=== AI Engine (Pro) - The Chatbot, AI Framework & MCP for WordPress ===
Contributors: TigrouMeow
Tags: ai, chatbot, mcp, claude, openai
Donate link: https://www.patreon.com/meowapps
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 3.7.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

AI meets WordPress. Your site can now chat, write poetry, solve problems, and maybe make you coffee.

== Description ==

**AI Engine connects WordPress with AI models.** One install, stable connectors for every major AI provider: OpenAI, Anthropic, Google, Mistral, and more. Build intelligent chatbots, generate content, create AI forms, and automate tasks. All from your WordPress dashboard.

Take the tour at [vibewithwp.ai](https://vibewithwp.ai/): what AI Engine does, how the MCP server works, and how it compares to the alternatives. Please make sure you read the [disclaimer](https://meowapps.com/ai-engine/disclaimer/). For more information, check the official website of [AI Engine](https://meowapps.com/ai-engine/).

== Quick Intro ==

Hello! ☀️ I built AI Engine to bring OpenAI, Anthropic, and other AI models into WordPress. Create chatbots that understand your content, generate posts in your voice, translate instantly, create images, or build custom AI tools.

For developers: [internal APIs](https://ai.thehiddendocs.com/php-functions/), [REST endpoints](https://ai.thehiddendocs.com/public-rest-api/), [function calling](https://ai.thehiddendocs.com/function-calling/), and [MCP support](https://ai.thehiddendocs.com/mcp/). Build AI features, automate workflows, or create SaaS applications on WordPress.

There is also a Workspace: a full-screen AI chat inside wp-admin, with every model you configured, and a free [iOS app](https://apps.apple.com/app/workspace-for-wordpress/id6794717714) so you can keep working on your site from your phone. Details on [workspace.press](https://workspace.press/).

Feeling overwhelmed? 🤪 Start simple: Create a chatbot. Then connect [Claude Code](https://ai.thehiddendocs.com/mcp/mcp-server-claude-code/), [Claude](https://ai.thehiddendocs.com/mcp/mcp-server-claude/), [ChatGPT](https://ai.thehiddendocs.com/mcp/mcp-server-chatgpt/), or [OpenClaw](https://meowapps.com/openclaw-wordpress-mcp/) through MCP, giving AI direct access to your site. Desktop clients can connect via OAuth: users just paste the MCP URL, sign in to WordPress, and approve. No shared token to manage. Add [SEO Engine](https://wordpress.org/plugins/seo-engine/) and watch it manage SEO in ways you never imagined. You can even connect AI Engine to multiple WordPress sites and manage them all through conversation.

You'll be having a blast before you've explored everything. You'll probably spot bits of AI Engine in plenty of other AI plugins, code and UI alike. Flattering, really... or fishy? 🤣 But only AI Engine keeps pushing forward with real care for its community, a drive toward perfection, and the patience to get the details right.

== Core Modules ==

🤖 **Chatbots**
Create intelligent chatbots with customizable themes, realtime audio, and multi-file support. Features modular UI Builder, conversation memory, and MacOS-style components.

🖥️ **Workspace** (with a free [iOS app](https://apps.apple.com/app/workspace-for-wordpress/id6794717714))
A full-screen AI chat inside your WordPress admin: every model you configured, conversation history and folders, a prompt library, image generation, web search, and hands-on access to your site through the MCP tools. It also runs on your iPhone and iPad, through [Workspace for WordPress](https://workspace.press/).

🎨 **Content & Media**
Generate content, translate text, create images and videos from prompts, and use Copilot in the WordPress editor to correct, enhance, translate, or rewrite text.

📝 **AI Forms (Pro)**
Build custom AI-powered forms that handle text, images, audio, or file uploads. Create advanced apps with conditional logic.

🧠 **Knowledge & Embeddings (Pro)**
Create embeddings and build knowledge bases from PDFs. Connect with Pinecone, Chroma, Qdrant, or OpenAI Vector Store for semantic search.

🔧 **Function Calling**
Connect AI to WordPress functions, WooCommerce, appointments, or custom APIs. Let AI interact with your site's data and services in real-time.

🛡️ **Security & Moderation**
IP banning, word filtering, and content moderation to keep your AI interactions safe.

💡 **Advisor**
AI-powered recommendations and insights to help you set up and optimize your WordPress site.

🔌 **Developer Tools**
Internal APIs, REST endpoints, MCP support, and extensive hooks. Build AI-driven features, automate workflows, or create SaaS applications.

== 🖥️ Workspace (and its iOS app) ==

A full-screen AI chat that lives in your WordPress admin, and now in your pocket too.

Every model you configured is one tap away, in the same conversation: start a thread on Claude, continue it on ChatGPT or Gemini, generate an image, search the web, then let it work on the site itself through the MCP tools, with an approval dialog before anything is changed.

[**Workspace for WordPress**](https://apps.apple.com/app/workspace-for-wordpress/id6794717714) brings all of it to your iPhone and iPad. You scan a QR code once to pair it with your site, no password typed on a phone keyboard, and the pairing is a revocable Application Password you can cut off at any time. Your conversations, folders and themes stay on your own site, and your API keys never leave it.

