status

• Hashed site identifier (non-reversible)

• Timestamp

How to Opt Out:

1. Via Settings: Settings → NV oOS → General → Log Management → Disable Activation Tracking

2. Via Filter Hook:

   add_filter( 'wp_mcp_ai_enable_usage_tracking', '__return_false' );

Full Privacy Details: See EXTERNAL_SERVICES.md for complete documentation.

The plugin records aggregate token usage per user, provider, and model whenever responses include usage metadata, simplifying internal reconciliation or billing workflows. Usage data is stored as user meta and automatically purged when accounts are deleted, and hooks are exposed for custom reporting pipelines.【F:includes/class-wp-mcp-ai-usage-tracker.php†L12-L119】

Token Usage Management Dashboard

Administrators with manage_options capability can view comprehensive token usage statistics in Settings → NV oOS:

Global Statistics (All Users):

• Total requests across all users

• Total tokens consumed (prompt + completion)

• Prompt tokens used

• Completion tokens generated

• Cached tokens (for providers supporting prompt caching)

• Reset all usage data button (with confirmation)

Individual User Statistics:

• Your personal token consumption

• Per-user breakdown of requests and tokens

• Reset personal usage data button

Detailed Breakdown:

• Usage by provider (OpenAI, Gemini, Anthropic, NVIDIA NIM, Ollama, LM Studio, Hugging Face, Cloudflare)

• Usage by specific model (e.g., gpt-4.1-mini, gemini-2.0-flash)

• Request counts per provider/model combination

• Last used timestamp for each model

• Comprehensive table view with all metrics

The usage tracking system automatically:

• Records usage from all API responses that include usage metadata

• Aggregates data by user, provider, and model

• Updates in real-time as conversations occur

• Supports the Open OpenAI Usage tool for quick access to provider dashboards

• Provides AJAX-powered reset functionality for administrators

🧷 Attachment MIME Controls

Administrators can override the default image and file MIME allowlists used by the chat uploader. The settings screen accepts one MIME type per line, and the attachment helper merges the overrides with its defaults before enforcing them on upload and shortcode configuration.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L225-L669】【F:includes/class-wp-mcp-ai-message-attachments.php†L503-L559】 Leave the fields empty to fall back to the bundled safe defaults.

⚡ Message Bundling

NV oOS implements client-side message bundling to optimize API usage and reduce server load. When enabled, messages sent within an 800ms window are automatically grouped into a single API request, reducing costs and improving performance for users who send multiple messages in quick succession.【F:docs/user-guides/chat/message-bundling-feature.md†L1-L80】

How It Works

1. User sends a message → Displayed immediately in the chat UI

2. 800ms timer starts → System waits for additional messages

3. More messages arrive → Timer resets with each new message

4. Timer expires → All queued messages sent together in one request

Visual Feedback

• "Preparing to send…" - Messages are being queued during the bundling window

• "Sending…" - Bundled messages are being transmitted to the server

Benefits

• Reduced API costs - Fewer requests mean lower costs for pay-per-request APIs

• Lower server load - Fewer requests to process and respond to

• Better mobile experience - Ideal for users who type in short bursts

• Backward compatible - Server code unchanged, same payload format

Configuration

Message bundling is enabled by default and requires no configuration. To disable for debugging:

window.wpMcpAiChatDebugMode = true;

➡️ See docs/user-guides/chat/message-bundling-feature.md for configuration options and implementation details.

🎯 Agentic Loop Token Management

NV oOS includes intelligent handling for tools that return large responses, preventing token overflow errors during agentic loops (where the AI automatically calls multiple tools).【F:docs/features/tools/presets/high-token-tool-handling.md†L1-L80】

The Problem

Tools like run_crawl4ai_job can return 100,000+ tokens of content. In agentic loops, each API call includes all previous messages, causing token counts to grow rapidly and exceed model limits (e.g., gpt-4.1-mini's 200k TPM limit).

The Solution: Three-Tier Strategy

Tier 1: Token Limit Detection

• Estimates total tokens before each API call

• Checks against model's TPM (Tokens Per Minute) limit

• Prevents requests that would exceed limits

Tier 2: Automatic Model Switching

• When limits exceeded, auto-switches to fallback model

• Default fallback: Gemini 2.0 Flash (1-2 million token capacity)

• Preserves full context without data loss

• Transparent to the user

Tier 3: Message Truncation

• If even fallback model can't handle tokens

• Truncates older messages from conversation

• Always preserves system prompts and recent context

• Logs what was truncated for debugging

Configuration

Automatic model switching is enabled by default. Configure fallback model under Settings → NV oOS:

// Default fallback model
'fallback_model' => 'gemini-2.0-flash-exp'

➡️ See docs/features/tools/presets/high-token-tool-handling.md for complete technical details and examples.

🔄 Chat Performance Optimizations

NV oOS includes several performance optimizations to enhance the chat experience:

• Message bundling - Reduces API calls by grouping rapid user inputs

• Token budget management - Prevents API limit overruns with safety margins【F:docs/features/performance/tpm-limit-validation.md†L1-L50】

• Chat history persistence - LocalStorage (24h) + optional JetEngine CCT storage【F:docs/user-guides/chat/chat-history-persistence.md†L1-L50】

• Automatic model switching - Seamlessly handles token overflow scenarios

• Rate limit protection - Intelligent retry with exponential backoff【F:docs/features/performance/rate-limit-protection.md†L1-L50】

➡️ See docs/features/chat/chat-performance-optimizations.md for detailed performance tuning guide.

🌐 Mesh Compute Routing

NV oOS includes intelligent mesh compute routing that automatically distributes AI workload across multiple sites OR multiple providers using AI-powered decision-making. This feature works in two modes:

1. Multi-Site Mesh: Distribute load across multiple WordPress installations

2. Single-Site Multi-Provider: Balance load across OpenAI, Gemini, Anthropic, NVIDIA NIM, Hugging Face, Cloudflare, and Ollama on one site

Both modes use the same AI-powered routing engine to optimize for cost, performance, and reliability.

