VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok

Prepare a concrete SEO change for one item, compare before/after values in WordPress, then apply with a human review. Optional Agentic Optimization integration uses its own editor and renderer, including per-item noindex, while preserving manual editing and avoiding duplicate SEO output. New relay tools require exact versioned consent.

Review eligible installed WordPress abilities individually; source or schema changes withhold them until reviewed again.

2 or later. Optional native WordPress Abilities expose reviewed Site Manager reads and draft writes; the separate MCP Adapter remains optional. 2 security support ends December 31, 2026.

VideoWhisper Site Manager lets you manage WordPress posts and pages through external AI/SI agents such as ChatGPT (Custom GPT + Actions), Claude (MCP), Codex (MCP), and Grok custom MCP connectors, using your own account, not API keys.

It exposes authenticated WordPress endpoints and setup guidance while you keep using your own AI account and subscription.

Included features:

• Authenticated REST, MCP and generated OpenAPI interfaces for external agents.

• Direct local OAuth with S256 PKCE, exact versioned per-tool consent, scopes, client management and revocation; no relay account required.

• Optional native WordPress Abilities and separate MCP Adapter exposure, reviewed per user under Read Only or Safe Drafts.

• Optional shared Turnkey relay, frontend connection help and native Application Password setup.

• Editorial tools for enabled content types, taxonomies, revisions, guarded recovery and signed-in draft previews.

• Connection doctor, client configuration copy and credential-free diagnostics.

• Opt-in image library/intake/metadata tools and effective standalone, Agentic Optimization or Yoast SEO; details below.

• Object permissions, HTTPS, publication controls, rate limits, audit logs and extension hooks.

The plugin does not call OpenAI, Anthropic, xAI, or any AI/SI provider directly. Your WordPress site exposes authenticated endpoints and setup guidance. You connect it to ChatGPT, Claude, Codex, or Grok yourself with your own account and subscription.

Current AI Actions and Tools

Available tools depend on site settings, authentication, exact consent and WordPress permissions. The registry feeds MCP, OpenAPI and the dynamic agent guide; grouped OpenAPI actions use an action subaction field.

Core: get_site_context, list_content, get_content, get_logs, create_content, update_content. Conditional recovery: revert_action, reset_action.

Direct native/Local OAuth editorial tools: list_content_types, list_terms, create_term, assign_terms, list_revisions, restore_revision, get_preview_link, trash_content, restore_content.

plugins_list lists compatible integrations, their agent instructions and visible tools. `get_site_context` includes a brief permission-aware integration summary. Other plugins attach through `vwsm_ai_plugin_integrations`.

surface=actions for alternate formats. The generated guide describes the current site’s permitted tools.

Extension Hooks

Developers can extend this plugin without editing core files. Common hooks include:

• Settings and admin UI: vwsm_settings_defaults, vwsm_settings_normalized, vwsm_admin_settings_save, vwsm_rest_settings_payload, vwsm_settings_tab_label, vwsm_settings_form_publishing_rows, vwsm_settings_form_security_rows, vwsm_settings_form_rate_limits_rows, vwsm_settings_form_logs_revisions_rows, vwsm_settings_form_turnkey_oauth_rows, vwsm_settings_form_authentication_rows, vwsm_settings_form_application_passwords_rows, vwsm_settings_form_content_rows, vwsm_settings_form_admin_rows, vwsm_settings_form_attachments_rows, vwsm_settings_form_fomantic_rows, vwsm_settings_form_after_core_rows, vwsm_auth_methods_section.

• Authentication and OAuth metadata: vwsm_oauth_server_url, vwsm_authorization_server_url, vwsm_rest_401_headers, vwsm_external_oauth_onboarding_urls, vwsm_onboarding_oauth_tab_content, vwsm_handle_external_register_gpt.

• OpenAPI, MCP, and tools: vwsm_ai_actions, vwsm_ai_plugin_integrations, vwsm_ai_plugin_option_integrations, vwsm_ai_plugin_action_dispatch, vwsm_ai_action_native_openapi_tools, vwsm_mcp_server_name, vwsm_mcp_extra_tools, vwsm_mcp_dispatch_tool, vwsm_mcp_site_context, vwsm_openapi_components, vwsm_openapi_document, vwsm_write_rate_limit_mcp_tools.

• Content and sanitization: vwsm_allowed_content_types, vwsm_revision_limit, vwsm_revision_gradient, vwsm_supported_extra_allowed_html_tags, vwsm_allow_extra_allowed_html_tags.

• User connection workflows: vwsm_user_connect_handle_post, vwsm_user_connect_after_sections, vwsm_user_connect_tools_data, vwsm_user_connect_gpt_url.

• Operator and environment behavior: vwsm_default_operator_username, vwsm_use_current_user_mode.

Disclaimer

This plugin provides infrastructure for operating a WordPress site with external AI chatbots and agents. The site owner is solely responsible for the actions enabled through this functionality, including content created or changed by AI tools, credentials and access tokens, backups, privacy compliance, and any publishing or policy consequences.

AI-generated content can be inaccurate, defamatory, plagiarized, non-compliant, or otherwise unsuitable for publication. Review AI output and tool activity before publishing. Keep publishing disabled unless you fully understand and accept the risk.

