WEBO MCP vs S2B AI Assistant – ChatBot, Chatbot Inspector, Image Generator

WEBO MCP is a WordPress MCP server — a complete Model Context Protocol gateway for WordPress. It lets AI agents and MCP-compatible clients (Claude Desktop, Cursor, Windsurf, n8n, and more) call well-defined tools over REST using JSON-RPC, instead of scraping the admin or sharing broad credentials. Official WEBO MCP website, documentation, and ecosystem hub: https://webomcp.com Why use WEBO MCP as your WordPress MCP server? Token-optimized unified tools: every domain exposes two abilities — *-query (all reads) and *-mutate (all writes) — with a single action discriminator. tools/list payload is up to 70% smaller than per-operation APIs, which means less of the model’s context window is consumed by tool schemas, lower cost per session, and fewer hallucinated tool names. Primary router endpoint: POST /wp-json/mcp/v1/router Standard MCP-style flow: initialize → tools/list → tools/call Session lifecycle for clients (pass session_id or Mcp-Session-Id after initialize) Built-in tool registry for common WordPress operations (posts, media, terms, menus, options, and more) Bundled Abilities API + MCP Adapter integration, with automatic bridging from registered abilities to MCP tools (configurable) WordPress 7.0/Core-aware bridge mode that uses Core Abilities/API surfaces when available and falls back only when needed Public tool policy controls (category filters and optional allowlists) plus optional internal tool exposure for private environments Bounded MCP audit log, optional per-user/role/client tool allowlists, and a read-only administrator health/status tool Security model (high level) MCP access requires a real WordPress user context: Application Password over HTTP Basic, or an existing logged-in session. Optional site-wide or per-user API key and HMAC can be enabled in Settings as an additional gate (they do not replace WordPress authentication). Generate/rotate from Settings → Security; by default they are skipped for Application Password and Bearer clients unless you enable “Require for App Password / Bearer”. Do not put the normal WEBO API key in URLs. For clients that cannot send headers, create a short-lived scoped mcp_token URL connector token in Settings -> WEBO MCP. Default access expectations for the router and GET /wp-json/webo-mcp/v1/tools: users who are super admins, can manage_options, or can edit_posts, consistent with typical site operator and editor workflows (filterable). Client guidance Always discover tools before calling them: run tools/list, pick an exact tool name from the response, validate required arguments, then call tools/call. This reduces mistakes and keeps automation predictable in production. Further documentation and optional integrations Official website, documentation, and ecosystem notes: https://webomcp.com Optional n8n community node (separate package): https://www.npmjs.com/package/n8n-nodes-webo-mcp Release notes and migration map: see docs/RELEASE_NOTES_2.1.0.md and docs/MIGRATION_GUIDE_2.1.0.md in the GitHub repository Cross-addon dispatcher map (granular legacy names removed from discovery): docs/MCP_TOOL_MIGRATION.md Compatibility note: any MCP-capable client can be used; which large language model runs inside the client is outside this plugin. Standalone core tools included: – Site info – Content (posts/pages): webo/content-query (list, get, find-by-url, search-replace, list-revisions, get-revision; with author/date/taxonomy filters) and webo/content-mutate (create, update, delete, bulk-update-status, restore-revision, change-author) – Users: webo/list-users and webo/user-mutate (add-to-blog, set-role) – Media: webo/media-query (list with search/MIME/post_id filters, get) and webo/media-mutate (upload, update, delete) – Comments: webo/comment-query (list, get) and webo/comment-mutate (create, update, delete) – Taxonomy/Terms: webo/taxonomy-query (discover, list, get) and webo/taxonomy-mutate (create, update, delete) – Nav menus: list menus, list menu items (menu_order, db_id), add menu link from post (explicit post_id + menu_order required) – Plugins: webo/plugin-query (installed, active, updates, …) and