Forms Suite<\/strong> - form builder, submissions, conditional logic, SMTP and payments.<\/li>\n<\/ul>\n\nClaude, ChatGPT, Cursor and Elementor are trademarks of their respective owners. Flavors Engine is not affiliated with or endorsed by them.<\/p>\n\n
External Services<\/h3>\n\n
This plugin contacts no external service on its own. Every service below is reached only when you act: by pressing a button, by connecting an AI client, or by adding a widget and entering your own API key for it. A default install, with nothing configured, makes no outbound request at all.<\/p>\n\n
Google Fonts<\/strong> - On the Design screen, when a saved design names a font your browser does not have installed, the preview shows a note explaining that it is not displaying the design's real fonts, alongside a Preview with Google Fonts<\/strong> button. Pressing that button loads a stylesheet from https:\/\/fonts.googleapis.com<\/code> so the preview can render the font. Nothing is requested until you press it, nothing is requested on your site's front end, and no data about your site or your visitors is sent - the request contains the font name and, as with any browser request, your IP address and user agent. Google's terms: https:\/\/policies.google.com\/terms - Google's privacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\nThe WordPress.org plugin directory<\/strong> - The search-extensions<\/code> and get-extension<\/code> abilities query https:\/\/api.wordpress.org<\/code> for plugin and theme information, exactly as your WordPress dashboard does. These run only when an AI client you have connected calls them. WordPress.org's privacy policy: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\nOpenverse<\/strong> - The search-images<\/code> ability queries https:\/\/api.openverse.org<\/code> for openly licensed photographs, the same catalogue the block editor's own openly-licensed media search uses. It runs only when an AI client you have connected calls it, the request contains only your search terms and filters, and no account or API key is involved. The ability returns links; it does not download anything. A file is only fetched and added to your Media Library if you then ask for import-media-url<\/code>, which downloads from whichever URL is passed to it. Openverse is a WordPress.org project. Openverse terms of service: https:\/\/docs.openverse.org\/terms_of_service.html - Openverse privacy policy: https:\/\/openverse.org\/privacy<\/p>\n\nThe remaining services are reached only by widgets you place on a page, and only after you enter your own API key or access token for them. None of them is contacted on a default install, because without your credential the request is never made.<\/p>\n\n
Mailchimp<\/strong> - The Mailchimp Form widget sends a subscription to https:\/\/<dc>.api.mailchimp.com<\/code> when a visitor submits the form, where <dc><\/code> is the data-centre suffix of your own API key. This one sends visitor data: the email address the visitor typed, and any merge fields your form collects, together with your API key. It runs only on a form you added and configured with your key. Mailchimp's terms: https:\/\/mailchimp.com\/legal\/terms\/ - Mailchimp's privacy policy: https:\/\/mailchimp.com\/legal\/privacy\/<\/p>\n\nYouTube Data API<\/strong> - The YouTube TV widget and the YouTube mode of the Social Feed widget request channel and video listings from https:\/\/www.googleapis.com\/youtube\/v3\/<\/code>, using a Google API key you supply. The request contains your key and the channel or playlist you configured. Responses are cached, and no visitor data is sent. Google's terms: https:\/\/policies.google.com\/terms - Google's privacy policy: https:\/\/policies.google.com\/privacy - YouTube API Services terms: https:\/\/developers.google.com\/youtube\/terms\/api-services-terms-of-service<\/p>\n\nThe YouTube player (loaded in the visitor's browser)<\/strong> - A page containing the YouTube TV widget loads YouTube's iframe player API from https:\/\/www.youtube.com\/iframe_api<\/code> and embeds the player itself from youtube.com. This is the only script this plugin loads from another domain, and it has to be: YouTube's terms require the player API to be served from their domain rather than bundled. It happens in the visitor's browser, on pages where you placed the widget, and it gives YouTube the visitor's IP address and user agent as any embed does - nothing is sent from your server. Google's terms: https:\/\/policies.google.com\/terms - privacy policy: https:\/\/policies.google.com\/privacy - YouTube API Services terms: https:\/\/developers.google.com\/youtube\/terms\/api-services-terms-of-service<\/p>\n\nInstagram<\/strong> - The Instagram mode of the Social Feed widget uses the Instagram API with Instagram Login (Business or Creator