# AICOMBase

> AICOMBase is an online dashboard for all your WordPress sites. A free plugin, AICOM, links each site to it: you see whether your sites are up, what needs fixing for privacy, accessibility, security and technical health, and everything AI changed — and you can let your preferred AI work on your sites within limits you set, with every change recorded and undoable.

Source: https://aicombase.com

Provided by: dudaster.com (https://dudaster.com)

# Everything about your sites, on one screen.

URL: https://aicombase.com/product

What you see in AICOMBase once your sites are connected — and what you can do from there.

## The overview: is everything OK?

The first screen shows every site as online, needing attention or offline. “Needs you” is the one list of what is waiting on a person across all your sites, most urgent first — an AI action to approve, a server that took several sites down (one line, not one per site), a certificate about to expire, problems found by a site check, a security alert, AI work that didn’t finish. Each line says what’s wrong in plain words and has the button that fixes it or hands it on — “Fix with AI”, “Copy message for your host”, “Retry” — plus “I’m on it” and “Accept” with a reason. A line leaves only when the problem is gone, and “Done recently” shows what was closed, by whom and why.

## Uptime

Every few minutes AICOMBase checks each site from the outside, even when nobody is working on it:

- Is it up, and how fast does it answer? With history and charts.
- Is the SSL certificate valid, and when does it expire?
- Is the AICOM plugin still connected?

When a site stops answering, an incident opens with a timeline — when it started, what failed, when it recovered — and closes by itself once the site is back. Each incident says what happened and what to do, in plain words, with a ready-to-send message for your host. When several sites on one server fail together, you see one server outage — most likely the server, not the sites — instead of one incident per site. How often each site is checked depends on your plan.

## Site checks

Privacy, accessibility, security and technical checks of your public pages become one short to-fix list per site: what to fix first, explained in plain words, and who can fix it. Any item can be handed to your AI agent (“Fix with AI”), sent to your developer as a brief, checked again right after you fix it, or accepted with a reason. The Site checks page shows what is checked.

## Work on your sites — with a record of everything

- Work: every job — yours, your AI agent’s or a site-check fix — with its result on every site it touched, why it didn’t work where it didn’t, and Retry and Undo for the whole job.
- Tasks: write what you want done (“Update the opening hours on the Contact page”), pick one site or many, and send it — or suggest it to your AI agent.
- Sessions: inside each job, every step on each site is recorded like a receipt, and can usually be undone in one click.
- Activity: the full history of what happened on every site.
- Audit log: a separate record of every security and settings change, which can’t be edited or deleted.

## You decide what AI may do

For each site you see what AICOM can do there — edit posts, manage media, WooCommerce and so on — and whether AI is allowed to. A policy sets the limits for each site; every AI agent gets its own key with its own, tighter limits. When an agent can’t do something, “Why can’t my AI agent…?” (Permissions) checks every place that decides and says which one said no, and where to change it. The AI agents page explains how.

## Built for many sites

- Group sites into categories, such as “Clients”, “Shops” or “Internal”.
- Send one task to a whole category at once.
- Analytics across all sites: availability, work, site checks and security over time.

## Notifications

Everything arrives in the dashboard’s notification centre. Email is your choice for each kind of event — by default you’re emailed about security events and sites going down. Each person in your team sets their own.

## Your team

- Four roles: Viewers look, Operators run work, Administrators manage settings and people, the Owner manages the plan.
- Two-factor sign-in for every account, and a list of signed-in devices you can sign out.

# Two pieces that work together.

URL: https://aicombase.com/how-it-works

AICOM sits inside each WordPress site. AICOMBase is online and looks after all of them. Here’s how the two fit together.

## The two pieces

- **AICOM — the plugin on each site** — A free WordPress plugin. It knows the site from the inside (pages, plugins, settings), lets AI work on it within the limits you set, takes a backup before changing anything, and records every piece of work. It also works on its own.
- **AICOMBase — the online dashboard** — The service at aicombase.com. It checks your sites from the outside, runs site checks, collects the record of work from every site, and lets you — or your AI — send work to one site or many, under the same rules everywhere.

## Getting started

Create a free account, install AICOM on your site and click Connect in it — a few minutes per site, and no password is shared. The setup guide walks you through it: https://aicombase.com/docs/aicom

## What happens every day

- AICOMBase checks every few minutes that each site is up, fast and has a valid certificate.
- The plugin reports that it’s alive, which version it runs and what it can do.
- Site checks read your public pages on a schedule and compare the results with the last run.
- Security signals from the sites (failed logins, unexpected plugin changes and the like) are collected.
- Anything that needs you appears in “Needs you” — and in your inbox, if you chose so (one email for a burst, and only after a site has been down as long as you chose).

## When AI works on a site

1. **It opens a session** — With a name and a goal (“Publish the autumn news post”). Without an open session, the plugin refuses the work.
2. **Every step is checked** — Each action needs a fresh, one-time permission for that exact site and step. The plugin checks it against its own limits and takes a backup first.
3. **It finishes and closes** — The session is closed with a summary once the result is checked — or automatically after two hours without activity.
4. **You can undo it** — Restore a session and the plugin puts back what it changed, from its backups.

The AI agents page explains keys, the extra safety checks and how to connect your AI.

## Words you’ll see

| Word | What it means |
| --- | --- |
| Session | One piece of work on one site, from start to checked finish, with every step inside it. Can usually be undone. |
| Task | A request — “do this on these sites” — that runs as a session on each site. |
| Site check | A privacy, accessibility, security or technical check of your public pages. Also called an audit. |
| Finding | One problem a site check found, with the evidence. |
| Capability | Something AICOM can do on a site, such as editing posts or managing WooCommerce. |
| Permission (scope) | An area of work, such as “Content” or “Plugins”. Policies and keys only open the ones you allow. |
| Policy | The rules for a site: which permissions are allowed and how risky the work may be. |
| AI connection key | What you give your AI so it can work through AICOMBase — limited to the sites and permissions you pick. |
| MCP | The open standard AI apps use to call tools. AICOMBase speaks it, so most AI apps can connect. |
| MCP Guard | A safety check on AI actions before they run; it can stop an action or freeze a key. |

# Get AICOM and connect your site.

URL: https://aicombase.com/docs/aicom

AICOM is the free WordPress plugin that links each of your sites to AICOMBase. Install it, click Connect, confirm — a few minutes per site, and no password is ever shared.

