AI Agent

XPAC Agent lets you build your site by chatting with AI. Ask for "a contact form with name, email and message on a new Contact page", and the agent makes the form and the page for you. Attach a screenshot of a design, or paste the address of a page you like, and it builds that page in the same layout, with your theme's fonts.

The agent works through tools. XPAC Agent brings the WordPress ones (pages, images, menus, and the site's name, colours and fonts), and Forms, Popups, Analytics, Notifications, User Profiles and the XPAC add-ons each bring their own. Those plugins' tools stay switched off until XPAC Agent is installed and active. XPAC Agent also adds the switches, the chat under XPAC → AI Agent, an Undo for each change, a log of every change AI made, and one MCP server that AI apps such as Claude Code, Claude Desktop, Cursor and VS Code can connect to.

Requirements

XPAC Agent needs PHP 8.0 or later. Only administrators can open XPAC → AI Agent.

The chat talks to AI through WordPress's own AI client. Connect a provider, such as OpenAI, Anthropic or Google, under Settings → Connectors. AI apps connected over MCP bring their own AI, so they do not need a provider on your site.

Connect an AI app makes an application password, which WordPress offers only on sites served over HTTPS, apart from local development sites.

Set it up

The screens

Everything is under XPAC → AI Agent. The sidebar lists Chat and Activity under Agent, and Tools and Connection under Configuration.

On the Tools screen, each tab lists its tools under Reads, Creates and Changes. Under each switch it says what the tool does, and either Runs without asking. or Asks you first unless the call is harmless.: such a tool waits for your Allow in the chat when a call would change something visitors see, cost money or send something off your site (see What waits for Allow). Turn all on and Turn all off switch a whole tab, and a tab with some tools off shows how many are on, such as 6/8. While the master switch is off, the tabs are hidden and no XPAC tool exists for any AI, in the chat or over MCP.

When the agent runs several tools in a row, the chat folds them into one line, such as 5 actions, with the links they made below it. Click the line to list the calls, and a call's arrow to see what it was given and what it returned. A run with a failed or declined action opens by itself. A finished action that can still be taken back shows Undo (see Undo).

While the agent works, a line under the conversation shows which step it is on and for how long, and the Send button turns into a stop button (Stop after this step), which stops the agent once the current step ends. By default, one message can lead to twelve steps at most. When the agent reaches that, it stops and says so; click Continue to let it go on.

A message can be up to 20,000 characters. Over the last 500, the box counts down how many are left.

Ready-made requests

A new chat asks What should we build? and offers ready-made requests. Each one comes from XPAC Agent or an active XPAC plugin and shows only while every switch it needs is on. The chat shows the first six that can run, in the order below. Clicking one fills in the message box for you to finish; nothing is sent until you send it. A request that needs one more thing from you, such as the address of the page to recreate, leaves the cursor where you type it. Clicking Build a landing page from a screenshot also opens the file picker, so you can attach the design straight away.

AI apps connected over MCP get every request whose switches are on, including the ones past the sixth, as ready-made prompts (see What an AI app gets).

Attach images

Show the agent what you mean: a screenshot of a design to rebuild, a logo, a photo of a sketch on paper.

• Click Attach images under the message box, paste a screenshot with Ctrl+V (⌘+V on a Mac), or drop image files anywhere on the chat.
• A message can hold up to four images: PNG, JPEG, WebP or GIF, each up to 10 MB and 40 megapixels. When your server's upload limit is lower than 10 MB, that limit counts. A message can be images alone.
• An image longer than 2048 pixels on its long side is scaled down first.
• Click an image in the conversation to see it larger.
• The model has to be one that reads images. Automatic picks one for you. If the model you picked cannot, a note beside the images says so, with Use Automatic.
• Each step shows the model the images of your latest two messages that have any. Older ones are left out to keep each step small; attach an image again if the agent needs it later.

Your images are not added to the media library. They are kept privately in your site's uploads folder, only you can open them, and deleting the conversation deletes them. When you ask the agent to put an image on a page, it adds a copy to the media library then, once.

What the agent can do

The tools you get depend on which XPAC plugins are active. The switch labels below are the ones on the Tools screen.

