Abilities Bridge
| 开发者 | joe12345campbell |
|---|---|
| 更新时间 | 2026年8月15日 04:50 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Making Connections Possible | Now with the Claude 5 family (Opus 5, Sonnet 5, Fable 5) and durable background chat: long AI conversations survive page reloads, closed tabs, and slow hosts
Abilities Bridge connects AI to your WordPress site. Use the built-in admin chat, connect via MCP to Claude Desktop, or integrate with other MCP-compatible applications. Supports both Anthropic (Claude) and OpenAI models.
Key Features
- Admin chat interface for direct AI interaction
- Image attachments in chat — upload images or capture a browser-approved screenshot (can be disabled in settings)
- MCP server for Claude Desktop, ChatGPT, and other MCP clients
- Persistent memory storage across conversations
- Abilities execution with 7-gate permission controls
- Integrated Connected Plugins — discover and approve AI abilities that other plugins register, with per-ability permission controls
- Claude and OpenAI model support
- OAuth 2.0 authentication for MCP connections
- Built-in Chat - API Billing - Uses the Anthropic or OpenAI API key stored on this site and is billed directly by that API provider
- Claude Account Connection - Connect Claude Desktop through MCP and OAuth using your Claude account; it does not use the built-in chat's Anthropic API key
- ChatGPT Account Connection - Connect ChatGPT developer mode through MCP and OAuth using your ChatGPT account; it does not use the built-in chat's OpenAI API key
- Other MCP Clients - Connect Claude Code and compatible apps using the WordPress MCP credentials shown in setup
- WordPress 6.2+, PHP 7.4+
- An Anthropic or OpenAI API key for the built-in chat, or the corresponding Claude/ChatGPT account for an MCP account connection
- HTTPS required for MCP OAuth 2.0 connections
安装:
- Upload the
abilities-bridgefolder to/wp-content/plugins/ - Activate the plugin through the 'Plugins' menu
- Complete the welcome wizard to grant consent
- For built-in chat, enter and save your Anthropic or OpenAI API key in Settings > Built-in Chat. The matching test button sends one short, billable request using the selected model. For an account connection, use Settings > Connect Claude or Connect ChatGPT
- Go to Abilities Bridge > Settings > Connect Claude
- Click "Generate New Claude Connection Credentials"
- Save both Client ID and Client Secret
- In Claude Desktop: Settings > Connectors > Add custom connector
- Enter credentials and MCP endpoint URL from WordPress
- Go to Abilities Bridge > Settings > Connect ChatGPT
- Click "Generate New ChatGPT Connection Credentials"
- Save both Client ID and Client Secret
- In ChatGPT: Settings > Apps > Advanced Settings > Enable developer mode
- Create app, add MCP endpoint URL, choose OAuth, and enter credentials
屏幕截图:
常见问题:
Do I need an API key?
For the built-in chat, yes - an Anthropic or OpenAI API key is required and API usage is billed to that provider account. Connecting Claude uses your Claude account instead and does not use the Anthropic API key. Connecting ChatGPT uses your ChatGPT account with developer mode and does not use the OpenAI API key.
Where do I get an API key?
- Anthropic: https://console.anthropic.com/
- OpenAI: https://platform.openai.com/
Do I need the Abilities API?
Yes. The Abilities API is the official WordPress API for AI. It comes standard with WordPress 6.9 and is also available as a plugin.
Is this safe to use?
All capabilities require explicit consent. Abilities use a 7-gate permission system with rate limits, risk levels, and admin approval. All actions are logged.
What data is sent to external services?
Chat messages, memory contents, and abilities execution requests are sent to your selected AI provider. Data is only sent when you actively use the plugin. No telemetry or usage statistics are collected.
What is the Memory Tool?
An optional feature that lets AI store persistent notes in the WordPress database across conversations. Limited to 1MB per entry, 50MB total. Enable in Settings > Memory.
What are Abilities?