## What AICOM is

AICOM is a free WordPress plugin by dudaster.com. On its own, it lets your preferred AI work on the site over MCP — with API keys, permissions, backups and a session record of every change. Connected to AICOMBase, it also reports the site’s health and AI work to your dashboard and accepts work sent from there, always checked against the site’s own rules first.

> AICOM keeps working fully without AICOMBase. Connecting is optional, and you can disconnect at any time.

## Before you start

- WordPress 6.0 or newer, and PHP 7.4 or newer.
- An administrator account on the WordPress site.
- AICOM 3.21 or newer. The AICOMBase connection has been in the plugin since version 3.17; AICOMBase also relies on what came after it — work sessions you can undo, and the site’s own permission limits.
- A free AICOMBase account, with one site included: https://aicombase.com/register
- The site must be able to make outgoing HTTPS requests — almost every host allows this.

## Download and install AICOM

1. **From your WordPress admin (easiest)** — Go to Plugins → Add New, search for “AICOM”, click Install Now, then Activate.
2. **Or upload it yourself** — Download the plugin from https://wordpress.org/plugins/aicom/ — then in WordPress go to Plugins → Add New → Upload Plugin, choose the .zip file, install and activate it.
3. **Check the version** — In Plugins, AICOM shows its version. If it’s older than 3.21, update it first (Dashboard → Updates). Once active, an AICOM menu appears in the WordPress admin.

## Connect the site to AICOMBase

1. **Open AICOM → AICOMBase and click Connect** — In the WordPress admin menu, under AICOM, open the AICOMBase page and click Connect. The plugin creates its own cryptographic identity for this site; the private key never leaves the site.
2. **Confirm in AICOMBase** — AICOMBase opens in a new tab. Sign in (or create your free account), check what the connection allows — identify this installation, report site and AICOM health, report sessions and activity, receive authorized tasks, enable monitoring — and click Connect site. The request is valid for 10 minutes.
3. **Done** — Back in WordPress the status shows Connected. In AICOMBase the site appears under Sites, and the first availability checks arrive within a few minutes.

> Browser blocked the new tab? Click “Open AICOMBase to confirm” on the AICOM → AICOMBase page. Several sites? Repeat these steps on each one — your plan decides how many you can connect.

## Configure AICOM for AICOMBase

All of this is on the AICOM → AICOMBase page in WordPress. The defaults are safe — you can leave them as they are.

| Setting | What it does |
| --- | --- |
| Local policy for AICOMBase work | The permissions AICOMBase may use on this site — by default everything except critical ones, such as managing plugins and settings. Your policy in AICOMBase and this local policy must both allow an action; a task that needs a permission not ticked here is refused and reported as a security event. |
| Pause remote work | AICOMBase sends no work to this site until you resume. Monitoring and reporting carry on. |
| Sync now | Sends the site’s status and what AICOM can do right away — useful after installing or removing a plugin such as WooCommerce. |
| Disconnect | Ends the connection on this site. AICOM keeps working, and you can connect again at any time. To also cancel the site’s keys in AICOMBase, revoke the site there (Sites → the site → Connection). |
| AICOMBase URL | Leave it empty. It’s only for developers running their own test server. |
| Connection log | What the plugin and AICOMBase said to each other recently — the first place to look when something seems stuck. |

> Locks and pause always win: whatever is allowed elsewhere, a locked or paused site does nothing AICOMBase asks.

## Then, in AICOMBase

1. **Tell it where your visitors are** — Set the site’s compliance profile, so the privacy checks use the right laws (for example EU and Romania).
2. **Run the first site check** — Privacy, accessibility, security and technical checks of your public pages — nothing on the site is changed.
3. **Connect your AI agent** — On the Keys page, create a key for your preferred AI — from a small local model to the most powerful one — choose the sites and permissions it may use, and paste the endpoint and key into your AI app.

The getting-started checklist on the Overview page walks you through these steps and ticks each one off by itself.

## What is shared — and what never is

- **Sent to AICOMBase** — Site health; WordPress, PHP and AICOM versions; what AICOM can do on the site; the record of AI work (sessions and activity); and, when site checks run, a limited view from inside (for example which plugins are active).
- **Never sent** — Your WordPress password, the site’s private key and AI API keys. Posts, pages and other content only pass through when a task you or your AI agent started needs them.
- **Always checked on the site** — Every task AICOMBase sends is signed, single-use and short-lived, and the site checks it against your local policy before anything runs.

## Troubleshooting

**I don’t see AICOM → AICOMBase in WordPress.**
Your AICOM is too old. Update it to 3.21 or newer (Dashboard → Updates), or download the latest version from https://wordpress.org/plugins/aicom/

**AICOMBase says the connection request expired.**
Connection requests are valid for 10 minutes. Go back to AICOM → AICOMBase in WordPress and click Connect again.

**“This AICOM installation’s identity is already connected to another site.”**
This copy of AICOM is already linked to a site in AICOMBase. Disconnect it on the AICOM → AICOMBase page, then connect again.

**The status says Offline, or “Could not reach AICOMBase”.**
The site couldn’t reach aicombase.com. Check that your host allows outgoing HTTPS requests, then click Sync now — the connection log shows the last error. AICOM keeps working in the meantime.

**Work from AICOMBase is refused with a permission error.**
The permission isn’t ticked in the local policy (AICOM → AICOMBase), or your policy in AICOMBase doesn’t allow it. The Capabilities page in AICOMBase shows, for every tool, whether AI may use it — and why not.

**I reinstalled the plugin and now the site appears twice.**
Deleting and reinstalling AICOM gives the site a new identity, so AICOMBase sees a new site — remove the old one from Sites. Disconnecting and reconnecting the same installation keeps its history.

**Something else?**
Ask on our Support page: https://github.com/dudaster/aicom/issues — please never post keys or passwords there, issues are public.

# AICOMBase for AI agents.

URL: https://aicombase.com/docs/ai/aicombase

Written for the AI that does the work — and for the person who sets it up. How to connect, the rules to follow, the tools, and what every answer means.