The app is free, the plugin is free, and there is no markup on anything: you pay your AI providers directly, at their price. More about it on [workspace.press](https://workspace.press/).

**Features:**

* Every provider in one thread, switchable per conversation
* Conversation history, folders, pins, and full-text search
* Prompt library, image generation, and web search
* Site actions through MCP, with approval before any change
* Attach files and save generated images to the Media Library
* Themes that sync across your devices through your WordPress account
* Requires iOS 17 or newer, on iPhone and iPad

== 🤖 Chatbots ==

Transform visitor interactions with intelligent, customizable chatbots.

**Features:**

* Modular UI Builder with containers, headers, footers
* Customizable themes and MacOS-style components
* Realtime audio conversations
* Multi-file upload support
* Discussion memory and history
* Cross-site embedding
* GDPR compliance tools

== 🎨 Content & Media ==

Create, refine, and visualize content with AI assistance.

**Copilot (Magic Wand):**

* Correct grammar and spelling
* Enhance text for readability and quality
* Make text longer or shorter
* Translate text and full posts
* Generate content from scratch
* Multi-block support in the WordPress editor

**Image & Video Tools:**

* Create images from text prompts
* Generate videos with AI (Sora)
* Edit existing images with AI
* Vision AI for image analysis
* Automatic alt text generation

== 📝 AI Forms (Pro) ==

Build powerful AI-driven forms and applications.

**Capabilities:**

* Text, image, audio, and file inputs
* Conditional logic and validation
* Custom AI-powered apps
* Multi-step workflows
* Result templates

== 🧠 Knowledge & Embeddings (Pro) ==

Create intelligent knowledge bases and semantic search.

**Vector Databases:**

* Chroma, Qdrant, Pinecone
* OpenAI Vector Store
* Automatic synchronization
* Dimension validation

**Smart Features:**

* PDF import with auto-chunking
* AI-powered search (Simple, Context-Aware, Smart)
* Content classification
* Personalized recommendations

== 🔧 Developer Tools ==

Extend WordPress with AI capabilities.

**APIs:**

* Internal API for plugin integration
* REST API for external applications
* MCP (Model Context Protocol) support
* Function calling framework

**Integration:**

* Works with SEO Engine, Social Engine, Code Engine
* Media File Renamer support
* Custom shortcodes and hooks
* Extensive WordPress filters

**Resources:**

* [Code Examples & Customization](https://ai.thehiddendocs.com/examples/)

== MCP (Model Context Protocol) ==

AI Engine turns your WordPress site into an intelligent MCP server. AI agents like ChatGPT, Claude, Claude Code, and OpenClaw can connect directly, browse content, edit posts, manage media, and handle complex tasks through natural conversation.

**What AI Agents Can Do:**

* Create and edit posts
* Moderate comments
* Install and manage plugins
* Customize themes
* Check SEO and analytics
* Manage media files
* Run SQL queries
* Manage WooCommerce products, orders, inventory, and customers
* Handle Polylang translations

**Setup Guides:**

* [General MCP Overview](https://ai.thehiddendocs.com/mcp/)
* [MCP with ChatGPT](https://ai.thehiddendocs.com/mcp/mcp-server-chatgpt/)
* [MCP with Claude](https://ai.thehiddendocs.com/mcp/mcp-server-claude/)
* [MCP with Claude Code](https://ai.thehiddendocs.com/mcp/mcp-server-claude-code/)

**Plugin Integration:**

Other plugins add their features to the MCP system:

* [SEO Engine](https://wordpress.org/plugins/seo-engine/) - Let AI analyze and optimize your content, fix SEO issues, and manage meta data
* [Social Engine](https://wordpress.org/plugins/social-engine/) - AI can schedule posts, manage social media, and create social content
* [Code Engine](https://wordpress.org/plugins/code-engine/) - Give AI access to code snippets and custom functions

AI Engine can also connect to external MCP servers, extending your chatbots with tools and services beyond WordPress.

**A note on safety and "full access":**

AI Engine's MCP tools are curated and permission-aware on purpose. They do not run arbitrary code, so your site stays safe even while an AI agent works on it.

Some people have asked us to match tools like Novamira and give an AI agent full, unrestricted control of WordPress through arbitrary PHP execution. We will not add that to the official AI Engine plugin, because it is genuinely unsafe: it effectively turns your site into remote code execution. If you specifically want that Novamira-style power on a development or staging site, we made an optional companion plugin, [AI Engine YOLO](https://github.com/jordymeow/ai-engine-yolo), which brings the same unrestricted PHP execution and file access to AI Engine's MCP server. It is dangerous by design, switches itself off on production, and is offered on GitHub only. Please never run it on a live site.

== Pro Features ==

* **AI Forms**: Create dynamic forms that generate answers, images, or files using AI.
* **Embeddings & Vector Databases**: Build knowledge bases from your content and PDFs for semantic search.
* **Content-Aware**: Let AI use your post and page content as context for smarter responses.
* **Function Calling**: Connect AI to WordPress functions, WooCommerce, or any custom API.
* **Cross-Site Chatbots**: Embed your chatbots on external websites.
* **Editor Assistant**: An AI sidebar in the post editor that can read, rewrite, insert, and rearrange your content blocks through chained function calls.
* **Realtime Audio**: Voice-based conversations on OpenAI's GA Realtime API, with the latest voice reasoning capabilities.
* **Statistics & Usage Control**: Track usage, set limits per role, and monitor costs.
* **Extra MCP Tools**: Adds plugin, theme, database, Polylang, and WooCommerce management to the MCP server.
* **Priority Support**: Get faster help from the Meow Apps team.

