Flavors Engine (by FlavorsWP)

वर्डप्रेस के अंदर रिमोट MCP सर्वर: AI क्लाइंट पोस्ट, पेज, मेनू, मीडिया, एलिमेंटर, SEO, एक्सेसिबिलिटी ऑडिट और WooCommerce प्रबंधित करते हैं, जिसमें प्रोडक्शन सेफ मोड और अनडू शामिल है।

wordpress.org पर देखें

दस्तावेज़

Title: Flavors Engine – MCP Server for Claude, ChatGPT & AI Agents, Elementor Addons & Theme Builder Author: flavorswp Published: September 16, 2026 Last modified: October 15, 2026

Search plugins

Flavors Engine – MCP Server for Claude, ChatGPT & AI Agents, Elementor Addons & Theme Builder

By flavorswp

Download

Support

Description

Connect your AI assistant to WordPress and get useful work done. Flavors Engine is a WordPress MCP server for compatible Claude, ChatGPT and other AI-agent setups, plus an Elementor addon with 151 free widgets, including 50 theme-builder widgets. Edit pages, work with Elementor elements, inspect SEO and speed, and handle basic WooCommerce tasks.

Start Free on WordPress.org. Elementor widgets work in the editor; an external MCP client supplies its model. Optional admin Chat needs a supported WordPress AI client and configured provider. No model subscription is included.

What Free includes

  • WordPress posts, pages, terms, menus and media tools, including supported page duplication with builder data.
  • Structured Elementor reading and editing: move, duplicate and reorder elements, and discover widget parameters. Requires Elementor.
  • 151 Elementor widgets, including the 50 dedicated theme-builder widgets. Enable the items you use.
  • Supported header, footer, single, archive, search, 404 and WooCommerce templates with display conditions. Placements depend on template type and installed plugins.
  • Content and HTML accessibility checks; basic per-post SEO titles, descriptions and robots through supported installed providers including Yoast, Rank Math, AIOSEO and SEOPress.
  • Requested PageSpeed inspection: Lighthouse metrics, opportunities and available Core Web Vitals. Public URL/API prerequisites apply; inspection alone does not improve speed.
  • 16 WooCommerce basics tools: inspection, supported product-field edits, simple- product creation, basic coupons and order notes. Requires WooCommerce 9.0+.
  • Supported site-health, recent PHP-error and configured backup-provider information.

Pro adds

Flavors Engine Pro is a separate installed and licensed add-on:

  • 110 additional Elementor widgets and Forms Suite.
  • Resumable plans for pages, templates and navigation. Your connected agent performs the tasks; creating a plan creates no page content.
  • Advanced supported builder, custom-field, SEO, forms, multilingual and WooCommerce integrations, with vendor dependencies.
  • Configured held approvals, working copies, agent memory, bulk SEO, cache fixes, backups and reviewed plugin/theme updates, with prerequisites and recovery limits.

Compare Free and Pro. A licence does not include model access or unlock another FlavorsWP product.

Practical requests

Try: “Move this Elementor testimonial section above the FAQ”; “Update this post’s SEO title”; “Create a draft simple WooCommerce product”; “Inspect this public page with PageSpeed”. These are example prompts, not recorded client executions. Review results before publishing.

Connect and review

Open Flavors Engine > Connect and follow your client’s OAuth or Application Password setup. Compatible transport, authentication, account/plan, plugin dependencies and user permissions determine available tools. Connection guide.

Safety profiles restrict actions; content writes can be allowed. Client confirmation is not independent human approval. Recorded undo has operation-specific snapshot, conflict and recovery limits. Permanent deletions, customer emails and external transactions are not universally reversible.

Optional Cloud service

No Cloud account is required for local MCP. Hosted access remains unverified. Pairing starts only when an administrator chooses Connect and confirms workspace, token scope and safety ceiling. Then hub.flavorswp.com receives site address/name, approved access token, public signing key, WordPress/PHP/plugin versions, safety profile, tool descriptions, pending updates, backup health and compact redacted issues. Signed hourly check-ins and debounced notifications continue while paired. Content and changes are sent for requested tools. PageSpeed may send the public URL to paired Cloud and Google. Private keys remain in WordPress. Disconnect revokes the managed token and stops future check-ins. Cloud allowances and paid Pro runners/updates are separate.