## Connect

|   |   |
| --- | --- |
| Endpoint | https://aicombase.com/api/mcp — MCP over Streamable HTTP: JSON-RPC 2.0, one POST per request (protocol versions 2024-11-05 to 2025-11-25). |
| Authentication | Either an OAuth 2.1 sign-in — the app discovers it from the 401 answer (RFC 9728 metadata at /.well-known/oauth-protected-resource/api/mcp), registers itself (RFC 7591) and sends the person to AICOMBase to choose sites and permissions; PKCE S256 — or the header Authorization: Bearer aicb_agent_…, an AI connection key a person creates in AICOMBase (Keys → Generate New Key), shown once; treat it like a password. |
| Methods | initialize, tools/list, tools/call. A tool can also be called directly by name as the method, e.g. {"method": "sites.list"}. |
| Working rules | initialize returns them in instructions — tailored to the key’s mode. Follow them. |

```
POST https://aicombase.com/api/mcp
Authorization: Bearer aicb_agent_XXXXXXXXXXXX_…
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"sites.list","arguments":{}}}
```

Apps that sign in — ChatGPT, Claude on the web and in its apps, Claude Code — need only the address: add a custom connector (or MCP server) with https://aicombase.com/api/mcp, and the person approves the access on AICOMBase's consent screen. Apps that take a key: add a remote MCP server with this address and the Authorization header. Apps that only run local MCP servers can use a bridge, for example:

```
npx -y mcp-remote https://aicombase.com/api/mcp --header "Authorization: Bearer YOUR_KEY"
```

## What the person sets up first

- At least one WordPress site connected to AICOMBase, running the AICOM plugin 3.21 or newer — see the setup guide: https://aicombase.com/docs/aicom
- An AI connection key with the sites (or site categories) and permissions the AI may use, and one tool mode: Full tool list, Tool Assist or MCPAssist. Tool Assist and MCPAssist are on every paid plan; a Free account gets them for its first 30 days.
- Optional key limits: allowed IP addresses, working hours, dry run only, expiry date.
- The work must also be allowed by the site’s policy in AICOMBase and by AICOM’s own settings on the site. The Capabilities page in AICOMBase shows, for every tool, whether it’s allowed and why not.

## The rules

- Open a session before any action on a site: session.open(site_id, name, description). Name it after the job you were given; describe what you’ll do and why. Without it, every action fails with NO_ACTIVE_SESSION.
- One job, one session, one site. Keep doing the job’s work in that session; a session left idle closes after 2 hours.
- Check the result before you finish — read back what you changed — then session.close(site_id, outcome, summary) with a one-line summary.
- Stay within your key. A refusal (permission, policy, lock, key limit) is final: don’t retry it in a loop — tell the person what was refused and why.
- guard_challenge: explain honestly with guard.justify(challenge_id, justification), then repeat the exact same call. held_for_approval: a person decides — stop and report.
- Never ask for WordPress passwords. AICOMBase never needs them.
- Everything you do is recorded and a person can undo it. Say plainly what you did in the session summary.

## How to do a job, by key mode

| Mode | Tools you get | A job, step by step |
| --- | --- | --- |
| Full tool list | 20 tools: sites, sessions, capabilities, tasks, findings, notifications, incidents, site checks, guard.justify | sites.list → session.open → capabilities.list(site_id) → tasks.create(site_id, capability_id, tool_id, arguments, instruction) → tasks.get → session.close |
| Tool Assist | The same, plus tools.suggest — capabilities.list has no tool catalogue | sites.list → session.open → tools.suggest(site_id, request) → check the proposal → tasks.create → tasks.get → session.close |
| MCPAssist | 6 tools: sites.list, session.open, session.close, session.status, mcpassist, guard.justify | sites.list → session.open → mcpassist(site_id, instruction) — on need_information or ambiguous, call it again with the same task_id and the answer → session.close |

With MCPAssist, ask mcpassist in plain words when you need to know what to fix or what’s new: “What needs fixing on this site?”, “Tell me about finding <id>”, “Any new notifications?”. It answers without changing anything.

Work a person wrote for you: tasks.pending lists tasks people suggested to you; tasks.resolve picks the tool and runs it. Several steps that make one job: give them the same job_id, then call jobs.finish.

## Tools

| Tool | What it does |
| --- | --- |
| sites.list | The sites your key can reach, with their status. |
| session.open / session.status / session.close | Open, check and close your session on a site. |
| capabilities.list | What a site can do: capabilities and their tools, with input schemas and required permissions (the catalogue only in Full tool list mode). |
| tasks.create | Run one tool on a site, with arguments matching its schema. |
| tasks.pending / tasks.resolve | Tasks people wrote and suggested to you; decide the tool and run it. |
| tasks.get | A task’s status and, once finished, its results or errors. |
| jobs.finish | Finish a multi-step job; may offer to save it as a reusable Skill. |
| findings.list / findings.get / findings.attempts | Problems the site checks found, one finding’s full detail, and past attempts to fix it. |
| audits.run / audits.status | Start a site check — or re-check specific findings after a fix — and follow it. |
| notifications.list / notifications.read | What’s new: findings, incidents, security alerts, task outcomes; mark them read. |
| incidents.list / incidents.get | Monitoring incidents and security alerts. |
| tools.suggest | Tool Assist: describe the job, get the right tool and arguments (nothing runs). |
| mcpassist | MCPAssist: say what you want; AICOMBase does it — or answers your question. |
| guard.justify | Answer an MCP Guard challenge. |

## Answers and errors

| You get | It means | Do this |
| --- | --- | --- |
| NO_ACTIVE_SESSION | No open session on that site. | session.open, then repeat the call. |
| guard_challenge | MCP Guard wants a reason before the action runs. | guard.justify(challenge_id, justification), then repeat the exact same call. |
| held_for_approval | A person must approve it. | Stop; tell the person. Don’t retry. |
| need_information / ambiguous | MCPAssist needs an answer to continue. | Call mcpassist again with the same task_id and the answer. |
| “isn’t available with this connection key” | That tool isn’t part of your key’s mode. | Use the tool the message names. |
| “doesn’t have the scope …” | Your key lacks that permission. | Tell the person; they can change the key. |
| Blocked by policy | The site’s policy doesn’t allow this work. | Tell the person; it’s their decision. |
| key_expired / ip_not_allowed | The key expired, or this IP isn’t allowed. | Stop; a person has to change or replace the key. |
| “… is included in every paid plan” | Tool Assist or MCPAssist on a Free account whose 30-day trial has ended. | Tell the person: they can upgrade, or switch the key to Full tool list. |
| outside_working_hours | The key only works in its hours (listing tools still works). | Try again inside the hours given. |
| Dry-run only key | Writes come back as a preview; tools that can’t preview are refused. | Report the preview; nothing was changed. |
| rate_limited (-32005) | More than 120 requests a minute with this key. | Wait a minute. |
| bad_bearer / missing_bearer | The key is wrong, revoked or missing. | Check the Authorization header. |

# The AICOM plugin for AI agents.

URL: https://aicombase.com/docs/ai/aicom

AICOM also works on its own: an AI can connect straight to one WordPress site. Use this for a single site; use AICOMBase to work across many sites with central rules.

