Connect your AI assistant to WordPress and get useful work done. Flavors Engine is a WordPress MCP server for compatible Claude, ChatGPT and other AI-agent setups, plus an Elementor addon with 151 free widgets, including 50 theme-builder widgets. Edit pages, work with Elementor elements, inspect SEO and speed, and handle basic WooCommerce tasks.

Start Free on WordPress.org. Elementor widgets work in the editor; an external MCP client supplies its model. Optional admin Chat needs a supported WordPress AI client and configured provider. No model subscription is included.

What Free includes

WordPress posts, pages, terms, menus and media tools, including supported page duplication with builder data.
Structured Elementor reading and editing: move, duplicate and reorder elements, and discover widget parameters. Requires Elementor.
151 Elementor widgets, including the 50 dedicated theme-builder widgets. Enable the items you use.
Supported header, footer, single, archive, search, 404 and WooCommerce templates with display conditions. Placements depend on template type and installed plugins.
Content and HTML accessibility checks; basic per-post SEO titles, descriptions and robots through supported installed providers including Yoast, Rank Math, AIOSEO and SEOPress.
Requested PageSpeed inspection: Lighthouse metrics, opportunities and available Core Web Vitals. Public URL/API prerequisites apply; inspection alone does not improve speed.
16 WooCommerce basics tools: inspection, supported product-field edits, simple-product creation, basic coupons and order notes. Requires WooCommerce 9.0+.
Supported site-health, recent PHP-error and configured backup-provider information.

Pro adds

Flavors Engine Pro is a separate installed and licensed add-on:

110 additional Elementor widgets and Forms Suite.
Resumable plans for pages, templates and navigation. Your connected agent performs the tasks; creating a plan creates no page content.
Advanced supported builder, custom-field, SEO, forms, multilingual and WooCommerce integrations, with vendor dependencies.
Configured held approvals, working copies, agent memory, bulk SEO, cache fixes, backups and reviewed plugin/theme updates, with prerequisites and recovery limits.

Compare Free and Pro. A licence does not include model access or unlock another FlavorsWP product.

Practical requests

Try: “Move this Elementor testimonial section above the FAQ”; “Update this post’s SEO title”; “Create a draft simple WooCommerce product”; “Inspect this public page with PageSpeed”. These are example prompts, not recorded client executions. Review results before publishing.

Connect and review

Open Flavors Engine > Connect and follow your client’s OAuth or Application Password setup. Compatible transport, authentication, account/plan, plugin dependencies and user permissions determine available tools. Connection guide.

Safety profiles restrict actions; content writes can be allowed. Client confirmation is not independent human approval. Recorded undo has operation-specific snapshot, conflict and recovery limits. Permanent deletions, customer emails and external transactions are not universally reversible.

Optional Cloud service

No Cloud account is required for local MCP. Hosted access remains unverified. Pairing starts only when an administrator chooses Connect and confirms workspace, token scope and safety ceiling. Then hub.flavorswp.com receives site address/name, approved access token, public signing key, WordPress/PHP/plugin versions, safety profile, tool descriptions, pending updates, backup health and compact redacted issues. Signed hourly check-ins and debounced notifications continue while paired. Content and changes are sent for requested tools. PageSpeed may send the public URL to paired Cloud and Google. Private keys remain in WordPress. Disconnect revokes the managed token and stops future check-ins. Cloud allowances and paid Pro runners/updates are separate.

Cloud requirements | Privacy | Terms

External-service recipients, triggers, data, privacy/terms and source/build information follow below.

External Services

This plugin contacts no external service on its own. Every service below is reached only when you act: by pressing a button, by connecting an AI client, or by adding a widget and entering your own API key for it. A default install, with nothing configured, makes no outbound request at all. An explicitly paired Cloud connection continues its signed status and event check-ins until you disconnect it, as described in the optional Cloud service section.

Google Fonts – On the Design screen, when a saved design names a font your browser does not have installed, the preview shows a note explaining that it is not displaying the design’s real fonts, alongside a Preview with Google Fonts button. Pressing that button loads a stylesheet from https://fonts.googleapis.com so the preview can render the font. Nothing is requested until you press it, nothing is requested on your site’s front end, and no data about your site or your visitors is sent – the request contains the font name and, as with any browser request, your IP address and user agent. Google’s terms: https://policies.google.com/terms – Google’s privacy policy: https://policies.google.com/privacy

The WordPress.org plugin directory – The search-extensions and get-extension abilities query https://api.wordpress.org for plugin and theme information, exactly as your WordPress dashboard does. These run only when an AI client you have connected calls them. WordPress.org’s privacy policy: https://wordpress.org/about/privacy/

Openverse – The search-images ability queries https://api.openverse.org for openly licensed photographs, the same catalogue the block editor’s own openly-licensed media search uses. It runs only when an AI client you have connected calls it, the request contains only your search terms and filters, and no account or API key is involved. The ability returns links; it does not download anything. A file is only fetched and added to your Media Library if you then ask for import-media-url, which downloads from whichever URL is passed to it. Openverse is a WordPress.org project. Openverse terms of service: https://docs.openverse.org/terms_of_service.html – Openverse privacy policy: https://openverse.org/privacy

The remaining services are reached only by widgets you place on a page, and only after you enter your own API key or access token for them. None of them is contacted on a default install, because without your credential the request is never made.