Cloud requirements | Privacy | Terms

External-service recipients, triggers, data, privacy/terms and source/build information follow below.

External Services

This plugin contacts no external service on its own. Every service below is reached only when you act: by pressing a button, by connecting an AI client, or by adding a widget and entering your own API key for it. A default install, with nothing configured, makes no outbound request at all. An explicitly paired Cloud connection continues its signed status and event check-ins until you disconnect it, as described in the optional Cloud service section.

Google Fonts – On the Design screen, when a saved design names a font your browser does not have installed, the preview shows a note explaining that it is not displaying the design’s real fonts, alongside a Preview with Google Fonts button. Pressing that button loads a stylesheet from https://fonts.googleapis.com so the preview can render the font. Nothing is requested until you press it, nothing is requested on your site’s front end, and no data about your site or your visitors is sent – the request contains the font name and, as with any browser request, your IP address and user agent. Google’s terms: https://policies.google.com/terms – Google’s privacy policy: https://policies.google.com/privacy

The WordPress.org plugin directory – The search-extensions and get-extension abilities query https://api.wordpress.org for plugin and theme information, exactly as your WordPress dashboard does. These run only when an AI client you have connected calls them. WordPress.org’s privacy policy: https://wordpress.org/about/privacy/

Openverse – The search-images ability queries https://api.openverse.org for openly licensed photographs, the same catalogue the block editor’s own openly- licensed media search uses. It runs only when an AI client you have connected calls it, the request contains only your search terms and filters, and no account or API key is involved. The ability returns links; it does not download anything. A file is only fetched and added to your Media Library if you then ask for import-media- url, which downloads from whichever URL is passed to it. Openverse is a WordPress. org project. Openverse terms of service: https://docs.openverse.org/terms_of_service. html – Openverse privacy policy: https://openverse.org/privacy

The remaining services are reached only by widgets you place on a page, and only after you enter your own API key or access token for them. None of them is contacted on a default install, because without your credential the request is never made.

Mailchimp – The Mailchimp Form widget sends a subscription to https://<dc>. api.mailchimp.com when a visitor submits the form, where <dc> is the data-centre suffix of your own API key. This one sends visitor data: the email address the visitor typed, and any merge fields your form collects, together with your API key. It runs only on a form you added and configured with your key. Mailchimp’s terms: https:// mailchimp.com/legal/terms/ – Mailchimp’s privacy policy: https://mailchimp.com/legal/ privacy/

YouTube Data API – The YouTube TV widget and the YouTube mode of the Social Feed widget request channel and video listings from https://www.googleapis.com/ youtube/v3/, using a Google API key you supply. The request contains your key and the channel or playlist you configured. Responses are cached, and no visitor data is sent. Google’s terms: https://policies.google.com/terms – Google’s privacy policy: https://policies.google.com/privacy – YouTube API Services terms: https://developers. google.com/youtube/terms/api-services-terms-of-service

The YouTube player (loaded in the visitor’s browser) – A page containing the YouTube TV widget loads YouTube’s iframe player API from https://www.youtube.com/ iframe_api and embeds the player itself from youtube.com. This is the only script this plugin loads from another domain, and it has to be: YouTube’s terms require the player API to be served from their domain rather than bundled. It happens in the visitor’s browser, on pages where you placed the widget, and it gives YouTube the visitor’s IP address and user agent as any embed does – nothing is sent from your server. Google’s terms: https://policies.google.com/terms – privacy policy: https://policies.google.com/privacy – YouTube API Services terms: https://developers. google.com/youtube/terms/api-services-terms-of-service

Instagram – The Instagram mode of the Social Feed widget uses the Instagram API with Instagram Login (Business or Creator accounts). It requests your own recent media from https://graph.instagram.com, using an Instagram access token you supply, and about once a week refreshes that token through https://graph.instagram.com/ refresh_access_token so it does not expire. The requests contain your token and a post count. Responses are cached, and no visitor data is sent. Meta Platform Terms: https://developers.facebook.com/terms – Meta Privacy Policy: https://privacycenter. instagram.com/policy

OpenWeatherMap – The plugin registers a weather proxy endpoint that requests current conditions from https://api.openweathermap.org for a location you configure, using an OpenWeatherMap API key you supply. The widget that uses it is part of Flavors Engine Pro, so on this plugin alone the endpoint exists but nothing calls it; it is listed here because the code ships. Responses are cached and no visitor data is sent. OpenWeatherMap’s terms: https://openweathermap.org/terms – privacy policy: https://openweather.co.uk/privacy-policy