WordPress

These come with XPAC Agent itself, whatever else is active:

This is how you build a page from a picture or another site:

• From a screenshot or a sketch: attach the image to your message and ask, for example, "build this as a new page". The agent matches its layout, colours and words rather than pasting the screenshot in. To put a photo on the page, attach it and say where it goes.
• From a web address: paste the address and ask for a page like it. The agent reads the page first, then builds your own version with your theme's colours. Write your own words for anything you publish; do not copy someone else's content.

New pages are drafts until you ask for them to be published. If someone edits a page in the editor while the agent is working on it, the agent reads it again rather than writing over their change. A chat image or web image is added to the media library only once, however many times the agent uses it.

The agent reads only public web pages. It cannot open addresses on your own network, such as localhost or 192.168.x.x, or pages behind a login.

FAQs, videos, galleries and social links

• FAQs: a question that opens to show its answer. Several can share a group, so only one is open at a time.
• Videos: YouTube and Vimeo only. When you give the address of a player, or paste a video's embed code, the agent uses the video's own page instead, because that is the address WordPress turns into a player.
• Galleries: a grid of images, from one to eight columns.
• Social links: an icon for each of your profiles. The agent picks the network from the address; one it does not recognise gets a plain link icon.

The site's name, logo, menus, colours and fonts

Before it changes these, the agent reads where they really show on your theme. Some themes draw their own header, footer or logo in their code, or show a pattern of their own on the front page instead of the page you set. The agent tells you when that is so, for example "The theme draws its own logo; a logo set here shows nowhere." It cannot change a part the theme writes in its own code; that is changed in the theme.

• Title and tagline take up to 200 and 300 characters. The icon must be a square image. The front page and posts page must be different published pages.
• Menus work on block themes. On a classic theme, the agent points you to Appearance → Menus. The agent reads a menu before it replaces it, so it never writes over a change it has not seen, and each change leaves a revision. A menu holds up to 100 items.
• Log in / Log out in a menu: ask for it, and the agent adds WordPress's own Log in/out block, which shows Log in to visitors and Log out to people who are signed in. With User Profiles and a published login page, Log in opens that page and brings the visitor back afterwards. It goes at the top level of a menu, not in a submenu. Put it last: WordPress draws it outside the menu's list of links, so anywhere else it splits that list in two. A search box, page list, site title, site logo, home link or icon can be added to a menu the same way; a submenu holds only links, submenus and page lists.
• Colours and fonts: the agent changes palette colours, and the colours of the background, text, headings and links, and the fonts of text and headings, from the fonts your theme offers. It does not install new fonts. Everything else in your site's styles, custom CSS included, is kept, and the Site Editor keeps a revision.

These three changes always wait for Allow in the chat, because they show on every page at once. A page cache can keep showing the old title or menu until it is cleared.

Generated images

Generate images needs WordPress 7.0 and a connected provider with a model that makes images.

• Each image is billed by your provider, so in the chat it always waits for Allow. The agent is told to make one only when you ask for a new picture, and to use images you already have otherwise.
• When you ask again with the same words in the same shape, the agent reuses the image it made the first time, and nothing is billed. Letter case and spaces around the words do not count.
• Images are square unless you ask for landscape or portrait.
• Only administrators can generate images, in the chat and from AI apps.

Forms

With Forms active:

A new page the agent makes stays a draft unless you ask for it to be published. A new form is different: it is published straight away unless you ask for a draft. It still shows nowhere until it is on a published page.

• A form in the trash comes back from the Trash under Forms, or when you ask the agent to change its status.
• Submissions are read sparingly. Every answer the agent reads is sent to your AI provider. So it reads 10 submissions at a time unless it asks for more, and 50 at most. An answer longer than 500 characters is cut, and says so. The agent can ask for only the fields it needs.
• A hidden field keeps its value. It always sends the value saved in the form. A visitor cannot change it, and a submit link cannot set it. So a notification sent to an address in a hidden field always goes where the form says.

With Multi-Step Form active, the agent can also split a form into steps.

Popups

With Popups active:

A new popup is saved as a draft unless you ask for it to be published.