## Connect

|   |   |
| --- | --- |
| Endpoint | POST https://YOUR-SITE/wp-json/aicom/v1/mcp — MCP JSON-RPC 2.0. Without pretty permalinks: POST https://YOUR-SITE/?aicom=1. Health check: GET https://YOUR-SITE/?aicom=1. |
| Authentication | Authorization: Bearer aicom_… or X-API-Key: aicom_… — a key the site’s administrator creates in WordPress: AICOM → API Keys → Generate New Key. Shown once. |
| Methods | initialize, tools/list, tools/call — plus tools/search (find tools by keywords) and tools/describe (one tool’s full schema). |
| Apache servers | If the Authorization header is stripped, use X-API-Key — or the administrator adds to .htaccess: SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 |

```
POST https://example.com/wp-json/aicom/v1/mcp
Authorization: Bearer aicom_XXXXXXXX_…
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"wp.posts.list","arguments":{"post_type":"post","posts_per_page":10}}}
```

## What the site’s administrator sets up

- The free AICOM plugin, installed and active: https://wordpress.org/plugins/aicom/
- An API key with only the permissions (scopes) the AI needs — presets such as Content Assistant or SEO Editor help.
- Optional key limits: allowed IPs or binding to the first IP, working hours, dry run only, a compact tool list for small models, an expiry date.
- Optional site-wide locks: Soft Lock (read-only) or Hard Lock (only public tools).

## The rules

- Open a session before any change: session.open(name, description) — a short name and what you’ll do and why. Writes, deletions and admin actions without one fail with NO_ACTIVE_SESSION. Check with session.status; finish with session.close.
- Destructive tools need "confirm": true in the arguments.
- Add "dry_run": true to see what would change without changing anything.
- Add an "idempotency_key" to writes: if you retry, you get the first result instead of doing it twice.
- Locks win: Soft Lock allows reading only; Hard Lock allows only public tools such as server.status.
- AICOM backs up posts, terms and Elementor pages before changing them; a person can restore a whole session. You don’t need to back up yourself.
- tools/list only shows tools your key may call. Small models: use tools/search with plain words, then tools/describe for the one tool you need.

## Errors

| Error | It means | Do this |
| --- | --- | --- |
| AUTH_FAILED | Missing, wrong, expired or revoked key — or a request from an IP the key doesn’t allow. | Check the key; ask the administrator. |
| DENIED_SCOPE | Your key lacks the permission this tool needs. | Tell the person; don’t retry. |
| NO_ACTIVE_SESSION | A change was attempted without an open session. | session.open, then repeat. |
| CONFIRM_REQUIRED | A destructive tool was called without confirm. | Make sure the person wants it; add "confirm": true. |
| SOFT_LOCK_ACTIVE / HARD_LOCK_ACTIVE | The site is locked. | Stop; only the administrator can unlock it. |
| BLOCKED_WORKING_HOURS | Outside the key’s working hours. | Try again inside the hours. |
| RATE_LIMITED | Too many requests. | Wait, then retry. |
| TOOL_NOT_FOUND | No such tool — or not one your key can see. | Use tools/search to find the right one. |
| IDEMPOTENCY_IN_PROGRESS / IDEMPOTENCY_CONFLICT | The same idempotency_key is still running, or was used for different arguments. | Wait — or use a new key for a different change. |

## When the site is connected to AICOMBase

Work sent from AICOMBase runs in AICOM sessions on the site too, marked as coming from AICOMBase, and is checked against AICOM’s own settings first. To work across many sites with one key, connect to AICOMBase instead: https://aicombase.com/docs/ai/aicombase

# Let your AI work on your sites — with a seatbelt.

URL: https://aicombase.com/ai-agents

Connect the AI you already use, give it a key that only opens what you allow, and keep the overview, the limits and the undo button.

## Any AI, three ways of working

Use whatever AI you prefer — a small model on your own computer, the assistant you already pay for, or the most powerful model available. They all connect the same way, over MCP, with a key you create. Each key works in one of three modes, depending on the AI:

| Mode | How the AI works | Best for |
| --- | --- | --- |
| Full tool list | It sees every tool it’s allowed to use and picks them itself. | Powerful models that should have full control. |
| Tool Assist | It describes the job; AICOMBase proposes the right tool, and the AI checks and runs it. | Saving tokens: the AI doesn’t read hundreds of tool descriptions. |
| MCPAssist | It just says what it wants in plain words; AICOMBase does the rest, step by step. | Small local models that get lost in long tool lists. |

Tool Assist and MCPAssist are part of every paid plan. A Free account gets both for its first 30 days.

## Keys: only what you allow

You create a key in AICOMBase and paste it into your AI app. Each key is limited to:

- The sites you pick — or whole categories of sites.
- The permissions you pick, with the same names as in the AICOM plugin.
- Optional limits: only from certain IP addresses, only during working hours, preview-only (dry run), or an expiry date.

A key can never do more than your policy for the site allows, and you can revoke it at any time. Presets save a combination you use often.

## Every job is a session

The AI opens a session with a name and a goal, works inside it and closes it once the result is checked. Without an open session the plugin refuses the work. You can read every session step by step — in AICOMBase and in WordPress (AICOM → Activity → Sessions) — and undo it.

## MCP Guard: a second pair of eyes

MCP Guard checks risky actions before they run, against your rules and against what the AI said it was doing in the session:

- Clearly fine — the action runs.
- Unclear — the AI has to explain why it needs it, before anything happens.
- Can’t be undone and still unclear (deleting users, for example) — it waits for your approval, and you get an email.
- Clearly harmful — the key is frozen at once, and nothing more runs until a person looks at it.

You write rules in plain words — “Never deactivate the WooCommerce plugin” — and sensible rules are built in. MCP Guard is meant as a paid option; for now it’s included on every plan as a trial.