The AI client’s own domain, during sign-in (OAuth Client ID Metadata) – When an AI client connects and identifies itself with an https URL as its client id, the plugin fetches that URL once to read the client’s metadata document (its name, its redirect addresses), caches the result, and uses it to decide whether the sign- in may proceed. The host contacted is therefore the client’s, not ours, and which host that is depends on which client you connect. The request is a plain GET with no body and no data about your site beyond the fact that it was made; redirects are validated one hop at a time and private or loopback addresses are refused. Nothing is fetched until you connect a client that uses this form of identifier. For Claude, that host is claude.ai or claude.com – Anthropic’s terms: https://www.anthropic. com/legal/consumer-terms – privacy policy: https://www.anthropic.com/legal/privacy

Your own site (self-diagnostics, not an external service) – The Troubleshoot screen checks that the MCP endpoint, the OAuth discovery documents and the REST API are reachable by requesting them from your own site’s address, and it sends a handful of AI-client user agents at one of those addresses to detect a hosting bot filter that would block real clients. Every one of these requests goes to your own domain. They are listed here because they are outbound HTTP requests and a reader auditing the code will see them; no third party is involved and no data leaves your server.

AI model providers – No AI model is bundled. An external MCP client supplies its own model access. Optional admin Chat can make model-discovery and generation requests through the WordPress AI Client to the provider/model configured by your administrator. Those requests can include conversation history, system/site context, tool descriptions, requested tool results and attachments included in the conversation. A remote provider therefore receives the requested data; a self-hosted MCP endpoint does not mean Chat generation stays on this server. Review the configured provider plugin’s service disclosures, terms and privacy policy before enabling Chat. Provider credentials and billing are configured separately from this Free plugin.

Data kept on your own site (not an external service) – When Flavors Engine Chat is used, the plugin counts the AI tokens each person used per day (prompt tokens, completion tokens and calls) and keeps that count in the person’s WordPress user meta for 62 days, so the Chat screen can show a usage meter. Nothing about it is sent anywhere, and it is deleted with the plugin’s other data on uninstall.

AI client sign-in addresses (no request is made) – The Connect screen shows the sign-in address of the AI client you choose, and the OAuth flow lists that client’s callback address as an allowed redirect target. For Claude those addresses are on the claude.ai and claude.com domains; other clients have their own. These are destinations your own browser is sent to when you press “connect”, and addresses the plugin checks a returning request against. The plugin itself never opens a connection to any of them, and no data is sent to them by the plugin. They are listed here only because the addresses appear in the code and a reader should know why. Anthropic’s terms: https://www.anthropic.com/legal/consumer-terms – privacy policy: https://www.anthropic. com/legal/privacy

Google PageSpeed Insights – When a connected agent calls pagespeed-check, the plugin sends the requested public page URL and mobile/desktop strategy to Google at https://www.googleapis.com/pagespeedonline/v5/runPagespeed. It uses Site Kit by Google when that plugin is configured and permits the user to read its data, otherwise the optional API key saved by the administrator or Google’s keyless quota. Results are cached for 15 minutes. No checks run on activation or on a schedule. Google terms: https://policies.google.com/terms – privacy: https://policies.google. com/privacy – API terms: https://developers.google.com/terms

Local site error log – Site diagnostics keep a bounded record of PHP fatal errors on this site, including their time, message, source and request path. Credentials and common secret values are redacted. The log is available only through authenticated diagnostics, is never uploaded automatically, and is removed when the plugin’s data- deletion option is used on uninstall.

Source Code

Everything in this plugin is readable source except the third-party libraries listed below, and this section is where to find the source for each compressed file.

This plugin’s own code. All PHP is source. Under assets/, every minified file ships beside the unminified file it was built from (x.min.js next to x.js), and SCRIPT_DEBUG makes WordPress load the readable one. Nine scripts have no separate minified twin because none was ever built: they were inherited as single-line files with no build step, so they ship reformatted in place, and each carries a header saying exactly that. Note that assets/js/library/ is not exclusively third-party: aos, gradient-bg, shape-divider, tabs and list-actions are this plugin’s own code and each ships with its readable source beside the minified file.