== Why AI Engine? ==

**Native to WordPress**
Built specifically for WordPress with seamless integration. No clunky interfaces, just native WordPress experience.

**Flexible & Powerful**
Built-in connectors for OpenAI, Anthropic, Google, xAI (Grok), Mistral, Perplexity, OpenRouter, Replicate, Azure (OpenAI), plus a Custom (OpenAI-compatible) connector for Ollama, LM Studio, vLLM, llama.cpp, LocalAI, or any self-hosted server. Use the models that work best for you. Google (Gemini) runs on the new Interactions API by default, bringing stateful conversations, streaming with a live event log, function calling, and built-in Google Search and Google Maps grounding, with the classic API kept as a one-click fallback.

**Developer Friendly**
Clean APIs, extensive hooks, and MCP support. Build custom AI features or entire SaaS applications on WordPress.

**Real MCP, for Real WordPress**
You may have heard of MCP Adapter, built by the WordPress team primarily for their WordPress.com hosting service. It's essentially a thin layer on top of the REST API. AI Engine takes a different approach: its MCP tools are specifically crafted for AI agents, with rich context, smart defaults, and practical actions that go far beyond what a generic REST API wrapper can offer. And it works on any WordPress installation, regardless of your hosting provider. AI Engine also exposes its REST API as MCP tools if you want that, but the dedicated tools are where the real power is.

**Privacy First**
IP hashing, GDPR tools, secure file handling, and session-based tracking. You control your data.

**Constantly Evolving**
Weekly updates based on real user feedback. We listen, we improve.

== My Dream for AI ==

I am excited about AI, but I believe we need to use it with intention and clarity. Social media showed us how powerful tools can reshape our lives in ways we never expected, sometimes for the better, sometimes not. I want to avoid repeating those mistakes. AI should help us remove the meaningless, tedious work or enhance the work we enjoy. Modern tools should give us more time for what truly matters: spending beautiful moments with the people we love! 💕

== Installation ==

1. Upload `ai-engine` to `/wp-content/plugins/`
2. Activate through the 'Plugins' menu
3. Get an API key from OpenAI (or your preferred AI provider)
4. Add your API key in Settings (Meow Apps > AI Engine)
5. Start creating! 🚀

== Disclaimer ==

AI Engine is a plugin that helps you to connect your websites to AI services. You need your own API keys and must follow the rules set by the AI service you choose. For OpenAI, check their [Terms of Service](https://openai.com/terms/) and [Privacy Policy](https://openai.com/privacy/). It is also important to check your usage on the [OpenAI website](https://platform.openai.com/usage) for accurate information. Please do so with other services as well.

The developer of AI Engine and related parties are not responsible for any issues or losses caused by using the plugin or AI-generated content. You should talk to a legal expert and follow the laws and regulations of your country. AI Engine does only store data on your own server, and it is your responsibility to keep it safe. AI Engine's full disclaimer is [here](https://meowapps.com/ai-engine/disclaimer/).

== Compatibility ==

Please be aware that there may be conflicts with certain caching or performance plugins, such as SiteGround Optimizer and Ninja Firewall. To prevent any issues, ensure that AI Engine is excluded from these plugins.

== Screenshots ==

1. A chatbot on your site, here as a popup in the corner of a page. Give it a name, an avatar and a personality.
2. The same chatbot inline, with a dark theme. Themes are built in, and you can style your own.
3. Realtime: a voice conversation with the AI, with avatars and the live events feed.
4. Building a chatbot in the settings: pick the environment, the model, the context and the functions, and try it right there in the live preview.
5. The Content Generator: a whole post from a topic, sections first, then the content and the excerpt, all editable before it is published.
6. The Workspace: a full-screen AI chat inside wp-admin that can read and manage your site, with every model you configured.
7. Workspace for iOS: your site's AI on your iPhone. Every model, your keys, your site, with conversations kept on your own WordPress and image generation included.

== Frequently Asked Questions ==

= Why am I getting "Error 429: You exceeded your current quota"? =

This error comes from OpenAI's API, not AI Engine. Set up billing limits in your [OpenAI account](https://platform.openai.com/account/billing). Caching plugins can sometimes store error responses, so [clear your caches](https://ai.thehiddendocs.com/common-issues/exceeded-current-quota/) too.

= Who is AI Engine for, and how do I manage usage limits? =

AI Engine can be used by site owners, administrators, and visitors via chat widgets. To set query limits and prevent unlimited model runs, follow the [Managing Limits guide](https://ai.thehiddendocs.com/limits/).

= Does the chatbot support my language? =

AI models support many languages, but quality varies. There's no definitive list since models are constantly updated. Test your language in the AI Playground.

= How does MCP work, and what can I do with it? =

MCP (Model Context Protocol) exposes WordPress tools to AI agents. [Learn how to enable the MCP endpoint](https://ai.thehiddendocs.com/mcp/), choose which tools to expose, and secure them. You can manage posts, comments, users, media, and more.