• Size: a lightbox opens small, medium, large, or at your theme's content width, which is the default. A floating bar is always full width.
• Buttons are filled, or outline for a quieter one such as "No thanks".
• Scrolling: a rule can open the popup once a visitor scrolls past a point, or when a visitor who was past it scrolls back up.
• Closing: a rule sets whether the popup has a close button, closes with Escape, and, for a lightbox, closes on a click outside it. Escape can be turned off only while the popup has a close button or a button that closes it, so a keyboard can always close it.
• Reading a popup back gives every part of its content with all its settings, so what the agent sends back unchanged stays the same.
• Moving a popup to the trash names the published pages whose button for it visitors stop seeing. It can be restored under XPAC → Popups, with its display rules.

Notifications

With Notifications active:

• A type's switches come back. Changing a type runs straight away, and its action shows Undo, which puts the switches back as they were.
• A template change waits. The subject, on-site text or icon it replaces is not kept, so the agent asks you first, every time. The email body is read, never changed: edit it under XPAC → Notifications → Templates.
• A retry waits. It emails users again, so the agent asks you first.
• A test goes to you. The test email goes to the administrator in the chat, as the type's template reads now.
• The preferences page is a draft. Once it is published, every notification email links to it, or to the first published page that already holds the block.

Analytics

With Analytics active, four tools read your site's own traffic. They only read, so they never wait for Allow, and only administrators can use them.

The agent reads the last 30 days unless you ask for another period, and can compare it with the period before or the same period a year earlier. A range of your own can cover up to 365 days. The figures are your site's own record, in its time zone. Daily visitors count a person once per day, there is no country or returning-visitor data, and a rate that cannot be worked out is reported as not known, never as zero.

Login

With User Profiles active, the Login tab lets the agent build your site's own sign-in, sign-up, password and profile pages, and set them up on User Profiles → Forms:

• A whole sign-in flow in one step. Build sign-in pages makes whichever of Sign in, Create account, Forgot password, Reset password, Verify your email and My account you ask for. They stay drafts, and nothing site-wide changes, until you agree to publish them; then each becomes the form and page its row on User Profiles → Forms uses. The agent reads your setup first and reuses the pages you already picked; it builds a new one in place of one only when you ask it to.
• Set up like Create. Asked to set a form up for its task, Build an auth form makes the form and its page the way Create on User Profiles → Forms does, and Set a form's auth action makes a form the one its task uses. Without that, they build or change the form only, as before. Update password has a form and no page: put its form on your account page.
• Forms come ready. A login form asks for an email, a username or either, and a password. A registration form asks for an email, a password checked for strength and its confirmation, any of username, names, display name, nickname, website and bio, and a consent box if you want one. On a profile form only the fields a user fills in change; a new email address takes effect once its owner confirms it by mail, and a new password needs the current one. Profile fields you name go into the form too.
• Pages built together work together. Built with a My account page, the login form, and a registration form that signs new users in, send them there. Built with a Verify your email page, the registration form asks new accounts to confirm their address and the login form lets only confirmed accounts in, unless you say otherwise.
• Roles. The agent gives new accounts only a role you may give yourself that carries no admin powers, such as Subscriber, Contributor or Author. It never gives Administrator or Editor, or any role with powers like theirs, even when you ask, never makes one the role new accounts get, and will not open registration while that role is one. A sign-up form never gives such a role anyway (see Role safety). The agent never puts a role on a profile form, since every user who saves it would get it.
• Who can do what. Change the sign-in settings, and publishing the pages, need someone who may set up sign-in, an administrator by default. Anyone can register and the default role need an administrator. A registration form needs an account that can add users.
• The reset and verification pages need their form first. The links in password and verification emails land on those pages, so the agent picks one only once it holds its published form.
• Access settings. Change the sign-in settings also sets the Access group on User Profiles → Forms: signed-in only pages and post types, verified accounts for them, onboarding pages in order, mandatory onboarding, keeping users out of wp-admin and where users go after confirming their email. It will not make a sign-in page signed-in only or an onboarding page, since signed-out visitors could no longer reach it.
• Mistakes are refused, not saved. The agent cannot match an account detail to a field the form does not have, put a password anywhere but a password field, or leave out what the task needs, such as the email on a registration form. It will not switch off the form a task uses; another form for the same task can be switched off. Read the sign-in setup lists what is broken.
• Check the pages in a private window. Signed in, the login and registration pages send you to your account page, and the reset page shows Not Found to anyone who did not open it from a reset email's link.
• Sign-in buttons. Asked for them, the agent adds them to the login and registration forms it builds. Visitors see a button once its provider is set up.

