# Aiutoma for WordPress

**Aiutoma** is the ultimate agentic assistant designed to bring true AI automation to your WordPress and WooCommerce ecosystem. Transform your website into an intelligent, self-managing platform that generates stunning content and connects seamlessly to external models.

## 💎 The 100% Native WordPress Experience

Unlike generic wrapper plugins, Aiutoma is engineered specifically for the WordPress ecosystem:
- **WordPress 7.0 AI API Ready:** Built directly on top of the futuristic native WordPress Core AI Connectors and Abilities API. It doesn't hack its way into your site; it utilizes standardized, official protocols.
- **Seamless Native UI/UX:** Forget clunky, bloated third-party interfaces. Aiutoma's dashboard, settings, and editor panels are meticulously crafted to blend perfectly into the classic WordPress UI mood. It feels like a feature WordPress shipped out of the box.
- **Strict Standards Compliance:** Written with clean, secure, and modern PHP 8.1 standards. No heavy external frameworks, no performance dragging. Just perfectly compliant, highly optimized code.
- **EU AI Act & GDPR Ready by Design:** Built from the ground up to respect European regulations (Regulation (EU) 2024/1689). Meets Article 50 transparency requirements out of the box with persistent AI badges, accuracy disclaimers, clear human operator handovers, and Privacy Policy links.

## 🚀 The Complete AI Suite

### 1. 🦸‍♂️ AI Playground (Command Center)
Your extremely powerful, yet perfectly safe, sandboxed command center. Instruct the AI to manage WordPress content, options, taxonomies, and execute safe DB queries. Everything is backed up automatically with instant 1-click rollbacks.

### 2. 🪄 Gutenberg Editor Agent
Meet your new co-writer. A smart, floating chatbot lives right inside your block editor. Type `/prompt` anywhere to visually generate Gutenberg blocks, rewrite entire paragraphs, or autonomously create and attach AI-generated featured images directly to your media library.

### 3. 🆓 Free-Tier Providers Included
Start automating at absolute zero cost. Aiutoma integrates natively with top AI providers that offer generous free tiers (like Google Gemini and HuggingFace). Experience enterprise-grade AI capabilities without worrying about monthly API bills.

### 4. 🌍 WPML Auto-Translation
Take your business global effortlessly. With native WPML integration, Aiutoma can automatically detect, translate, and sync your content across multiple languages, keeping your international SEO flawless and up-to-date.

### 5. 📡 LLMs.txt & Markdown Endpoints (AI-Ready SEO)
Prepare your website for the next generation of search engines. Aiutoma automatically exposes ultra-clean `.md` endpoints for your public content, mapping your entire site architecture via an autogenerated `/llms.txt` file for flawless ingestion by ChatGPT, Claude, and Perplexity crawlers.

### 6. 🔗 MCP & OpenAPI Integrations
Take remote control of your WordPress site. Connect Claude Desktop (via the Model Context Protocol) or Custom GPTs (via OpenAPI Custom Actions) to manage your site, read data, and execute tasks securely from your favorite AI clients.

### 7. 🔔 AI Webhook Receiver
Keep track of everything. Provide external AI agents, Zapier flows, or background cron tasks with a secure REST endpoint that logs their automated actions directly into your native WordPress Comments (cleanly attached to specific post IDs).

### 8. 🧠 RAG Knowledge Base
Give your AI true, deep context. Automatically sync your posts, WooCommerce products, and user data into a high-performance, local SQLite vector database. Your AI will always know your exact inventory and data.

### 9. 💬 Frontend Chatbot (EU AI Act Ready)
Empower your visitors with total legal confidence. Deploy a sleek, lightning-fast frontend chat widget powered by your RAG embeddings to provide instant customer support, smart WooCommerce recommendations, and guided user experiences:
- **EU AI Act (Art. 50) Transparency:** Built-in permanent AI indicator badges and accuracy disclaimers ensure users always know they are chatting with an AI system.
- **Human-in-the-Loop Handover:** Seamlessly take over live chats from the admin dashboard with real-time system notices informing visitors when an operator joins or leaves.
- **Privacy & GDPR Controls:** Session tracking controls, customizable consent checkboxes, and automated Privacy Policy page integration.