Key Capabilities

• AI-Optimized Routing - Analyzes prompt complexity and routes to optimal provider/site

• Cost Optimization - Use GPT-4o-mini for simple queries, GPT-4o for complex tasks

• Automatic Failover - Switch providers on rate limits or outages

• Compute Hubs - Designate powerful servers for heavy workloads

• Rate Limit Management - Auto-switch to alternative providers when limits hit

• Privacy Control - Route sensitive data to local Ollama instances

Quick Start Examples

Single-Site Setup (No mesh required):

• Configure multiple AI providers (OpenAI + Gemini + Anthropic + Hugging Face + Cloudflare + Ollama)

• Set assistant routing strategy to "AI Optimized"

• Save 90% on costs by routing simple queries to cheaper models

Multi-Site Setup (Distributed compute):

• Enable mesh networking on all sites

• Designate compute hubs with larger models

• Automatic load balancing across peer sites

• Cross-server compute pooling for Cloudways, SiteGround, etc.

➡️ See docs/features/federation/mesh-routing-guide.md for complete setup guide, routing strategies, and use cases. ➡️ See docs/features/federation/mesh-compute-pooling.md for architecture and authentication details.

🔗 Federation & Discovery System

NV oOS includes a decentralized AI capability network that allows WordPress sites to publish their capabilities and discover peer sites. Think of it as "npm for AI tools" — sites can advertise what they offer and find complementary capabilities from trusted peers.

Overview

The Federation & Discovery system provides three deployment modes:

1. Publisher Mode: Publish your site's capabilities via /.well-known/ai-peer

2. Directory Mode: Run a discovery service for peer registration and search

3. Consumer Mode: Query directories to find and use peer capabilities

Quick Start

Enable Federation (Publisher Mode):

1. Navigate to Settings → NV oOS → Federation & Discovery

2. Check Enable federation

3. Configure regions (e.g., us, eu, ap) and data tags (e.g., no_pii, gdpr_ok)

4. Your capabilities are now published at https://yoursite.com/.well-known/ai-peer

Enable Directory Service (Optional):

1. In the same settings section, check Enable directory service

2. Your directory API is now available at https://yoursite.com/wp-json/ai-dir/v1

3. Automatic hourly health checks verify registered peers

Key Features

• 📡 Well-Known Endpoints - Standards-based capability publishing

• 🔍 Peer Discovery - Search by capability, region, and data policy

• ✅ Health Monitoring - Automatic cron-based peer verification

• 🏆 Smart Ranking - Scores peers by region, latency, and policy match

• 🔐 JWKS Verification - Built-in security with public key discovery

• ⚙️ Conditional Loading - Zero overhead when disabled

API Endpoints

Directory REST API (/wp-json/ai-dir/v1):

• POST /peers/register - Register a new peer

• GET /peers - List all peers with health status

• GET /peers/{id} - Get peer details

• GET /search - Search peers by capability/region/policy

• POST /reverify/{id} - Manually trigger health check

• POST /report/{id} - Report peer issues

Well-Known Endpoints:

• GET /.well-known/ai-peer - Your site's capability manifest

• GET /.well-known/jwks.json - Public keys for verification

Use Cases

Private Organization Network:

• Multiple WordPress sites within one organization

• Share AI capabilities across internal sites

• Central directory for discovery

• Private peer network with secure authentication

Public Directory Service:

• Community-run capability discovery

• Accept registrations from external sites

• Provide search API for consumers

• Build an ecosystem marketplace

Capability Consumer:

• Query public directories for needed capabilities

• Integrate with mesh router for automatic peer selection

• No need to publish your own capabilities

• Access specialized tools from the network

Configuration Options

• Regions: Geographic locations (e.g., us, eu, ap, global)

• Data Tags: Compliance policies (e.g., no_pii, gdpr_ok, hipaa_like)

• QPS Limit: Queries per second (default: 5)

• Burst Capacity: Simultaneous requests (default: 10)

➡️ Complete Documentation: docs/features/federation/federation-discovery.md ➡️ Implementation Summary: FEDERATION-IMPLEMENTATION-SUMMARY.md

🕵 Code Review

The 2025-10-31 internal review confirms the hardening of the group email automation (header filtering and attachment caps) and the case-sensitive variable handling in the OpenAI external action tool, and only flags a low-severity performance concern around guest token transient churn for public chat embeds. These findings have been consolidated into the master code review document. One follow-up action item recommends re-using or rate-limiting guest tokens to keep the options table tidy on cache-less hosts.

➡️ See docs/developer/best-practices/CODE-REVIEW-MASTER.md for the complete code quality assessment.

🔒 MCP Server Authentication

Remote MCP assistants should authenticate with Auth0-issued bearer tokens (Authorization: Bearer YOUR_TOKEN) whose audience and scope align with the values configured under Settings → NV oOS. Same-origin experiences (the dashboard editor and shortcode UI) continue to rely on the X-WP-Nonce header tied to the logged-in WordPress session. Review docs/reference/api/mcp-server-authentication.md for a complete setup guide plus a breakdown of the structured error responses returned on failure, and keep the deployment troubleshooting checklist handy when diagnosing capability or credential regressions.

MCP transports (v1.1.55+): POST /wp-json/mcp-ai/v1/mcp speaks JSON-RPC 2.0 over Streamable HTTP by default. Legacy HTTP+SSE clients (SSE-only Accept: text/event-stream or ?stream=true) get a credential-bound session handshake from GET /mcp and receive responses as event: message on the GET stream — enable with WP_MCP_AI_LEGACY_SSE_ENABLED. JSON-RPC errors return HTTP 200 with the {"jsonrpc","id","error"} envelope so agent SDKs that drop non-2xx bodies relay tool errors instead of hanging; auth/permission failures keep real HTTP statuses. Assistant credential headers may be sent as Authorization: Bearer cred_xxxxx.SECRET or raw Authorization: cred_xxxxx.SECRET. Tool-call traffic is governed by the settings-driven tool rate limiter (credential tokens exempt by default), and GET/HEAD discovery probes never consume the request quota. See docs/developer/implementation-plan-mcp-agent-compat.md and docs/developer/legacy-sse-transport-plan.md for the full rationale.