## Connecting your AI app

ChatGPT, Claude on the web and the Claude app sign in instead of using a key: add a custom connector (in ChatGPT, a custom MCP server) with the address https://aicombase.com/api/mcp. It sends you to AICOMBase, where you sign in and choose the sites, the permissions and the mode — that becomes the app's key, shown on the Keys page, where you can change or disconnect it. Other AI apps use a key you make yourself:

1. **Create a key** — In AICOMBase, open Keys → Generate New Key: pick the sites, the permissions and the mode.
2. **Add AICOMBase to your AI app** — In any AI app or agent that supports MCP, add a remote MCP server with the AICOMBase address and your key (shown on the Keys page).
3. **Ask for something** — “Update the opening hours on the Contact page of example.com to 9–17.” The session appears live in AICOMBase.

# Find it. Fix it. Check it again.

URL: https://aicombase.com/audits

Site checks (audits) read your public pages and turn what they find into a short action plan: what to fix first, why it matters and how — then check again to confirm it’s fixed.

## Four kinds of check

- **Privacy & GDPR** — Cookies and trackers that load before the visitor agrees, a missing consent banner, missing privacy or cookie policy links, forms that collect personal data without a notice, fonts and videos loaded from other companies’ servers. Rules for the EU, with a Romanian overlay.
- **Accessibility (WCAG 2.2 AA)** — Images without a description, form fields without labels, buttons and links without a name, text that is too light, zoom switched off, keyboard traps — the things the European Accessibility Act cares about.
- **Security setup** — HTTPS and redirects, security headers, files and folders that shouldn’t be public, user names that anyone can look up.
- **Technical health** — Errors, slow or failing pages, broken links and setup problems that hurt visitors and search engines.

## What you get: an action plan

- Each problem in plain words, with why it matters and how to fix it — and the evidence, such as the page and the exact element.
- Sorted by priority: urgent, important, or when you have time.
- Who can fix it: your AI agent, you, or your developer.
- A checklist for the things no robot can decide, such as whether your privacy policy is right for your business.

Every run is compared with the last one, so you see what’s new, what got fixed and what came back.

## From problem to fixed

1. **A problem is found** — For example: “12 images without a description on /shop”.
2. **It becomes a task** — One click turns it into a task with all the details, for your AI agent or for you.
3. **The work is done in a session** — Within your limits, with a backup, step by step.
4. **The pages are checked again** — If the problem is gone, it’s marked fixed — with a link to the work that fixed it.

How often checks run and how many pages they read depends on your plan.

> Site checks report what they can observe on your pages. They are not legal advice and don’t certify that a site complies with any law.

# Built so that a mistake — human or AI — stays small.

URL: https://aicombase.com/security

A dashboard connected to all your sites must never become the weak spot. This is how AICOMBase is built to prevent that.

## The connection

- No WordPress passwords. Each site has its own digital identity; its secret key never leaves the site.
- Everything travels over HTTPS and every message is signed. Old, repeated or altered messages are rejected.
- Every action needs a one-time permission, valid only for that site and that step, for a few minutes.
- You can pause, renew or cut a connection at any time — from AICOMBase or from inside WordPress.

## Limits on what can happen

- The site decides first: AICOM’s own settings in WordPress say what AICOMBase may do there, and AICOMBase can never go beyond that.
- A policy per site sets which kinds of work are allowed and how risky they may be.
- AI keys are limited to the sites and permissions you choose, and MCP Guard checks risky AI actions before they run.
- No work outside a session, and a backup before every change, so work can be undone.
- Roles for your team — a Viewer can’t change anything.

## Security alerts

Signals from every site — failed logins, unexpected plugin or user changes and the like — become security alerts in one place. On every paid plan, Security Bot reads them across all your sites and tells you which ones matter, and a daily security check looks at your public setup.

## Records you can trust

- An audit log of every security and settings change that can’t be edited or deleted — and never contains passwords or keys.
- Two-factor sign-in and a list of signed-in devices for every account.
- AI only ever receives the information a decision needs.

> AICOMBase watches, records and coordinates — it isn’t an antivirus or a firewall. Keep your hosting’s security and backups in place.

# Pricing

URL: https://aicombase.com/pricing

- **Free** — €0; up to 1 site; monitoring as often as every 15 min; 30 days of history; up to 10 pages per audit.

- **Solo** — €6 / month (launch price for the first year, then €12 / month); up to 3 sites; monitoring as often as every 5 min; 365 days of history; up to 100 pages per audit.

- **Pro** — €15 / month (launch price for the first year, then €29 / month); up to 10 sites; monitoring as often as every 5 min; 365 days of history; up to 100 pages per audit.

- **Agency** — €35 / month (launch price for the first year, then €69 / month); up to 30 sites; monitoring as often as every 5 min; 365 days of history; up to 100 pages per audit.

- **Scale** — €79 / month (launch price for the first year, then €149 / month); up to 100 sites; monitoring as often as every 5 min; 365 days of history; up to 100 pages per audit.

Prices are per month, in euro, plus VAT where it applies. Paid by card, Apple Pay or Google Pay from Plan & Usage in the account; Stripe sells on AICOMBase's behalf through Link, adds the VAT and emails receipts and invoices (EU businesses can enter a VAT number at checkout).

Moving up a plan starts at once and only the difference for the rest of the paid month is charged. Moving down, or cancelling (back to Free), takes effect when the paid month ends; until then the plan paid for stays. Nothing is deleted: sites beyond a smaller plan's limit pause monitoring.

# An agency with 12 client sites: Monday morning in five minutes

URL: https://aicombase.com/use-cases/agency-monday-morning

For: Agencies and freelancers. Illustrative example.

How a small web agency uses AICOMBase to check every client site at once, catch an expiring certificate and new accessibility findings before clients notice, and send one update to all shops.

## Before

Ana runs a three-person web agency. Every Monday she used to open twelve WordPress dashboards, one after another, looking for update warnings, broken contact forms and anything a client might complain about. It took the whole morning, and things still slipped through.

## With AICOMBase

1. **One screen** — She opens AICOMBase. Eleven sites are green. One is marked “Attention”: the SSL certificate of a client’s shop expires in six days.
2. **One list** — “Needs you” also shows two new accessibility findings on another site (form fields without labels) and a task that failed on Friday.
3. **One instruction, many sites** — The four WooCommerce shops all need the new holiday shipping notice. She writes one task, picks the “Shops” category, and sends it. Each shop gets its own session she can read and undo.
4. **Proof for clients** — At the end of the month she shows each client the audit history: what was found, what was fixed, and when.