Social Login

With User Profiles active, the Social Login tab lets the agent set up sign-in providers, put their buttons into forms and choose what a provider sign-up fills:

• Secrets go in and never come back. The agent can save a provider's client secret or private key you paste, but never reads one back: results say only whether one is saved. Client IDs show.
• The form needs its sign-in task first. Sign-in buttons work only in a form that signs people up or in. Give the form its task with Set a form's auth action first.
• Asking twice changes nothing. A form that already has a provider's button keeps it as it is; only the missing buttons are added.
• Who can do what. Everything but adding buttons needs someone who may set up sign-in, an administrator by default. Add sign-in buttons to a form needs Forms, and someone who can edit forms.

User profiles

With User Profiles active, the User Profiles tab lets the agent shape the profile fields your users fill in and the field sets that group them, and look after users:

• Passwords never. No tool reads, sets or returns a password.
• The admin's email is locked. The agent does not change an administrator's Email Address.
• The same locks as the screen. A field's key never changes. The five built-in fields (first name, last name, nickname, email and password) stay in the Account set and cannot be deleted, and a field's type changes only before anyone answers it.
• A new field shows nowhere yet. It reaches users once a form holds it.
• Who can do what. Every tool needs an administrator, or whoever xpac_user_profiles_capability lets manage users and profile fields. Changing a user also needs the right to edit that user.

Connect forms to integrations

With at least one integration add-on active, four more switches appear in the Forms group: See the integrations, Browse where an integration can send, Connect forms to integrations and Disconnect forms from integrations.

The agent can then check which integrations are ready, look up where each one can send (a list, an audience, a table and its fields), and connect a form to it with its fields matched up. It can also make a connection send only when the answers meet your conditions.

This works with Airtable, Brevo, Campaign Monitor, GetResponse, Klaviyo, Mailchimp, SendGrid, TouchBasePro, Webhooks, Zapier, Zoho Campaigns and Submission To Post.

The agent never sees or enters an account's API key. Connect each account in its own settings first. When one is not ready, the agent tells you what is missing and where to set it. It never takes a webhook signing secret either, and the chat shows Webhooks and Zapier addresses partly hidden, because they work like passwords.

Spam protection

With Akismet, Cloudflare Turnstile or Google reCAPTCHA active, the agent can switch each one on or off for a form when it creates or changes the form. It can switch one on only after you have set that add-on up; if you have not, it tells you what is missing.

Submit links

With Forms Auto Submit active, the Make submit links switch appears. The agent can then make a link that submits a form with preset answers when someone opens it. Each link works once, until it expires: one hour by default, anywhere from five minutes to seven days.

The form must be published, with Auto Submit turned on. The agent can switch Auto Submit on for the form when it creates or changes it. A link leaves out confirmation fields, which are filled in from the field they confirm, and a form with a required consent box gets no link. Read the Auto Submit warnings before sending links: email scanners can open a link before the person does.

Conditional fields

The agent can show, hide or disable a field depending on another field's answer, such as "show Company only when Account type is Business". A field can have up to 20 conditions, matched all together or any one of them. The agent can also remove a field's conditions.

What waits for Allow

In the chat, anything that only reads your site, or makes something new that visitors cannot see yet, runs straight away. Anything that changes what visitors see or other services get, that removes or trashes something, that costs money, or that could send your data off the site, waits. A change to a draft page or post runs straight away. Most changes to forms and popups wait even on a draft (see the table). The chat shows a card with the full input the tool will get, and nothing happens until you click Allow. Decline tells the agent no.

