SaadPilot AI Connector

SaadPilot AI Connector runs a Model Context Protocol (MCP) endpoint on your WordPress site. A local administrator approves each AI connection using OAuth authorization code flow with PKCE S256. The connection is limited to a fixed list of content tools and the approving user’s existing content capabilities.

Features:

• Create, read, update and schedule posts and pages; new content is forced to draft by default.
• List and create categories, upload JPEG/PNG/WebP/GIF images and make optimized image copies.
• Edit allowlisted Yoast, Rank Math or generic SEO metadata.
• Review publish readiness, content calendars, internal links, broken links and duplicate content.
• Save up to ten bounded content snapshots in non-autoloaded WordPress database options.
• Emergency pause and disconnect controls in the local WordPress dashboard.
• OAuth scopes, resource binding, expiring access tokens, rotating refresh tokens and local rate protection.
• No vendor account, paid license, vendor quota, relay or telemetry.

The remote tool catalog does not provide site settings, user management, plugin/theme management, cron administration, arbitrary REST/ability execution, source inspection, site-root documents or executable code management. Remote calls run with a request-local content capability ceiling; administrative and unfiltered-HTML capabilities are denied even when the approving user is an administrator or multisite super administrator. Local dashboard settings require manage_options and a WordPress nonce.

Privacy and external requests

There is no SaadPilot vendor service or telemetry. When you authorize an AI client, requested content is returned directly to that client and may be processed by its chosen AI provider. Review that provider’s terms and privacy policy before connecting. OAuth records store the approving user ID, client name, registered callbacks, hashed tokens, scopes and expiration. Rate-protection transients contain salted identifiers.

The broken-link checker makes limited HEAD/GET requests to public links in the selected content only when invoked. These requests disclose your server’s IP address to the destination. Media upload uses supplied bytes and the WordPress media APIs. The plugin does not download executable software.