= Can I restrict the chatbot to answer only from my site content? =

You can't completely block the model's built-in knowledge, but you can [use smart prompts and embeddings](https://ai.thehiddendocs.com/restrict-chatbot-topics/) to steer conversations toward your content.

= The chatbot doesn't appear or looks odd on my site =

Check the [Common Issues guide](https://ai.thehiddendocs.com/common-issues/) for solutions to REST API problems, caching conflicts, nonce errors, and layout glitches.

= Where can I learn the basics and troubleshoot problems? =

Start with the [Basics guide](https://ai.thehiddendocs.com/basics/) for installation and key concepts. For specific issues, check [Common Issues](https://ai.thehiddendocs.com/common-issues/).

= How do I report security issues? =

Report security vulnerabilities through the [Patchstack Vulnerability Disclosure Program](https://patchstack.com/database/vdp/9e5fbbbc-964a-4204-8bc0-198f21284efd).

== Changelog ==

= 3.7.6 (2026/09/05) =
* Add: Support for GPT-6 Astra, including its max reasoning level.
* Fix: Temperature is no longer sent to models that reject it.
* Update: The reasoning dropdown now only shows levels supported by the selected model.

= 3.7.5 (2026/09/03) =
* Add: Claude Fable 5.1 to the Anthropic models.
* Fix: Anthropic now caps max_tokens to the model's limit instead of returning a 400 error.
* Fix: Provider errors with a flat body (such as Mistral) and any 4xx/5xx status now show the actual error message.
* Update: Removed the Assistants module following OpenAI's shutdown.
* Update: Transcription now uses gpt-transcribe, and Opus 4.1 has been removed.
* Update: Built-in tools that can't be used with Chat Completions are now reported in the logs instead of being dropped silently.

= 3.7.4 (2026/09/01) =
* Fix: Sending a message after a client-side JS function call no longer fails with an invalid_request_error.
* Fix: MCP OAuth login redirects are no longer cached by page caches and served to the wrong visitor.
* Fix: Plugin file tools no longer report a refusal as a missing directory.
* Update: The "Done!" placeholder for client-side function calls is now translatable and filterable.

= 3.7.3 (2026/08/26) =
* Fix: Chatbots using the default environment and model are no longer excluded from the function calling list.
* Fix: Vision now detects image types from the file contents instead of the extension, so images served through a CDN work.
* Fix: Magic Wand can read the selected text again in the iframed block editor of WordPress 7.1, re-enabling Suggest Synonyms.
* Update: Completed steps in the Setup Assistant now collapse to a single line.

= 3.7.2 (2026/08/20) =
* Fix: Editor Assistant endpoints accepted a nonce any visitor could generate, allowing anyone to run AI queries on the site's provider account (reported by Abdullah Kareem via WPScan).
* Fix: A crafted URL could escape the uploads folder and send any server-readable file to the AI provider (reported by Jashid Sany via WPScan).
* Fix: Editor Assistant now works for admin-equivalent accounts whose role isn't literally administrator.
* Fix: Embeddings sharing the same reference no longer stay stuck, and a single unprocessable vector no longer blocks the maintenance queue.
* Fix: A temperature of 0 is no longer treated as unset and stripped from the request.
* Fix: Image-only replies from GPT-5 models no longer show "medium" as the answer text.
* Update: Claude Sonnet 5 pricing ($2/$10 is now permanent), dashboard wording, and tested with WordPress 7.1.
* 🎵 Discuss with others about Ai Engine on [the Discord](https://discord.gg/bHDGh38).
* 🌴 Keep us motivated with [a little review here](https://wordpress.org/support/plugin/ai-engine/reviews/). Thank you!
* 🥰 If you want to help us, check our [Patreon](https://www.patreon.com/meowapps). Thank you!
* 🚀 [Click here](https://trello.com/b/8U9SdiMy/ai-engine-feature-requests) to vote for the features you want the most.

= 3.7.1 (2026/08/14) =
* Add: WPML support in the MCP server, mirroring the Polylang tools.
* Add: SEO section in the Modules tab, with robots.txt access for AI crawlers and live stats when SEO Engine is installed.
* Update: MCP self-test now detects AI-crawler blocking, nested .htaccess files and www mismatches, and logs every OAuth authorize refusal.
* Update: Internal errors are now hidden behind a filterable public message, and AI Forms no longer show provider errors to visitors.
* Update: Shared dashboard synced with the new Board and the AI site analysis.
* Fix: The mwai_mcp_mutate hook now fires on deletions, so cache purges hooked to it run.

= 3.7.0 (2026/08/03) =
* Fix: Qdrant collections were always created with 1536 dimensions regardless of the embedding model, and default dimensions are now read from the right place.
* Update: Embedding dimensions are no longer locked for OpenAI-compatible models, as that size is only a guess.
* Fix: The MCP access level no longer restricts OAuth connections, and the setting is no longer hidden behind the bearer token.
* Fix: MCP connections no longer drop at random when the client refreshes its access token.
* Update: Credited Revanth Hari Narayana Matte (via WPScan) for reporting the security issues fixed in 3.6.4 and 3.6.6.