webo/plugin-mutate (install, activate, deactivate; supports child-site site_id / blog_id activation for network admins) – Health: webo/health-status (REST/router status, Application Password support, permalinks, cron, object cache, plugin update summary, WordPress/PHP versions, and redacted MCP config) – Client health: webo/client-health-report (score 0–100, grade A–D, Markdown scoreboard for agency clients; hybrid foundation for Pro collectors later) – 404 logs: webo/get-404-logs (read-only Rank Math / Redirection 404 monitor: url, hits, accessed, referrer) – Abilities bridge: webo/ability-query and webo/ability-execute in default layered mode. Only abilities with meta.mcp.public === true are visible and executable through WEBO MCP. – Themes: webo/theme-query (installed themes) and webo/theme-mutate (install from WordPress.org by slug, switch installed theme) – Theme context: webo/theme-context (active theme info, block editor settings, style presets, registered blocks) – Block patterns: webo/block-patterns (list/get patterns, list/get synced patterns) – Site stats: webo/site-stats (overview, post counts, comment counts, user counts, media stats, activity summary) – Activity log: webo/activity-log (list events, summary, clear) – User profile: webo/user-profile (get own profile, update display name / bio / preferences) – Site settings: webo/site-settings (get and update the 20 most common WordPress options via MCP) – Content search: webo/content-search (full-text cross-post-type search with grouped results) – Menus: webo/menu-query, webo/menu-mutate (navigation menu items; not post/CPT list order) – Post/CPT order (optional): webo/reorder-query, webo/reorder-mutate when Webo Reorder is active — see docs/abilities/reorder.md – Options: get/update (safe allowlist only), set site icon/favicon from media – SEO (WordPress post): seo/article-analysis — requires post_id; merges Rank Math meta when available (same data path as webo-rank-math/get-post-seo-meta); optional related-keyword suggestions via outbound request unless no_autocomplete is true Excluded by default in standalone-safe mode: – Bulk/mass execution tools – Plugin/theme write-management abilities – Multisite-specific abilities Privacy This plugin does not phone home or send telemetry. MCP traffic is initiated by clients you configure. Some tools may perform outbound HTTP requests only when a client invokes them (for example seo/article-analysis may request keyword suggestions from a third-party suggest API unless you pass no_autocomplete). The plugin stores the following options in the WordPress database when configured: – webo_mcp_api_key: API key used to authenticate MCP requests. – webo_mcp_hmac_secret: HMAC secret used to sign and validate MCP requests. – webo_mcp_require_secondary_credentials: when enabled, also require API key/HMAC for Application Password and Bearer clients (off by default so standard connectors are not blocked). – webo_mcp_url_connector_tokens: hashed, expirable, revocable URL connector tokens for clients that cannot send headers. Raw tokens are shown once and are not stored. – webo_mcp_tool_allowlist_enabled and webo_mcp_tool_allowlist_rules: optional administrator-configured MCP tool allowlist policy. – webo_mcp_audit_log_enabled, webo_mcp_audit_log_max_entries, and webo_mcp_audit_log: bounded MCP tool-call audit log settings and compact audit events. Audit entries include user/tool/action/status data, anonymized IPs, and hashed session IDs; they do not store request payloads, API keys, HMAC secrets, or Application Passwords. – webo_mcp_installed_at and webo_mcp_review_notice: local timestamps/state for an optional WordPress.org review request notice (not sent off-site; dismissible). These options are removed when the plugin is uninstalled via the WordPress Plugins screen. External services This plugin can connect to Google Suggest (Autocomplete) when a client calls the seo/article-analysis tool and does not set no_autocomplete to true. This external request is used to return related keyword suggestions for SEO analysis. Service provider: Google LLC (Google Suggest / Autocomplete API endpoint). Data sent and when: – Sent only when