Using NV oOS as an MCP server

1. Install the plugin and create assistants. Each WordPress instance that activates NV oOS exposes an MCP-ready assistant directory backed by the ai_assistant custom post type, so every published assistant becomes available to remote clients once credentials are issued.【F:includes/assistants/class-wp-mcp-ai-assistant-cpt.php†L460-L620】

2. Configure the REST and connector settings. Populate the Auth0, model provider, and optional integration credentials under Settings → NV oOS so the REST controller can advertise the correct namespace URLs and enforce bearer tokens per your tenant, scope, and provider defaults.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L36-L118】

3. Expose the MCP directory endpoints. The REST layer publishes /assistants, /chat, /tools, and an SSE-compatible /sse handshake inside the wp-json/mcp-ai/v1 namespace, automatically scoping responses to the authenticated assistant or returning every assistant the caller may read.【F:includes/class-wp-mcp-ai-rest.php†L234-L703】 Hand-held clients can subscribe to the streaming directory event or call the JSON routes directly using the base URLs returned in the directory payload.【F:includes/class-wp-mcp-ai-rest.php†L653-L703】

4. Register any additional tools. Extend the server’s capabilities by hooking into wp_mcp_ai_register_tools and loading custom tool classes; registered slugs flow through the assistant directory and tool execution endpoint without extra wiring.【F:includes/class-wp-mcp-ai-tool-registry.php†L75-L195】

5. Verify the deployment before sharing credentials. Run wp mcp-ai remote https://example.com/wp-json/mcp-ai/v1 --token=YOUR_TOKEN from any WP-CLI environment to confirm authentication, assistant scope, and chat probes succeed before you hand tokens to operators or client teams.【F:includes/class-wp-mcp-ai-cli-command.php†L137-L220】

Operating multiple MCP deployments

Provision a separate WordPress site (or network site) for each MCP server you need, activate NV oOS, and repeat the configuration steps above with environment-specific Auth0 audiences, scopes, and provider keys. Because the assistant directory response includes the resolved REST base and namespace metadata, MCP clients can be pointed at different deployments simply by swapping the base URL and the bearer credential minted for that site’s assistants.【F:includes/admin/class-wp-mcp-ai-admin-settings.php†L48-L118】【F:includes/class-wp-mcp-ai-rest.php†L653-L703】

Sites that enable the Simple JWT Login integration can now reuse those bearer tokens alongside Auth0 credentials. The plugin validates tokens with Simple JWT Login’s native services, falls back to manual JWT decoding when the dependency cannot resolve a user, and automatically scopes REST requests to the assistant encoded in the token so cross-assistant hops are blocked with actionable errors.【F:includes/class-wp-mcp-ai-simple-jwt-login-integration.php†L47-L214】【F:includes/integrations/class-wp-mcp-ai-integration-simple-jwt.php†L240-L378】【F:includes/class-wp-mcp-ai-rest.php†L2769-L2808】

🌐 Connecting Remote MCP Clients

NV oOS works seamlessly with popular MCP clients including Claude Desktop, LM Studio, and ChatGPT connectors. Each client connects to your WordPress site via the MCP REST API at /wp-json/mcp-ai/v1 and can access assistants, execute tools, and interact with your WordPress data remotely.

SSE Support: All MCP endpoints support Server-Sent Events (SSE) for real-time streaming. Enable SSE in your client configuration for better response times and real-time updates. See the SSE Streaming Support section for details.

Quick Start

1. Generate an assistant credential from any published assistant's API Credentials meta box

2. Copy the token (format: cred_xxxxx.SECRET) — shown only once!

3. Configure your MCP client with your site's base URL and the credential

4. Test the connection using the provided test script or WP-CLI command

Claude Desktop setup

Claude Desktop supports MCP servers through a JSON configuration file. Add your WordPress site:

{
  "mcpServers": {
    "wordpress-site": {
      "url": "https://your-site.com/wp-json/mcp-ai/v1",
      "headers": {
        "Authorization": "Bearer cred_xxxxx.SECRET"
      },
      "sse": true
    }
  }
}

See the complete Claude Desktop setup guide and example configurations for multi-assistant deployments.

LM Studio Setup

⚠️ Having SSE content-type errors? Use the JSON-RPC endpoint instead!

LM Studio can connect using two methods:

Method 1: JSON-RPC (Recommended - No SSE)

Use this if you're getting SSE error: Invalid content type, expected "text/event-stream":

{
  "servers": [
    {
      "id": "wordpress-mcp",
      "name": "WordPress Site",
      "url": "https://your-site.com/wp-json/mcp-ai/v1/mcp",
      "auth": {
        "type": "bearer",
        "token": "cred_xxxxx.SECRET"
      },
      "timeout": 30000
    }
  ]
}

Configure in LM Studio:

• Server Name: WordPress Site

• URL: https://your-site.com/wp-json/mcp-ai/v1/mcp

• Auth Type: Bearer Token

• Token: cred_xxxxx.SECRET

• Do NOT enable SSE

Method 2: SSE Streaming (Optional)

If you want to use SSE for real-time updates:

• Base URL: https://your-site.com/wp-json/mcp-ai/v1

• Enable SSE: ✓ (checked)

• SSE Endpoint: /sse

See the complete LM Studio setup guide and example configurations:

• lmstudio-mcp-without-sse.json - Recommended

• lmstudio-config.json - With SSE

ChatGPT connector setup

⚠️ Note: ChatGPT connectors currently require Auth0 authentication. Assistant-issued credentials are not yet supported by OpenAI's ChatGPT platform.

To connect via ChatGPT:

1. Configure Auth0 in Settings → NV oOS

2. Generate an Auth0 access token with the configured audience

3. Add the MCP server in ChatGPT's connector settings

See the ChatGPT connector guide for detailed Auth0 setup steps.