The chat interface. includes/assets/chat/index.js is compiled from src/chat/ index.tsx, which ships inside this plugin. Build it with the @wordpress/scripts toolchain that package.json declares:

```
npm install && npm run build:chat
```

Third-party libraries. Each is shipped in the minified form its own project distributes. The readable source for every one is published by that project at the address below, which is also where any modification should be taken from.

Masonry and imagesLoaded are not bundled: the plugin uses the copies WordPress core itself ships and registers. GreenSock (GSAP) is not bundled either – its licence is not GPL-compatible, so the widgets that need it are not part of this plugin.

Server-side PHP dependencies are managed with Composer and declared in composer. json; each carries its own LICENSE file inside vendor/.

Screenshots

[⌊Free MCP server overview with the site's endpoint and active safety profile. Actual plugin UI from a local environment with synthetic demo data; client and ability counts depend on the installation.⌉⌊Free MCP server overview with the site's endpoint and active safety profile. Actual plugin UI from a local environment with synthetic demo data; client and ability counts depend on the installation.⌉[

Free MCP server overview with the site’s endpoint and active safety profile. Actual plugin UI from a local environment with synthetic demo data; client and ability counts depend on the installation.

[⌊Free widget catalogue with 151 available Elementor widgets, per-widget switches and module controls. The theme-builder widgets are included in this total.⌉⌊Free widget catalogue with 151 available Elementor widgets, per-widget switches and module controls. The theme-builder widgets are included in this total.⌉[

Free widget catalogue with 151 available Elementor widgets, per-widget switches and module controls. The theme-builder widgets are included in this total.

[⌊Free Theme Builder with a synthetic draft header created through the actual template ability. The example is inactive and has no display conditions; it is not a published customer site.⌉⌊Free Theme Builder with a synthetic draft header created through the actual template ability. The example is inactive and has no display conditions; it is not a published customer site.⌉[

Free Theme Builder with a synthetic draft header created through the actual template ability. The example is inactive and has no display conditions; it is not a published customer site.

[⌊Free Abilities screen with actual available operations and individual controls. Tools depend on installed plugins, enabled modules, permissions and policy.⌉⌊Free Abilities screen with actual available operations and individual controls. Tools depend on installed plugins, enabled modules, permissions and policy.⌉[

Free Abilities screen with actual available operations and individual controls. Tools depend on installed plugins, enabled modules, permissions and policy.

Installation

  1. Install and activate Flavors Engine.
  2. For the MCP server: open Flavors Engine Connect, leave Production Safe selected, choose your AI client and follow the OAuth or Application Password route.
  3. For the widgets: install Elementor 3.13 or newer, then open any page in the Elementor editor.

The MCP endpoint is:

```
https://example.com/wp-json/mcp/flavors-engine
```

FAQ

What is an MCP server, and why would I want one?

MCP (Model Context Protocol) is the standard AI clients such as Claude, ChatGPT and Cursor use to work with outside tools. With an MCP server on your site, you can ask your AI client to write a page, build a header or tidy up your menus, and it does the work in WordPress instead of giving you code to paste.

How do I connect Claude, ChatGPT or Cursor?

Open Flavors Engine, then Connect. Choose your client and follow the OAuth sign- in, or create an Application Password for clients that cannot open a browser. Your site’s MCP address is shown on that screen.

Is it safe to let an AI edit my site? Can I undo changes?

The default Production Safe profile blocks raw developer operations, and each tool also checks the connected user and site policy. Content writes can be allowed. Recorded undo covers specific operations with snapshot and conflict limits; permanent deletions and external effects are not universally reversible. Pro can hold configured actions for human review.

Are there usage limits or credits?

The local MCP server does not sell AI credits. Your external client or configured Chat provider can have its own fees and limits. Admin Chat records usage counts and can be limited by the configured site policy.

Can I use it with other Elementor addons or Elementor Pro?

They use Elementor’s widget and template APIs. Check your installed Elementor version, required vendor features and other addons on a staging site before relying on a particular combination.

Do I need Elementor?

No. The MCP server is fully functional without it. Elementor is only needed for the widget library and theme builder.

Do I need an API key or a subscription?

This Free plugin needs no paid activation key. AI generation still needs model access through an external client or a configured admin Chat provider. That client/provider may require its own account, API key or paid plan.