Mailchimp – The Mailchimp Form widget sends a subscription to https://<dc>.api.mailchimp.com when a visitor submits the form, where <dc> is the data-centre suffix of your own API key. This one sends visitor data: the email address the visitor typed, and any merge fields your form collects, together with your API key. It runs only on a form you added and configured with your key. Mailchimp’s terms: https://mailchimp.com/legal/terms/ – Mailchimp’s privacy policy: https://mailchimp.com/legal/privacy/

YouTube Data API – The YouTube TV widget and the YouTube mode of the Social Feed widget request channel and video listings from https://www.googleapis.com/youtube/v3/, using a Google API key you supply. The request contains your key and the channel or playlist you configured. Responses are cached, and no visitor data is sent. Google’s terms: https://policies.google.com/terms – Google’s privacy policy: https://policies.google.com/privacy – YouTube API Services terms: https://developers.google.com/youtube/terms/api-services-terms-of-service

The YouTube player (loaded in the visitor’s browser) – A page containing the YouTube TV widget loads YouTube’s iframe player API from https://www.youtube.com/iframe_api and embeds the player itself from youtube.com. This is the only script this plugin loads from another domain, and it has to be: YouTube’s terms require the player API to be served from their domain rather than bundled. It happens in the visitor’s browser, on pages where you placed the widget, and it gives YouTube the visitor’s IP address and user agent as any embed does – nothing is sent from your server. Google’s terms: https://policies.google.com/terms – privacy policy: https://policies.google.com/privacy – YouTube API Services terms: https://developers.google.com/youtube/terms/api-services-terms-of-service

Instagram – The Instagram mode of the Social Feed widget uses the Instagram API with Instagram Login (Business or Creator accounts). It requests your own recent media from https://graph.instagram.com, using an Instagram access token you supply, and about once a week refreshes that token through https://graph.instagram.com/refresh_access_token so it does not expire. The requests contain your token and a post count. Responses are cached, and no visitor data is sent. Meta Platform Terms: https://developers.facebook.com/terms – Meta Privacy Policy: https://privacycenter.instagram.com/policy

OpenWeatherMap – The plugin registers a weather proxy endpoint that requests current conditions from https://api.openweathermap.org for a location you configure, using an OpenWeatherMap API key you supply. The widget that uses it is part of Flavors Engine Pro, so on this plugin alone the endpoint exists but nothing calls it; it is listed here because the code ships. Responses are cached and no visitor data is sent. OpenWeatherMap’s terms: https://openweathermap.org/terms – privacy policy: https://openweather.co.uk/privacy-policy

The AI client’s own domain, during sign-in (OAuth Client ID Metadata) – When an AI client connects and identifies itself with an https URL as its client id, the plugin fetches that URL once to read the client’s metadata document (its name, its redirect addresses), caches the result, and uses it to decide whether the sign-in may proceed. The host contacted is therefore the client’s, not ours, and which host that is depends on which client you connect. The request is a plain GET with no body and no data about your site beyond the fact that it was made; redirects are validated one hop at a time and private or loopback addresses are refused. Nothing is fetched until you connect a client that uses this form of identifier. For Claude, that host is claude.ai or claude.com – Anthropic’s terms: https://www.anthropic.com/legal/consumer-terms – privacy policy: https://www.anthropic.com/legal/privacy

Your own site (self-diagnostics, not an external service) – The Troubleshoot screen checks that the MCP endpoint, the OAuth discovery documents and the REST API are reachable by requesting them from your own site’s address, and it sends a handful of AI-client user agents at one of those addresses to detect a hosting bot filter that would block real clients. Every one of these requests goes to your own domain. They are listed here because they are outbound HTTP requests and a reader auditing the code will see them; no third party is involved and no data leaves your server.

AI model providers – No AI model is bundled. An external MCP client supplies its own model access. Optional admin Chat can make model-discovery and generation requests through the WordPress AI Client to the provider/model configured by your administrator. Those requests can include conversation history, system/site context, tool descriptions, requested tool results and attachments included in the conversation. A remote provider therefore receives the requested data; a self-hosted MCP endpoint does not mean Chat generation stays on this server. Review the configured provider plugin’s service disclosures, terms and privacy policy before enabling Chat. Provider credentials and billing are configured separately from this Free plugin.

