=== Novasira – AI SEO Agent for WordPress ===
Contributors: wpunicorn, novasira
Tags: seo, ai, ai-seo, mcp, chatgpt
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 0.1.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

AI SEO for WordPress. Let ChatGPT, Claude or Cursor audit your site over MCP, then fix titles, alt text and schema. No API keys, no data sent out.

== Description ==

**Novasira turns an AI assistant into an SEO worker that can see inside your WordPress site.**

Connect ChatGPT, Claude, Claude Code, Cursor, VS Code, GitHub Copilot, Windsurf,
Codex, Gemini CLI or any other MCP client. Ask it to audit your SEO. It reads
your real data, tells you what is wrong in order of importance, and, when you
say so, fixes it.

A crawler sees your published pages. Novasira sees the database: drafts, post
meta, the taxonomy shape, every image's alt text, the real internal link graph,
which pages your sitemap leaves out. It reads what WordPress already stores,
reports what it finds, and hands the findings to your agent along with the
written method for judging them.

It does not rank your site, predict traffic, or score your competitors. It reads
a database and tells you what is in it.

**What you can ask your AI to do**

* "Audit this site's SEO and tell me what to fix first."
* "Find every image with no alt text and write good ones."
* "Which pages have a missing or duplicate title or meta description?"
* "Which pages are not linked to from anywhere else on the site?"
* "Check my schema markup and my sitemap for problems."
* "Rewrite the title and description for this page, and show me before saving."

**What you get**

* **A site health score and a ranked list of what to fix first**, from checks
  that run against your own data.
* **Twenty-six SEO areas**: full audit, content quality, internal links, schema,
  sitemaps, images and alt text, technical SEO, AI search, local SEO, products
  and more. Each has written guidance and a prompt you can copy.
* **Nine MCP tools** your agent can call: scan an area, read the method, read a
  page's SEO, list images with no alt text, check internal links, read schema,
  and write SEO fields or alt text when you ask it to.
* **A step-by-step Connect screen** with ready-made setup for each AI tool.
* **Sign in with WordPress (OAuth 2.1)** with per-connection permissions, or an
  application password limited to Novasira's own endpoint.
* **Works alongside Yoast SEO, Rank Math and SEOPress.** It reads what they
  store and does not change their settings.
* **No outbound requests, no telemetry, no account, no API key.**

= Twenty-six areas =

The plugin organises its work into twenty-six SEO areas. Twenty of them are
**live**: WordPress holds the data, so the area can be scanned against this
site. Six are **advisory**: the answer lives outside this database, so the area
ships the method and the prompt and says so plainly.

Live areas: full audit, action plan, single page, content quality, content
brief, topic clusters, internal links, programmatic pages, technical, sitemaps,
schema, languages, images, alt text, search experience, AI search, agent
readability, drift, products, local.

Advisory areas: Search Console, backlinks, competitors, keyword data, maps
listing, and the orchestrator page that says which area answers which question.

The advisory split is deliberate. Impressions, rankings, referring domains and
keyword volumes do not exist anywhere in a WordPress database. Novasira ships no
API key, no crawler and no bundled data service, so for those areas it gives you
the method and the prompt rather than a number it would have had to invent.

= Guidance, not a score =

Every area carries a written guidance document, which an agent reads through an
MCP tool. Each one answers the same five questions: what the area is about, what
Novasira can actually see from inside WordPress, how to tell a real problem from
a number that merely looks bad, what to do about it cheapest-first, and how you
would know you were wrong.

In the admin, each area has a card naming what it covers, whether it is live or
advisory, and a prompt you can copy and hand to your agent.

That last question is the point. A finding without a falsifiability check is a
guess with a chart next to it.

= The agent side =

Novasira registers its tools as WordPress abilities and serves them over a
single MCP endpoint on your own site, using the bundled `wordpress/mcp-adapter`
(GPL-2.0-or-later). You connect your agent to your site; nothing is brokered
through a third party.

Only an authenticated user with the required capability can reach the endpoint.
**Novasira → Connect** walks through it in a few steps: switch the MCP server
on, pick your AI tool (Claude, ChatGPT, Claude Code, Cursor, VS Code, GitHub
Copilot, Windsurf, Codex, Gemini CLI and more), choose how it signs in, and copy
the ready-made connection for that tool. An agent can sign in in either of two
ways:

* **Sign in with WordPress (OAuth 2.1).** Clients that support MCP
  authorization, such as Claude, discover the sign-in automatically. An
  administrator approves each connection on a consent screen, choosing which
  permissions it gets (read, write, manage), and can revoke it at any time from
  **Novasira → Connect**. This uses dynamic client registration, so any client
  can ask to connect; nothing is granted until an administrator approves.
* **Application password.** Works with every client and every host. The Connect
  screen can create one for you through WordPress core's own application
  password API, named "Novasira…", and puts it straight into a prompt and a
  config snippet for the tool you picked. The password is shown once, in that
  page view only; Novasira never stores it (WordPress keeps only its hash, as it
  does for any application password). A key created here is accepted only on
  Novasira's MCP endpoint: WordPress refuses it on every other REST route and
  on XML-RPC. Keys created here are listed, and can be revoked, under
  **Manage connections and keys**.