Is my content sent anywhere?

Your external MCP client connects to the self-hosted site endpoint and receives the data returned by the requested tools. Optional admin Chat sends generation data to its configured provider through the WordPress AI Client. Optional Cloud pairing has its own disclosed data flow. Review those service settings and consent before use.

Is anything locked behind an upgrade?

The Free package works without a paid licence. Pro is a separate add-on with additional widgets, site plans and advanced integrations; required vendor plugins and AI services are separate. See the Free/Pro comparison above.

Does the Cookie Consent widget support Google Consent Mode?

Yes, Consent Mode v2, and it is off by default. Turn on “Google Consent Mode v2” in the widget’s Google Consent Mode section and the widget sets the analytics, advertising and personalisation consent types to denied before your Google tags run, then sends an update when a visitor accepts, rejects or changes a category. These signals only reach Google tags you have already installed yourself (for example Google Analytics or Google Ads through Site Kit or Tag Manager). The plugin loads no Google script, contacts no Google server and tracks no one.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Flavors Engine – MCP Server for Claude, ChatGPT & AI Agents, Elementor Addons & Theme Builder” is open source software. The following people have contributed to this plugin.

Contributors

“Flavors Engine – MCP Server for Claude, ChatGPT & AI Agents, Elementor Addons & Theme Builder” has been translated into 1 locale. Thank you to the translators for their contributions.

Translate “Flavors Engine – MCP Server for Claude, ChatGPT & AI Agents, Elementor Addons & Theme Builder” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.1.2

  • Fix the public HTTPS MCP connection page and load Design, Skills, Changes and Chat assets on the registered WordPress admin screen.

1.1.1

  • Updated the plugin title and listing with supported Free workflows, practical examples, Free/Pro comparison and connection requirements.
  • Refreshed genuine Free screenshots from a local synthetic WordPress environment.
  • No functional PHP changes beyond release version metadata.