= 3.6.9 (2026/08/01) =
* Fix: Crash when clicking quickly through discussions, and slow image checks writing into the wrong message.
* Fix: MCP token refresh being rejected on servers that pass Basic credentials to PHP instead of forwarding the header.
* Fix: Stored chat messages could run scripts when an admin opened a discussion.

= 3.6.8 (2026/08/01) =
* Fix: Workspace mobile app connection on servers that don't expose the Authorization header, with clearer pairing errors.
* Fix: A Context Max Length of zero no longer empties posts, which blocked embeddings sync and blanked chatbot context.
* Update: Transcription now defaults to gpt-4o-mini-transcribe instead of whisper-1.
* Update: The mobile connection warning links to the troubleshooting page instead of showing the htaccess snippet.
* Add: Logging on the MCP OAuth token endpoint for failing refreshes.

= 3.6.7 (2026/07/31) =
* Add: Workspace is officially launched on [iOS](https://apps.apple.com/app/workspace-for-wordpress/id6794717714). 
* Update: OpenAI pricing for GPT-5.6 Terra and Luna following the July 30 cut, and corrected o3 which was priced 7.5x too high.
* Update: Removed the leftover mcp.js relay and its documentation, and corrected the MCP header comment that still mentioned SSE and OAuth.
* Add: getDiscussion() to the PHP API, to read a stored discussion without using $mwai_core.

= 3.6.6 (2026/07/30) =
* Update: Minimum PHP version is now 8.1, declared in the plugin header so WordPress blocks activation on older versions.
* Fix: Push All no longer exhausts the memory limit on large sites; post content is now checked in chunks.
* Fix: Long Japanese and Chinese posts no longer produce empty content, which left their embeddings stale.
* Fix: Hardened the REST endpoints against client-supplied file paths and API keys, corrected the MCP OAuth route match and guest session cookie, and stopped the chatbot key reaching Editors.
* Fix: The mwai_mcp_callback filter now receives five arguments from both the Workspace and the MCP endpoint.
* Add: CSV and JSON export for the Query and MCP logs, honouring the active filters and sort.
* Fix: Chatbot input is no longer hidden behind the mobile keyboard in fullscreen, and shortcuts are now chips that don't inherit the site's button styles.

= 3.6.5 (2026/07/28) =
* Add: Elapsed time counter on the AI Forms submit button, matching the chatbot.
* Add: Note in the Sync panel that the Sync filters are shared by all environments.
* Fix: Three security issues reported by WPScan (key disclosure to editors, guessable guest sessions, audio transcription file read).
* Fix: Streaming requests now respect MWAI_SSL_VERIFY and verify TLS certificates (reported by Mohammed Abd Alrahman).
* Fix: Recurring tasks no longer stay parked after repeated failures, so discussions and logs cleanups run again.
* Fix: Administrator-equivalent accounts (custom roles with manage_options) are no longer refused at the MCP OAuth consent screen.
* Fix: A custom JavaScript filter that crashes no longer breaks the chatbot, and raw JavaScript errors are no longer shown to visitors.
* Fix: The embeddings environment Type field no longer shows "Select" for the Internal (WordPress DB) environment.
* Fix: The Web Search button now appears in the Workspace composer when pinned.
* Update: Push All now respects the Sync category and language filters, so it no longer seeds posts Sync would not maintain.
* Update: Workspace is now available to everyone; Knowledge, MCP Servers and Functions stay Pro.
* Update: Removed the unused module_addons and module_blocks option defaults.

= 3.6.3 (2026/07/27) =

* Add: Workspace: a full-screen chat surface in wp-admin, with a model picker across all your environments, conversation history, folders, a prompt library, per-user themes, and edit-and-branch on any message. Available in the Pro, coming later in the Free.
* Add: The Workspace can generate and edit images, search the web with each provider's own search tool (OpenAI, Anthropic, Google, OpenRouter), and work on the site itself through the MCP tools, with an approval dialog before any site-changing tool runs.
* Add: QR-code pairing for the Workspace mobile companion app, with a revocable Application Password.
* Add: Internal (WordPress DB) vector environment that stores embeddings locally, now the default for new installs.
* Add: Discussions now show the tool calls and their parameters alongside the embeddings usage, and can be searched server-side by content and title.
* Add: Claude Opus 5.
* Fix: Public chat and form endpoints no longer trust client-supplied models, environments, instructions or messages, and internal errors are hidden from visitors; the stateful-response restore is now owner-scoped, so another user's chat ID can no longer resume their conversation.
* Fix: Content-aware chatbots no longer inject a post the visitor cannot read, so a client-supplied context ID can no longer leak draft or private content.
* Fix: Chatbot error and notice messages are sanitized before being rendered as HTML, and configuration errors are shown to editors only instead of being printed publicly.
* Fix: Function calling is more reliable: Claude no longer re-calls tools with the previous message's parameters, multi-round calls on stateless providers keep their feedback blocks instead of clearing them each round, and the Gemini 2.x models work again.
* Fix: Google model names and capability detection, so image, thinking and web-search models are recognised and preview variants are no longer ambiguous.
* Fix: OVH replies arriving empty, caused by an oversized max_tokens and a hijacked catalog fetch.
* Fix: Embeddings re-sync destroying a vector when the new content comes back empty, and guest file listing crashing with a 500.
* Fix: The usage-limit lock never firing on streaming chatbots, and the Discussions table spinning forever when opened in a background tab.
* Update: MCP server hardening: a failing tool now returns a readable error instead of killing the server for the client, and the tools list is capped at 500 results.
* Update: Settings Reset now asks you to type the site host and says plainly that it deletes the API keys, environments, chatbots and themes; more native browser dialogs were replaced with NekoModal across Discussions, Query Logs, Knowledge, Templates and Limits.