## What changed

- Monday check: from a morning to a coffee.
- Problems found before the client calls.
- Every change has a written record — no more “what did you do to my site?”.

# “What did the AI just do?” — reading a session like a receipt

URL: https://aicombase.com/use-cases/see-what-ai-changed

For: Site owners new to AI. Illustrative example.

A shop owner asks AI to update the contact page. Here is exactly what they see in AICOMBase afterwards, and how to undo it in one click if they don’t like the result.

## The request

Mihai owns a bakery with a small WordPress site. He moved to a new address and asks his AI assistant: “Update the address on the Contact page, in Romanian and English.”

## The receipt

In AICOMBase a new session appears: “Update Contact page address”. Inside it, step by step:

- Read the Contact page.
- Updated the address (Romanian).
- Updated the translation (English).
- Verified the result — both pages show the new address.
- Session closed: completed.

Each step shows which tool ran, on which page, and when. Nothing happened outside the session.

## Changed your mind?

Mihai notices the AI also shortened the opening-hours line, which he didn’t want. He clicks “Restore session”. The plugin replays the backups it took before each change, newest first, and the page is back as it was.

> Restoring works because AICOM takes a backup before it changes something. That’s also why the plugin refuses work outside a session.

# Getting a shop ready for the European Accessibility Act, step by step

URL: https://aicombase.com/use-cases/accessibility-european-accessibility-act

For: Online shops in the EU. Illustrative example.

A plain-language walkthrough: run an accessibility audit, understand the findings (alt text, form labels, contrast), let AICOM fix the safe ones, and recheck — without becoming an expert.

## Why this matters

Since June 2025, the European Accessibility Act requires many online shops and services in the EU to be usable by people with disabilities. The common technical yardstick is WCAG. Most problems on real shops are boring and fixable: images without descriptions, form fields without labels, text that is too light to read.

## 1. Run the audit

In AICOMBase, open Site checks → Accessibility and run it on your shop. It reads as many pages as your plan allows and checks them against WCAG 2.2 Level AA.

## 2. Read the findings

| Finding | In plain words | Who fixes it |
| --- | --- | --- |
| Image without alternative text | A blind visitor’s screen reader says “image” and nothing else. | AICOM can add descriptions; you check them. |
| Form field without a label | The checkout field “Phone” has no label a screen reader can read. | AICOM can fix in most themes. |
| Text contrast below minimum | Light grey text on white is hard to read. | Usually a theme setting — often yours. |
| Viewport disables zoom | People can’t zoom in on mobile. | AICOM can fix. |

## 3. Fix and recheck

Open a finding your AI can fix, click “Add task”, then “Suggest to AI agent”. The AI fixes it in a session, with a backup. When it’s done, the pages are checked again and fixed findings are marked as fixed.

Some items can’t be checked by a robot — for example whether your checkout can be completed with a keyboard only. AICOMBase lists those as a manual checklist so they don’t get forgotten.

> An audit helps you find and fix problems. It is not a legal certificate.

# Cookies before consent: finding the tracker your banner missed

URL: https://aicombase.com/use-cases/cookies-before-consent

For: Anyone with analytics or ads on their site. Illustrative example.

Why a cookie banner isn’t enough, how the AICOMBase privacy audit catches tracking that fires before the visitor clicks “Accept”, and what to do about it.

## The problem

Under EU rules, non-essential cookies and trackers should only load after the visitor agrees. Many sites have a cookie banner but still load an analytics or advertising script straight away, because it was added by a theme, a plugin or a copy-pasted snippet.

## What the audit sees

- Cookies set before consent — measured on a fresh visit, before anything is clicked.
- Requests to known tracking services before consent.
- Tracking code in the page even when no consent tool is detected.
- Embeds (videos, maps) and fonts loaded from third parties on page load.
- Missing privacy-policy or cookie-policy links, and forms that collect personal data without a notice.

Each finding shows the evidence — the cookie name, the request URL, the page — so you can see it for yourself.

## Fixing it

Often the fix is to let your consent plugin manage the script, or to switch an embed to a click-to-load version. AICOM can make supported changes inside a session; the audit then runs again to confirm the tracker no longer loads before consent.

> The privacy audit reports what it observes. It is not legal advice.

# At 2 a.m. an AI agent tried to deactivate WooCommerce. Here’s what happened.

URL: https://aicombase.com/use-cases/mcp-guard-stops-a-risky-action

For: Teams running AI agents unattended. Illustrative example.

A realistic example of MCP Guard at work: a nightly AI job drifts off-task, the risky action is held for approval, the key is protected, and the owner decides in the morning.

## The setup

A shop runs a nightly AI job through AICOMBase: “Clean up draft products older than 90 days.” The key has the Content and WooCommerce scopes and MCP Guard is on, with the built-in rules plus one in plain language: “Never deactivate the WooCommerce plugin.”

## What went wrong

Halfway through, the agent hits an error and decides the fix is to deactivate and reactivate WooCommerce. That would take the shop offline.

## What MCP Guard did

1. **Rule matched** — The action matched “Never deactivate the WooCommerce plugin”.
2. **Whole session reviewed** — The decision engine compared it with the session’s stated goal (cleaning drafts). Deactivating the shop has nothing to do with that.
3. **Asked to justify** — The agent explained: “to clear a cache error”. Not convincing for an action that takes the shop down.
4. **Held, not run** — Deactivating a plugin on a live shop isn’t treated as safely reversible, so it waited for a person. The owner got an email.

In the morning the owner read the session, denied the action and fixed the cache issue by hand. The shop never went down. Had the session looked malicious, the key would have been frozen on the spot.

# Your site went down at night. What AICOMBase shows you.

URL: https://aicombase.com/use-cases/site-down-at-night

For: Every site owner. Illustrative example.

From the first failed check to the recovery: how incidents, alerts and timelines work, and why outside monitoring matters even when nobody is working on the site.