accounts). It requests your own recent media from https:\/\/graph.instagram.com<\/code>, using an Instagram access token you supply, and about once a week refreshes that token through https:\/\/graph.instagram.com\/refresh_access_token<\/code> so it does not expire. The requests contain your token and a post count. Responses are cached, and no visitor data is sent. Meta Platform Terms: https:\/\/developers.facebook.com\/terms - Meta Privacy Policy: https:\/\/privacycenter.instagram.com\/policy<\/p>\n\nOpenWeatherMap<\/strong> - The plugin registers a weather proxy endpoint that requests current conditions from https:\/\/api.openweathermap.org<\/code> for a location you configure, using an OpenWeatherMap API key you supply. The widget that uses it is part of Flavors Engine Pro, so on this plugin alone the endpoint exists but nothing calls it; it is listed here because the code ships. Responses are cached and no visitor data is sent. OpenWeatherMap's terms: https:\/\/openweathermap.org\/terms - privacy policy: https:\/\/openweather.co.uk\/privacy-policy<\/p>\n\nThe AI client's own domain, during sign-in (OAuth Client ID Metadata)<\/strong> - When an AI client connects and identifies itself with an https URL as its client id, the plugin fetches that URL once to read the client's metadata document (its name, its redirect addresses), caches the result, and uses it to decide whether the sign-in may proceed. The host contacted is therefore the client's, not ours, and which host that is depends on which client you connect. The request is a plain GET with no body and no data about your site beyond the fact that it was made; redirects are validated one hop at a time and private or loopback addresses are refused. Nothing is fetched until you connect a client that uses this form of identifier. For Claude, that host is claude.ai or claude.com - Anthropic's terms: https:\/\/www.anthropic.com\/legal\/consumer-terms - privacy policy: https:\/\/www.anthropic.com\/legal\/privacy<\/p>\n\nYour own site (self-diagnostics, not an external service)<\/strong> - The Troubleshoot screen checks that the MCP endpoint, the OAuth discovery documents and the REST API are reachable by requesting them from your own site's address, and it sends a handful of AI-client user agents at one of those addresses to detect a hosting bot filter that would block real clients. Every one of these requests goes to your own domain. They are listed here because they are outbound HTTP requests and a reader auditing the code will see them; no third party is involved and no data leaves your server.<\/p>\n\nAI model providers<\/strong> - This plugin bundles no AI model and contacts no model provider. Your MCP client connects directly to your site and brings its own model access; the plugin never sees a provider API key. The MCP endpoint is self-hosted and there is no relay.<\/p>\n\nAI client sign-in addresses (no request is made)<\/strong> - The Connect screen shows the sign-in address of the AI client you choose, and the OAuth flow lists that client's callback address as an allowed redirect target. For Claude those addresses are on the claude.ai and claude.com domains; other clients have their own. These are destinations your own browser is sent to when you press \"connect\", and addresses the plugin checks a returning request against. The plugin itself never opens a connection to any of them, and no data is sent to them by the plugin. They are listed here only because the addresses appear in the code and a reader should know why. Anthropic's terms: https:\/\/www.anthropic.com\/legal\/consumer-terms - privacy policy: https:\/\/www.anthropic.com\/legal\/privacy<\/p>\n\nSource Code<\/h3>\n\n
Everything in this plugin is readable source except the third-party libraries listed below, and this section is where to find the source for each compressed file.<\/p>\n\n
This plugin's own code.<\/strong> All PHP is source. Under assets\/<\/code>, every minified file ships beside the unminified file it was built from (x.min.js<\/code> next to x.js<\/code>), and SCRIPT_DEBUG<\/code> makes WordPress load the readable one. Nine scripts have no separate minified twin because none was ever built: they were inherited as single-line files with no build step, so they ship reformatted in place, and each carries a header saying exactly that. Note that assets\/js\/library\/<\/code> is not exclusively third-party: aos<\/code>, gradient-bg<\/code>, shape-divider<\/code>, tabs<\/code> and list-actions<\/code> are this plugin's own code and each ships with its readable source beside the minified file.<\/p>\n\nThe chat interface.<\/strong> includes\/assets\/chat\/index.js<\/code> is compiled from src\/chat\/index.tsx<\/code>, which ships inside this plugin. Build it with the @wordpress\/scripts<\/code> toolchain that package.json<\/code> declares:<\/p>\n\nnpm install && npm run build:chat\n<\/code><\/pre>\n\nThird-party libraries.<\/strong> Each is shipped in the minified form its own project distributes. The readable source for every one is published by that project at the address below, which is also where any modification should be taken from.<\/p>\n\n\n- Slick Carousel<\/strong> - MIT - https:\/\/github.com\/kenwheeler\/slick (carousel and slider widgets)<\/li>\n