= 3.6.2 (2026/07/16) =

* Fix: Fixed block editor paragraph spacing broken by the AI Copilot handler wrapper.
* Add: Note filtering support for the wp_get_comments MCP tool, allowing agents to read WordPress 6.9 editor Notes.
* Fix: Fixed the Anthropic engine dropping conversation history on function-call follow-up requests.
* Fix: Fixed duplicate embedding vectors for the same reference and environment, which left embeddings stuck at pending after a sync.

= 3.6.1 (2026/07/13) =

* Fix: MCP user tools not enforcing proper capabilities, allowing Multisite site administrators to edit users beyond their reach. Hotfix. (Thanks to Charles Vosburgh for reporting.)
* Fix: MCP read tools corrupting block-JSON Unicode escapes by double-unslashing database content.
* Update: Native browser dialogs (alert/confirm/prompt) are now forbidden in code; NekoModal is used instead.

= 3.6.0 (2026/07/10) =

* Add: GPT-5.6 family (Sol, Terra, and Luna) to OpenAI models, with Sol marked as the latest.
* Fix: Gemini image models not being selectable when their ID lacks a `-preview` suffix.
* Fix: MCP media upload tool crashing on download errors and rejecting extensionless image URLs.

= 3.5.9 (2026/07/06) =

* Fix: MCP post meta tools double-serializing array values, which stored nested arrays as strings.
* Fix: MCP wp_create_post and wp_update_post tools stripping shortcodes, email HTML, and inline CSS for admin-authorized callers.
* Fix: Chatbot theme styles loading outside AI Engine's admin screens, which caused Gutenberg editor iframe warnings.
* Fix: simpleJsonQuery failing on Anthropic and Google environments by no longer forcing an OpenAI fallback model, with a clearer error message.
* Fix: Discussions and Queries timestamps now display in the site's configured timezone instead of the browser's.
* Fix: MCP Functions settings crashing when tools were registered due to the list being returned as an object instead of an array.
* Fix: OpenAI Vector Store Pull All failing with a limit error by paginating the file list.
* Update: WordPress MCP tools are now enabled by default.

= 3.5.8 (2026/07/03) =

* Fix: Code blocks now display correctly in the Timeless and Foundation chatbot themes (was using proportional font instead of monospace).
* Fix: Sonnet 5 breaking with "each thinking block must contain thinking" when streaming with function calling.
* Fix: MacOS chatbot container showing empty notches in the corners due to double-rounded borders.
* Update: Reorganized the admin UI — Modules tab now leads with "Chatbots & Knowledge" and "MCP & Agents", and Settings tabs were reordered to match.
* Update: Moved the Event Logs option from Settings → AI to Settings → Chatbot for easier discovery.
* Update: Enlarged the chatbot preview pane in settings (480px → 620px) and polished the ChatGPT theme with monospace code blocks, accent border on focused input, and smoother transitions.
* Update: Refined the Messages chatbot theme with monospace code blocks, readable links in user bubbles, input focus ring, and capped bubble width.
* Add: Gutenberg MCP tools: wp_write_blocks, wp_list_block_patterns, and wp_insert_block_pattern.
* Add: Nonce checks added to license, rating, and news notice forms.

= 3.5.7 (2026/07/01) =

* Fix: Chroma "Pull All" now returns all pages of large collections instead of only the first page.
* Add: Claude Sonnet 5 model support.
* Fix: Anthropic function-calling loops no longer fail when no explicit max tokens is set.
* Fix: Gemini Interactions engine now properly includes RAG context, chat history, and PDF uploads, and passes connection tests.
* Add: In-chat image output and stream error handling for Gemini Interactions.
* Fix: Outbound API calls now verify TLS certificates by default.
* Update: Credited Shivamani Vastrala and Meher Sudhakar Abbireddi (via WPScan) for reporting the security issues fixed in 3.5.5.