Why these wait:

• A published form or popup is live. A change shows to visitors at once, and a new connection sends the next visitor's answers to another service. A draft is not live, so adding a field, a connection or a new display rule to a draft runs straight away. Other changes to a form or popup still wait. A scheduled form counts as published, because it goes live on its date without anyone being asked again.
• An existing page may be live. Adding to it, or publishing a new one, changes what visitors see.
• The site's name, menus, colours and fonts show on every page.
• Sign-in settings and roles decide who gets in. Publishing sign-in pages, opening registration or giving new accounts a role changes who can make an account on your site and what that account can do.
• Some settings send things off your site. A notification to an outside address, a redirect to another site, or a connection to an outside web address sends visitors or their answers elsewhere.
• A web address can carry your data out. A page the agent reads could tell it to open an address with what the conversation holds written into it, such as submissions it just read. Opening that address alone would send them. So a web address runs straight away only when it came from you or from something the agent read.
• Images cost money. Your provider bills each one.
• A retry emails users again, and a template change keeps no copy of the subject, on-site text or icon it replaces.
• Moving to the trash and undoing change what is already there.

How the cards work:

• When several actions wait, Allow all and Decline all answer them together.
• Once one action in a reply waits, every later action in that reply waits too, because your answer to the first can change what the others mean.
• Sending a new message declines whatever is waiting.
• If the agent was interrupted mid-step, a card can say an action may already have run. Check the result before allowing it again.

Undo

Every change the agent makes, in the chat or from an AI app connected to the MCP address, keeps a copy of what it replaced for 7 days, so you can take it back.

In the chat, a finished action whose change can still be taken back shows Undo after its links. Click it and the change is put back. The action stays in the conversation, greyed out and marked Undone, and a run of actions counts them, such as 2 undone. Undo does not ask the AI or start a new step; the agent is only told that you undid the change. While an undo runs, the rest of the conversation waits for it. A message you were typing stays in the box.

Your own Undo buttons in the chat work whether or not Undo agent changes is on, and even while Let AI agents use XPAC tools is off.

Undo takes back:

• Pages and posts: content, title, excerpt, status, slug, parent page, order, page template, featured image, categories and tags. A page moved to the trash comes back out of it.
• Forms: fields, title, status, settings and integration connections. A form moved to the trash comes back.
• Popups: content, title, status, size and display rules.
• Anything the change created, such as a page, form, popup or menu: it goes to the trash.
• The site's settings: title, tagline, logo, icon, front page and posts page.
• The sign-in settings: the pages on User Profiles → Forms, email verification, the Access settings, Anyone can register and the role new accounts get, and which form each task uses. Pages the change published go back to drafts, and when it built sign-in pages, one Undo takes back the pages, their forms and the settings together.
• Users: the profile values a change saved. A removed photo cannot come back, and the action says so.
• Social Login: the provider switches and keys, and the sign-up data.
• Notifications: a type's on-site and email switches.
• Profile fields and field sets: a field's label, type, help text, choices, rules and field set; a trashed field comes back. A field set gets its name, description and place back, a deleted one is made again, and a new one is deleted while it holds no fields.
• The site's colours and fonts.
• Menus.
• Images the change added to the media library: they are deleted, unless a page or post shows the image, it is a featured image, or it is the site's logo or icon. Then it is kept, and a note under the action says so.

What undo leaves alone:

• A category or tag the change created stays. The page's categories and tags are put back as they were.
• A change whose copy would be larger than 2 MB, or could not be stored, keeps nothing and shows no Undo. While Undo agent changes is on, the action's details say why: "This change cannot be undone: what it replaced was too large to keep." or "This change cannot be undone: what it replaced could not be stored."
• A failed action keeps nothing.
• An undo is not recorded itself, so there is no redo.

When undo says no:

• Something changed since. If you, another administrator or the editor changed the page, form or setting after the agent did, the action says what would be lost, such as "Page "About us" changed after this edit; undoing puts back the version before it and the later changes are lost." Click Undo anyway to put back the version from before the agent's change, or Keep.
• A later agent change comes first. When the agent changed the same thing again later, Undo stays off and says Undo the later change first. Undo the later one, then this one.
• After 7 days the action no longer shows Undo, and an AI app is told "This change is too old to undo."
• The plugin that made the change is not active. A change a plugin keeps in its own place, such as a popup's display rules, needs that plugin to take it back. The action says "The plugin that made this change is not active, so it cannot be undone." Activate the plugin again, then click Undo.
• Only part of it came back. When some of a change can be put back and some cannot, the action says "Only part of this change could be undone." Check what it touched, and fix the rest by hand.
• Only the person who made the change can undo it. Deleting a conversation, or the user who made it, removes its undo copies too.

