=== AI Chat for Amazon Bedrock – Secure AWS Chatbot & MCP ===
Contributors: glay, glayguo
Tags: amazon bedrock, claude, chatbot, mcp, mcp-server
Requires at least: 6.4
Tested up to: 7.1
Stable tag: 1.5.0
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stream Claude, Nova and more from your own AWS account. IAM roles, no stored keys, an MCP server for AI clients, and security-first defaults.

== Description ==

Connect WordPress directly to **Amazon Bedrock** using your own AWS account. Add a configurable AI chat powered by Claude, Amazon Nova or Titan, Meta Llama, Mistral, or DeepSeek model formats, then extend authenticated conversations with optional Model Context Protocol (MCP) tools.

The plugin is designed for site owners, developers, and teams already using AWS who want predictable requests and security-focused defaults. Model requests go from your WordPress server to the configured Amazon Bedrock endpoint; the plugin author does not operate an AI relay service.

= What you can build =

* An authenticated internal assistant powered by Amazon Bedrock
* A public website chatbot with explicit guest access and per-visitor request limits
* A Bedrock conversation that can use tools from an administrator-approved external MCP server
* An authenticated, read-only WordPress MCP endpoint for published posts and pages
* A multi-model AWS setup that can switch supported model formats without changing the chat interface

= Highlights =

* Add chat with the `[ai_chat_bedrock]` shortcode
* Streaming responses by default, with an automatic buffered fallback
* Supports Anthropic Claude, Amazon Nova and Titan, Meta Llama, Mistral, and DeepSeek request/response formats
* Configure the system prompt, model ID, maximum tokens, temperature, title, and welcome message
* Run without stored AWS keys using an EC2 instance role, ECS or EKS task role, or server environment variables
* Keep guest access disabled until an administrator deliberately enables it
* Limit requests per visitor to reduce accidental model usage and AWS spend
* Encrypt stored AWS credentials, or keep them outside the database in `wp-config.php`
* Use temporary AWS credentials with an AWS session token
* Report Bedrock input and output token counts for each answer
* Connect only to public HTTPS MCP destinations through WordPress safe HTTP requests
* Execute MCP tools on the server so browsers cannot forge tool results
* Expose published WordPress content through read-only MCP routes that require authentication by default
* Verify the selected Bedrock model from the included admin test interface

= Streaming =

Streaming is enabled by default. Each visitor message sends one authenticated POST request to a plugin REST route, and Amazon Bedrock response events are relayed to the browser with Server-Sent Events. Conversation content is never placed in a URL, and one visitor message still results in exactly one Bedrock invocation.

Streaming requires the PHP cURL extension. When streaming is unavailable, disabled, or interrupted, the chat automatically falls back to a single buffered request, so answers are still delivered.

= Credentials without stored keys =

Credentials are resolved in this order:

1. `wp-config.php` constants
2. Encrypted WordPress settings
3. Server environment variables
4. ECS or EKS task role
5. EC2 instance role using IMDSv2

Sources 3 to 5 let a site on AWS run with no long-lived access keys in WordPress at all. Temporary role credentials are cached encrypted and refreshed before they expire. Role lookups can be disabled in the settings or with the `ai_chat_bedrock_use_role_credentials` filter. The active source is displayed on the settings screen without revealing secret values.

= Five-minute setup =

Before starting, enable access to the model in the selected AWS Region and create an IAM identity that can invoke only the models the site needs.

1. Install and activate **AI Chat for Amazon Bedrock**.
2. Open **AI Chat Bedrock > Settings**.
3. Enter the AWS Region, credentials, and Bedrock model ID.
4. Save the settings and run the admin test while signed in.
5. Add `[ai_chat_bedrock]` to a page or post.
6. Review model pricing and request limits before enabling guest chat.

A minimal IAM policy for a foundation model can start with the following pattern. Replace `REGION` and `MODEL_ID` with the actual values required by your deployment. Inference profiles and some model types use different resource ARNs; follow the AWS documentation for the model you select.

`{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "bedrock:InvokeModel",
      "Resource": "arn:aws:bedrock:REGION::foundation-model/MODEL_ID"
    }
  ]
}`

Do not grant broad AWS administrator permissions to a WordPress site.