- Prism<\/strong> - MIT - https:\/\/github.com\/PrismJS\/prism (code-highlight widget)<\/li>\n
- Salvattore<\/strong> - MIT - https:\/\/github.com\/rnmp\/salvattore (column layout for the Post Masonry widget). Shipped as a readable adaptation in
assets\/js\/library\/flavor-columns.js<\/code>, credited in its header.<\/li>\nassets\/js\/library\/table.min.js<\/code> is five libraries concatenated and minified, all MIT, listed in the file's own header and here:\n\n\n- DataTables<\/strong> - https:\/\/github.com\/DataTables\/DataTables<\/li>\n
- DataTables Buttons<\/strong> - https:\/\/github.com\/DataTables\/Buttons<\/li>\n
- JSZip<\/strong> - https:\/\/github.com\/Stuk\/jszip<\/li>\n
- pdfmake<\/strong> - https:\/\/github.com\/bpampuch\/pdfmake<\/li>\n
- jquery-csv<\/strong> - https:\/\/github.com\/typeiii\/jquery-csv<\/li>\n<\/ul><\/li>\n
- The Lottie animation widget ships three MIT libraries:\n\n
\n- lottie-web<\/strong> - https:\/\/github.com\/airbnb\/lottie-web<\/li>\n
- lottie-interactivity<\/strong> - https:\/\/github.com\/LottieFiles\/lottie-interactivity<\/li>\n
- lottie-player<\/strong> - https:\/\/github.com\/LottieFiles\/lottie-player<\/li>\n<\/ul><\/li>\n
- Jarallax<\/strong> - MIT - https:\/\/github.com\/nk-o\/jarallax (the parallax background extension;
assets\/js\/library\/parallax-bg.min.js<\/code>)<\/li>\n- Animate.css<\/strong> 4.1.1 - MIT - https:\/\/github.com\/animate-css\/animate.css (entrance animations)<\/li>\n
- AOS<\/strong> (Animate On Scroll) - MIT - https:\/\/github.com\/michalsnik\/aos (scroll-triggered animations; the bundled file is a reduced reimplementation, readable as shipped)<\/li>\n<\/ul>\n\n
Masonry and imagesLoaded are not bundled: the plugin uses the copies WordPress core itself ships and registers. GreenSock (GSAP) is not bundled either - its licence is not GPL-compatible, so the widgets that need it are not part of this plugin.<\/p>\n\n
Server-side PHP dependencies are managed with Composer and declared in composer.json<\/code>; each carries its own LICENSE file inside vendor\/<\/code>.<\/p>\n\n\n\n- Install and activate Flavors Engine.<\/li>\n
- For the MCP server: open Flavors Engine \u2192 Connect<\/strong>, leave Production Safe<\/strong> selected, choose your AI client and follow the OAuth or Application Password route.<\/li>\n
- For the widgets: install Elementor 3.13 or newer, then open any page in the Elementor editor.<\/li>\n<\/ol>\n\n
The MCP endpoint is:<\/p>\n\n
https:\/\/example.com\/wp-json\/mcp\/flavors-engine\n<\/code><\/pre>\n\n\n\nWhat is an MCP server, and why would I want one?<\/h3><\/dt>\nMCP (Model Context Protocol) is the standard AI clients such as Claude, ChatGPT and Cursor use to work with outside tools. With an MCP server on your site, you can ask your AI client to write a page, build a header or tidy up your menus, and it does the work in WordPress instead of giving you code to paste.<\/p><\/dd>\n
How do I connect Claude, ChatGPT or Cursor?<\/h3><\/dt>\nOpen Flavors Engine, then Connect. Choose your client and follow the OAuth sign-in, or create an Application Password for clients that cannot open a browser. Your site's MCP address is shown on that screen.<\/p><\/dd>\n
Is it safe to let an AI edit my site? Can I undo changes?<\/h3><\/dt>\nThe default Production Safe profile blocks raw PHP, filesystem and database access, every call runs with your own WordPress permissions, and supported changes are recorded in a change ledger you can roll back. You can also connect with read-only access or switch individual abilities off.<\/p><\/dd>\n
Are there usage limits or credits?<\/h3><\/dt>\nNo. The server runs on your own site, so there is nothing to meter. Any cost is between you and your AI client.<\/p><\/dd>\n
Can I use it with other Elementor addons or Elementor Pro?<\/h3><\/dt>\nYes. The widgets and theme builder work alongside other addons and alongside Elementor Pro.<\/p><\/dd>\n
Do I need Elementor?<\/h3><\/dt>\nNo. The MCP server is fully functional without it. Elementor is only needed for the widget library and theme builder.<\/p><\/dd>\n
Do I need an API key or a subscription?<\/h3><\/dt>\nNo. The plugin needs no activation key and talks to no licence service. Your MCP client supplies its own model access.<\/p><\/dd>\n
Is my content sent anywhere?<\/h3><\/dt>\nThe MCP endpoint is self-hosted; there is no relay. Your AI client connects directly to your site.<\/p><\/dd>\n