AI apps undo in their own way. While Undo agent changes is on, each change an app makes comes back with an undo token and the time it expires. Ask the app to take the change back, and it hands that token to Undo agent changes. The same rules apply, and the app is told to use it only when you ask. In the chat, the agent can use the same tool when you ask it to undo something, and that waits for Allow.

Activity

XPAC → AI Agent → Activity lists every change AI made on your site, from the chat and from AI apps connected to the MCP address. Use it to see what an AI app did while you were not watching, or who asked for a change. Every administrator sees every change, including other administrators' and every app's.

• What is listed: each action that could change something and actually ran. Reading is not listed, and neither is an action you declined, one that was switched off or one refused before it started.
• Columns: When, Change (the switch's label, the title of what it touched and its links), Result, Source (Chat and the model, or AI app and the app's name and version) and By. Duration is hidden; turn it on from the view options. Under By, a user who was deleted reads Deleted user, and one removed with Erase Personal Data reads Anonymised user.
• Result: Done, Failed, Running, or Did not finish for an action that never reported back within 15 minutes. Allowed marks one you approved in the chat.
• Filters: Source, Result, Tool and Person. Search changes matches titles and tool names.
• View details shows the input as the log summarised it, the error if any, what it touched and the tool's name. For a change from your own chat, Open conversation takes you to it. Another administrator's conversation is named, not opened, and a deleted one says so.
• How long: 90 days. The line under the heading says so.

The log is kept small and free of secrets. It never stores what a tool answered, only whether it worked, the ids and title of what it touched, and up to three links on your site. What the tool was given is summarised by rules:

• anything named like a password, an API or private key, a token or another secret reads [redacted];
• email addresses read [email], and web addresses keep only their site;
• short one-line text is kept, and longer text reads as its length, such as (412 characters);
• a list reads as its length, such as (3 items), so visitors' answers never show; only a short list of numbers, such as ids, is kept.

These rules go by the shape of the input, not by knowing each tool, so a short piece of personal data in a field with a plain name can still show.

Choose a model

The menu under the message box picks the model for your chats. Each administrator picks their own. Automatic, the default, lets WordPress pick a model that can use tools from the providers you connected.

The menu lists the models your connected providers offer that can run the agent. Dated snapshots of a model and deep-research models are left out. The menu is hidden when there is no model to pick, and locked while the agent is working. If the model you picked is not available when the chat calls it, for example because its provider was disconnected, WordPress uses another one instead of failing. On Automatic, the menu also names the model that wrote the latest reply.

Generating images does not use this menu. It asks for the newest image model each connected provider offers.

The token figure

Beside the model name, the chat shows how many tokens the conversation has sent to the AI provider so far, such as 12.4k tokens sent. It counts the tokens the provider reports; it does not show how many of them the provider had cached.

Every step sends the agent's instructions, the tool descriptions and the whole conversation again, so this number grows with each step. Large results from earlier in a long conversation are sent in short form to keep it down. Start a new chat for a new task to keep each conversation small. A conversation that grows too long for the model stops with "This conversation is too long for the model. Start a new chat.", and offers New chat instead of Retry.

Connect AI apps over MCP

AI apps that speak MCP, such as Claude Code, Claude Desktop, Cursor and VS Code, can use the same tools as the chat. They use their own AI, so this works from WordPress 6.9 without a provider under Connectors.

Where each app takes it

The dialog names the site in each app after your site's address, such as example-com. When the file already lists other servers, add only the new entry inside it.

Claude.ai web connectors need the site on a public HTTPS address and their Request headers option, which is in beta. Apps that sign in only with OAuth, such as ChatGPT, cannot connect this way.

Connected apps

Under the button, Connected apps lists the apps you connected: the app, its password's name, when it was created, and when it was last used or Never used. WordPress notes the last use at most once a day. Revoke asks first, and then the app's password stops working at once.

• Each administrator sees, connects and revokes only their own apps. The same passwords also show on your profile under Users → Profile → Application Passwords.
• An account can have 10 connected apps at a time, and connect at most 5 within 10 minutes.
• Connecting needs an account that can edit posts, and application passwords turned on for the site and for you.
• The list stays on the screen while Serve these tools to AI apps over MCP is off, so you can still revoke an app.
• A password made here opens only the MCP address. The rest of the site's REST API and XML-RPC refuse it, so a leaked config reaches only the tools that are on.
• Deleting XPAC Agent revokes every password it made. Deactivating it does not, and while it is deactivated these passwords are no longer limited to the MCP address: revoke them first if you turn the plugin off for good.