= Credential options =

For stronger credential isolation, define credentials in `wp-config.php` instead of saving them in the WordPress database:

`define( 'AI_CHAT_BEDROCK_AWS_ACCESS_KEY', 'replace-with-access-key' );`
`define( 'AI_CHAT_BEDROCK_AWS_SECRET_KEY', 'replace-with-secret-key' );`
`define( 'AI_CHAT_BEDROCK_AWS_SESSION_TOKEN', 'replace-with-session-token' ); // Optional.`

When credentials are saved through the settings screen, the plugin encrypts them with authenticated encryption derived from the site's WordPress authentication salts. Saved secrets are never rendered back into the form.

= Security and cost defaults =

* Only signed-in users can chat until guest access is explicitly enabled.
* External MCP tools are unavailable to anonymous chat visitors by default.
* Built-in WordPress MCP routes require authentication unless public read-only access is deliberately enabled.
* Public read-only MCP requests and chat requests are rate limited.
* Input, history, token, tool-call, redirect, and remote-response limits are enforced server-side.
* MCP destinations must use public HTTPS URLs; private, loopback, link-local, credential-bearing, and unsafe redirect targets are rejected.
* Debug mode records redacted operational metadata, not prompts, responses, credentials, or authorization headers.

Request limiting reduces accidental usage but is not a billing guarantee. Review Amazon Bedrock pricing and configure AWS Budgets or other account-level monitoring before opening chat to public traffic.

= MCP behavior =

The optional MCP client lets an authenticated conversation discover and call tools from an administrator-configured external server. Tool calls execute on the WordPress server and their results are returned to Bedrock for the final answer.

Tool use is governed by a policy layer:

* A capability is required to use tools at all, defaulting to `edit_posts`.
* Tools whose name or description suggests they change data are blocked until an administrator allows them, and remain administrator-only.
* Up to five tool calls run per round, and the number of rounds is configurable from 1 to 5, defaulting to 3.
* The final round is answered without tools so a conversation always terminates.
* Every call is recorded in an audit log with the tool, round, outcome, duration and parameter key names. Parameter values, tool output and chat content are never stored.

The built-in WordPress MCP routes are read-only and return published, non-sensitive content only.

= Editor assistant =

An optional sidebar in the block editor offers six writing actions: improve, shorten, expand, summarize, suggest titles and translate. Suggestions are returned to the editor and never saved automatically, the endpoint requires the `edit_posts` capability, requests are rate limited, and expansion is instructed not to invent facts. Disabled by default.

= Conversation log =

Optional and disabled by default. When enabled, questions and answers are stored so administrators can review answer quality and moderation. Storage is capped at the 200 most recent exchanges, retention is configurable from 1 to 90 days, entries can be deleted for one user or all at once, and nothing is stored while the option is off. Enable it only if you disclose the recording to your visitors.

= One-click connection with OAuth =

Instead of copying tokens, AI clients can connect with OAuth 2.1: paste the MCP endpoint into the client, sign in to WordPress, and approve the request. The client never receives a WordPress password.

* Discovery: `/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource`
* Dynamic client registration, so no manual client setup is needed
* PKCE with S256 is mandatory, and redirect targets must be HTTPS or loopback
* Authorization codes are single use and short lived
* Access tokens last one hour; refresh tokens rotate, and reusing a rotated token revokes the connection
* Access and refresh tokens are stored only as hashes
* Each connection acts as the approving WordPress user and inherits that account's permissions
* Connections are listed in the MCP settings and can be revoked individually or all at once

OAuth is disabled by default. Approving a connection requires the capability configured for MCP tools.

= Connect an AI client to this site =

The plugin also exposes this WordPress site as a Model Context Protocol server, so MCP clients such as Claude Code, Cursor, VS Code or an agent framework can read the site.

* Endpoint: `https://example.com/wp-json/ai-chat-bedrock/v1/mcp`
* Transport: JSON-RPC 2.0 over Streamable HTTP, with `initialize`, `tools/list` and `tools/call`
* Authentication: a WordPress Application Password works out of the box. WordPress requires HTTPS for Application Passwords.
* Tools: five read-only content tools by default. Enabling the site content abilities adds SEO suggestions, WooCommerce product lookup and draft-only post creation.
* Every call is capability-checked and recorded in the audit log.

Anonymous access is disabled by default. It can be enabled explicitly for read-only tools and is then rate limited. If the endpoint returns 404, open Settings > Permalinks and save once so WordPress registers pretty REST routes.

= Connecting an MCP server or Amazon Bedrock AgentCore Gateway =

External servers are called with JSON-RPC over Streamable HTTP, the transport current MCP servers and AgentCore Gateway expose, with a declared protocol version. Three authentication modes are available:

* None, for a public endpoint.
* Bearer token, stored encrypted and never displayed again.
* AWS SigV4, which signs each request with the same AWS credentials already used for Bedrock. An AgentCore Gateway endpoint therefore needs no extra secret; the signing service defaults to `bedrock-agentcore` and the region falls back to the Bedrock region.