Testing your connection

Use the built-in test script to verify connectivity:

./bin/test-remote-connection.sh \
  -u https://your-site.com/wp-json/mcp-ai/v1 \
  -t cred_xxxxx.SECRET

Or use WP-CLI:

wp mcp-ai remote https://your-site.com/wp-json/mcp-ai/v1 \
  --token=cred_xxxxx.SECRET

Expected output confirms the server is reachable and lists available assistants.

Complete documentation

For comprehensive setup guides, troubleshooting, and advanced configurations, see:

• MCP Client Configurations – ⭐ NEW: Complete guide for all MCP clients (LM Studio, Claude Desktop, Cursor, Continue.dev, Cline, OpenAI)

• Remote Client Setup Guide – Step-by-step instructions for Claude Desktop, LM Studio, and ChatGPT

• MCP Server Authentication – Authentication methods and credential management

• REST API Reference – Endpoint documentation and payload examples

• Example Configurations – Ready-to-use config files for all major MCP clients

🎫 Token Management UI

NV oOS 1.0.0 introduces a centralized Token Manager for managing all external agent access tokens across your assistants. Access it via NV oOS → Token Manager in the admin menu.

Features

• Centralized Control - Manage all assistant credentials in one place

• Security Best Practice - Tokens shown only once after creation (cannot be retrieved later)

• Lifecycle Management - Create, view, revoke, and delete credentials

• Audit Trail - Track who created/revoked each token and when

• Metadata Display - See creation date, status (active/revoked), associated assistant

• Bulk Visibility - View credentials across all assistants at a glance

How It Works

The Token Manager follows industry standards similar to GitHub Personal Access Tokens, Stripe API keys, and Auth0 credentials:

1. Create Token - Generate new credentials from the assistant editor

2. Copy Immediately - Token shown once and cannot be retrieved later

3. Use in MCP Clients - Configure external applications (Codex CLI, MCP clients, custom integrations)

4. Revoke When Needed - Disable compromised tokens without deleting audit history

5. Delete When Done - Permanently remove tokens and all metadata

Security Notes

• Tokens are hashed before storage (only hash stored, never plaintext)

• Requires manage_options capability

• All actions logged with user attribution

• Revoked tokens cannot be reactivated (must create new)

• HTTPS strongly recommended for token transmission

Usage Example

# In assistant editor: Create credential → Copy token immediately
# Token format: cred_[YOUR_PREFIX].[YOUR_SECRET_KEY_HERE]
# Example format only - never share real tokens!

# Configure MCP client (e.g., Codex CLI)
export WPOOS_BEARER_TOKEN="your_token_here"
codex chat --assistant 123 "Hello world"

# Later: Revoke from Token Manager UI if compromised
# Or: Delete entirely when integration removed

⚠️ Security Warning: The examples above use placeholder tokens. Never share real tokens publicly or commit them to version control.

Access Requirements

• Capability: manage_options (administrators only)

• Menu Location: NV oOS → Token Manager

• REST API: /wp-json/mcp-ai/v1/token-manager/*

For complete documentation, see Token Management Guide.

🤖 ChatGPT Connector

OpenAI’s ChatGPT connector beta currently authenticates exclusively through Auth0. Because NV oOS issues its own assistant-scoped bearer credentials, you can connect LM Studio, Claude Desktop, and other MCP-aware clients today, while ChatGPT support will require either Auth0 bridging or native bearer support from OpenAI. We’ll update this section as soon as ChatGPT adds compatibility with first-party tokens.【F:docs/reference/api/mcp-server-authentication.md†L22-L46】

🛰 REST API Endpoints

All front-end chat surfaces ultimately call the MCP REST namespace at /wp-json/mcp-ai/v1, which exposes dedicated endpoints for chat completions and direct tool execution. Both routes share the same authentication rules described above: supply an Auth0 bearer token, a plugin-issued assistant credential, or a WordPress REST nonce for same-origin requests. Guest tokens issued by the shortcode or Elementor widget continue to be honoured when allow_guests="true" is enabled.【F:includes/class-wp-mcp-ai-rest.php†L230-L322】【F:includes/class-wp-mcp-ai-rest.php†L289-L343】【F:includes/class-wp-mcp-ai-rest.php†L1288-L1336】

• GET /assistants – Returns a directory of accessible assistants with provider defaults, tool counts, capability metadata, and implementation details so remote clients can choose which assistant to call. Credential tokens are automatically scoped to their issuing assistant while Auth0 tokens and REST nonces surface every published assistant the caller can read.【F:includes/class-wp-mcp-ai-rest.php†L238-L666】 The endpoint also supports Server-Sent Events for MCP clients that expect streaming discovery payloads, emitting a single directory event with cache-busting headers before closing the stream.【F:includes/class-wp-mcp-ai-rest.php†L1690-L1772】

• GET /sse – Mirrors the assistant directory response but forces a Server-Sent Events handshake so MCP clients that negotiate /sse subscriptions receive the streaming directory payload without additional query parameters.【F:includes/class-wp-mcp-ai-rest.php†L400-L715】

• POST /chat – Normalises structured messages, injects assistant defaults, auto-enables the Submit Document Prompt tool when uploads are present, and forwards the request through the language model router. Responses include the assistant ID and the raw provider payload so clients can stream or render messages as needed.【F:includes/class-wp-mcp-ai-rest.php†L230-L322】【F:includes/class-wp-mcp-ai-rest.php†L931-L1095】

• POST /tools – Executes a specific registered tool outside of a chat turn. The endpoint enforces assistant tool allowlists, scopes credential-based requests to the issuing assistant, merges assistant defaults (such as external action identifiers), and returns the tool result with execution metadata.【F:includes/class-wp-mcp-ai-rest.php†L264-L322】【F:includes/class-wp-mcp-ai-rest.php†L1162-L1321】

See docs/reference/api/rest-api.md for payload examples, attachment handling rules, and troubleshooting tips when integrating custom clients.