seo/article-analysis is called with autocomplete enabled. – Sends the analysis query text to https://suggestqueries.google.com/complete/search as the q parameter. – Sends standard HTTP request metadata such as IP address and User-Agent as part of the web request. Terms of Service: https://policies.google.com/terms Privacy Policy: https://policies.google.com/privacy Developer Hooks The plugin exposes the following actions and filters for developers: Actions webo_mcp_register_tools Fired during plugin bootstrap after standalone tools are registered. Use this to register custom MCP tools from other plugins. Filters webo_mcp_current_user_can_use_mcp (bool $allowed, int $user_id) Gate for all MCP REST access. Default: super admin OR manage_options OR edit_posts. Override to tighten (e.g. super-admin only) in hardened installs. webo_mcp_secondary_credentials_exempt (bool $exempt, WP_REST_Request $request) When true, skip optional API key / HMAC after WordPress auth. Default true for Application Password (Basic) and Bearer sessions unless Settings → Security → “Require for App Password / Bearer” is enabled. Return false to always enforce X-WEBO-* headers. webo_mcp_allow_internal_tools (bool $allow_internal, WP_REST_Request $request) Controls whether internal tools are included in tools/list responses. Defaults to false for public environments. webo_mcp_public_categories (array $categories, WP_REST_Request $request, array $tool) Filters which tool categories are exposed as public. Defaults to array( ‘wordpress’ ). webo_mcp_rate_limit_per_hour (int $limit, string $client, array|null $profile) Adjust effective hourly limit (fallback for both buckets). webo_mcp_rate_limit_read_per_hour / webo_mcp_rate_limit_mutate_per_hour (int $limit, string $client, array|null $profile) Per-bucket limits after admin/profile resolution. webo_mcp_tool_is_mutating (bool $is_mutating, string $tool_name, array|null $tool_definition, array $arguments) Override mutating classification for rate limits and read-only profiles. webo_mcp_tool_arguments_allow_extra (bool $allow, string $tool_name, array $schema, array $arguments) When true, unknown tool argument keys are passed through (default false). webo_mcp_disallow_url_token_query (bool $disallowed) Block URL connector tokens in query strings (admin setting is the default source). webo_mcp_rest_bom_guard_json_api_requests (bool $activate, string $uri_raw) Opt-in BOM sanitizer for all /wp-json/ responses (default false; MCP routes only). webo_mcp_bridge_deny_patterns (array $patterns) Controls which abilities are excluded when auto-bridging abilities into MCP tools (e.g. bulk, themes/, multisite/). webo_mcp_auto_bridge_abilities (bool $enabled) Enables or disables automatic bridging of registered abilities into MCP tools. Defaults to true; bridge mode still controls whether the bridge is off, layered, or full. webo_mcp_bridge_mode (string $mode) Controls Abilities bridge mode after the WEBO_MCP_BRIDGE_MODE constant and before the stored option. Values: off, layered, full. Default: layered. webo_mcp_enable_adapter (bool $enabled) Enables or disables the bundled WordPress MCP Adapter runtime. Defaults to true. webo_mcp_validate_media_fetch_url (true|\WP_Error $ok, string $url, array $parsed) Reject unsafe URLs for webo/media-mutate upload action (return WP_Error to block). webo_mcp_tool_allowlist_allowed (bool $allowed, string $tool_name, WP_REST_Request $request, array $params, array $allowed_tools) Filters the optional per-user/role/client allowlist decision. Credits Special thanks to the authors and open source projects that contributed to this plugin: – WordPress (https://wordpress.org) – Abilities API (https://github.com/WordPress/abilities-api) Reference: https://make.wordpress.org/ai/2025/07/17/abilities-api/ – MCP Adapter (https://github.com/WordPress/mcp-adapter) Reference: https://make.wordpress.org/ai/2025/07/17/mcp-adapter/ – Composer (https://getcomposer.org) – Other PHP and JS libraries from the community If you use this plugin, please give credit to the authors of these libraries. License This plugin is licensed under the GPLv2 or later. See https://www.gnu.org/licenses/gpl-2.0.html for details.