= 3.5.6 (2026/06/26) =

* Add: Gemini Interactions API engine as the default for Google, with streaming, function calling, and in-chat image generation (classic API kept as a fallback).
* Add: Google Search and Maps grounding as Gemini chatbot tools, plus a setting to fall back to the standard Gemini API.
* Add: MCP server support to Realtime voice chatbots — tools were selectable but previously did nothing — and the model now speaks tool results aloud.
* Add: `mwai_mcp_mutate` action that fires after any content-mutating MCP tool, letting integrations purge caches, reindex, or audit.
* Add: `raw` option to the MCP `wp_get_option` tool to read directly from the database, bypassing object cache and filters.
* Add: `author__not_in` to MCP `wp_get_posts`, and a `content_format=prose` option to `wp_get_post`/`wp_get_post_snapshot` that strips block-attribute JSON to reduce token usage.
* Fix: `wp_create_post` MCP tool no longer corrupts shortcode and HTML content via the markdown parser.
* Fix: MCP log entries mislabeled as OAuth; admin and bearer calls now display correctly.
* Fix: Streaming parallel tool calls leaving a null in the `tool_calls` array, which broke function calling on strict providers.
* Fix: MCP `wp_get_posts`, `wp_get_media`, and `wp_get_comments` filters by author, `user_id`, and email were accepted but silently ignored.
* Fix: `wp_update_option` now decodes JSON-string array values into real arrays before saving, preventing corruption of array options like `sticky_posts`.
* Fix: Chatbot events panel is now scrollable and error messages are dismissable.
* Update: Removed the legacy MCP SSE transport, keeping only the Streamable HTTP endpoint.
* Update: Enabled function calling for Mistral.
* Update: Uploaded images now fill the message bubble width in the chatbot across all themes.
* Update: MCP post tools now accept `ID`, `post_id`, or `id` interchangeably, and `wp_update_post` accepts top-level fields with clearer error messages.

= 3.5.5 (2026/06/20) =

* Fix: Path traversal vulnerability in create_image and prevented chatbot discussions from being taken over by another logged-in user.
* Fix: Add-ons were reported as disabled whenever options were fetched outside the admin context.
* Fix: Max Tokens entered with a thousands separator (e.g. the Danish "64.000") was read as 64 and capped responses.
* Fix: Content Aware placeholders now resolve automatically in chatbot instructions without requiring a toggle.
* Fix: Setup Assistant no longer shows "Connect an AI Provider" as incomplete when only the Fast model is deprecated.
* Fix: Realtime instructions now resolve placeholders like {FIRST_NAME} into their values.
* Fix: MCP tools generated from WordPress REST endpoints could break Google Gemini due to enum on non-string types.
* Fix: Changing the type of an AI environment now drops fields from the previous type (endpoint, region, deployments), preventing engines from calling the wrong provider's endpoint.
* Fix: The "Default AI Environment not configured" warning no longer appears when a Chroma embeddings environment generates its own vectors.
* Fix: The Usage widget on the Dashboard no longer overflows its panel when numbers are wide.
* Fix: Anthropic's streaming ping keepalive events are now ignored instead of being logged as an unknown stream data type.
* Update: Reworked embeddings sync — pages are no longer marked stale without real changes, the background task (now called Maintenance) runs for all environments, processes batches within a time budget, no longer gets blocked by a failing vector, and can be disabled in Settings > Knowledge > Sync Settings.
* Update: API key and token fields are now masked with an eye toggle to reveal them.
* Update: Marked the original GPT-5 models (gpt-5, gpt-5-mini, gpt-5-nano, gpt-5-pro) as deprecated per OpenAI's December 10, 2026 shutdown.
* Update: The fullscreen resize button now uses thin corner-bracket icons that match the close button.
* Update: OpenAI Vector Store document uploads now accept multiple files at once.
* Add: User Memory added to the add-ons list.
* Add: Optional capability filter for get_chatbots() to fetch only chatbots whose model supports function calling.
* 🎵 Discuss with others about Ai Engine on [the Discord](https://discord.gg/bHDGh38).
* 🌴 Keep us motivated with [a little review here](https://wordpress.org/support/plugin/ai-engine/reviews/). Thank you!
* 🥰 If you want to help us, check our [Patreon](https://www.patreon.com/meowapps). Thank you!
* 🚀 [Click here](https://trello.com/b/8U9SdiMy/ai-engine-feature-requests) to vote for the features you want the most.

= 3.5.4 (2026/06/10) =

* Fix: Hold to Talk button on mobile Realtime chatbot no longer triggers the context menu (copy, select) when held.
* Update: Images and files can now be sent without a text message; engines skip the empty text part for providers that reject it.
* Fix: Sending is now blocked while a file is still uploading, with a spinner on the send button and a progress bar on the file preview until upload completes.
* Fix: Eliminated the gap between the chatbot and the keyboard on iOS by locking body scroll while the mobile chatbot is open.
* Fix: Anthropic safety refusals now show a readable message instead of an empty reply.
* Add: Claude Fable 5 model. Marked Claude Sonnet 4, Opus 4, and Opus 4.1 as deprecated.
* Add: Web search support for OpenRouter via the Tools & Capabilities section.
* Add: Full Screen view for Discussions, a Discussions count on the Dashboard, and fixed filenames with underscores being rendered as italics in the admin discussion view.
* Update: AI provider connectors now mentioned in the readme description.
* Update: PDF import now remembers the Density, Overlap, and filename-as-title settings between imports.
* Fix: OpenClaw link in the readme now points to our own article.
* Update: Marked GPT Image 1.5 and GPT Image 1 Mini as deprecated; default image model moved to GPT Image 2.
* Fix: PHP 8.2+ deprecation warning caused by an undeclared `$extraData` property on `Meow_MWAI_Reply`.
* Add: Embeddings sync can now be restricted to specific Polylang languages via a comma-separated languages field.
* Fix: `wp_alter_post` regex mode now handles patterns containing "/" (e.g. Gutenberg block markers) and returns the actual PCRE error instead of a generic one.

