=== QuangNhatDev AI Agent Tools for WebMCP ===
Contributors: quangnhatdev
Donate link: https://ko-fi.com/quangnhat2505
Tags: webmcp, ai, woocommerce, automation, developer-tools
Requires at least: 6.4
Tested up to: 7.1
Stable tag: 1.0.1
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add privacy-first WebMCP tools, diagnostics, and live testing for WordPress and WooCommerce AI-agent workflows.

== Description ==

QuangNhatDev AI Agent Tools for WebMCP helps WordPress sites expose structured, read-only capabilities to compatible browser AI agents through WebMCP.

Instead of forcing an agent to infer site behavior from page layouts, buttons, menus, or product cards, the plugin registers clearly defined tools through the browser `document.modelContext` API.

The plugin is designed to fail safely. If WebMCP is unavailable in a visitor's browser, the normal WordPress site continues to work unchanged.

= Why use it? =

* Native WebMCP integration based on `document.modelContext`.
* Built-in browser and server diagnostics.
* Live WebMCP Tool Tester inside WordPress admin.
* WordPress content, navigation, taxonomy, and site-information tools.
* WooCommerce product search and product detail tools when WooCommerce is active.
* Public custom post type support.
* Per-tool enable and disable controls.
* Same-origin REST endpoints.
* Local rate limiting with salted identifiers.
* Read-only tools by default.
* No telemetry, analytics, cloud account, or mandatory external service.

= Included tools =

WordPress tools:

* `wp_search_content` - Search published posts, pages, and enabled public custom post types.
* `wp_get_content` - Read one published content item by ID, URL, slug, or path.
* `wp_get_navigation` - Read public navigation menus and menu locations.
* `wp_get_taxonomies` - List public taxonomies or terms from one taxonomy.
* `wp_get_site_info` - Read non-sensitive public site information.

WooCommerce tools, available when WooCommerce is active:

* `woo_search_products` - Search visible published WooCommerce products.
* `woo_get_product` - Read one visible published WooCommerce product.

= Privacy-first by design =

The built-in tools are intentionally limited to public, read-only information.

The plugin does not expose:

* Drafts or private posts.
* Password-protected content.
* WordPress users.
* WooCommerce customers or orders.
* Payment information.
* Arbitrary post metadata.
* Administrative write actions.
* Cart, checkout, coupon, payment, or form-submission actions.

All built-in tools use `readOnlyHint: true`. Content-returning tools also use `untrustedContentHint: true`.

= Diagnostics and testing =

The Diagnostics screen helps administrators verify:

* Plugin, WordPress, and PHP versions.
* HTTPS availability.
* WebMCP master-switch status.
* Browser Origin Trial token configuration.
* REST API base URL.
* WooCommerce integration status.
* `document.modelContext` availability.
* `registerTool()`, `getTools()`, and `executeTool()` availability.
* Tools currently registered in the document.

The Live Tool Tester discovers browser-registered tools and executes them directly from WordPress admin, making it easier to inspect tool inputs and structured outputs without manually writing JavaScript in DevTools.

= Browser support =

WebMCP is an experimental and evolving web-platform technology. Browser support and API behavior may change over time.

The plugin checks for WebMCP support before registering tools and degrades safely when the API is unavailable.

An optional field is provided for a first-party browser Origin Trial token when required by the browser implementation. The token is issued by the browser vendor and does not unlock or restrict plugin functionality.

This plugin is independently developed and is not an official Google, Chrome, WooCommerce, or WordPress product.

== Installation ==

1. Install and activate **QuangNhatDev AI Agent Tools for WebMCP**.
2. Open **Tools > QuangNhatDev AI Agent Tools**.
3. Review the **General** settings.
4. Enable only the tools you want to expose under **Tools**.
5. Turn on **Enable WebMCP** when you are ready to register the enabled tools on the public frontend.
6. Open **Diagnostics** to verify the server and current browser environment.
7. Use **Tool Tester** to discover and execute registered WebMCP tools.

The master switch is disabled by default.

== Frequently Asked Questions ==

= What is WebMCP? =

WebMCP is an emerging browser API that allows websites to expose structured tools to compatible AI agents. Instead of relying only on page structure or UI interpretation, an agent can discover explicitly defined capabilities and invoke them with structured inputs.

