WindCodex Ops – Safe AI Actions
| 开发者 | windcodex |
|---|---|
| 更新时间 | 2026年10月14日 18:39 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1.3 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- No code execution, ever – the AI can only call the fixed list of tools this plugin ships with. There is no PHP execution, no arbitrary SQL, no shell access anywhere in the codebase.
- Safe on live, customer-facing sites – every tool is tested and scoped to a specific job (update a meta tag, insert a block, resize an image) rather than a general-purpose capability.
- Undo built in – edits and deletes of posts, pages, categories and tags can be rolled back for 72 hours by default (see the FAQ for details).
- Preview before anything irreversible – actions that can't be undone can be set to show a preview first and run only after the AI confirms.
- Works with any MCP-compatible AI platform – Claude, ChatGPT, and any other client that speaks the Model Context Protocol connects the same way, over standard OAuth.
- You control who can connect – only Administrators can connect an AI app by default, and each connection can only do what its approving user could do in the dashboard.
- No license key, no paywall – every tool group in this plugin is free and on by default.
- Content management – posts, pages, categories, tags, revisions, and Gutenberg content blocks (read, insert, remove, and update one in place by position).
- Media and assets – uploads, alt text, compression, format conversion, and usage lookup so the AI can tell you where an image is used before touching it.
- SEO and discoverability – meta tags, focus keyword, canonical URL, Open Graph, and readability tools that auto-detect Yoast SEO, Rank Math, All in One SEO, and SEOPress, so the same tools work correctly no matter which one is active.
- Site structure – menus, navigation blocks, classic widgets, redirects, sitemap status, and read-only permalink structure lookup.
- Site health and diagnostics – status checks, error logs, cron health, database/disk usage, and orphaned-data cleanup.
- Let an AI assistant draft, edit, and publish blog posts and pages without giving it FTP or database access.
- Keep SEO metadata (titles, meta descriptions, Open Graph tags) consistent across every post, regardless of which SEO plugin the site runs.
- Batch-update image alt text and compress media for accessibility and page speed, from a chat interface.
- Clean up broken permalinks, stale redirects, and orphaned post meta without opening the database.
- Monitor site health – error logs, cron status, disk usage – and get a plain-language summary instead of digging through wp-admin screens.
- Insert or update a specific Gutenberg block on a page programmatically, without touching the rest of the content.
- Rewrite and standardize product page titles and meta descriptions ahead of a sale or new collection launch, without opening each product one by one.
- Compress and add missing alt text across a product image gallery in one pass – smaller images load faster on mobile, and alt text is what image search actually indexes.
- Set up a 301 redirect the moment a product is discontinued or its URL changes, so existing links and search rankings don't turn into 404s.
- Find every page and post referencing a specific image before swapping it out for a new banner or seasonal promo graphic.
- Add a limited-time menu item (e.g. a Black Friday or holiday collection link) to site navigation and remove it again afterward, without a developer touching the theme.
- Check sitemap status and crawl-facing site health before a big traffic push, so search engines can actually find the pages being promoted.
- Tool groups are tagged low or medium risk, shown as a badge in Settings > WindCodex Ops > Tools. This is informational, not a gate: every group is on by default, and the label helps you decide which groups to turn off for your site.
- Individual high-risk actions are the ones that can't be undone – permanently deleting media, recompressing an image, deleting a category or tag, or removing a menu item, navigation item or widget. With Require preview before high-risk actions on, these return a preview first and run only when the AI confirms. You can also be emailed whenever one runs.
- Install and activate the plugin.
- Go to Settings > WindCodex Ops and review which tool groups are enabled.
- Copy the Connector URL from the Connection tab and add it to Claude, ChatGPT, or any other MCP-compatible AI platform as a custom connector.
- Authenticate once via OAuth while logged in as an Administrator – most platforms register themselves automatically from the discovery URLs on the Connection tab.
- The AI can now use any enabled tool group against your site. Revoke any connected app at any time from the Connection tab.
- WordPress 6.0 or higher
- PHP 7.4 or higher
- An MCP-compatible AI platform (Claude, ChatGPT, or similar) to connect to
- No WindCodex account, API key, or license required to use this plugin itself – see External services below for what it connects to and why
wp_check_plugin_staleness), when called by your connected AI, looks up each active plugin's last-updated date from https://api.wordpress.org/plugins/info/1.0/{slug}.json to flag plugins that look abandoned. Only the plugin's slug (its folder/file name) is sent – no site data, user data, or content. This call only happens when that specific tool is invoked. See the WordPress.org API's terms (https://wordpress.org/about/privacy/) for how WordPress.org handles requests to its services.
More from WindCodex
Ops is free and fully functional. If you run WooCommerce or manage client sites, see our other plugins at https://windcodex.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=ops
- SiteDocs – AI-written site documentation and client handover
- SwitchUser – switch users safely, with an audit trail
安装:
- Go to Plugins > Add New.
- Search for WindCodex Ops.
- Click Install Now, then Activate.
- Download the plugin ZIP file.
- Upload the
windcodex-opsfolder to/wp-content/plugins/. - Activate through the Plugins screen in WordPress.
- Go to Settings > WindCodex Ops.
- Review which tool groups are on – everything is enabled by default; turn off anything you'd rather a connected AI not touch.
- Copy the Connector URL from the Connection tab and add it to your AI platform as a custom connector.
屏幕截图:
常见问题:
Does this plugin phone home or require an account?