Endpoints must be public HTTPS URLs. Private, loopback, link-local and credential-bearing URLs are rejected, redirects are disabled, and response size is capped. Discovered tools are still subject to the tool policy above.

= Site content abilities =

An optional set of narrow abilities can be registered for agents and other plugins:

* Search published posts and pages
* Read one published post or page
* Suggest an SEO title and meta description, without saving anything
* Look up published WooCommerce products, returning name, price, stock status and URL
* Create a draft post

Reads never return drafts, private, or password-protected content. The only write operation creates a new draft: nothing is published, updated, or deleted, and WooCommerce orders and customers are never exposed. Draft creation requires `edit_posts`, and reads require the capability configured for MCP tools. This feature is disabled by default.

= Interface =
The chat is a self-contained, responsive interface with message bubbles, a typing indicator, a live streaming caret, tool activity status, and per-answer token counts. It follows the visitor's dark-mode and reduced-motion preferences and keeps focus styles and screen-reader labels intact.

The admin screens include a dashboard with connection, model, streaming and MCP status, a quick-start checklist, today's usage, a diagnostics page with a real connectivity test, and an MCP screen with the tool policy and audit log.

= Data flow and privacy =

Chat messages and the configured system prompt are sent to Amazon Bedrock. When an authenticated user invokes MCP tools, relevant tool parameters are sent to the configured MCP server and tool results are sent to Bedrock to complete the response. No permanent chat-history table is created by version 1.1.0.

Review AWS and each configured MCP provider's privacy terms. Site administrators are responsible for informing users about these data flows and obtaining any consent required for their deployment.

== Installation ==

1. Install the plugin through **Plugins > Add New**, or upload it to `/wp-content/plugins/`.
2. Activate **AI Chat for Amazon Bedrock**.
3. Enable the desired Bedrock model in the AWS Region you plan to use.
4. Create least-privilege AWS credentials with `bedrock:InvokeModel` access to the required model resources.
5. Open **AI Chat Bedrock > Settings** and configure the Region, credentials, and model ID.
6. Run the admin test while signed in.
7. Add `[ai_chat_bedrock]` to a page or post.
8. Enable guest chat only after reviewing Bedrock pricing, AWS account monitoring, and the plugin request limit.

== Frequently Asked Questions ==

= Do I need an OpenAI API key? =

No. Model requests use Amazon Bedrock and your AWS credentials. Availability, model access, pricing, and data handling are governed by your AWS account and Region.

= Which Bedrock models are supported? =

Version 1.1.0 includes request and response formats for Anthropic Claude, Amazon Nova and Titan, Meta Llama, Mistral, and DeepSeek model families. A specific model may still require model access, a supported Region, the correct model or inference-profile ID, and suitable IAM permissions.

= Why do I receive AccessDeniedException or a model access error? =

Confirm that the model is available and enabled in the configured AWS Region, the model ID is correct, and the IAM identity can call `bedrock:InvokeModel` for the required resource. Some models use inference profiles with different IDs and IAM resources.

= Why can guests not use the chat after upgrading? =

Version 1.1.0 defaults to signed-in users to reduce the risk of anonymous scripts generating unbounded AWS charges. An administrator can explicitly enable guest access and configure a request limit.

= Are AWS credentials stored in plaintext? =

Newly saved credentials are encrypted with authenticated encryption derived from WordPress salts. Existing plaintext credentials are migrated when an administrator opens the dashboard. `wp-config.php` constants remain the preferred production option.

= Can I use temporary AWS credentials? =

Yes. Configure the access key, secret key, and session token together, or define all three constants in `wp-config.php`.

= Does version 1.2.0 stream responses? =

Yes. Streaming is the default and uses an authenticated POST request with Server-Sent Events. The removed 1.0.x implementation was unsafe because it used a GET EventSource that placed conversation data in URLs and issued duplicate Bedrock requests. If the PHP cURL extension is missing or a proxy buffers the stream, the chat falls back to one buffered request automatically.

= Can I run without storing AWS keys? =

Yes. Leave the key fields empty and keep IAM role credentials enabled. The plugin then uses server environment variables, an ECS or EKS task role, or the EC2 instance role through IMDSv2.