Build AI chatbots and automation agents for WordPress without coding. The built-in Chatbot Inspector module helps locate pages containing S2B AI Assistant shortcodes as well as chatbots and shortcode placements from popular third-party chatbot plugins. It can also detect popular widget-based chatbots across your website. Generate images using the OpenAI API. Core Modules 🤖 Chatbots Develop multiple AI chatbots with different styles and behaviors on different pages of your website. You can choose models from different AI API providers: OpenAI, Anthropic, Google Gemini, xAI, Deepseek. Personalize the appearance of each chatbot, including colors, styles and text, as well as its position, window size and behavior by configuring the model, instructions, temperature, token limits and other options. OpenAI Responses API and Knowledge Files S2B AI Assistant supports the OpenAI Responses API, allowing you to create chatbots that can use your own documents as a knowledge source. Upload product documentation, manuals, FAQs, company information or other supported files and let the chatbot search this knowledge when answering visitors’ questions. Each chatbot can have multiple knowledge files and its own independent knowledge base. S2B AI Assistant automatically manages the OpenAI Vector Store and File Search integration, so you do not need to create or configure vector stores manually. The Responses API integration also supports conversation history and model-specific options such as reasoning effort and response verbosity. You can use a regular Responses API chatbot without knowledge files, or add files when you want the chatbot to answer questions using your own content. This provides a modern alternative to the deprecated OpenAI Assistants API for document-based chatbots. Deep Customization feature This allows you to create a unique view for each chatbot using custom CSS rules. To do this, you need to find the ‘Deep customization’ section on the “Chatbots” tab, add the unique HTML ID of the closed and opened chatbot. You can then add CSS rules to each closed and open view of any chatbot. Separate CSS rules can be applied to different chatbots. Chatbot view modifications Use shortcode attributes to change how chatbots are displayed. [s2baia_chatbot view=embedded] — display chatbot directly inside the page without a modal window [s2baia_chatbot view_mode=fullscreen1] — open chatbot in fullscreen mode automatically after page load [s2baia_chatbot view_mode=fullscreen1 hideclose=1] — fullscreen chatbot without close button Available in S2B AI Assistant Pro Restrict chatbot access by user Link chatbot access to WooCommerce products Learn more about restricting chatbot access 🔍 AI Chatbot Inspector Detect chatbots from supported WordPress chatbot plugins and find where they are used across your website. Features Detect supported chatbot plugins Locate pages/posts where chatbot shortcodes are inserted Scan shortcode placements Inspect chatbot integrations across your website Chatbot Statistics Track chatbot engagement directly from your WordPress dashboard. S2B AI Assistant includes a built-in statistics engine that monitors both native S2B chatbots and supported third-party chatbot plugins, giving you a single place to measure chatbot performance. It includes: Chatbot Views Chatbot Opens Open Rate Today, This Week, This Month and All Time statistics Last activity timestamp Supported plugins AI Engine Tidio Buttonizer Chatway LiveChat S2B AI Assistant and more Available in S2B AI Assistant Pro Restrict access to chatbots from supported plugins by user Link third-party chatbot access to WooCommerce products Learn more about chatbot access control 📈 AI Tools Includes three AI-powered SEO agents: SEO Readability Rewrite (HTML only) – Improves clarity while preserving HTML structure. SEO Compare (Post vs URL) – Benchmarks your post/page against an external URL. SEO Compare URLs – Compares two external URLs and generates optimization suggestions. How It Works Each agent runs as a task: * Configure inputs * Content is fetched and analyzed * AI generates a structured SEO report * More detailed information can be found on this page Execution Modes Tasks run either: * Manually, or * In Background (WP-Cron queue) For background processing, WP-Cron must be enabled. If DISABLE_WP_CRON is set to true, queued tasks will not run but you can still run them manually. Available in S2B AI Assistant Pro * Multiple Tasks Per Agent find more 🎨 Image generation Image generation feature requires only API key. It is ready to use by default. You can configure generation options on the Image Generation tab. On the same tab you can generate and store new images using Dall-e-2 and Dall-e-3 models. 