AI Provider for Hugging Face
This plugin registers Hugging Face as an AI provider for the WordPress AI Client introduced in WordPress 7.0. It enables text and image generation through Hugging Face’s Inference API using popular open-source models. Features: Registers Hugging Face on the Settings > Connectors admin screen Supports API key management (environment variable, PHP constant, or database) Text generation via wp_ai_client_prompt() Image generation via wp_ai_client_prompt()->generate_image() Dynamically fetches top 20 popular models from HuggingFace (updated every 12 hours) Multi-provider support — automatically routes to the best available inference provider (hf-inference, fal-ai, replicate, together, nscale, wavespeed) Add custom models from the Settings > Hugging Face admin page Extensible model lists via hugging_face_ai_provider_models and hugging_face_ai_provider_image_models filters Configurable base URL for self-hosted TGI instances Clear, actionable error messages for common API issues Usage: $result = wp_ai_client_prompt( 'Summarize the benefits of caching.' ) ->using_temperature( 0.7 ) ->generate_text(); // Generate an image $image = wp_ai_client_prompt( 'A futuristic WordPress logo in neon colors' ) ->generate_image(); External Services This plugin connects to the Hugging Face Inference API to provide AI-powered text and image generation capabilities within WordPress. The Hugging Face Inference API is a third-party service operated by Hugging Face, Inc. What data is sent and when Your Hugging Face API key is sent with every request for authentication. When fetching the model list, a request is sent to the Hugging Face API to retrieve available models. When generating text, your prompt and any conversation context are sent to the Hugging Face Inference API. When generating images, your text prompt is sent to the Hugging Face Inference API. When resolving inference providers, a request is sent to the Hugging Face API to determine available providers for the selected model. Data is only sent when the plugin is actively used to generate text or images, or when loading the model list on the admin settings page. Service links Hugging Face Website Hugging Face Inference API Documentation Hugging Face Terms of Service Hugging Face Privacy Policy Hugging Face Content Policy All API communication is routed through https://router.huggingface.co and https://huggingface.co/api.
Kagivault
Kagivault is an encrypted vault for the WordPress 7.0 AI Connectors API. Out of the box, WordPress stores the API keys you configure on Settings → Connectors (OpenAI, Anthropic, Google, OpenRouter, and any other AI provider registered with the AI Client) as plaintext rows in the wp_options table. Anyone with database access — backups, leaked dumps, host migration files — can read them. Kagivault wraps each AI Connectors key with XChaCha20-Poly1305 (authenticated encryption) and protects the data-encryption key with a vault password derived through Argon2id. The vault password is never persisted, and the vault automatically re-locks after a short, configurable idle timeout. Unlock from the admin UI, and the WordPress AI client transparently sees the decrypted keys — no other plugin changes required. Highlights Drop-in encryption for every AI Connectors provider (connectors_ai_*_api_key rows) Vault password unlock with idle-timeout auto-lock Recovery key as a parallel unlock path Optional: link a WordPress login password so signing in automatically unlocks the vault Easy-mode initialization — no separate vault password to remember if you just want one-click setup Transparent for the core WP AI client and the Connectors admin page Versioned blob format for future cipher upgrades Requirements WordPress 7.0 or newer (uses the Connectors API introduced in 7.0) PHP 8.3 or newer PHP sodium extension with XChaCha20-Poly1305 AEAD (sodium_crypto_aead_xchacha20poly1305_ietf_encrypt) PHP sodium extension with Argon2id (SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13, requires libsodium 1.0.13+) The bundled sodium extension shipped with PHP 8.3+ on most platforms (Debian/Ubuntu php-sodium, RHEL php-sodium, Alpine php-sodium, Windows official builds) includes both capabilities. The plugin refuses to activate and surfaces a clear admin notice if either is unavailable. Privacy Policy Kagivault does NOT: Send any data to external servers Track users Use cookies for tracking Share data with third parties Kagivault DOES: Process and store encrypted API keys locally on your server (wp_options) Keep the data-encryption key only in a short-lived transient that expires after the configured idle timeout Support For support, bug reports, or feature requests: Website: https://github.com/benridane/kagivault Development Development happens on GitHub. Pull requests welcome! Follow WordPress coding standards All code must pass wp plugin check kagivault