### 10. 🛡️ Advanced AI Crawlers & Robots.txt Management (Server Protection)
Protect your server from saturation by aggressive AI bots without sacrificing search visibility:
- **Training Bots vs. Answer Engines:** Granularly distinguish between training scrapers (ByteDance/Bytespider, Common Crawl, GPTBot, ClaudeBot, Google-Extended) and citation-generating answer engines (ChatGPT Search, Perplexity, Claude Search).
- **Server Resource Throttling:** Block heavy data scrapers that flood PHP workers and MySQL connections, or enforce rate limiting (`Crawl-delay: 5s/10s`).
- **Endpoint Protection:** Automatically prevents AI bots from scanning resource-heavy internal searches (`/?s=`) and REST API endpoints.
- **Live Preview & 1-Click Presets:** Instant simulation of your generated `robots.txt` output and quick presets (*Protect Server*, *Block All*, *Allow All*).

## 🇪🇺 EU AI Act Compliance (Regulation (EU) 2024/1689)
Aiutoma is engineered to keep your website legally compliant as an AI deployer under European law:
- **Risk Classification:** Aiutoma operates as a **Limited Risk** AI system. It does not engage in prohibited practices (Art. 5) or high-risk decision-making (Art. 6 / Annex III).
- **Article 50 Transparency Obligations:** Natural persons are clearly and continuously informed that they are interacting with an AI system through visible header badges, explicit initial greetings, and persistent accuracy disclaimers.
- **Human Editorial Oversight:** Backend generation tools (Gutenberg agent, SEO, and Playground) require explicit human review and publication, fulfilling the oversight standards of Art. 50(4).

## 🛠️ Setup & Requirements
- **Requires:** WordPress 6.0+, PHP 8.1+
- **API Keys:** Uses native WP Core AI Connectors. Just plug in your keys and watch the magic happen.

## 🌐 External Services

This plugin connects to external third-party services to provide artificial intelligence completions, embeddings generation, anti-bot verification, image creation, content translation, and instant messaging functionality. All external connections are made directly from your WordPress server to the respective service endpoints. No personal data is sent without explicit user or administrator action.

### 1. Cohere
- **Service & Purpose:** Connects to the Cohere API (`api.cohere.ai`, `dashboard.cohere.com`) for text completions and embeddings when configured by the administrator.
- **Data Sent & When:** Prompt text, chat history, and model parameters sent upon user-initiated AI queries.
- **Provider:** Cohere Inc.
- **Terms & Privacy:** [terms of use](https://cohere.com/terms-of-use) | [privacy policy](https://cohere.com/privacy)

### 2. Groq
- **Service & Purpose:** Connects to the GroqCloud API (`api.groq.com`, `console.groq.com`) for high-speed LLM inference when configured with a Groq API key.
- **Data Sent & When:** Prompt text, system instructions, and chat messages sent upon executing queries.
- **Provider:** Groq, Inc.
- **Terms & Privacy:** [terms of use](https://groq.com/terms-of-use/) | [privacy policy](https://groq.com/privacy-policy/)

### 3. Hugging Face
- **Service & Purpose:** Connects to Hugging Face Inference API and Router (`router.huggingface.co`, `api-inference.huggingface.co`, `huggingface.co`) for model inference and sentence-transformers embeddings for RAG search.
- **Data Sent & When:** Prompts and post content excerpts sent when calculating embeddings or requesting text generation.
- **Provider:** Hugging Face, Inc.
- **Terms & Privacy:** [terms of service](https://huggingface.co/terms-of-service) | [privacy policy](https://huggingface.co/privacy)

### 4. Cloudflare Workers AI
- **Service & Purpose:** Connects to Cloudflare Workers AI (`api.cloudflare.com`, `dash.cloudflare.com`) for serverless model inference on Cloudflare's edge network.
- **Data Sent & When:** Prompts and chat messages sent when querying Cloudflare AI models.
- **Provider:** Cloudflare, Inc.
- **Terms & Privacy:** [terms of use](https://www.cloudflare.com/website-terms/) | [privacy policy](https://www.cloudflare.com/privacypolicy/)

### 5. Cloudflare Turnstile
- **Service & Purpose:** Connects to Cloudflare Turnstile (`challenges.cloudflare.com`) for non-intrusive CAPTCHA and anti-bot verification on the frontend chatbot.
- **Data Sent & When:** Turnstile verification token and visitor IP address sent when submitting a chatbot message.
- **Provider:** Cloudflare, Inc.
- **Terms & Privacy:** [terms of use](https://www.cloudflare.com/website-terms/) | [privacy policy](https://www.cloudflare.com/privacypolicy/)