🌊 SSE Streaming Support

NV oOS includes comprehensive Server-Sent Events (SSE) support for real-time streaming responses, enabling faster perceived response times and better user experience.

What is SSE?

Server-Sent Events provide unidirectional server-to-client streaming over HTTP, allowing the server to push updates as they become available rather than waiting for the complete response.

Benefits:

• ⚡ Faster perceived response time - Users see content immediately as it's generated

• 🔄 Real-time updates - Progressive loading for long-running operations

• 📶 Connection keep-alive - Prevents timeouts during lengthy responses

• 🎯 Better UX - ChatGPT-style typing effect for AI responses

SSE-Enabled Endpoints

1. Assistant Directory Streaming (GET /assistants)

Stream the assistant directory for MCP clients expecting SSE handshakes:

curl -H "Accept: text/event-stream" \
  https://your-site.com/wp-json/mcp-ai/v1/assistants

The endpoint emits a single directory event with all accessible assistants, then closes the connection.

2. Dedicated SSE Endpoint (GET /sse)

Force SSE mode for MCP clients that specifically probe the /sse endpoint:

curl https://your-site.com/wp-json/mcp-ai/v1/sse

This mirrors the /assistants response but always uses SSE format, ensuring compatibility with LM Studio and Claude Desktop.

3. Job Status Streaming (GET /jobs/{job_id}/stream)

Subscribe to real-time updates for async operations like Crawl4AI jobs:

const eventSource = new EventSource(
    `/wp-json/mcp-ai/v1/jobs/${jobId}/stream?max_duration=300&poll_interval=2`
);

eventSource.addEventListener('status', (e) => {
    const status = JSON.parse(e.data);
    console.log('Progress:', status.progress + '%');
});

eventSource.addEventListener('complete', (e) => {
    console.log('Job finished:', e.data);
    eventSource.close();
});

SSE Configuration

Enable POST Method for SSE (LM Studio Compatibility)

By default, SSE uses the standard GET method. For clients with SSE bugs (like LM Studio), enable POST support:

1. Go to Settings → NV oOS → Assistant Settings

2. Enable "Enable POST Method on SSE Endpoint"

3. Save settings

⚠️ Note: Standard SSE specification uses GET. Only enable POST if you experience client compatibility issues.

Modern SSE Features (2024-2025)

The SSE implementation includes current best practices:

• Automatic reconnection with retry: directive (3-second interval)

• Event IDs for tracking reconnection state

• HTTP/2 compatibility for multiplexing

• Proper CORS headers for cross-origin requests

• Cache-Control directives to prevent proxy buffering

• Heartbeat messages to keep connections alive

Frontend Integration

Enable SSE streaming in your JavaScript client:

// Request streaming in chat
const response = await fetch('/wp-json/mcp-ai/v1/chat', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'Accept': 'text/event-stream',
        'X-WP-Nonce': wpMcpAi.nonce
    },
    body: JSON.stringify({
        assistant_id: 123,
        messages: [{ role: 'user', content: 'Hello' }],
        stream: true
    })
});

// Process SSE stream
const reader = response.body.getReader();
const decoder = new TextDecoder();
let buffer = '';

while (true) {
    const { done, value } = await reader.read();
    if (done) break;
    
    buffer += decoder.decode(value, { stream: true });
    const events = buffer.split('\n\n');
    buffer = events.pop();
    
    for (const event of events) {
        if (event.startsWith('data: ')) {
            const data = JSON.parse(event.substring(6));
            // Update UI with streaming chunk
            updateChatUI(data);
        }
    }
}

Documentation

For complete SSE implementation details, configuration options, and troubleshooting:

• SSE Streaming Guide - Complete implementation guide with code examples

• MCP and SSE - Understanding SSE benefits for MCP protocol

• Job Notification System - Real-time job status via SSE

• REST API Reference - SSE endpoint specifications

📝 MCP JSON-RPC 2.0 Endpoint

NV oOS implements a dedicated /mcp endpoint that follows the Model Context Protocol specification version 2024-11-05 using JSON-RPC 2.0 for bidirectional communication with AI assistants and tools.【F:docs/reference/api/mcp-endpoint.md†L1-L80】

MCP Version: 2024-11-05
Compliance: Full MCP 2024-11-05 — all 11 protocol methods, OAuth 2.1, Streamable HTTP, JSON-RPC batching, tool annotations, session management

What's New in MCP 2024-11-05

The latest specification is fully implemented:

• OAuth 2.1 Security: PKCE, token rotation, mandatory HTTPS

• Streamable HTTP Transport: Better reconnection and bidirectional communication

• JSON-RPC Batching: Efficient parallel task processing (up to 20 messages per batch)

• Tool Annotations: readOnlyHint, destructiveHint, idempotentHint, openWorldHint metadata

• Progress Notifications: Descriptive status updates during tool execution

• Completions: Argument autocompletion for tools and prompts

• Session Management: State recovery via Mcp-Session-Id header (1h TTL)

• Logging: Client-controlled log verbosity via logging/setLevel

• Cancellation: Request cancellation via notifications/cancelled

Endpoint URL

POST /wp-json/mcp-ai/v1/mcp

JSON-RPC 2.0 Format

All requests must use standard JSON-RPC 2.0 format:

{
  "jsonrpc": "2.0",
  "id": "unique-request-id",
  "method": "initialize",
  "params": {}
}

Supported Methods

• initialize - Initialize MCP connection and retrieve server capabilities

• ping - Server liveness check

• tools/list - List available tools with annotations for the authenticated assistant

• tools/call - Execute a specific tool with progress notifications support

• resources/list - List available resources (knowledge files, etc.) with metadata

• resources/read - Read resource content by URI with MIME-typed responses

• prompts/list - List available prompt shortcuts

• prompts/get - Get full prompt content with system instructions and argument values

• completion/complete - Argument autocompletion (enum/boolean for tools, slug matching for prompts)

• logging/setLevel - Client-controlled log verbosity (8 standard levels)