1.1.0

  • New: PageSpeed checks through Site Kit or Google PageSpeed Insights, with an optional administrator API key and cached scores, metrics and opportunities.
  • New: confirmed Site Kit sharing for Administrators, with undo and the plugin’s own permission checks.
  • New: local site issues diagnostics show the PHP error behind a critical error, paused extensions, failed backups and rolled-back safe updates.
  • Fixed: All-in-One WP Migration archives count as successful backups only after their completeness is verified.
  • Fixed: access-token connections allow abilities’ internal REST requests while direct HTTP and batch routes keep their boundary.
  • Fixed: modern MCP tools include read-only and destructive hints, native public abilities appear in compact discovery, and resource abilities are served as resources.
  • New: one safety gate for every way an agent reaches the site. MCP, the REST route, WordPress core’s ability runner and Chat all run the same checks: safety profile, confirmation, rate limit and design gates. Chat used to skip them.
  • New: Changes screen. Every recorded change, newest first, filterable by ability, agent, date and status, with undo for one change, one batch or everything a filter shows, and CSV or JSON export.
  • New: undo a whole agent session. Every write is filed under the connection that made it, and flavors/undo-session takes it all back, newest first, after checking nothing else changed the same content since.
  • New: the change log has its own database table instead of one capped option, keeps 10,000 changes or 90 days, and hides credential-like values and email addresses when a record is read.
  • New: a person can be the one who confirms destructive calls (Settings, Confirmation mode). Off by default.
  • New: access tokens can expire, be limited to chosen abilities, and carry a safety- profile ceiling below the site’s.
  • New: search and replace across posts with a reviewed preview, serialized and builder data kept intact, and per-post undo.
  • New: image editing (resize, crop, rotate, flip), as a new image or in place, with undo.
  • New: accessibility audit against WCAG 2.2, missing alt text finder, and a content audit for broken internal links, orphan pages, thin content and missing descriptions.
  • New: scheduled audits that run daily or weekly on WP-Cron, compare each run with the last and email the administrators you name. Routines screen under Flavors MCP.
  • New: Block Notes for WordPress 7.1, site tools (WP-Cron list, run and delete, Site Health tests, transient cleanup) and multisite tools.
  • New: read-first integrations that register only when the plugin is active: WooCommerce products, orders and customers, plus a safe product edit with undo; per-post SEO title, description and robots for Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework, Slim SEO and SmartCrawl; forms and entries for WPForms, Contact Form 7, Gravity Forms and Forminator with contact details withheld; backup status for UpdraftPlus, Duplicator and BackWPup; security status for Wordfence and Solid Security.
  • New: Elementor page structure: move, duplicate and reorder elements, find elements by widget or text, and read or change page settings. Every Elementor page edit can now be undone from the Changes screen.
  • New: an agent can check its own work: a link to open a page (drafts too) at desktop, tablet and phone widths, and a check of the page as visitors receive it (headings, missing alt text, empty sections, PHP errors).
  • New: block themes: read and change global styles (colours, fonts, spacing), edit templates and template parts such as the header and footer, and list or save patterns. Each change can be undone.
  • New: duplicate a post or page with its builder data, terms and featured image; widget areas on classic themes; upload an image or file the agent already has; and in WooCommerce, create a simple product, a basic coupon or an order note. Covered changes can have undo records; permanent deletion, customer emails and external effects are not universally reversible.
  • New: Connection Doctor names what stops a client connecting (firewall, Cloudflare, ModSecurity, a stripped Authorization header, Application Passwords switched off, OAuth clock skew) and the exact fix.
  • New: MCP server card at /.well-known/mcp/server-card.json, skills as skill:// resources, MCP Tasks for long calls, and a preview card for hosts that render MCP Apps.
  • Changed: client setup for Zed, Cline, Kilo Code, OpenCode, Amazon Q, OpenClaw, Kimi Code, Qwen Code, Factory Droid, GitHub Copilot CLI and others follows each vendor’s current documentation.
  • Fixed: undoing a change to a draft or to a post’s meta could report a mismatch when the post was restored exactly.
  • Fixed: changing the site timezone through an agent accepts UTC offsets (UTC+2) the way Settings, General does.
  • Fixed: with Elementor 4.3 installed and its own MCP setting off, the Flavors Engine MCP endpoint disappeared. It now stays available.
  • Fixed: an AI client could list abilities but not run one when another plugin read the WordPress Abilities registry early in the request, because the MCP Adapter then missed registering get-ability-info and execute-ability. Flavors Engine now registers both when the adapter did not. Reconnect the client, or start a new chat, so it reads the tool list again.
  • Fixed: the approval, OAuth consent and authorize, Block Editor queue and connected apps screens no longer log a PHP deprecation from admin-header.php on every visit.
  • Fixed: Flavors Commerce Intelligence access tokens are left to that plugin to check instead of being refused by Flavors Engine.
  • Fixed: Elementor colour, typography and spacing settings written by an agent over WP-CLI or replayed later were dropped as unknown.
  • Fixed: saving the Elementor kit on the Hello theme no longer unassigns your menus.
  • Fixed: a header or footer template built with an HTML header or footer tag no longer hides itself.
  • Fixed: the theme builder menu stays visible when its mobile toggle is off, the mobile overlay shows its close button, and the toggle has its own colour and alignment controls. The mobile menu dropdown is wide enough for its links.
  • Changed: the Site Title widget renders as a paragraph by default so pages keep a single H1. Pick H1 in the widget if you relied on it.
  • Changed: a template created with an empty condition list stays switched off until you give it conditions.
  • Fixed: the table widget shows its header row and applies row colours to cells.
  • Fixed: importing an image from a URL without a file extension (such as Unsplash) works, and image search reports rate limits clearly.