= Why must external MCP servers use HTTPS? =

HTTPS and WordPress safe HTTP validation reduce server-side request forgery risk and protect tool inputs in transit. Private, loopback, link-local, credential-bearing, and unsafe redirect targets are rejected.

= How is the built-in WordPress MCP server protected? =

It is read-only and returns published content only. WordPress authentication is required by default. Administrators may explicitly expose it publicly; public requests are then rate limited.

= Does MCP support multi-round tool chains? =

Yes. The model can call tools, read the results, and continue reasoning for up to the configured number of rounds, defaulting to 3. The last round is answered without tools so the conversation always terminates. Tool output is always framed as untrusted data.

= Can the AI change my site or a remote system? =

Not by default. The built-in WordPress MCP endpoint is read-only. For external MCP servers, any tool that looks like it changes data is blocked until an administrator allows it, and those tools stay restricted to administrators.

= Does the plugin collect telemetry? =

No. Version 1.1.0 does not send plugin-usage telemetry to the plugin author. Requests are sent only to services the administrator configures, as described in the Data flow and privacy section.

= Is this plugin affiliated with Amazon Web Services? =

No. Amazon Bedrock and AWS are trademarks of Amazon.com, Inc. or its affiliates. This is an independent open-source WordPress plugin.

== Screenshots ==

1. Streaming answer on the front end, grounded in a published post and citing the source, with token counts for the reply.
2. Dashboard showing the credential source, region and model, streaming state, MCP status, usage today and a quick-start checklist.
3. Settings for AWS authentication, model selection, streaming, guest access, guardrails, spend limits and answer grounding.
4. Diagnostics with a live Amazon Bedrock connectivity test, including round-trip time and tokens used.
5. MCP screen with server registration, authentication choice, tool policy and the tool-call audit log.

== Changelog ==

= 1.5.0 =
* Added an optional block editor assistant with improve, shorten, expand, summarize, title suggestion and translate actions; suggestions are never saved automatically.
* Added an optional conversation log with a 200-entry cap, configurable retention from 1 to 90 days, per-user deletion and one-click clearing.
* Added a Conversations admin screen showing stored exchanges, token totals and the oldest entry.
* Recorded editor assistant requests under their own source so they can be reviewed separately.
* Extended uninstall cleanup to conversation, OAuth and site ability options.

= 1.4.0 =
* Added an OAuth 2.1 authorization server so MCP clients can connect by signing in to WordPress and approving, with no token copying.
* Added authorization server and protected resource discovery documents at the standard well-known paths.
* Added dynamic client registration, mandatory PKCE S256, single-use authorization codes, and HTTPS or loopback redirect validation.
* Added bearer token authentication for the MCP endpoint, with hashed token storage, one-hour access tokens and rotating refresh tokens.
* Revoked a connection automatically when a rotated refresh token is reused.
* Added a connected clients list in the MCP settings with individual and bulk revocation.

= 1.3.0 =
* Rebuilt the built-in WordPress MCP server on JSON-RPC 2.0 over Streamable HTTP, so standard MCP clients can now connect; the previous custom routes could not be used by any MCP client.
* Added `initialize` with protocol-version negotiation, `tools/list`, `tools/call`, `ping`, batch requests and notification handling.
* Exposed the controlled site abilities through the MCP server: SEO suggestions, WooCommerce product lookup and draft-only post creation, each capability-checked.
* Recorded every MCP server tool call in the audit log with metadata only.
* Kept the legacy discovery and tool routes for existing integrations.