Is anything locked behind an upgrade?<\/h3><\/dt>\nNothing in this download is disabled or greyed out. Flavors Engine Pro is a separate plugin that adds plugin-aware abilities for other page builders, WooCommerce, forms, SEO and custom fields, along with an extra widget pack.<\/p><\/dd>\n
Does the Cookie Consent widget support Google Consent Mode?<\/h3><\/dt>\nYes, Consent Mode v2, and it is off by default. Turn on \"Google Consent Mode v2\" in the widget's Google Consent Mode section and the widget sets the analytics, advertising and personalisation consent types to denied before your Google tags run, then sends an update when a visitor accepts, rejects or changes a category. These signals only reach Google tags you have already installed yourself (for example Google Analytics or Google Ads through Site Kit or Tag Manager). The plugin loads no Google script, contacts no Google server and tracks no one.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.1<\/h4>\n\n\n- Fixed: Post Masonry showed no posts with the default skin.<\/li>\n
- Fixed: slider and carousel arrows and dots never appeared, and autoplay could not be turned off.<\/li>\n
- Fixed: a malformed cookie could stop pages with the Post Views widget from loading.<\/li>\n
- Fixed: the Cookie Consent centre modal left the page unclickable after a choice.<\/li>\n
- Fixed: dozens of widget settings that had no effect, including accordion multi-open, marquee pause, pricing and bento responsive columns, stats alignment and blend modes on both cursors.<\/li>\n
- Fixed: the OAuth MCP endpoint is registered at the address the Connect screen shows.<\/li>\n
- Security: the MCP endpoint refuses anonymous callers and respects the on\/off switch; OAuth tokens are accepted on REST requests only, and read-only grants cannot run write abilities.<\/li>\n
- Security: theme templates now need the Edit Theme Options capability to create, import or preview.<\/li>\n
- Security: hardened HTML tag settings, links and several scripts that built markup from settings.<\/li>\n
- Accessibility: keyboard support, labels, focus rings, pause controls and reduced-motion support across many widgets.<\/li>\n
- Uninstall keeps your data unless you tick \"Delete all Flavors Engine data when the plugin is deleted\" in the settings.<\/li>\n
- Theme builder: a new single, archive, search or 404 template needs a display condition before it applies, as in Elementor Pro. Templates you already have keep working: the update gives each one without conditions the site-wide condition for its type.<\/li>\n
- New: \"Preview Settings\" for theme-builder templates, so a single or archive template can be edited with a real post or archive in the preview.<\/li>\n
- New: optional Google Consent Mode v2 signals in the Cookie Consent widget (off by default; loads no Google script).<\/li>\n
- Changed: the Social Feed widget's Instagram source uses the Instagram API with Instagram Login and refreshes its token automatically. The old Basic Display API was shut down by Meta.<\/li>\n
- Fixed: the OAuth MCP endpoint also speaks the current MCP protocol, and read-only connections only see read tools.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- First release of Flavors Engine, combining the MCP server and the Elementor widget library into one plugin.<\/li>\n
- Elementor is an optional dependency: the MCP server runs on sites that do not have it.<\/li>\n
- Theme builder with header, footer, single, archive, search, 404, popup, loop item, template part and login templates, plus display conditions. Every non-WooCommerce theme-builder widget ships free; the WooCommerce widgets are in Pro.<\/li>\n
- Elementor content abilities are part of the free plugin: read and write a page's Elementor document, and add, edit or delete a single element, over MCP.<\/li>\n
- One accent colour and one centred container across every admin screen.<\/li>\n<\/ul>","raw_excerpt":"Self-hosted MCP server for Claude, ChatGPT and Cursor with safety profiles and undo. Plus 151 Elementor widgets and a free theme builder.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/358639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=358639"}],"author":[{"embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/flavorswp"}],"wp:attachment":[{"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=358639"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=358639"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=358639"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=358639"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=358639"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/kab.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=358639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}