• notifications/cancelled - Cancel a pending request

Authentication (OAuth 2.1 Enhanced)

The MCP endpoint uses enhanced authentication aligned with MCP 2024-11-05 security standards:

• WordPress Nonce (X-WP-Nonce header)

• Bearer Tokens (Authorization: Bearer <token>) with rotation support

• Assistant Credentials (generated from assistant editor, OAuth 2.1 compliant)

• Auth0 JWT (for enterprise authentication)

• Session Management (Mcp-Session-Id header for reconnection)

Error Handling

Enhanced Error System (Phase 3):

• Severity Levels: CRITICAL, ERROR, WARNING, INFO, DEBUG for categorized logging

• User-Friendly Messages: Automatic translation of technical errors into actionable guidance

• Recovery Suggestions: Built-in troubleshooting steps for common failure scenarios

• Centralized Error Handler: Consistent error creation with automatic logging

• Comprehensive Logging: Track errors, tool executions, and chat interactions

• Sensitive Data Protection: Automatic redaction of API keys and tokens in logs

See Error Handling Documentation for detailed usage.

MCP Standard Error Codes:

• -32700: Parse error (invalid JSON)

• -32600: Invalid Request (malformed JSON-RPC)

• -32601: Method not found

• -32603: Internal error

Use Cases

Learn More

➡️ Complete MCP Documentation:

• MCP Endpoint Reference - Complete method documentation and 2024-11-05 features

• MCP and SSE Explained - Understanding transport layers and protocol updates

• MCP Server Authentication - OAuth 2.1 and security enhancements

• MCP Client Configurations - Connect LM Studio, Claude Desktop, etc.

• Official MCP Specification 2024-11-05

🛠 Assistant Editor Overview

Assistant posts ship with dedicated controls that map directly to runtime behaviour:

• Available Tools – Choose which registered tools (core, WooCommerce, JetEngine, or custom) the model may invoke. Dependency-aware notices explain why certain tools are unavailable, and you can now disable the pre-built prompt shortcuts that tools normally contribute.

• Quick Tool Selection Presets – one-click presets group the current live registry by use-case (🤖 Agentic Workflow, 🛒 E-commerce, ⚕️ Healthcare, 💬 Communication, 💻 Development, 📋 Registration & Compliance, and more). Click a preset to add its tools to the current selection; click again to remove them. Combine multiple presets freely. Use ✓ Select All / ✗ Clear All for bulk actions. Implemented in includes/helpers/class-wp-mcp-ai-tool-presets-helper.php.

• Model Defaults – Provide assistant-specific overrides for the OpenAI model, temperature (0–2), and system prompt applied to every conversation.

• Base Knowledge – Attach Media Library items that are chunked, truncated, and streamed as memory context, and optionally store an external Vector Store ID to coordinate retrieval workflows.

• Prompt Shortcuts – Capture labelled prompts with optional descriptions and tool affinities; they render as accessible quick actions in the chat UI so operators can seed conversations instantly.【F:includes/assistants/class-wp-mcp-ai-assistant-cpt.php†L893-L1048】【F:includes/class-wp-mcp-ai-shortcode.php†L430-L693】【F:assets/js/chat.js†L600-L666】

If an API or shortcode request omits the assistant parameter, the plugin automatically uses the default assistant configured in the global settings.

📊 Assistant Storage: CPT vs CCT

NV oOS uses a Custom Post Type (CPT) as the primary storage for AI assistants, with automatic synchronization to a JetEngine Custom Content Type (CCT) when JetEngine is available.

Storage Architecture

• CPT (mcp_ai_assistant): The authoritative source for all assistant data

  • Full-featured WordPress editor with 14 meta fields

  • Supports credentials, shortcuts, memory files, and advanced features

  • Always available in both Base and Full versions

  • Primary REST endpoint: /wp-json/mcp-ai/v1/

• CCT (assistants): Synchronized secondary storage (Full Version only)

  • Receives automatic updates when CPT is saved

  • 7 basic fields: title, description, provider, model, system_prompt, temperature, tools

  • Available via JetEngine REST endpoint: /wp-json/jet-cct/assistants

  • Ideal for JetEngine-based integrations and queries

Automatic Synchronization (v1.0.0+)

When you save an assistant through the WordPress admin:

1. CPT is updated with all settings

2. CCT is automatically synced (if JetEngine is active)

3. Link is maintained via _wp_mcp_ai_cct_item_id meta

4. Deletion cascades - removing CPT also removes linked CCT item

What gets synced: Basic configuration (title, description, provider, model, system_prompt, temperature, tools)
What's CPT-only: Advanced features (credentials, shortcuts, memory files, role rules, vector store, external actions)

When to Use Each Endpoint

Use CPT endpoint (/wp-json/mcp-ai/v1/) for:

• Chat, tools, and directory interactions

• Full assistant configuration access

• Credential-based authentication

• Primary integration scenarios

Use CCT endpoint (/wp-json/jet-cct/assistants) for:

• JetEngine-specific queries and filters

• Building JetEngine relations

• Integrating with JetEngine dashboards

• Querying basic assistant metadata

➡️ Read the complete CPT vs CCT guide for detailed comparisons, code examples, and migration information.

⚡ Assistant Tool Shortcuts

Every assistant exposes a Prompt Shortcuts meta box so editors can curate prewritten instructions, scope them to registered tools, and add operator-facing descriptions that appear as tooltips and screen reader hints in the chat UI.【F:includes/assistants/class-wp-mcp-ai-assistant-cpt.php†L893-L1048】【F:includes/class-wp-mcp-ai-shortcode.php†L430-L693】【F:assets/js/chat.js†L600-L666】 The shortcode merges these custom prompts with each tool’s declared shortcut tasks and always appends a safe fallback so assistants remain usable even without bespoke entries.【F:includes/class-wp-mcp-ai-shortcode.php†L430-L693】

Developers can extend or replace these prompts with filters such as wp_mcp_ai_assistant_custom_tool_shortcuts and wp_mcp_ai_default_tool_shortcut, letting sites tailor default quick actions per assistant or environment.【F:includes/class-wp-mcp-ai-shortcode.php†L444-L692】

➡️ Read the full guide to assistant prompt shortcuts.