## The timeline

- 03:12 — the check from outside gets an HTTP 503. One failed check isn’t an incident yet — it could be a blip.
- 03:14 — the following checks fail too: an incident opens, the site turns red in the overview and in “Needs you”, and you’re notified.
- 03:15 — the AICOM heartbeat is also missing, so it’s the whole server, not just one page.
- 07:40 — the host fixes the server. Checks pass, the incident closes by itself with its full timeline.

## Why outside checks matter

A plugin inside a broken site can’t report that the site is broken. AICOMBase checks from the outside — availability, response time, SSL — so you know even when the site itself can’t tell you.

# Asking your AI to publish a bilingual news post on your WordPress site

URL: https://aicombase.com/use-cases/ai-publishes-bilingual-post

For: People who already use an AI assistant. Illustrative example.

What it looks like to connect your preferred AI to WordPress through AICOMBase: create a key, ask in plain words, and watch a session open, run and close — with nothing done outside it.

## 1. A key that only opens the news section

In AICOMBase, Elena creates a key for her association’s site with only the Content and Media scopes and the “Tool Assist” mode. Her AI won’t even see plugin or user tools — and with Tool Assist it doesn’t read a tool list at all, which keeps token use low.

## 2. The request

In her AI assistant: “Publish a news post in Romanian and English about our autumn volunteer day on 18 October, in the News category, with the photo I attached.”

## 3. What happens

1. **Session opened** — The AI opens a session called “Autumn volunteer day news post” with a short description of the goal.
2. **Work inside it** — Uploads the photo, creates the Romanian post, creates the English translation, links them and puts both in News.
3. **Checked and closed** — The AI reads both posts back to confirm, then closes the session as completed with a summary.

Elena sees the session in AICOMBase and also in WordPress under AICOM → Activity → Sessions, marked as coming from AICOMBase. If the AI had tried to do anything without opening a session first, the plugin would have refused.

# Frequently asked questions

URL: https://aicombase.com/faq

## What is AICOMBase?

An online dashboard for all your WordPress sites: it tells you when a site is down, what needs fixing, and what AI changed on it — and lets your AI work on your sites safely.

## What is AICOM?

A free WordPress plugin. It lets AI do real work on a site — edit content, translate, manage WooCommerce and more — within limits you set, with backups and a record of every change. It links each site to AICOMBase.

## Do I need AICOMBase to use AICOM?

No, AICOM works on its own. AICOMBase adds the view from outside: monitoring, site checks, alerts, history and control across many sites.

## How do I connect a site?

Install the free AICOM plugin, click Connect on its AICOMBase page and confirm. Step by step: https://aicombase.com/docs/aicom

## Which AI can I use?

Any AI app that supports MCP. ChatGPT, Claude on the web and the Claude app sign in with your AICOMBase account; Claude Desktop, Claude Code, Cursor and others — including small models on your own computer — use a key you make on the Keys page: https://aicombase.com/ai-agents

## Can I use ChatGPT?

Yes. In ChatGPT, add a custom MCP server (custom connector) with the address https://aicombase.com/api/mcp and OAuth sign-in. ChatGPT sends you to AICOMBase, where you choose the sites and permissions it gets. Whether ChatGPT offers custom MCP servers depends on your ChatGPT plan. Claude on the web works the same way: Settings → Connectors → Add custom connector.

## Can the AI break my site?

Only within the limits you set, only inside a session, and with a backup first, so work can be undone. MCP Guard can stop risky actions before they run: https://aicombase.com/security

## Does it help with GDPR and the European Accessibility Act?

The site checks find the most common privacy and accessibility problems and help you fix them. They are not a legal certificate: https://aicombase.com/audits

## What happens if a site goes down?

It’s marked offline, an incident opens with a timeline, and you’re notified. It closes by itself once the site is back.

## Can my team use it?

Yes. Invite people as Owner, Administrator, Operator or Viewer. Each person signs in with their own account and chooses their own notifications.

## How much does it cost?

One site is free, with no credit card. See the plans: https://aicombase.com/pricing

## Where is my data stored?

On AICOMBase’s own servers, kept for 30, 90 or 365 days depending on your plan. The Privacy Policy has the details.

## Where do I get help?

On our Support page on GitHub: https://github.com/dudaster/aicom/issues — for questions, bug reports and ideas. It’s public, so never post keys or passwords there.

# Glossary: the words used in the dashboard

## AICOM

The WordPress plugin installed on each of your sites. It does the actual work on the site and reports back to AICOMBase.

AICOM lives inside WordPress. It knows your pages, plugins and settings, carries out work within the permissions you allow, takes a backup before changing things and keeps its own record of every session. AICOMBase is the online control centre that talks to AICOM on all your sites.

## AICOMBase

This dashboard: one place to watch, check and steer all your WordPress sites that run AICOM.

## Needs you

The one list of everything waiting on a person, most urgent first — each with the button that fixes it or hands it on.

Approvals first, then outages (a server that took several sites down is one row), security, connections, site checks, AI work that didn't finish. A row leaves when the problem is gone, or when someone accepts it with a reason; what was closed lately is listed under Done recently.

## Job

One request — by you, your AI agent or a site-check fix — with its result on every site it touched.

An AI agent sends one task per site, seconds apart; Work shows them as one job: done here, didn't work there and why, with Retry for the sites it never reached and Undo for what it changed.

## Connection

The secure link between AICOMBase and the AICOM plugin on one site. No WordPress password is ever shared.

Each site gets its own cryptographic key when you connect it. You can pause the connection (nothing runs), lock it, rotate its key or revoke it at any time from the site's Connection tab.

## Heartbeat / check-in

A small “I'm alive” message the AICOM plugin sends to AICOMBase every minute or so. If it stops, AICOM shows as offline.

The heartbeat says the plugin is running, which version it is and whether there's work waiting. It contains no content from your site.

## Task

A request for work on one or more sites — written by you, created by an AI agent, or created from a site-check finding.

A task says what should happen (for example “update the opening hours on the Contact page”) and on which sites. It runs inside a session on each site, so you can see every action and undo it.

## Session

One piece of work on one site, from start to finish, with every action inside it. Sessions can usually be undone.

AICOM refuses to change anything outside a session. A session has a name and a goal, lists each action with its result, and — when the tools used keep backups — can be restored (undone) with one click.

## Action

One single step AICOM performed inside a session, e.g. “update post 12” or “set the description of image 83”.

## Restore / undo a session

Puts back what a session changed, using the backups AICOM took before each change.