  • Fixed: the design check ignores WordPress core preset colours and handles large pages.
  • Fixed: parallax, animated gradient and shape divider sections load their scripts on cached pages and on block themes.
  • Fixed: Elementor edits made through abilities show on the front end straight away, and page settings that only carry styles can be written from WP-CLI and cron.
  • Changed: widget schemas for agents are compact by default and always include the options for select controls.
  • Fixed: WooCommerce theme templates (Shop, Single Product, Cart, Checkout, Thank You, My Account) never replaced the store pages. They do now.
  • Fixed: the Template Library screen and its one-click import were never loaded. It is under Flavors Theme Builder.
  • Fixed: a Template Part can be placed with [flavors_ui_template id=N] without any add-on, and the template editor’s Code button copies that shortcode.
  • Fixed: theme templates are kept out of the XML sitemap and search engines, and their URLs show a 404 to visitors who cannot edit them.
  • Fixed: popup display conditions for devices, timing, scroll, exit intent, clicks, inactivity and page views work in the browser, and an agent can set a popup’s trigger, frequency and size through flavors/create-template and flavors/update- template.
  • Fixed: display conditions offered in the template editor match the template type, each is listed once, and the rules that nothing evaluated are gone or now work.
  • Fixed: modern MCP clients see every tool an administrator may use, including media update and delete and the Block Notes tools.
  • Fixed: an ability blocked by the safety profile says which profile blocked it instead of “not found”.
  • Fixed: replaying an OAuth authorization code returns invalid_grant and revokes the tokens issued for it.
  • Fixed: the write rate limit counts parallel calls exactly.
  • Fixed: ability schemas with no inputs are valid JSON Schema in get-ability-info and the REST abilities view.
  • Fixed: widgets from an add-on reappear on their own after the add-on was briefly unavailable.
  • Improved: WooCommerce template widgets load only on the page type their template renders on.
  • Improved: theme builder styles and scripts load only on pages that use a theme template or theme builder widget.
  • Improved: the animation library loads for a widget only when that widget’s own animation setting is on.
  • New: Chat counts the AI tokens each person uses per day and shows a meter. Counts are kept in user meta for 62 days. Parallel requests are counted under a lock so none is lost, and a usage limit set by an extension leaves the chat session usable (HTTP 429) instead of failing it.
  • New: block themes: revert a template or template part to the theme file (needs confirmation, can be undone), change a saved pattern, and list and edit block navigation menus, each with undo. Template lists say whether a theme file exists, and global styles report the keys WordPress did not keep.
  • New: a built-in block-theme skill that teaches agents the Global Styles, template, pattern and navigation abilities.
  • New: per-ability rules on the Abilities screen: always require confirmation, or require a minimum safety profile, for any ability, including one from another plugin. Both only tighten.
  • New: the Design screen shows the active design at the top, in its own colours and fonts, with its contrast, colour, typeface and rule counts.
  • New: design checks report an accent colour that is never used or used too much, type that misses the declared scale or runs far past it, and say which checks ran when no design is active. A purple the design declares is no longer reported as an AI default.
  • New: design tokens read a layout group and expose type sizes, leading, tracking, measure and body weight as CSS variables; the design check warns when no type scale or no line height is declared.
  • New: image search can be narrowed by licence type (commercial use or modification), file type and source.
  • New: Connection Doctor runs from the Diagnostics screen, and the troubleshooter knows the access-token method, including what a 401 on a token means.
  • New: OAuth setup tabs for Mistral Le Chat, Perplexity, Manus, Factory Droid, Kimi Code CLI, Qwen Code, Gemini CLI and ZCode, and access-token snippets for the Claude Messages API and the OpenAI Responses API.
  • New: a copyable prompt for the OAuth and access-token methods that lets an AI coder write the client configuration itself.
  • New: the Overview screen lists recent changes with one-click undo, and the admin bar menu links to Recent changes.
  • New: other MCP servers’ writes (Elementor’s and WooCommerce’s own) go through the same safety checks and are recorded for undo where possible, and Polylang is preferred over WPML’s compatibility layer when both answer.
  • New: hooks for extensions: the rate-limit filter receives the credential, token identities can be admitted to extra REST routes, an extension can mark an access token as managed, ability-rule saves fire an action, and flavors_token_owner() returns a token’s owner.
  • Fixed: undoing a WooCommerce product edit no longer writes old sales counts and review ratings back over the live ones.
  • Fixed: Elementor content written by a user without the unfiltered_html capability is filtered through kses, as Elementor’s own editor does.
  • Fixed: elementor-set-content keeps a Theme Builder template’s type when template_type is omitted, so a rewritten header stays a header. It also returns view and preview links.
  • Fixed: the rendered-page check no longer reports images inside template tags, Elementor containers with a background, font icons, form message areas or CAPTCHA slots as broken or empty, and ignores placeholders inside script templates.
  • Fixed: the Block Editor queue no longer saves empty list items, lets each block’s editor finish its own attributes before saving, and does not autosave in its hidden editor.
  • Fixed: backslashes in a design (Windows paths, regular expressions) survive saving, and a design name with a backslash keeps it.
  • Fixed: the skill editor keeps backslashes in skill bodies, honours the Enabled/ Disabled choice when creating a skill, and its delete buttons act only on skills.
  • Fixed: an Elementor line-height given as a plain number is written as a ratio, not as pixels, and a style list sent where an object was expected is reported instead of failing the request.
  • Fixed: Elementor style helpers that other code calls are available even when Elementor’s global classes are not.
  • Removed: the developer sandbox stylesheet no longer ships in the plugin package.