Use HTTPS, protect Application Passwords and OAuth credentials, restrict access where possible, monitor logs, and maintain independent backups. Use at your own risk.

Frontend connection help

The [vwsm_user_connect] page provides section links, expandable app setup,

MCP URL copy buttons and a permission-aware tool list. com uses its custom

connector setup. Grok Bot has a separate Connect apps interface; custom MCP

availability depends on the product/account. Follow the linked provider guides.

Native WordPress abilities and optional MCP Adapter exposure have separate

administrator reviews. A connection can permit fewer tools than the account.

Personalized shortcode pages send no-cache headers; exclude them from any

reverse-proxy or full-page cache that ignores WordPress cache controls.

Privacy

Native Abilities availability is stored in site options. Reviewed policies are private user metadata scoped to the site; they contain selected tool fingerprints, mode, native version, audience, user and epoch, plus the optional Adapter exposure choice. No Application Password is copied into these policies.

Local OAuth stores client names, registered callbacks, registration IP addresses, user/client IDs, granted scopes, versioned tool selections and permission mode, token expiry and last-use timestamps in this site database. Access/refresh tokens use keyed hashes and confidential client secrets use password hashes. Credentials are returned only during issuance and are not included in tool/audit payloads.

Administrators can revoke tokens and remove clients from Local OAuth. Deactivating Pro does not remove a Free-owned local connection.

This plugin stores the following data on your WordPress site:

• Plugin settings in WordPress options (for example: publish, rate limit, HTTPS, IP allowlist, authentication, and provider URL settings)

• Audit log entries in a custom database table ( *_vwsm_audit_logs )

• Optional dedicated operator user ID reference in WordPress options (when using onboarding helper)

• Short-lived transient for one-time Application Password display after creation (plaintext is not stored long-term)

• Short-lived transient cache for external bearer-token validation, when Turnkey OAuth is used

• Optional connected service account tokens, site keys, server URLs, and provider policy links used for remote account and Turnkey OAuth workflows

• A private vwsm_user_context user-meta value (up to 2,000 characters) when a user saves My Agent Context from [vwsm_user_connect]

Audit logs may include (depending on settings):

• Authenticated WordPress user ID

• Request route and method

• Sanitized request/response summaries

• Timestamp and IP address

This plugin does not send data to third-party AI services by itself.

This plugin does not include telemetry/analytics tracking by default.

Site owners are responsible for:

• Securing the site with HTTPS

• Managing WordPress users and Application Passwords

• Configuring GPT sharing safely (recommended: Only Me )

• Reviewing the privacy implications of any external AI service connected to the site’s API

External services

Optional user-selected image source

Only explicitly executed approved image intake sends a WordPress HTTP GET to the administrator-approved HTTPS source supplied by the agent/user. The source receives the URL (including any query), server network address and WordPress HTTP user-agent. Host validation may resolve DNS, including during a dry run.

This feature supplies no WordPress login cookie, Application Password or OAuth token. The administrator chooses the destination and must review its terms/privacy policy. Manual editing, library reads, standalone SEO and disabled intake require no external image service.

Source URLs and idempotency keys are redacted from audit summaries. The optional Connection doctor probe contacts only this site’s MCP endpoint without credentials.

This plugin can optionally connect to external services only when an administrator chooses a workflow that uses them, mainly as relay for multi site management. The default external services listed below are provided for free registration-based onboarding and multi site relay functionality. They do not require payment to use with this plugin.

Site administrators can also configure another compatible third-party Relay & OAuth Server URL or add custom services through the documented WordPress hooks.

Promptaur Relay & OAuth Server

com

This service is used for optional multi-site relay routing (manage multiple sites from same session), shared Turnkey OAuth, shared GPT/shared MCP onboarding, and bearer-token validation on this type of setup. It makes setup simpler by allowing users to connect through one shared OAuth login and, when enabled by the service, use pre-existing shared GPT or MCP connector configuration instead of creating their own.

Data sent to this service:

• When registering a site: the WordPress site URL, site name, and optional account or server registration token entered/configured by the administrator.

• When registering a GPT/OAuth client: the site key, site secret, client name, and GPT callback URL supplied in onboarding.

• When validating OAuth bearer tokens: the bearer access token plus the site’s registered site key and site secret. The plugin caches validation briefly according to the configured token cache TTL.

• When loading Turnkey configuration, status, disconnect, or user connection data: the site key, site secret, and the specific account/site/user connection values needed for that request.

com/terms-of-use/

com/privacy-policy/

VideoWhisper Remote Connect

com

This optional onboarding service is used by the VideoWhisper Remote Connect wizard to register or log in a contact, import connection settings, and simplify account/site setup for multi-site relay server. It is a free registration-based service used to improve onboarding; it is not required for direct Application Password setup.

Data sent to this service from the onboarding page:

• The client plugin identifier, WordPress site URL, and normalized site domain.

• Registration/login details entered by the administrator, such as name, email address, PIN/confirmation code, website/domain, and form fields returned by the service configuration.

• Remote account tokens returned by the service when the administrator chooses to import settings or push the current site URL/account state.

com/terms-of-use/

com/privacy-policy/