Data kept on your own site (not an external service) – When Flavors Engine Chat is used, the plugin counts the AI tokens each person used per day (prompt tokens, completion tokens and calls) and keeps that count in the person’s WordPress user meta for 62 days, so the Chat screen can show a usage meter. Nothing about it is sent anywhere, and it is deleted with the plugin’s other data on uninstall.

AI client sign-in addresses (no request is made) – The Connect screen shows the sign-in address of the AI client you choose, and the OAuth flow lists that client’s callback address as an allowed redirect target. For Claude those addresses are on the claude.ai and claude.com domains; other clients have their own. These are destinations your own browser is sent to when you press “connect”, and addresses the plugin checks a returning request against. The plugin itself never opens a connection to any of them, and no data is sent to them by the plugin. They are listed here only because the addresses appear in the code and a reader should know why. Anthropic’s terms: https://www.anthropic.com/legal/consumer-terms – privacy policy: https://www.anthropic.com/legal/privacy

Google PageSpeed Insights – When a connected agent calls pagespeed-check, the plugin sends the requested public page URL and mobile/desktop strategy to Google at https://www.googleapis.com/pagespeedonline/v5/runPagespeed. It uses Site Kit by Google when that plugin is configured and permits the user to read its data, otherwise the optional API key saved by the administrator or Google’s keyless quota. Results are cached for 15 minutes. No checks run on activation or on a schedule. Google terms: https://policies.google.com/terms – privacy: https://policies.google.com/privacy – API terms: https://developers.google.com/terms

Local site error log – Site diagnostics keep a bounded record of PHP fatal errors on this site, including their time, message, source and request path. Credentials and common secret values are redacted. The log is available only through authenticated diagnostics, is never uploaded automatically, and is removed when the plugin’s data-deletion option is used on uninstall.

Source Code

Everything in this plugin is readable source except the third-party libraries listed below, and this section is where to find the source for each compressed file.

This plugin’s own code. All PHP is source. Under assets/, every minified file ships beside the unminified file it was built from (x.min.js next to x.js), and SCRIPT_DEBUG makes WordPress load the readable one. Nine scripts have no separate minified twin because none was ever built: they were inherited as single-line files with no build step, so they ship reformatted in place, and each carries a header saying exactly that. Note that assets/js/library/ is not exclusively third-party: aos, gradient-bg, shape-divider, tabs and list-actions are this plugin’s own code and each ships with its readable source beside the minified file.

The chat interface. includes/assets/chat/index.js is compiled from src/chat/index.tsx, which ships inside this plugin. Build it with the @wordpress/scripts toolchain that package.json declares:

npm install && npm run build:chat

Third-party libraries. Each is shipped in the minified form its own project distributes. The readable source for every one is published by that project at the address below, which is also where any modification should be taken from.

Slick Carousel – MIT – https://github.com/kenwheeler/slick (carousel and slider widgets)
Prism – MIT – https://github.com/PrismJS/prism (code-highlight widget)
Salvattore – MIT – https://github.com/rnmp/salvattore (column layout for the Post Masonry widget). Shipped as a readable adaptation in assets/js/library/flavor-columns.js, credited in its header.
assets/js/library/table.min.js is five libraries concatenated and minified, all MIT, listed in the file’s own header and here:
- DataTables – https://github.com/DataTables/DataTables
- DataTables Buttons – https://github.com/DataTables/Buttons
- JSZip – https://github.com/Stuk/jszip
- pdfmake – https://github.com/bpampuch/pdfmake
- jquery-csv – https://github.com/typeiii/jquery-csv
The Lottie animation widget ships three MIT libraries:
- lottie-web – https://github.com/airbnb/lottie-web
- lottie-interactivity – https://github.com/LottieFiles/lottie-interactivity
- lottie-player – https://github.com/LottieFiles/lottie-player
Jarallax – MIT – https://github.com/nk-o/jarallax (the parallax background extension; assets/js/library/parallax-bg.min.js)
Animate.css 4.1.1 – MIT – https://github.com/animate-css/animate.css (entrance animations)
AOS (Animate On Scroll) – MIT – https://github.com/michalsnik/aos (scroll-triggered animations; the bundled file is a reduced reimplementation, readable as shipped)

Masonry and imagesLoaded are not bundled: the plugin uses the copies WordPress core itself ships and registers. GreenSock (GSAP) is not bundled either – its licence is not GPL-compatible, so the widgets that need it are not part of this plugin.

Server-side PHP dependencies are managed with Composer and declared in composer.json; each carries its own LICENSE file inside vendor/.

Flavors Engine – MCP Server for Claude, ChatGPT & AI Agents, Elementor Addons & Theme Builder

About this plugin