= 1.2.0 =
* Added streaming Bedrock responses over an authenticated POST request with Server-Sent Events, enabled by default.
* Added automatic fallback to a buffered request when streaming is unavailable, disabled, or interrupted.
* Added an AWS credential provider chain covering environment variables, ECS and EKS task roles, and EC2 instance roles (IMDSv2).
* Cached temporary role credentials encrypted, with refresh before expiry and invalidation when settings change.
* Fixed SigV4 canonicalization so model identifiers containing colons or slashes are signed correctly; affected requests previously failed with a signature mismatch.
* Replaced the fixed model list with live discovery of Bedrock models and cross-region inference profiles, and expanded the region list.
* Added a diagnostics screen and Site Health check covering credentials, region, model, streaming, encryption, guest access and MCP, with an optional live connectivity test.
* Added an Amazon Bedrock Chat block with server-side rendering alongside the existing shortcode.
* Added optional Amazon Bedrock Guardrails support and a site-wide daily request limit.
* Added request and token usage counters with 30-day retention; counters never include prompts or responses.
* Added MCP tool governance: a required capability, per-tool allow list, administrator-only handling of tools that change data, configurable multi-round tool loops, and a metadata-only audit log.
* Replaced the custom MCP request format with JSON-RPC over Streamable HTTP, so standard MCP servers and Amazon Bedrock AgentCore Gateway endpoints work; the previous format is still accepted as a fallback.
* Added MCP authentication choices: none, an encrypted bearer token, or AWS SigV4 for AgentCore Gateway.
* Added WordPress Abilities API support: this plugin registers text generation and status abilities, and abilities registered by other plugins can be offered to the chat model under the tool policy.
* Added answer grounding from published site content and from an Amazon Bedrock knowledge base, inserted as clearly labelled reference data.
* Added optional narrow site abilities: published content search and read, SEO suggestions, WooCommerce product lookup, and draft-only post creation.
* Redesigned the chat interface with message bubbles, a typing indicator, a streaming caret, tool status, token counts, dark-mode and reduced-motion support.
* Redesigned the admin experience with a status dashboard, quick-start checklist and usage overview.
* Shared one validated request builder between the streaming and buffered endpoints.
* Extended uninstall cleanup to usage counters, model caches, credential caches, tool policy and the audit log.

= 1.1.0 =
* Added encrypted AWS credential storage and `wp-config.php` credential constants.
* Added AWS session-token support for temporary credentials.
* Disabled guest chat by default and added configurable per-visitor rate limits.
* Removed duplicate and arbitrary-option AJAX handlers.
* Removed the duplicate-request EventSource implementation and conversation data in URLs.
* Moved MCP tool-result processing entirely to the server.
* Added HTTPS-only, SSRF-resistant MCP requests with response-size and redirect limits.
* Made WordPress MCP routes authenticated by default and restricted them to published, non-sensitive content.
* Removed unconditional prompt/tool logging and ensured debug logs contain metadata only.
* Fixed AI-response and admin-notice XSS paths.
* Removed PHP sessions and the unused chat-history table.
* Added strict settings, message, history, model, and REST input limits.
* Unified the `ai-chat-for-amazon-bedrock` text domain.
* Completed uninstall cleanup and added automated security regression checks.

= 1.0.7 =
* Added Model Context Protocol client, server, management, and tool integration.

= 1.0.6 =
* Improved escaping, internationalization, and direct-file-access protection.

= 1.0.5 =
* Added additional Bedrock models and chat customization.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.5.0 =
Adds an optional editor assistant and an optional conversation log. Both are disabled by default and no chat content is stored unless you enable logging and disclose it to your visitors.

= 1.4.0 =
Optional OAuth connections for AI clients are available and disabled by default. Enable them in the MCP settings if you want clients such as Claude Desktop to connect by signing in and approving. Existing Application Password access is unchanged.

= 1.3.0 =
The built-in WordPress MCP endpoint now speaks standard MCP JSON-RPC at /wp-json/ai-chat-bedrock/v1/mcp and works with MCP clients using a WordPress Application Password. Authentication is still required by default. If the endpoint returns 404, save your permalink settings once.

= 1.2.0 =
Streaming is now the default and requires the PHP cURL extension; sites without it keep using buffered responses. If AWS keys are not configured, the plugin now resolves credentials from server environment variables, an ECS or EKS task role, or the EC2 instance role. Disable IAM role credentials in the settings if the server role must not be used.

= 1.1.0 =
Security release. Guest chat is disabled until explicitly enabled, stored AWS credentials are migrated to encrypted values, external MCP servers must use public HTTPS URLs, and the unsafe legacy streaming mode has been removed. Back up the database and test model/MCP access before enabling guest traffic.

== Privacy Policy ==

Chat messages and the configured system prompt are sent to Amazon Bedrock. When MCP tools are enabled for authenticated users, relevant tool parameters are sent to the selected external MCP server and tool output is sent to Amazon Bedrock to complete the answer. Review AWS and each MCP provider's privacy terms before use.

Conversation logging is disabled by default, and with it off no chat content is written to the database. When an administrator enables it, questions and answers are stored for the configured retention window, capped at the 200 most recent exchanges, and can be deleted per user or in full from the Conversations screen. Administrators are responsible for disclosing this recording to visitors.

The plugin does not create permanent chat-history records. It stores a salted hash-derived transient counter for each visitor for up to one minute to enforce request limits. Debug logging is optional and records only redacted operational metadata. Administrators are responsible for disclosing these data flows and obtaining any consent required in their jurisdiction.