AI-callable WordPress functions (creating posts, managing users, etc.) that must be individually authorized. Each ability is controlled by rate limits, risk levels, and approval requirements.
What is Beacon Campaign Sender?
Beacon Campaign Sender is a separate plugin that connects to Abilities Bridge as an Integrated Connected Plugin. When it is installed and active, it registers its tools with Abilities Bridge and they appear on the Integrations page. Approve them with one click to let AI agents use Beacon's tools, with the same per-ability permission controls as every other ability. Nothing is enabled until you approve it.
更新日志:
1.4.0
- New: durable background chat. Sending a message now runs as a tracked background job on the server instead of one long browser request - slow answers always arrive. Reload the page or close the tab mid-generation and the chat reattaches; come back later and the finished answer is waiting in the conversation
- New: Stop is instant. Stopping a generation immediately frees the conversation so you can ask again right away; a step already running at the provider may still finish (and be billed) - its result is discarded, and the chat says so honestly
- New: live progress while the AI works ("Calling ability: ...", elapsed time), with an explicit run-in-foreground fallback for hosts where background processing is unavailable
- New: Claude 5 models - Opus 5 (recommended default for new users), Sonnet 5, and Fable 5, with previous models available under Legacy; every user's saved model choice is preserved
- New: OpenAI GPT-5.6 Terra (recommended default for new users), Sol (higher quality), and Luna (fastest and cheapest), using provider-native background mode for durable chats; previous OpenAI models remain available under Legacy and every user's saved choice is preserved
- New: if Fable 5's stricter safety system declines an ordinary request, an administrator-enabled setting retries the answer once on Opus 5 and discloses the substitution right in the chat; the setting defaults on and explains that the fallback is a second billable AI request
- Improved: Settings now clearly separate API-billed built-in chat keys from Claude and ChatGPT account connections; the ChatGPT connection diagnostic no longer asks for an unrelated OpenAI API key
- Improved: Built-in Chat now provides matching Anthropic and OpenAI connection-test buttons with selected-model feedback and a clear notice that each test sends one short, billable API request
- New: interrupted OpenAI generations are recovered - the plugin retrieves finished (already billed) results from OpenAI's servers after a worker or connection loss instead of abandoning them
- Improved: abilities that change data are never automatically re-run after a crash or interruption; the chat reports the uncertainty instead of risking a duplicate action
- Improved: gateway timeouts (HTTP 408/504/524) are no longer retried automatically - a retry could submit a second billed generation for an answer that may already exist
- Improved: Claude 5 models get a larger response budget automatically so their internal reasoning cannot truncate visible answers
- Security: OAuth redirect addresses are now validated as exact domain suffixes - look-alike domains (e.g. claude.ai.example.com) are rejected
- Security: the OAuth rate limiter no longer trusts spoofable forwarded-IP headers (sites behind a proxy can opt in via the abilities_bridge_trusted_proxy_header filter), and brute-force lockouts are scoped per client and address so an attacker can no longer lock a legitimate client out
- Fixed: API authentication and rate-limit errors from Claude now show their real message immediately instead of a generic "invalid response" retried four times
- Fixed: two administrators generating MCP credentials at the same time can no longer overwrite or discard each other's one-time secret (per-user storage)
- Fixed: two simultaneous OAuth sign-ins can no longer erase each other's in-flight state (the pending store is now serialized)
- Fixed: if the database cannot grant the OAuth pending-store lock, authorization now stops with a temporary retry message instead of writing without serialization and risking a lost sign-in
- Fixed: uninstalling on a multisite network now removes tables, options, attachments, and scheduled events from every site, not just the main one
- Fixed: uninstall validation now permits both durable chat-job tables to be removed instead of silently leaving them behind
- Fixed: uninstall now clears the correct daily-cleanup scheduled event