### 6. Mistral AI
- **Service & Purpose:** Connects to Mistral AI API (`api.mistral.ai`, `console.mistral.ai`) for text generation and chat completions.
- **Data Sent & When:** User prompts and conversation context sent when interacting with Mistral models.
- **Provider:** Mistral AI SAS
- **Terms & Privacy:** [terms of service](https://legal.mistral.ai/terms/get-started/) | [privacy policy](https://legal.mistral.ai/terms/privacy-policy/)

### 7. OpenRouter
- **Service & Purpose:** Connects to OpenRouter API (`openrouter.ai`) to route requests across diverse models.
- **Data Sent & When:** Prompts and chat history sent when querying models through OpenRouter.
- **Provider:** OpenRouter
- **Terms & Privacy:** [terms of service](https://openrouter.ai/terms) | [privacy policy](https://openrouter.ai/privacy)

### 8. Amazon Web Services (AWS Bedrock)
- **Service & Purpose:** Connects to Amazon Bedrock Runtime API (`amazonaws.com`, `bedrock-runtime`, `console.aws.amazon.com`) for foundation model Converse API calls using AWS IAM credentials.
- **Data Sent & When:** Conversation messages and inference parameters sent to the designated AWS region.
- **Provider:** Amazon Web Services, Inc.
- **Terms & Privacy:** [terms of service](https://aws.amazon.com/service-terms/) | [privacy policy](https://aws.amazon.com/privacy/)

### 9. GitHub Models & Azure AI
- **Service & Purpose:** Connects to GitHub Models via Azure AI Inference (`models.inference.ai.azure.com`, `models.github.ai`) using GitHub tokens.
- **Data Sent & When:** Prompts and conversation history sent when querying GitHub models.
- **Provider:** GitHub, Inc. / Microsoft Corporation
- **Terms & Privacy:** [terms of service](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) | [privacy policy](https://privacy.microsoft.com/privacystatement)

### 10. OpenAI
- **Service & Purpose:** Connects to OpenAI API (`api.openai.com`) for vector embeddings and text completions.
- **Data Sent & When:** Text content, post excerpts, and user prompts sent when generating embeddings or running queries.
- **Provider:** OpenAI, LLC
- **Terms & Privacy:** [terms of use](https://openai.com/policies/terms-of-use/) | [privacy policy](https://openai.com/policies/privacy-policy/)

### 11. Anthropic
- **Service & Purpose:** Connects to Anthropic API (`api.anthropic.com`) for text completions, conversational processing, and AI token tracking when querying Claude models.
- **Data Sent & When:** Prompts, conversation history, and system instructions sent only upon user-initiated AI queries.
- **Provider:** Anthropic PBC
- **Terms & Privacy:** [terms of service](https://www.anthropic.com/legal/commercial-terms) | [privacy policy](https://www.anthropic.com/legal/privacy)

### 12. Google Gemini & AI Studio
- **Service & Purpose:** Connects to Google Generative Language API (`generativelanguage.googleapis.com`, `aistudio.google.com`) for text, multimodal chat, and vector embeddings.
- **Data Sent & When:** Prompts, attached media, and text content sent when generating content or embeddings.
- **Provider:** Google LLC
- **Terms & Privacy:** [terms of service](https://ai.google.dev/gemini-api/terms) / [terms of use](https://policies.google.com/terms) | [privacy policy](https://policies.google.com/privacy)

### 13. Google Translate
- **Service & Purpose:** Connects to Google Translate API (`translate.googleapis.com`) in the WPML integration module for auto-translation.
- **Data Sent & When:** Post titles and content strings sent when the administrator initiates an automated translation action.
- **Provider:** Google LLC
- **Terms & Privacy:** [terms of service](https://policies.google.com/terms) | [privacy policy](https://policies.google.com/privacy)

### 14. Telegram
- **Service & Purpose:** Connects to Telegram Bot API (`api.telegram.org`, `t.me`) for chatbot interactions over Telegram.
- **Data Sent & When:** Webhook callback URLs and outbound messages sent when conversing with Telegram users.
- **Provider:** Telegram FZ-LLC
- **Terms & Privacy:** [terms of service](https://telegram.org/tos) | [privacy policy](https://telegram.org/privacy)

### 15. Meta / WhatsApp Cloud API
- **Service & Purpose:** Connects to Meta Graph API and WhatsApp Business Cloud API (`graph.facebook.com`, `developers.facebook.com`, `business.facebook.com`) for chatbot interactions over WhatsApp.
- **Data Sent & When:** Recipient phone numbers and response text messages sent when responding to WhatsApp inquiries.
- **Provider:** Meta Platforms, Inc.
- **Terms & Privacy:** [terms of service](https://www.facebook.com/legal/terms) | [privacy policy](https://www.facebook.com/privacy/policy/)