Connect by hand

Any application password works too. Create one under Users → Profile → Application Passwords, copy the MCP address from Connection (it looks like https://your-site.example/wp-json/xpac/mcp), and have the app send the username and application password as HTTP Basic authentication. For Claude Code:

claude mcp add --transport http xpac "https://your-site.example/wp-json/xpac/mcp" \
  --header "Authorization: Basic $(printf 'your-username:xxxx xxxx xxxx xxxx xxxx xxxx' | base64)"

The app signs in as that user, and each tool checks that user's permissions, so pick a user who is allowed to do what you want AI to do, and no more. The user must be able to edit posts. A password made by hand is not limited to the MCP address. Point the app at the MCP address: changes made through other routes into the site are not listed under Activity and cannot be undone.

What an AI app gets

• Instructions. When the app connects, it is told what the tools are for, your site's name, address, language and time zone, and each plugin's guidance, without the lines about the chat's Allow step. It is also told that nothing waits for Allow over this connection, and to make sure you want a change before it changes or removes content or sends form answers to another service.
• Ready-made prompts. The requests in the chat's Ready-made requests arrive as prompts, named after the plugin and the request, such as xpac-forms-contact-page. One that needs one more thing takes it as an argument, such as the page's address for xpac-wp-page-from-url.
• An undo token with each change, while Undo agent changes is on (see Undo).

To stop all AI apps at once, turn off Serve these tools to AI apps over MCP. The chat keeps working.

Privacy and security

• Your API keys stay with WordPress. The chat goes through WordPress's AI client, and keys stay under Settings → Connectors. XPAC Agent never sees them, and its tools never take or return passwords or secret keys.
• What reaches the AI provider. Your messages, the images you attach, the tool descriptions and what the tools return are sent to the provider you connected. When you ask the agent to read submissions, what visitors typed is sent too. When it generates an image, your description of the image is sent. Over MCP, what the tools return, submissions included, goes to the app and the AI it uses.
• Tools run as you. In the chat, every tool runs as the administrator who is signed in and checks that person's permissions. Over MCP, tools run as the application password's user; with Connect an AI app, that is you.
• Conversations are private to each administrator. They are stored in your site's database, and other administrators cannot open yours. The list shows your 50 most recent; older ones are kept. Delete one with the bin button beside it in the list. Images you attach are stored in wp-content/uploads/xpac-agent/, where the web server is told not to serve them and each file has a random name; only you can open yours, through the chat. Deleting a user under Users deletes their conversations, images and undo copies too.
• The activity log is the site's record. Every administrator can read it. It never stores what a tool answered, and its rules leave out secrets and visitors' form answers (see Activity). A change is kept 90 days. WordPress's privacy tools cover it: Export Personal Data hands a person their changes, under "AI agent activity" in the export, and Erase Personal Data keeps each change as the record of what happened but removes the person, the app and the conversation it came from.
• Undo copies are private. A copy of what a change replaced, such as a page's content or a form's settings, is kept for 7 days. Only the person who made the change can use it, and it is never sent to the AI provider or an app.
• App passwords open only MCP. A password made by Connect an AI app is shown once, stored by WordPress as a hash like any application password, and refused everywhere on the site except the MCP address.
• Replies cannot load outside content. Answers are shown as formatted text. HTML shows as plain text, and images the AI writes are not loaded, only their description, so a reply cannot quietly send your conversation to another site.
• Deleting the plugin removes its data. Deactivating XPAC Agent keeps your conversations, settings, activity log and undo copies. Deleting it under Plugins removes every conversation and its images, the activity log, the undo copies, the tool switches and each administrator's model choice, and revokes every application password it made. Images the agent added to the media library, generated ones included, stay there. On a multisite network, it cleans up the site it is deleted from, and revokes its application passwords on every site.

Troubleshooting

For developers

Any plugin can bring tools, ready-made requests and undo for its own data by registering WordPress abilities and describing them to XPAC Agent through filters, without loading an Agent class. See the Agent hook reference.