Either way, the agent reaches Novasira's own tools and nothing else. They read
your content and SEO data, and write only SEO fields: titles, meta
descriptions, canonical URLs, slugs and image alt text. The endpoint does not
carry the MCP adapter's generic tools for running other plugins' abilities, and
no tool installs or changes plugins, themes, users or site settings. There is no
Novasira server: the agent you choose connects straight to your site.

For OAuth connections Novasira stores, in your site's database: the registered
client's name and redirect addresses, and for each approved connection a hash
of its access and refresh tokens (never the tokens themselves), the permissions
granted, timestamps, and the IP address it last connected from. Access tokens
last 30 days and renew while in use; an unused connection expires after 180
days. A token is accepted only on Novasira's own MCP endpoint, never on the
rest of the REST API.

Everything the agent can read, that user could already read in wp-admin, and a
tool that edits a post refuses anybody who could not edit that post by hand.

= Credits =

* `wordpress/mcp-adapter` and `wordpress/php-mcp-schema` by the WordPress AI
  Team (GPL-2.0-or-later), bundled unmodified in `vendor/`. Sources:
  https://github.com/WordPress/mcp-adapter and
  https://github.com/WordPress/php-mcp-schema

= What it reads from other SEO plugins =

Where Yoast SEO, Rank Math or SEOPress is installed, Novasira reads the title
and description each one stores so that its report reflects what your site
actually outputs. It does not replace them, convert between them, or change
their settings.

== Installation ==

1. Upload the plugin to `/wp-content/plugins/novasira/`, or install it from the
   Plugins screen.
2. Activate it. There is nothing to install: no tables are created and no
   settings are required.
3. Open **Novasira** in the admin menu. The Dashboard shows what the site looks
   like; **SEO areas** lists all twenty-six with their guidance.
4. To work with an agent, open **Connect** and follow the steps: pick your AI
   tool, choose Sign in or Application password, and copy what the last step
   gives you into the tool.

WordPress 6.9 or later is required: the Abilities API that Novasira registers
its tools with is part of WordPress core from 6.9.

== Frequently Asked Questions ==

= How do I connect ChatGPT, Claude or Cursor to my WordPress site? =

Open **Novasira → Connect**, pick your AI tool, choose Sign in or Application
password, and copy what the last step gives you into the tool. Clients that
support MCP sign-in, such as Claude, find the sign-in on their own.

= What is MCP? =

The Model Context Protocol is an open standard that lets an AI assistant call
tools on another system. Novasira runs an MCP server on your own site, so the
assistant talks to your site directly. Nothing goes through a third party.

= Which AI tools work with it? =

Any MCP client. The Connect screen has ready-made setup for ChatGPT, Claude,
Claude Desktop, Claude Code, Cursor, VS Code, GitHub Copilot, Windsurf, Codex,
Gemini CLI and more.

= Is it safe to give an AI access to my site? =

The agent reaches Novasira's own tools and nothing else. They read your content
and SEO data, and write only SEO fields: titles, meta descriptions, canonical
URLs, slugs and image alt text. No tool installs or changes plugins, themes,
users or site settings. You choose the permissions on the sign-in screen, and
you can revoke any connection from **Novasira → Connect** at any time.

= Does Novasira send my site's data anywhere? =

No. The plugin makes no outbound HTTP requests of any kind. It has no update
server, no licence check, no analytics and no telemetry. See the External
services section below.

= Is this a replacement for Yoast, Rank Math or SEOPress? =

No. Those plugins output your titles, descriptions and schema to visitors.
Novasira reads what they have stored and reports on it. Run whichever you
already use; Novasira works alongside it and does not change its settings.

= Does it work without an AI agent? =

Partly. The admin screens show each area's findings and guidance, and you can
act on them by hand. The abilities are only useful with an MCP client connected,
and the advisory areas are mostly a method and a prompt, which is of more use to
an agent than to a dashboard.

= Will it change my content? =

Only when asked. Reading is the default. Two abilities write: one sets a
single page's SEO fields (title, description, canonical URL, slug, noindex and
nofollow), and one sets an image's alt text. Each takes an explicit call naming
the post or image, needs a connection granted the write permission, and refuses
anyone who could not edit that item by hand. The prompts the plugin supplies
tell the agent to show you the change and wait.