🧠 Content-Aware Chatbots (RAG) Build AI chatbots that answer questions using your website content. The plugin supports Retrieval-Augmented Generation (RAG) using external vector databases, Embedding API, and Chat Completion API. Upload selected posts or pages into a vector database to enable semantic search across your website content. When visitors ask questions, the chatbot retrieves relevant content and sends it together with the user query to the AI model. This allows you to: Build website-aware AI chatbots Reduce Chat Completion API costs Limit answers only to your website content Improve response relevance using semantic search Learn more: * Content-aware chatbot * RAG setup guide 🧩 Additional Features Conversation logging Token usage statistics Fullscreen chatbot mode Embedded chatbot view allows you to update models directly from OpenAI and independently choose the model to use from OpenAI API platform https://platform.openai.com/docs/models . You can use the same chatbot with different views across different pages. External Services This plugin uses external API when it performs following functions: -when it runs semantic search it sends requests to vector databases: Pinecone -when it builds vector database from content of your website it sends content selected by you to vector database APIs:Pinecone -when you select delete indexed content then it sends deletion requests to APIs: Pinecone -when clients of your website try to search information then plugin sends user’s request to OpenAI API for build embedding and then sends embedded request to vector database APIs for doing semantic search:Pinecone -when clients of your website try to send request to chatbot plugin sends user’s request to OpenAI API. Also it can send request to vector database APIs for doing semantic search:Pinecone -when clients of your website try to send request to chatbot plugin sends user’s request to xAI API -when you or clients of your website try to generate image then plugin sends request to OpenAI API. By using this plugin, you consent to sending data to OpenAI’s and/or Pinecone’s servers, which may include user queries and other relevant information. Please ensure compliance with xAI, OpenAI’s, DeepSeek & Pinecone terms and any applicable data privacy laws. Service Providers: OpenAI Pinecone xAI DeepSeek Anthropic Google Terms of Use: OpenAI API Terms Pinecone xAI DeepSeek Anthropic Google Privacy Policies: OpenAI Privacy Policy Pinecone xAI DeepSeek Anthropic Google Pinecone vector database The S2B AI Assistant box makes use of the API provided by Pinecone. This plugin does not collect any data from your Pinecone account. The information sent to the Pinecone servers mainly includes the content of your website and the specified context. The usage information displayed in the add-on’s settings is only for your reference. To obtain accurate information about your usage, it is important to check it on the Pinecone website. Additionally, please make sure to review their Privacy Policy and Legal documents for more details. Open AI The S2B AI Assistant makes use of the API provided by [OpenAI](https://openai.com/blog/openai-api or [Reference]https://platform.openai.com/docs/api-reference). This plugin does not collect any data from your OpenAI account apart from the number of tokens used. The information sent to the OpenAI servers mainly includes the content of your article and the specified context. The usage information displayed in the add-on’s settings is only for your reference. To obtain accurate information about your usage, it is important to check it on the OpenAI website. Additionally, please make sure to review their Privacy Policy and Terms of Service for more details. Disclaimer The S2B AI Assistant is a plugin that allows users to integrate their websites with AI services such as OpenAI’s ChatGPT, Claude, xAI’s Grok, DeepSeek and Pinecone vector database https://www.pinecone.io/ . In order to use this plugin, you (user of this plugin) must have own API keys and adhere to the guidelines provided by the chosen AI service. When utilizing the S2B AI Assistant, you (user of this plugin) are required to monitor and oversee the content produced by the AI, as well as handle any potential issues or misuse. The developer of the S2B AI Assistant plugin and other related parties cannot be held responsible for any problems or losses that may arise from the usage of the plugin or the content generated by the AI. Users are advised to consult with a legal expert and comply with the applicable laws in their jurisdiction. OpenAI, ChatGPT, and related marks are registered trademarks of OpenAI. Grok, xAI and related marks are registered trademarks of X.AI LLC. Author of this plugin is not a partner of, endorsed by, affiliated with or sponsored by: OpenAI I, L.L.C.,OpenAI Ireland Ltd , xAI LLC, DeepSeek or Pinecone Systems, Inc. This plugin is intended for users 18 years of age and older. If users under 18 access this plugin, they must do so under direct adult supervision. Parents, guardians, teachers, or other responsible adults should review all AI-generated content before use and ensure it’s appropriate for the intended audience. This plugin generates AI content for informational purposes only. Content generated by this plugin should NOT be used as professional legal, medical, or financial advice without proper review by qualified professionals. Always consult licensed attorneys, medical professionals, or financial advisors for matters requiring professional expertise.