= 3.5.3 (2026/05/28) =

* Fix: Filenames with underscores (e.g. `Some_File_2026.pdf`) were getting partially italicized by the chatbot's markdown renderer.
* Fix: ReferenceError (`data is not defined`) in the chatbot response handler that masked the real error message when a host returned a non-JSON body.
* Fix: The Push All button showed "(null)" when a post type had zero matching posts.
* Fix: The `wp_update_option` MCP tool schema no longer logs a "problematic union type" warning on every `list_tools` call.
* Fix: The Meow Apps menu icon now shows correctly in both the expanded and collapsed sidebar states.
* Fix: Hotfix for the MCP endpoint URL being hidden until a bearer token was generated, even though OAuth doesn't need one. It now appears as soon as the MCP Server is enabled.
* Add: Claude Opus 4.8 to the Anthropic model list, with the `latest` tag moved to it.
* Add: AI Forms multi-upload fields now stack new file selections on top of previous ones, with a staged list and per-file remove buttons.
* Add: `mwai-bouncing-loader` and `mwai-bouncing-dot` CSS classes to the chatbot loading dots for custom styling.
* Add: MCP Logs view in Insights with per-tool-call capture, status, duration, and a top tools widget.
* Add: MCP Connection Test in MCP Server settings that detects host-level WAF blocks (e.g. WP Engine's default) before they surface in claude.ai.
* Update: Aligned Forms and Playground markdown rendering with the chatbot so single newlines now produce visible line breaks.
* Update: Extended CORS headers on MCP endpoints with Mcp-Protocol-Version, Mcp-Session-Id, Accept, and Last-Event-ID for browser-context MCP clients.
* Update: Claude Sonnet 4 and Opus 4 (2025/05/14) marked as deprecated ahead of Anthropic's 2026-06-15 retirement date.
* Update: The chatbot Functions empty state now tells Free users that function calling is Pro-only.
* Update: Polished the plugin readme description with cleaner punctuation and brand consistency.

= 3.5.2 (2026/05/22) =

* Add: Setup Assistant on the Dashboard that walks through essential configuration with a progress bar and per-step actions.
* Add: Direct file upload to OpenAI Vector Store via a new Documents tab, with async status polling, Sync from OpenAI action, and clearer PHP upload-limit errors.
* Add: `setField` and `prefill` methods to the AI Forms JS API for setting values programmatically without manual `dispatchEvent` workarounds.
* Update: Redesigned the Dashboard Usage panel into an analytics card with headline, week-over-week delta, daily bar chart, and provider/peak/average/per-query tiles.
* Update: Reorganized the Modules tab into clearer sections with short intros, concise descriptions, renamed Utilities to AI Copilot, and surfaced MCP and Public API as proper modules.
* Update: Renamed the user-facing "Units" metric to "Tokens" across the dashboard, queries explorer, insights, and `[mwai_stats]` shortcode, with full back-compat on REST output and legacy settings.
* Update: Aligned the Discussions, Insights, and Knowledge layouts by standardizing column ratios and removing custom margin and header overrides.
* Update: Added a Refresh button to the Usage panel header, widened the Tokens column in Queries Explorer, and showed "N/A" for queries with no scope.
* Update: MCP tool-registration warnings are now always written to the PHP error log instead of requiring the debug logging flag.
* Fix: Stripped inline citation markers from OpenAI's file_search Responses API text that were surfacing as gibberish in chatbot replies.
* Fix: Stopped embedding the sessionId in chatbot and forms HTML for logged-out visitors, so page caches no longer share one sessionId across all visitors.
* Fix: Guarded REST AI endpoints so they no longer overwrite the cookie-derived session with an empty client-sent sessionId.
* Fix: Gemini embedding queries no longer report bogus token counts by correctly reading promptTokenCount from the response.
* Fix: Dynamic MCP REST tool schemas no longer serialize the meta arg on media/posts/pages as an array, which Claude's MCP validator was rejecting.
* Fix: Translate Post now translates list items inside modern Gutenberg lists, which were silently skipped since WP 6.1+.

= 3.5.1 (2026/05/17) =

* Add: Popup Icon Size option in chatbot settings to resize the popup trigger without custom CSS.
* Fix: Chatbots admin preview now keeps long discussions, fullscreen toggles, and resize actions contained within the preview pane instead of clipping or overflowing the viewport.
* Fix: Chatbot rendering bug where a `$` inside an inline code span caused other message text to leak into the code display.

= 3.5.0 (2026/05/16) =

* Fix: MCP OAuth authorization and token validation now require administrator capability, preventing privilege escalation by non-admin users.
* Update: Marked gpt-5.2-chat-latest and gpt-5.3-chat-latest as deprecated (OpenAI shutting them off August 10, 2026).
* Update: Added a deprecation banner on the Finetunes screen due to OpenAI sunsetting self-serve fine-tuning.
* Fix: CSV import for fine-tuning now shows an explicit error when no usable prompt/completion columns are found.
* Fix: Updated the broken OpenAI tutorial link on the Finetunes screen.

For older releases, see [changelog.txt](https://plugins.svn.wordpress.org/ai-engine/trunk/changelog.txt).