= Do the advisory areas work if I have no API keys? =

They give you the method, the prompt and an honest statement about where the
numbers live. They do not produce numbers. If your agent has its own access to
Search Console, a keyword data provider or the open web, it can bring the
numbers; the plugin will not pretend to.

= Does it promise better rankings? =

No. No plugin can. Novasira reports what your database contains and what the
method says about it. What search engines do with your site afterwards is not
something this plugin, or any plugin, controls.

= Which capability is required? =

By default:

* The Novasira admin menu, Connect, Status and Settings require an
  administrator (`manage_options`). Only an administrator can approve an OAuth
  connection.
* Reading through the MCP tools, and the Tools and Docs screens, require
  `edit_posts`. Writing through the MCP tools also requires `edit_posts`, plus
  permission to edit the specific post or image.

Both MCP capabilities can be raised under **Novasira → Settings** to
`publish_posts`, `edit_others_posts` or `manage_options`. They cannot be lowered
below `edit_posts`, so subscribers can never reach the tools.

== External services ==

**Novasira makes no outbound requests at all.** It contacts no API, no licence
server, no update service, no analytics endpoint and no CDN, and sends nothing
anywhere. There is no account to create and no key to enter. The only personal
data it stores is described under "The agent side" above (the last IP address of
each OAuth connection), kept in your own database; suggested privacy-policy text
is added under Settings → Privacy.

The **Connect** screen has two buttons that open a third-party website in a new
tab, only when you click them. Nothing is sent automatically:

* **Add the connector to Claude.ai** opens claude.ai's connector settings, with this site's MCP
  endpoint address and site name in the link so you do not have to type them.
  Provided by Anthropic. Terms: https://www.anthropic.com/legal/consumer-terms ·
  Privacy: https://www.anthropic.com/legal/privacy
* **Open ChatGPT connectors** opens chatgpt.com's connector settings. Provided by OpenAI.
  Terms: https://openai.com/policies/terms-of-use · Privacy:
  https://openai.com/policies/privacy-policy

The plugin bundles `wordpress/mcp-adapter` (GPL-2.0-or-later, by the WordPress
AI Team) and `wordpress/php-mcp-schema`. The adapter's role is to **serve** an
MCP endpoint on this site — an inbound route under this site's own REST API. It
does not call out either. Reaching that endpoint requires authenticating as a
user with the capability described above; an unauthenticated request gets
nothing.

The application-password connection snippets tell your AI client to start
`@automattic/mcp-wordpress-remote` with `npx`. That is an open-source npm
package (MIT licence, by Automattic) which your own computer downloads from
the npm registry when the client starts it; Novasira does not download, bundle
or run it. It connects only to this site's MCP endpoint, using the credentials
in the snippet. Source: https://github.com/Automattic/mcp-wordpress-remote ·
npm terms: https://docs.npmjs.com/policies/terms · npm privacy:
https://docs.npmjs.com/policies/privacy

If you connect an AI agent to that endpoint, the agent is software you chose and
run, and whatever it reads from your site travels wherever you have configured
it to travel. That is a property of your agent and your MCP client, not of this
plugin. Novasira itself never initiates a connection.

== Screenshots ==

1. The SEO dashboard: site health, what to fix first, and scores by area.
2. SEO areas: all twenty-six, each marked live or advisory, with a prompt to copy.
3. Connect: pick your AI tool, choose how it signs in, copy the ready-made setup.
4. AI tools: the nine MCP tools, what each does, and the capability it needs.

== Changelog ==

= 0.1.1 =
* Clearer plugin name and description.
* Status screen no longer reports a false problem for the MCP server and tools on a normal admin page load.

= 0.1.0 =
* First release.
* Twenty-six SEO areas: twenty live against WordPress data, six advisory.
* Written guidance for every area, read by an agent through an MCP tool.
* Scanning for pages, content, content briefs, topic clusters, internal links,
  programmatic pages, technical, sitemaps, languages, images and search
  experience, plus the audit and action plan composed from them.
* MCP endpoint served on this site through the bundled `wordpress/mcp-adapter`.
* Reads titles, descriptions, robots flags and canonicals stored by Yoast SEO,
  Rank Math and SEOPress where one of them is installed.
* Sign in with WordPress: OAuth 2.1 with PKCE and per-connection permissions,
  alongside application passwords.
* A step-by-step Connect screen with ready-made setup for seventeen AI tools,
  and application passwords created and revoked in place.
* Deleting the plugin removes its settings, sign-in connections and the
  application passwords its Connect screen created.
* No outbound requests, no telemetry, no account.