- Privacy: the readme now discloses background job metadata stored locally and OpenAI's server-side retention of background-mode responses
- Fixed the one-time display of newly generated MCP client credentials never appearing on sites with a broken or evicting external object cache (e.g. LiteSpeed/Redis/Memcached object caching). The pending credentials are now stored in the database instead of a transient, shown once, then deleted
- Fixed OAuth authorization failing with "Authorization request has expired or is invalid" on the same sites: in-flight authorization requests and consent tokens are now stored in the database instead of transients, so connecting Claude or ChatGPT works even when the host's object cache is broken, restarted, or evicting
- MCP discovery (initialize, tools/list, ping) now requires authentication for every client, the same as running a tool; the unauthenticated pre-OAuth discovery added in 1.3.1 has been removed. This fixes Claude custom connectors (which connect authenticate-first); ChatGPT connects the same way via OAuth
- Unauthenticated MCP requests now return an HTTP 401 with a WWW-Authenticate challenge so MCP clients reliably start the OAuth flow
- MCP discovery (initialize, tools/list, ping) is now available before OAuth so remote app builders such as ChatGPT Apps can discover actions and then authenticate; running a tool still requires authentication
- Ability names are now mapped to MCP-safe tool names and resolved back by lookup, fixing tool calls for abilities whose names contain underscores
- Chat now returns a useful summary of tool results when the AI provider completes a tool action but returns no final text, instead of getting stuck on a "response pending" message
- Simplified the floating chat bubble by removing the in-bubble provider and model selectors
- Replaced browser confirm/alert popups in the admin chat with inline messages and a two-click delete confirmation
- Added chat image attachments — upload images or capture a browser-approved screenshot in the main chat and floating bubble (JPEG/PNG/WebP, up to 3 per message)
- Added an "Enable image attachments" setting to turn the upload and screenshot feature on or off
- Added Claude Opus 4.8 support and relabeled Opus 4.7
- Context-usage warning now scales to the model's context window instead of firing at fixed token counts
- Private attachment storage with server-side validation and authenticated, ownership-checked serving; files are cleaned up on conversation delete and plugin uninstall
- Replaced hardcoded Connected Plugins detection with the documented abilities_bridge_plugin_integrations contract
- Added validation, safe per-callback discovery, disabled integration cards, profile-aware approvals, and partial approval messages
- Added cleanup notice for old beacon-send/* approvals from pre-release Beacon Send integrations
- Breaking change for private/pre-release partner integrations: providers must register themselves through the integration filter
- Added Claude Opus 4.7 model support (most intelligent option)
- Added GPT-5.5 model support (now the default OpenAI option)
- Added Connected Plugins admin page for discovering and approving Abilities Bridge integrations
- Added per-model guidance text in the chat bubble and dashboard
- Conversation lookup, delete, and restore are now scoped to the current user — admins can no longer access other admins' conversations by ID
- OAuth consent now uses request-bound, single-use consent tokens with 5-minute transients
- Memory tool path validator no longer accepts paths sharing the /memories prefix but living outside the namespace (e.g. /memoriesXYZ)
- Default OpenAI model updated from GPT-5.4 to GPT-5.5
- Added WP AI Client credential integration for shared API keys via WordPress Connectors
- Added WP AI Client integration test page
- Added separate settings flows for Anthropic MCP and OpenAI ChatGPT MCP
- Added direct OpenAI ChatGPT MCP flow from built-in WordPress MCP endpoint
- Added floating chat bubble for administrators
- MCP OAuth client storage is now profile-aware
- MCP tools/list now filters visible tools using authenticated permissions
- OpenAI chat integration migrated to the Responses API
- Added GPT-5.4 model support
- Updated default OpenAI model to GPT-5.4
- Added OpenAI as an alternative AI provider
- Added Learn More tab with overview video and resources
- Updated Pro Features tab with Concierge Service and Site Abilities Plugin
- Initial release
- MCP server for WordPress Abilities execution
- Memory tool with database storage
- OAuth 2.0 authentication
- Admin chat interface