Only possible when every tool used in the session keeps a backup (marked “reversible”). Things outside the site — emails sent, caches — can't be undone.

## Background lookup

A small read-only step AICOMBase runs on its own to find something (a post, a menu, a category) before doing the real work. Hidden by default.

For example, before “add this post to the News category”, AICOMBase looks up which category is called News. These lookups never change anything and are hidden from lists unless you ask to see them.

## Activity

The day-to-day history of everything that happened on your sites: work, checks, connections, alerts.

## Audit Log

A permanent, tamper-proof record of important control decisions (who connected a site, changed a policy, approved something). Unlike Activity, it can't be edited or deleted.

## Capability

A group of things AICOM can do on a site, e.g. “Posts & pages”, “Media library”, “WooCommerce”. Reported by the plugin itself.

A site has a capability when AICOM (and, for things like WooCommerce, the related WordPress plugin) is installed and active — you don't switch capabilities on or off in AICOMBase. Each one contains several tools. Whether AI may actually use them is decided by your policy for the site, the agent's key and AICOM's own settings on the site; the Capabilities pages show the result for every tool.

## Clautron

A free WordPress plugin by dudaster.com that adds small site features (a redirect, an admin column, a cookie banner…) without a separate plugin for each.

Clautron calls those features capabilities — features of the site itself, not to be confused with AICOM's capabilities (what AI can do). With Clautron on a site, AICOMBase can install or deactivate its ready-made features from the site's Capabilities tab, and your AI agent can build new ones. Get it in WordPress → Plugins → Add New (needs WordPress 7.0+).

## Tool

One specific operation inside a capability, e.g. “list posts” or “set image alt text”. Shown with a technical name like wp.posts.list.

## Permission (scope)

A permission area such as “Create & edit posts” or “Manage plugins”. The AICOM plugin on the site, the site's policy and the AI key must all allow it before anything runs.

Scopes have technical names like write.wp.posts. Think of them as the boxes you tick when giving someone access: only the ticked areas are allowed.

## Policy

An optional limit for a site: whatever an AI key allows, a policy can block it on the sites that follow it. Permissions themselves are given on each key. Every site follows one policy — by default one that limits nothing.

What an AI agent may do is given on its key: which sites, which permissions. On top of that, three things can only take away: the site's policy (optional — e.g. “Read only” on a client's site where AI must only look), the AICOM plugin's own settings in WordPress, and MCP Guard, which watches what the agent actually does. A policy starts from a template and you can then change every permission.

## Default policy

The policy every site follows until you give it another — including sites you connect later. Normally it limits nothing, so the AI key decides. There is always exactly one.

Give a site a policy of its own and it follows that one instead; take the assignment away (or delete that policy) and the site goes back to the default. A new workspace starts with “Default — no limit”, built from the No limit template (the AI key decides), plus a “Read only” policy ready to assign. You can make any policy the default from its page.

## Policy template

A ready-made starting point for a policy. It only fills in the first permissions — you can change each one afterwards, and the policy then shows as Custom.

No limit: the AI key decides — nothing extra is blocked on these sites. Read only: AI can look, never change. Content editor: AI can write and edit posts, pages and media; no plugins, users or settings. SEO editor: AI can edit SEO fields, categories and alt text; can't write new content. Full access: AI can do everything AICOM offers, including plugins, settings, users and files. Custom: AI can do only what you tick; starts with nothing allowed.

## Risk level

How much damage a tool could do if misused: Low (read only), Medium (edits content), High (deletes, users, files), Critical (settings, plugins).

## Reversible

AICOM keeps a backup before this kind of change, so a session using it can be undone.

## Pause / lock

Pause stops new work on a site until you resume it. An emergency lock also blocks it on the site's side — use it if something looks wrong.

## AI agent

An AI assistant you connect yourself (from a small local model to the most powerful ones) that works on your sites through AICOMBase.

You give it an AI connection key. It can only use the sites and permissions on that key, always works inside sessions and is checked by MCP Guard.

## AI connection key

A password-like token you give to an AI agent. It decides which sites and permissions that agent may use. You can pause or revoke it any time.

## MCP

Model Context Protocol — the standard way AI apps connect to tools. AICOMBase speaks it, so most AI apps can connect to it.

## MCP Guard

A safety check on everything an AI agent does: suspicious or irreversible actions can be held for your approval or the agent's key frozen.

## Tool Assist / Tool Router

Gives an AI agent only the few tools it needs for a job instead of the full list — fewer mistakes and lower AI costs.

## MCPAssist

One single tool for small or local AI models: the model says what it wants in plain words and AICOMBase does the tool work.

## Workflow

A fixed, step-by-step recipe that runs exactly the same way every time, without an AI choosing the steps.

## Skill

A reusable recipe saved by your AI agent after doing a multi-step job, so it can repeat it next time.

## AI judgement / AI-assisted

An opinion from AI that helps you decide what to look at first. It never changes the facts and never acts on its own.

## Automatic check (deterministic)

Measured by a fixed rule, not guessed by AI — the same input always gives the same result.

## Site checks (audits)

Automatic checks of your public pages: Privacy & GDPR, Accessibility, Security setup and Technical health.

## Finding

One specific problem a site check found, with the evidence and how to fix it.

## Uptime

The share of checks in which your site answered normally. 99.9% over 30 days ≈ 43 minutes of trouble in a month.

## Response time

How long your site takes to answer one request from our servers. Under 1 second is good.

## Degraded (slow)

The site is up but answers much slower than it usually does — more than 3× its usual time over the last 7 days. About speed, not an outage.

It can be almost anything that slows pages down: a page cache plugin switched off or cleared, a plugin or theme update, a busy server (other sites on it, backups, traffic, bots), hosting limits, a slow database, or an outside service the page waits for. Check the cache first and what changed when it started; if other sites on the same server are slow too, it's the server. It closes by itself once the site is back near its usual speed.

## p95 (95th percentile)

The time 95 out of 100 requests were faster than. It shows the slow moments an average hides.

## Incident

A period when a site was down, erroring, too slow or AICOM lost contact. It opens by itself and closes when checks pass again.

## SSL certificate

What makes the padlock and https:// work. When it expires, browsers show visitors a big warning.

## Security alert

A security event worth a look, e.g. many failed logins, an unexpected new administrator or unusual AI activity.

## Security Bot

AI that reads all security alerts across your sites and tells you which ones matter most. It only advises.