🧠 Agent Skills

Agent Skills (agentskills.io) are reusable, portable behaviour packages that extend any assistant without touching its system prompt. Each skill is a SKILL.md file — a standard Markdown document with a small YAML frontmatter block — that lives in wp-content/uploads/mcp-ai-skills/{skill-name}/SKILL.md. When an assistant loads a skill, its instructions are automatically injected into the conversation context so the model knows exactly when and how to use that capability.

67 Pre-Built Skills (Base Plugin)

The base plugin ships with 67 pre-built skills that are automatically installed to wp-content/uploads/mcp-ai-skills/ on first activation. No Pro add-on is required — they are available on every install out of the box. The skills include 24 general-purpose tools (document handling, design, testing), 22 WordPress developer skills (security, APIs, plugin patterns), 21 design-* skills (analytics through video creation), and the bundled mcp-ai-wpoos-plugin skill.

How Skills Are Loaded

Skills are selected per-assistant via the Skills meta box in the assistant editor. Whichever skills are checked, their combined instructions are prepended to the system prompt under an # Active Skills heading at inference time. This means skills are composable — you can combine pdf + xlsx + doc-coauthoring on a single document-specialist assistant.

Skills are stored as plain text files and can be customised in-place. The original bundled content can be restored at any time from Settings → Advanced → Skill Management → Force Reinstall Bundled Skills.

Managing Skills

Base plugin — Skill management is available under Settings → Advanced → Skill Management:

• View installed skills and their metadata

• Refresh the skill index

• Install or force-reinstall the 16 bundled skills

Pro add-on — The dedicated Skill Manager admin page (Assistants → Skill Manager) adds:

• Upload a SKILL.md file or a ZIP archive containing a skill directory

• Install a skill from a remote URL

• Inline CodeMirror editor to create or edit SKILL.md content directly in the browser

• Delete / uninstall skills

SKILL.md Format

---
name: my-skill
description: One-line description of what this skill does.
compatibility: claude-3-5-sonnet, claude-3-opus
---

# My Skill

Detailed instructions for the model go here in standard Markdown.
Use headings, lists, code blocks — whatever best conveys the behaviour.

The name field (max 64 chars) becomes the skill's slug. The description field (max 1 024 chars) is shown in the admin UI. The compatibility field is optional and informational.

➡️ See Agent Skills reference for the complete specification, filters, and developer API.

👔 Professional & Team Layers

NV oOS includes an enterprise-grade template system for rapid assistant deployment through Professions and Teams. Instead of manually configuring each assistant from scratch, administrators can:

1. Select from ~311 pre-built professional templates spanning 12 industry categories

2. Create custom profession templates with reusable configurations

3. Deploy entire teams of specialized assistants with one click

4. Test everything from the backend before exposing to end users

🎓 Professional Templates

Professions are reusable assistant templates with pre-configured:

• Role descriptions and expertise areas

• Default tools curated for each profession

• Knowledge bases with industry-specific best practices

• AI model defaults (provider, model, temperature)

• Warnings and disclaimers for professional contexts

Available Categories (~311 professions across 12 categories):

Methodology note: the current sanity check counts 311 profession knowledge documents; runtime availability can vary with seeders, filters, and installed features.

• 🌾 Agriculture & Natural Resources

• 🎨 Art, Media & Entertainment

• 💼 Business & Finance

• 🎓 Education

• 🏥 Healthcare & Medicine

• ⚖️ Law & Public Safety

• 🔬 Science & Engineering

• 🍽️ Service Industry

• 💻 Technology

• 🔧 Trades & Manual Labor

• 🚚 Transportation

• 📋 Miscellaneous

Example Professions:

• Software Developer, Web Developer, Data Scientist

• Accountant, Financial Advisor, Marketing Consultant

• Registered Nurse, Physician, Pharmacist

• Attorney, Paralegal, Mediator

• Content Writer, Graphic Designer, Social Media Manager

• And ~180 more, depending on active seeders and installed features...

Creating Assistants from Templates

Navigate to AI Assistants → Add New to browse the visual profession grid:

1. Browse by category or search for a specific role

2. Click "Create" on any profession to open a customization modal

3. Customize the assistant name and AI settings (or use defaults)

4. Deploy your configured assistant instantly

Each profession template includes:

• Pre-written system prompts with role-specific expertise

• Curated tool selections appropriate for the profession

• Industry knowledge bases and best practices

• Recommended model settings for optimal performance

👥 Team Deployments

Teams group multiple professionals for coordinated workflows. Deploy an entire team of specialists with one click:

Pre-Built Teams:

• Engineering Team - Software, Mechanical, Electrical, Civil Engineers

• Pharmaceutical Development Team - Pharmacist, Researcher, Clinical Pharmacologist, Regulatory Affairs

• Research & Data Science Team - Data Scientist, Research Scientist, Statistician, Computer Scientist

• Marketing & Growth Team - Marketing Consultant, Content Creator, Graphic Designer, Business Consultant

Team Features:

• Centralized configuration - Set provider, model, and temperature for all team members

• One-click deployment - Creates all team member assistants simultaneously

• Consistent settings - Team defaults override individual profession defaults

• Custom teams - Create your own teams with any combination of professions

Navigate to Teams → Add Team to deploy a pre-configured team or create custom team combinations.