1.0.2

  • Fixed: Flavors Engine Pro widgets and extensions now load their scripts and styles, and the Animated Counter animates again.
  • Fixed: WooCommerce product grids with the “Featured” source show featured products again.
  • Fixed: quick view, wishlist and compare only work on published, visible products.
  • Security: shared cart, sales notification and search handlers read their settings from the saved widget instead of the request.
  • Declared compatibility with WooCommerce order storage (HPOS) and the Cart and Checkout blocks.
  • Connect screen: setup steps and config files for GitHub Copilot, Devin Desktop( Windsurf), Zed, Cline, Kilo Code, Amazon Q, OpenCode and OpenClaw follow their current documentation, and most of them now sign in with OAuth directly instead of through a bridge.
  • Readme: the theme builder list now shows only the template types you can create today, and links to the documentation.

1.0.1

  • Fixed: Post Masonry showed no posts with the default skin.
  • Fixed: slider and carousel arrows and dots never appeared, and autoplay could not be turned off.
  • Fixed: a malformed cookie could stop pages with the Post Views widget from loading.
  • Fixed: the Cookie Consent centre modal left the page unclickable after a choice.
  • Fixed: dozens of widget settings that had no effect, including accordion multi- open, marquee pause, pricing and bento responsive columns, stats alignment and blend modes on both cursors.
  • Fixed: the OAuth MCP endpoint is registered at the address the Connect screen shows.
  • Security: the MCP endpoint refuses anonymous callers and respects the on/off switch; OAuth tokens are accepted on REST requests only, and read-only grants cannot run write abilities.
  • Security: theme templates now need the Edit Theme Options capability to create, import or preview.
  • Security: hardened HTML tag settings, links and several scripts that built markup from settings.
  • Accessibility: keyboard support, labels, focus rings, pause controls and reduced- motion support across many widgets.
  • Uninstall keeps your data unless you tick “Delete all Flavors Engine data when the plugin is deleted” in the settings.
  • Theme builder: a new single, archive, search or 404 template needs a display condition before it applies, as in Elementor Pro. Templates you already have keep working: the update gives each one without conditions the site-wide condition for its type.
  • New: “Preview Settings” for theme-builder templates, so a single or archive template can be edited with a real post or archive in the preview.
  • New: optional Google Consent Mode v2 signals in the Cookie Consent widget (off by default; loads no Google script).
  • Changed: the Social Feed widget’s Instagram source uses the Instagram API with Instagram Login and refreshes its token automatically. The old Basic Display API was shut down by Meta.
  • Fixed: the OAuth MCP endpoint also speaks the current MCP protocol, and read- only connections only see read tools.

1.0.0

  • First release of Flavors Engine, combining the MCP server and the Elementor widget library into one plugin.
  • Elementor is an optional dependency: the MCP server runs on sites that do not have it.
  • Theme builder with header, footer, single, archive, search, 404, popup, loop item, template part and login templates, plus display conditions. Every non-WooCommerce theme-builder widget ships free; the WooCommerce widgets are in Pro.
  • Elementor content abilities are part of the free plugin: read and write a page’s Elementor document, and add, edit or delete a single element, over MCP.
  • One accent colour and one centred container across every admin screen.
  • Fixed: the closed Mobile Menu dropdown no longer makes pages scroll sideways on phones, and the open dropdown stays on screen.
  • Fixed: Post Meta prints category and tag links as links instead of escaped markup.
  • Fixed: popups use their width, height and animation settings, are announced as dialogs, and return focus to where it was when they close.
  • Fixed: the New Visitor and Returning Visitor popup conditions now filter (decided in the browser from a local visit count; nothing is sent anywhere).
  • Fixed: widget scripts keep the dependencies their widgets declare, and the extension scripts load only on pages whose content uses them.

Meta

Ratings

No reviews have been submitted yet.

Your review

See all reviews

Contributors

Support

Got something to say? Need help?

View support forum