=== AI Chat for Amazon Bedrock === Contributors: glay, glayguo Tags: ai, amazon bedrock, chatbot, claude, mcp Requires at least: 6.4 Tested up to: 7.1 Stable tag: 1.1.0 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Add a secured, rate-limited Amazon Bedrock chat to WordPress with optional Model Context Protocol tools. == Description == AI Chat for Amazon Bedrock connects a WordPress chat interface to selected Amazon Bedrock foundation models. Version 1.1.0 focuses on safe production defaults, predictable requests, least-privilege administration, and a hardened MCP integration. = Features = * Shortcode: `[ai_chat_bedrock]` * Claude, Amazon Titan and Nova, Meta Llama, Mistral, and DeepSeek model formats * System prompt, model, token, temperature, title, and welcome-message settings * Guest access disabled by default * Per-visitor request limiting to reduce accidental AWS spend * Encrypted database credential storage with optional `wp-config.php` constants * Temporary AWS credential/session-token support * MCP client restricted to public HTTPS destinations and WordPress safe HTTP requests * Read-only WordPress MCP server, authenticated by default * Server-side MCP tool execution; browsers cannot forge tool results * Admin test interface = Security defaults = * Only signed-in users can chat until an administrator explicitly enables guest access. * External MCP tools are never exposed to anonymous chat visitors by default. * WordPress MCP REST routes require authentication unless public read-only access is explicitly enabled. * Stored AWS credentials are encrypted using the site's WordPress authentication salts and are never rendered back into settings forms. * Debug mode records only redacted request metadata, not prompts, responses, credentials, or authorization headers. For the strongest credential isolation, define these constants in `wp-config.php` instead of saving credentials in WordPress: `AI_CHAT_BEDROCK_AWS_ACCESS_KEY` `AI_CHAT_BEDROCK_AWS_SECRET_KEY` `AI_CHAT_BEDROCK_AWS_SESSION_TOKEN` (optional) Use an IAM identity restricted to `bedrock:InvokeModel` for only the models the site needs. == Installation == 1. Upload the plugin directory to `/wp-content/plugins/`, or install it through WordPress. 2. Activate **AI Chat for Amazon Bedrock**. 3. Open **AI Chat Bedrock > Settings**. 4. Configure an AWS region, credentials, and a model. 5. Test while signed in. 6. Add `[ai_chat_bedrock]` to a page or post. 7. Enable guest chat only after reviewing AWS Budgets, model pricing, and the request limit. == Frequently Asked Questions == = Why can guests not use the chat after upgrading? = Version 1.1.0 defaults to signed-in users to prevent anonymous scripts from generating unbounded AWS charges. An administrator can explicitly enable guest access in the settings. = Are AWS credentials stored in plaintext? = Newly saved credentials are encrypted with authenticated encryption derived from WordPress salts. Existing plaintext credentials are migrated when an administrator opens the dashboard. `wp-config.php` constants remain the preferred production option. = Does this version stream responses? = No. The previous EventSource implementation issued duplicate Bedrock requests and placed conversations in URLs. Version 1.1.0 uses one stable POST request per model invocation. Streaming can return in a future version after a transport-safe implementation is available. = Can I use temporary AWS credentials? = Yes. Configure the access key, secret key, and session token together, or define all three constants in `wp-config.php`. = Why must external MCP servers use HTTPS? = The restriction, combined with WordPress safe HTTP validation, reduces server-side request forgery and protects tool inputs in transit. Private, loopback, link-local, credential-bearing, and unsafe redirect targets are rejected. = How is the built-in WordPress MCP server protected? = It is read-only and returns published content only. WordPress authentication is required by default. Administrators may explicitly expose it publicly; public requests are then rate limited. = Does MCP support multi-step tool chains? = Version 1.1.0 executes up to five tool calls from one model response and then asks the model for a final answer. It does not recursively execute a second round of tool requests. == Screenshots == 1. Chat interface 2. Secure settings page 3. MCP server management 4. Admin chat test == Changelog == = 1.1.0 = * Added encrypted AWS credential storage and `wp-config.php` credential constants. * Added AWS session-token support for temporary credentials. * Disabled guest chat by default and added configurable per-visitor rate limits. * Removed duplicate and arbitrary-option AJAX handlers. * Removed the duplicate-request EventSource implementation and conversation data in URLs. * Moved MCP tool-result processing entirely to the server. * Added HTTPS-only, SSRF-resistant MCP requests with response-size and redirect limits. * Made WordPress MCP routes authenticated by default and restricted them to published, non-sensitive content. * Removed unconditional prompt/tool logging and ensured debug logs contain metadata only. * Fixed AI-response and admin-notice XSS paths. * Removed PHP sessions and the unused chat-history table. * Added strict settings, message, history, model, and REST input limits. * Unified the `ai-chat-for-amazon-bedrock` text domain. * Completed uninstall cleanup and added automated security regression checks. = 1.0.7 = * Added Model Context Protocol client, server, management, and tool integration. = 1.0.6 = * Improved escaping, internationalization, and direct-file-access protection. = 1.0.5 = * Added additional Bedrock models and chat customization. = 1.0.0 = * Initial release. == Upgrade Notice == = 1.1.0 = Security release. Guest chat is disabled until explicitly enabled, stored AWS credentials are migrated to encrypted values, external MCP servers must use public HTTPS URLs, and the unsafe legacy streaming mode has been removed. Back up the database and test model/MCP access before enabling guest traffic. == Privacy Policy == Chat messages and the configured system prompt are sent to Amazon Bedrock. When MCP tools are enabled for authenticated users, relevant tool parameters are sent to the selected external MCP server and tool output is sent to Amazon Bedrock to complete the answer. Review AWS and each MCP provider's privacy terms before use. The plugin does not create permanent chat-history records. It stores a salted hash-derived transient counter for each visitor for up to one minute to enforce request limits. Debug logging is optional and records only redacted operational metadata. Administrators are responsible for disclosing these data flows and obtaining any consent required in their jurisdiction.