🧪 Backend Testing

Test assistants, professions, and teams directly from the WordPress admin before deploying to end users:

Test Assistant (Admin → AI Assistants → Test Assistant)

• Full feature parity with frontend chat interfaces

• All tools enabled including sensitive/restricted tools (admin-only)

• File upload support with complete MIME type configuration

• Transcript saving for debugging and analysis

• Tool shortcuts pre-loaded from assistant configuration

• Streaming responses with real-time feedback

Test Profession (Admin → Professions → Test Profession)

• Preview profession templates before creating assistants

• Validate role descriptions and expertise areas

• Test default tool selections in live conversations

• Verify knowledge base content and accuracy

• Assess AI model performance with profession-specific tasks

Test Team (Admin → Teams → Test Team)

• Test entire teams before deployment

• Validate team member coordination and role separation

• Verify shared settings propagate correctly

• Multi-assistant conversations to test team dynamics

• Performance benchmarking across team members

Security Note: All test pages require manage_options capability and are restricted to WordPress administrators. Sensitive tools are enabled in test environments because administrators already have full site access.

Documentation:

• Test Assistant Feature Enhancements - Complete testing capabilities guide

• Dynamic Assistant Creation System - Visual guide to profession and team architecture

Custom Professions & Teams

Administrators can create custom profession templates and teams:

Create Custom Profession:

1. Navigate to Professions → Add New

2. Set title, description, and category

3. Define expertise areas and role description

4. Select default tools from the registry

5. Add knowledge base content

6. Configure AI model defaults

7. Publish for use in assistant creation

Create Custom Team:

1. Navigate to Teams → Add New

2. Set team name and description

3. Select profession members from your library

4. Configure team-wide defaults (provider, model, temperature)

5. Publish to enable one-click team deployment

Benefits

For Organizations:

• ✅ Rapid assistant deployment without manual configuration

• ✅ Consistent configurations across similar roles

• ✅ Template library grows with your organization

• ✅ Share profession templates across sites

• ✅ Professional-grade assistant quality out of the box

For Administrators:

• ✅ Test everything safely from the backend

• ✅ No coding required for template-based assistants

• ✅ Visual template selection interface

• ✅ Reusable configurations reduce errors

• ✅ Full control over custom templates

For Developers:

• ✅ JSON-based knowledge base system

• ✅ Extensible via filters and hooks

• ✅ WordPress standard CPT architecture

• ✅ REST API access for profession and team data

• ✅ Automated seeding from knowledge base files

🔑 Assistant API credentials

Administrators can issue per-assistant access tokens from the API Credentials meta box that appears on every assistant edit screen. Tokens are only available to users with the manage_options capability, surface the credential history in a table, and expose one-click revoke and delete actions for rapid cleanup.【F:includes/assistants/class-wp-mcp-ai-assistant-cpt.php†L483-L595】 When you click Generate Credential the plugin produces a single-use token in the form cred_xxxxx.SECRET, hashes the secret server-side, and records the issuer so you have an audit trail of who created each credential.【F:includes/class-wp-mcp-ai-credentials.php†L94-L135】

Remote integrations can authenticate by sending that token in the standard Authorization: Bearer header—no Auth0 dependency required. The REST layer validates the credential, emits structured errors when a token is revoked or malformed, and scopes the request to the assistant that issued the token so clients cannot hop between assistants without an explicit credential for each one.【F:includes/class-wp-mcp-ai-rest.php†L316-L444】【F:includes/class-wp-mcp-ai-rest.php†L1282-L1321】【F:includes/class-wp-mcp-ai-credentials.php†L242-L297】

🐳 Local Development with Docker

Spin up a disposable WordPress instance that mounts the plugin source directly into the container:

docker compose up -d

• WordPress will be available at http://localhost:8000.

• The plugin source in this repository is mounted to /var/www/html/wp-content/plugins/mcp-ai-wpoos inside the container, so edits on your machine are reflected immediately.

• The MySQL service is provisioned with the wordpress database, user, and password (wordpress / wordpress).

Visit the site in your browser to complete the standard WordPress installation flow, using the database credentials above when prompted. When you're finished developing, stop the stack with docker compose down.

🔁 Codex environment startup script

If you are working inside an OpenAI Codex environment, add bin/codex-startup.sh to your workspace start-up tasks so a fresh WordPress install is provisioned automatically for every session — no Docker required.

bin/codex-startup.sh

The script performs the following steps:

• Downloads WP-CLI locally (if necessary) and uses it to fetch the latest WordPress core files into .codex-wordpress/wordpress.

• Installs the SQLite Database Integration plugin so WordPress can run without a MySQL server.

• Symlinks this repository into the new install's wp-content/plugins/mcp-ai-wpoos directory.

• Installs Composer development dependencies (when available) and provisions the WordPress test suite so composer run test works immediately.

• Runs wp core install, activates the NV oOS plugin, enables pretty permalinks, and sets a default site tagline.

• Boots a development server on port 8000 via wp server and logs output to .codex-wordpress/wp-server.log.

Default credentials:

Override any of these values by exporting the environment variables WORDPRESS_URL, WORDPRESS_TITLE, WORDPRESS_ADMIN_USER, WORDPRESS_ADMIN_PASSWORD, WORDPRESS_ADMIN_EMAIL, or WORDPRESS_PORT before running the script.

🧑‍💻 Development Tooling

Install the PHP development dependencies (including PHP_CodeSniffer, the WordPress Coding Standards ruleset, and PHPUnit) with:

bin/setup-dev.sh

The script runs composer install and makes the following Composer scripts available:

These commands automatically resolve the bundled vendor/bin tools (such as phpcs, phpcbf, and phpunit), so a global installation is no longer required.

NPM Dependencies & Bundling

For details on how NPM dependencies are managed and bundled for both the base plugin and Pro addon, see DEPENDENCIES_BUNDLING.md.

Quick Reference:

• Base plugin dependencies: @microsoft/fetch-event-source, dompurify, marked, ky, chart.js, @neplex/vectorizer, @langchain/*, @mlc-ai/web-llm

• Build commands: npm run build:js, npm run install:chartjs, npm run install:vectorizer, npm run build:js:pro

• Pro addon has separate addons/pro/package.json for Pro-specific dependencies

📦 NPM Packages

Twenty-three standalone browser-utility packages have been extracted from the oOS chat UI and published to the NPM registry under the @nvdigitalsolutions scope. Each package is independently usable in any JavaScript/TypeScript project (no WordPress required).