= What does this plugin do? =

It registers selected public WordPress and WooCommerce capabilities as read-only WebMCP tools and provides diagnostics and live testing tools for administrators.

= Does this plugin send my site data to an external service? =

No. The plugin does not include telemetry, analytics, or third-party API calls. Built-in WebMCP tools call same-origin WordPress REST endpoints created by this plugin.

= Does it expose private WordPress data? =

No built-in tool exposes drafts, private posts, password-protected posts, users, orders, customer data, payment information, arbitrary post metadata, or administrative information.

= Does it modify content, carts, orders, or forms? =

No. Version 1.0.1 includes read-only tools only.

= What happens in a browser without WebMCP support? =

Nothing breaks. The browser-side script checks for `document.modelContext` before registering tools. Normal WordPress output continues unchanged.

= Why are WooCommerce tools missing from getTools()? =

WooCommerce tools are registered only when WooCommerce is active and the corresponding tool toggles are enabled.

= Can I expose custom post types? =

Yes. Public, viewable custom post types can be selected under **Tools > QuangNhatDev AI Agent Tools > General**. WooCommerce products are handled separately by the WooCommerce tools.

= Can developers extend the tool definitions? =

Yes. Developers can use the `qnatw_tool_definitions` filter from their own plugin or theme code. Custom definitions are validated before exposure to the browser and must use a same-origin endpoint.

= Does this plugin improve search-engine rankings? =

No ranking benefit is claimed. WebMCP is intended to make supported site data and actions easier for compatible AI agents to discover and use after they reach the site.

= Do I need a browser Origin Trial token? =

That depends on the current browser implementation and testing method. The plugin provides an optional field for a first-party browser Origin Trial token but does not obtain or validate tokens for you.

= Does the Origin Trial token control plugin functionality? =

No. It is an optional web-platform token issued by a browser vendor for experimental browser features. The plugin does not use it as a license key, payment gate, or feature unlock.

= Does the plugin include telemetry? =

No. The plugin does not include usage tracking or telemetry.

= Is this a traditional remote MCP server? =

No. This plugin focuses on browser WebMCP integration inside WordPress. It is not a general-purpose remote MCP server.

== Screenshots ==

1. General settings with the WebMCP master switch, privacy-first output controls, local rate limiting, and public content type selection.
2. Per-tool controls for the built-in WordPress and WooCommerce WebMCP tools, all read-only by default.
3. Built-in server and browser diagnostics for HTTPS, REST, `document.modelContext`, registered tools, and WebMCP execution support.
4. Live WebMCP Tool Tester for discovering a registered tool, executing structured JSON input, and inspecting the returned output.

== Privacy ==

This plugin stores its settings in the WordPress options table.

For local REST rate limiting, it stores short-lived transients keyed by a salted hash. The plugin does not intentionally store raw IP addresses, create visitor profiles, send telemetry, or contact external services.

When the plugin is deleted through WordPress, its main settings option is removed by `uninstall.php`. Short-lived rate-limit transients expire automatically.

== Developer Notes ==

Filter built-in tool definitions with:

`qnatw_tool_definitions`

Filter selected response data with:

* `qnatw_search_content_result`
* `qnatw_get_content_result`
* `qnatw_get_navigation_result`
* `qnatw_get_taxonomies_result`
* `qnatw_get_site_info_result`
* `qnatw_search_products_result`
* `qnatw_get_product_result`
* `qnatw_manifest`

The plugin intentionally does not provide an arbitrary PHP or JavaScript editor.

== Changelog ==

= 1.0.1 =
* Initial public release.
* Added seven read-only WebMCP tools for WordPress and WooCommerce.
* Added master switch and per-tool controls.
* Added public custom post type selection.
* Added server and browser diagnostics.
* Added live WebMCP Tool Tester.
* Added local rate limiting and optional browser Origin Trial token support.
* Added explicit REST permission callbacks for intentionally public, read-only WebMCP endpoints.
* Added uninstall cleanup, translation-ready strings, and privacy-first defaults.