No license key or WindCodex account is required. The plugin does talk to external services in two specific cases – see External services above – but only to the AI platform you explicitly connect over the OAuth connector you set up yourself, and to the WordPress.org API when the plugin-staleness tool is used.
Can the AI run arbitrary code or SQL through this plugin?
No. WindCodex Ops has no code-execution capability of any kind – not client-side, not server-side. The AI can only call the fixed, pre-approved list of tools this plugin exposes.
How does authentication work?
OAuth only. Most platforms register themselves automatically via the discovery URLs shown on the Connection tab. If auto-registration fails, paste the Client ID/Secret from that same tab into the platform's Advanced/OAuth settings instead. The Connection tab lists every app that's ever connected, who it's currently acting as, and lets you revoke any one of them individually.
Who can connect an AI app?
Only Administrators, by default. Anyone else who reaches the consent screen is told their account isn't allowed to connect. To let Editors connect too, change Settings > WindCodex Ops > General > Who can connect. Each connection acts with the permissions of the person who approved it – there is no shared or fallback account – and stops working immediately if that person loses the role or is deleted. An Editor's connection can only do what an Editor can do in the dashboard.
Which AI platforms can connect to WindCodex Ops?
Any platform that supports the Model Context Protocol (MCP) as a client, including Claude and ChatGPT. Connection uses standard OAuth, so most platforms auto-register themselves from the discovery URLs on the Connection tab.
Can I undo a change the AI made?
Yes, for edits and deletes of posts, pages, categories and tags. WindCodex Ops keeps an undo window – 72 hours by default, extendable to 96 or 168 hours under Settings > WindCodex Ops > General > Preferences – so a mistaken edit can be rolled back instead of manually fixed. WordPress has no trash for categories or tags, so undoing a deleted term recreates it from its saved name, slug and description rather than restoring it in place; posts that had it aren't automatically reassigned. "Show activity feed" and "Keep undo history" are separate toggles in the same Preferences screen, so turning off the feed doesn't affect undo.
Will this work with any SEO plugin?
Yes. The SEO tools auto-detect Yoast SEO, Rank Math, All in One SEO, and SEOPress, and read/write the correct plugin-specific meta fields automatically – no manual configuration needed.
Can I turn off specific tool groups?
Yes. Every one of the 5 tool groups can be switched off independently in Settings > WindCodex Ops > Tools, regardless of its risk level. Everything is on by default.
Does this plugin affect site performance?
No. Tools only run when an AI platform actively calls them through the connector; there is no background processing on page loads. The only scheduled task is the optional weekly activity summary email.
What happens to my data if I uninstall the plugin?
By default, all plugin data (settings, connected apps) is left in place in case you reinstall later. If you want everything removed, opt into full cleanup under Settings > WindCodex Ops > General > Data & Privacy before uninstalling.
Is my data sent to WindCodex or any third-party server?
Nothing is ever sent to WindCodex, and this plugin does not collect or sell any data. Data is sent externally only as described in External services above: to the AI platform you've explicitly connected via OAuth (only what an enabled tool returns, only when that platform calls it), and a plugin slug to the WordPress.org API when the plugin-staleness tool is used. Every public, unauthenticated endpoint (OAuth token exchange, dynamic client registration) is rate-limited per IP.
Is there a Pro version?
Yes. WindCodex Ops Pro is coming soon on windcodex.com. It is a separate, standalone plugin that includes everything in Ops plus WooCommerce, users, custom fields, page builders, security and backup, and advanced admin tools. Nothing in this free plugin is locked or limited. When you switch to Pro, your settings carry over automatically.
更新日志:
- New: "Require preview before high-risk actions" now works. Actions that can't be undone – permanently deleting media, recompressing an image, deleting a category or tag, removing a menu item, navigation item or widget – first return a preview and only run when the AI calls again with confirm=true.
- New: "Email me on high-risk actions" now emails the site admin address whenever a high-risk action runs (including confirmed bulk changes), limited to 10 emails an hour.
- New: "Weekly activity summary" now emails a weekly digest of tool calls, changes and high-risk actions. Weeks with no activity are skipped.
- Tweak: clearer descriptions for these settings and for "Show activity feed".
- New: Help menu in the WindCodex Ops settings header, with quick links to the documentation, the support forum, and leaving a review.
- New: "Settings" and "Docs" links on the Plugins screen.
- New: "Who can connect" setting under Settings > WindCodex Ops > General – Administrators only by default, or Editors and above. Only those users can approve an AI connection on the consent screen.
- Security: a connection now stops working as soon as the user who approved it loses that role or is deleted, and every tool call requires it.
- Removed: the "Acting user" setting. Every connection runs as the person who approved it – there is no shared or fallback account.
- Removed: the custom delete confirmation on the Plugins screen (WordPress's standard one is shown instead), the relabelling of this plugin's row on the Enable Abilities for MCP settings screen, and the script that moved other plugins' notices on the WindCodex Ops settings page. Notices now appear above the settings header.
- Initial release: 100+ fixed, tested tools across five groups – content, media, SEO, site structure, and site health.
- OAuth connection for Claude, ChatGPT and other MCP-compatible AI platforms, with per-app revoke.
- Undo window (72, 96 or 168 hours) for posts, pages, categories and tags.
- Separate "Show activity feed" and "Keep undo history" settings.
- Note: WindCodex Ops Pro is coming soon on windcodex.com. It is a separate, standalone plugin that adds WooCommerce, page builders, backup and more. This free plugin stays fully functional and is not limited in any way.