### 16. Pollinations AI
- **Service & Purpose:** Connects to Pollinations AI (`image.pollinations.ai`) for generating featured images and artwork from text descriptions.
- **Data Sent & When:** Image generation prompt sent in the URL query string when invoking image generation.
- **Provider:** Pollinations AI
- **Terms & Privacy:** [terms of service](https://pollinations.ai/) | [privacy policy](https://pollinations.ai/)

### 17. WordPress.org Block Pattern Directory
- **Service & Purpose:** Connects to WordPress.org Block Patterns API (`api.wordpress.org`) to search for public block patterns in the Gutenberg assistant ability.
- **Data Sent & When:** Pattern search keywords sent when searching block patterns.
- **Provider:** WordPress.org
- **Terms & Privacy:** [terms of service](https://wordpress.org/about/privacy/) | [privacy policy](https://wordpress.org/about/privacy/)

## 🔒 Security & Remote Execution Boundaries
In strict compliance with WordPress.org security policies:
- **No Remote Administration:** External MCP and OpenAPI integrations only expose content and data abilities (such as querying published posts, catalog lookup, or drafting content). They strictly prohibit remote installation, activation, or modification of plugins/themes, arbitrary code execution, filesystem modifications, or user management.
- **No Arbitrary PHP Execution:** The plugin does not execute arbitrary PHP code, run shell/terminal commands, or alter theme/plugin/core files. All actions use official, sandboxed WordPress APIs.

## 📦 Source Code & Third-Party Libraries
In compliance with WordPress.org Guidelines, the public source code repository, custom scripts, and third-party libraries included in this plugin are documented below:

- **Aiutoma Plugin Source Code Repository:**
  - **Public Repository:** [https://github.com/frafish/aiutoma](https://github.com/frafish/aiutoma)
  - **License:** GPL-3.0-or-later
  - **Native Plugin Scripts & Stylesheets:** All first-party JavaScript files (including [`modules/editor/assets/js/agent.js`](file:///var/www/html/wp-content/plugins/aiutoma/modules/editor/assets/js/agent.js), [`modules/editor/assets/js/inline-prompt-block.js`](file:///var/www/html/wp-content/plugins/aiutoma/modules/editor/assets/js/inline-prompt-block.js), [`modules/editor/assets/js/media-integration.js`](file:///var/www/html/wp-content/plugins/aiutoma/modules/editor/assets/js/media-integration.js), [`modules/playground/assets/js/playground.js`](file:///var/www/html/wp-content/plugins/aiutoma/modules/playground/assets/js/playground.js), [`modules/chatbot/assets/js/chatbot.js`](file:///var/www/html/wp-content/plugins/aiutoma/modules/chatbot/assets/js/chatbot.js), and [`modules/mcp/assets/js/mcp.js`](file:///var/www/html/wp-content/plugins/aiutoma/modules/mcp/assets/js/mcp.js)) and CSS stylesheets are original, uncompiled, human-readable source code written directly in vanilla JavaScript, jQuery, and CSS. They are authored by hand and require no compilation, bundling, or transpilation build steps.

- **AI Request Logs Dashboard:**
  - **Source Project:** Official WordPress AI Plugin ([WordPress/ai](https://github.com/WordPress/ai))
  - **Public Repository:** [https://github.com/WordPress/ai](https://github.com/WordPress/ai)
  - **Public Source Code:** [https://github.com/WordPress/ai/tree/trunk/src/admin/ai-request-logs](https://github.com/WordPress/ai/tree/trunk/src/admin/ai-request-logs)
  - **Local Uncompiled Source:** Included in [`modules/ai/assets/tokens-log/src/`](file:///var/www/html/wp-content/plugins/aiutoma/modules/ai/assets/tokens-log/src/)
  - **License:** GPL-2.0-or-later
  - **Build Tool:** Built with `@wordpress/scripts` (`npx wp-scripts build src/admin/ai-request-logs/index.tsx --output-path=build-scripts/admin`)

- **Select2 (v4.1.0 Stable):**
  - **Public Repository:** [https://github.com/select2/select2](https://github.com/select2/select2)
  - **Public Source Code:** [https://github.com/select2/select2/tree/4.1.0/src](https://github.com/select2/select2/tree/4.1.0/src)
  - **License:** MIT
  - **Build Tool:** Built with Grunt (`npm install && grunt compile`)