Animeoid Control

Animeoid Control connects your WordPress site to AI assistants that support the Model Context Protocol (MCP), such as ChatGPT and Claude. You approve the connection in WordPress, and the assistant can then help you with your content: write and edit posts and pages, manage media and alt text, categories and tags, menus and widgets, SEO fields and audits, comments, WooCommerce products, and read site health and analytics.

What the assistant cannot do through this plugin, in any mode:

• install, update, activate, deactivate or delete plugins or themes, or update WordPress;
• create, edit or delete users, or change roles and capabilities;
• change login, security, permalink or other critical site settings (only display settings such as the site title, tagline, date format and reading settings);
• write to the database, run scheduled tasks or WordPress Abilities, or call other REST routes;
• save or run code (PHP, JavaScript or CSS);
• create or restore backups.

Those stay with you in WordPress.

This is also enforced inside WordPress, not only by the list of tools: while a request from an AI app runs, WordPress refuses every administrative capability (plugins, themes, updates, file editing, users and roles, unfiltered HTML, network administration) and every change to critical settings, even for an administrator’s connection.

Safety is built in:

• You approve every website. A website joins your Animeoid account only after one of its administrators approves it in WordPress, and you can disconnect it from the Animeoid AI screen at any time.
• You approve risky changes yourself. Permanently deleting content, media, comments, terms or menus waits for you. In Claude and ChatGPT a card in the chat shows exactly what will be deleted, and you tap Approve or No; in other apps, or if you switch chat approval off, you approve on Tools → Animeoid Security. The assistant cannot approve for you.
• Emergency stop. One button pauses all AI access and scheduled AI tasks instantly, without disconnecting anything.
• Audit log. Every change records who made it, through which connection, and what changed.
• Draft-first. Content changes start as drafts or previews, and many changes can be undone.
• No code. Scripts, PHP, inline event handlers and style blocks in anything the assistant saves are refused. Every value WordPress is about to save during an assistant request is checked again after decoding, so encoded scripts are refused too.

Optional autopilots can collect topics from news feeds you choose, prepare forum topics (with wpForo) and draft articles for your review. They are off by default and run in your time zone. Unattended drafting uses the AI provider you set up in WordPress itself (the WordPress AI Client, WordPress 7.0 or later); without one, the connected assistant writes the drafts.

Assistants connect through the Animeoid service (animeoid.fun), so you need a free Animeoid account. The service provides the address your assistant connects to, its sign-in, one address for several websites, and a relay for hosts that block AI apps. The free plan includes 1 website and 500 actions a month. Plans and limits are applied by the service, never by this plugin, and nothing in the plugin is locked.

Integrations

Some tools only work when another plugin is active. The assistant is told clearly when one is missing:

• WooCommerce tools need WooCommerce.
• Forum tools need wpForo.
• Search Console, Analytics and PageSpeed reports need Site Kit by Google.
• Native Breakdance workflows need Breakdance.

External services

This plugin makes no outbound requests until you opt in (see the FAQ). Requests to your own site are not outside services. These are the services it can contact, when, and what it sends:

• Animeoid account service (animeoid.fun) — required for AI connections; contacted only after you approve connecting this website to your Animeoid account (Animeoid AI → Connect with your Animeoid account). It provides the address assistants connect to, their sign-in, routing between your websites and usage limits. AI requests reach your website through this service. The plugin sends your site address and name, the plugin version and tool list, a generated site ID and signed request headers, and the results of assistant requests (the content the assistant asked to read or change); this website then checks the service for new requests. Terms: https://animeoid.fun/control/terms/ — Privacy: https://animeoid.fun/control/privacy/
• The AI provider set up in WordPress — only when you use unattended generation (scheduled autopilot drafts or AI text and image generation without the connected assistant) and an AI provider is configured in WordPress (WordPress AI Client, WordPress 7.0 or later). WordPress sends the prompt and source text to that provider; the plugin itself stores no AI keys. The provider’s own terms and privacy policy apply.
• News feeds and pages you list — the Trends autopilot fetches the RSS feeds and article pages you add on Tools → Autopilots, and the Article Engine reads source pages you or the assistant name. Only a normal page request is sent.
• Google Trends (trends.google.com) — when the Trends autopilot is on, fetches public trending searches for the regions you choose. Sends only the region code. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy
• YouTube (youtube.com) — when an article or trend includes a YouTube video, reads the public video page or oEmbed data to confirm the channel and title. Sends the video address. Terms: https://www.youtube.com/t/terms — Privacy: https://policies.google.com/privacy
• Cloudflare (api.cloudflare.com) — only if you save a Cloudflare zone ID and API token under Tools → Animeoid Advanced. After a content change it asks Cloudflare to purge only the changed page addresses and the home page (the addresses are sent); after menu or theme changes only the home page; the whole zone is purged only when you use the clear cache tool. Terms: https://www.cloudflare.com/terms/ — Privacy: https://www.cloudflare.com/privacypolicy/
• Links and images you ask for — the broken-link checker requests the links in your posts, and media upload from a URL downloads the address given. Requests to private or local network addresses are refused.
• Site Kit by Google — analytics, Search Console and PageSpeed reports are read through the Site Kit plugin’s own connection, under Google’s terms.

Source code

All PHP, CSS and JavaScript in this plugin is human-readable, except assets/mcp-app-sdk.js. That file is the unmodified browser build (app-with-deps) of the MCP Apps SDK, npm package @modelcontextprotocol/ext-apps 1.3.1. Source and build instructions: https://github.com/modelcontextprotocol/ext-apps/tree/v1.3.1 (licence in assets/MCP-APPS-LICENSE).

Animeoid Control’s own code is MIT-licensed (see LICENSE.txt). The bundled PDF reader in vendor/pdfparser is smalot/pdfparser (LGPL-3.0; the LGPL and the GPL-3.0 it supplements are both included). The thumbnail font assets/autopilots/DejaVuSans-Bold.ttf is DejaVu Sans (Bitstream Vera licence, included).