VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok

Open Site Manager > Connection doctor to copy the direct endpoint/configuration, inspect local policy and export a credential-free diagnostic report. The optional reachability check sends one anonymous request to this site's endpoint only; it does not verify client credentials. WordPress cannot observe a client chat's loaded catalog. Refresh tools in the client and start a new conversation when necessary; refreshing a site connection does not add tools or permissions. Under Site Manager > Images and SEO, enable only the required modules. Existing settings and grants retain the prior storage-only SEO behavior. New tool names require exact Local OAuth or native Abilities review. New workflows are not exposed to unversioned relay grants.

• list_media, get_media and set_featured_image use the enabled image module and object capabilities. Featured-image selection requires fresh content_version. Safe Drafts can select an existing image on draft/pending content without editing shared image metadata.
• upload_media_from_url requires a separate reviewed Local OAuth tool selection or native WordPress authentication, upload capability, an editable target/current version and a 16–80 character idempotency key. Intake creates a public Media Library URL even for drafts. It is excluded from Safe Drafts. Administrators approve at most 20 exact HTTPS source hostnames. No redirects, credentials, private/reserved addresses, SVG, GIF or animated intake. JPEG/PNG/static WebP must fit 8 MiB or the lower host upload limit and the 16 MP/memory budget. Dry runs resolve/validate the hostname but perform no HTTP image download or attachment save. Identical retries reuse the attachment; conflicting reuse is rejected. Failed temporary files are cleaned.
• update_media requires explicit shared-metadata and publication settings, WordPress publication/edit capabilities and current media_version. Shared alt/caption/title/description edits can affect live pages. Read Only/Safe Drafts exclude this tool.
• get_seo reports the provider, stored title/description/canonical and seo_version. update_seo requires the current version and changes only supplied fields; empty strings clear them. Preview with dry_run before applying. Draft policies remain enforced; live/private/scheduled edits require publication permission.
• Storage only keeps existing _vwsm_* metadata behavior and makes no effective-output claim. Standalone opts into public singular title/description/canonical rendering and yields to recognized Yoast, Rank Math, AIOSEO, SEOPress or The SEO Framework ownership. It is not a full sitemap/schema/redirection suite. Yoast uses only its fixed native get/update post SEO abilities and vendor permissions; tested with Yoast 28.7. Yoast must have indexables enabled/built; local/staging environments may intentionally disable those abilities. No vendor table writes, provider credential storage or execute-any-ability wrapper is included. Other vendor write adapters remain future work.

No. This plugin does not store or use any AI/SI provider API keys. Your agents or AI/SI apps connect to this plugin. Plugin does NOT connect directly to AI/SI services.

Yes, you can connect agents or applications (i.e. ChatGPT, Claude, Grok Bot) that use your free account or paid subscription from their providers (i.e. OpenAI, Anthropic, xAI).

Use a compatible Streamable HTTP MCP client. Client availability depends on the provider, product version and account. Release 1.3.1 was verified with the official TypeScript MCP SDK 2.3.1, including TLS, discovery, authorization, refresh and revocation. The setup tabs provide guidance for popular clients; this does not guarantee every app version or account tier.

The plugin includes site-owned Local OAuth with explicit scopes and versioned individual tool selection, plus optional Turnkey OAuth and WordPress Application Passwords. Turnkey OAuth uses a compatible Relay & OAuth Server for shared GPT/MCP workflows. Application Passwords use WordPress core HTTP Basic Authentication over HTTPS. Developers can add more authentication flows with the documented hooks.

Version 1.3.1 requires an explicit, versioned selection of individual tools. Existing settings, client registrations and audit data remain, but tokens issued without these permissions require a one-time reconnection. Only selected unchanged tools remain usable; newly added tools, contract changes and expanded publication permission require another review. Token refresh cannot expand access. These per-tool grants apply to included Local OAuth, not native WordPress Application Passwords or the optional relay service.

Read the item with get_content, review its content_version, preview the intended change with dry_run, and pass that version as expected_version when saving through Local OAuth. A stale version returns a conflict instead of overwriting a later edit. Creating content defaults to draft. Responses include a request ID and, where available, an audit log ID. Supported update snapshots can be reverted/reset only if the current owned fields match the expected snapshot and permissions still allow the operation. This is not an undo guarantee for third-party effects or unsupported fields.

Site content, users, settings, client registrations and audit data are retained. Local access/refresh tokens are revoked and a reinstall requires a new permission review. Plugin cleanup jobs are removed. Deactivating the plugin alone does not delete customer data.

Not by default. Creating published content or changing an already live item is blocked unless an administrator enables Allow publish in the plugin settings. The onboarding instructions and GPT/Claude guidance also reflect whether publishing is enabled.

The /logs endpoint is restricted by the log access settings. This is intentional. A dedicated Editor account can still create/edit content, but cannot access operational audit data unless that access is enabled.

Yes, by default plugin REST endpoints (including the OpenAPI and MCP endpoints) require HTTPS. A development-only setting can allow HTTP if needed on a local/dev environment.

External bearer-token validation uses a short cache to reduce remote validation traffic. The cache TTL is configurable in settings (External token cache (seconds)), so revoked tokens are typically rejected after that cache window expires.

Yes. You can create the dedicated user and create the Application Password directly from the onboarding page. A profile link is still provided for later review/revocation.

No CRM ticket-management code is bundled in this free plugin. The free plugin provides generic hooks that let other plugins register their own AI tools. Live Support Tickets is a separate free WordPress.org plugin; if it or another installed plugin registers tools through the documented hooks, those tools are available according to that plugin's own settings and permissions.

Posts and pages by default (both enabled). Free includes explicitly enabled public custom post types in the Content settings tab. Non-public/system types are excluded. Developers can extend tool behavior with hooks such as vwsm_allowed_content_types, vwsm_mcp_extra_tools, vwsm_mcp_dispatch_tool, vwsm_openapi_components, and vwsm_openapi_document.

No. You need to use ChatGPT, Claude, Codex, or another compatible external AI application. This plugin only provides REST endpoints, an MCP endpoint, and onboarding for those external AI applications.

Yes. Once you set up and authorize the connector in Claude.ai on desktop, it is automatically available in the Claude iOS and Android mobile apps — no additional setup is needed.

Consult VideoWhisper for assistance, reports or feature suggestions.

Please report security bugs found in the source code of the plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.