AI Agents & Chat for Amazon Bedrock: the WordPress chat and MCP plugin this site runs on

Open-source WordPress plugin for Amazon Bedrock on your own AWS account: streaming chat, a controlled agent, MCP server and client, rule-based answer checks.

“AI Agents & Chat for Amazon Bedrock” is an open-source WordPress plugin published on wordpress.org, and it is the plugin this site runs on. It calls Amazon Bedrock directly with the site owner’s own AWS account, provides streaming chat and a tool-using agent on the site, exposes the site itself as an MCP server, and includes a rule-based regression check for answers. Its defaults are conservative: visitor chat is off by default, the only write operation its tools can perform is creating a draft, and credentials never have to be stored in the database.

Connection and credentials

Model requests go directly from the WordPress server to the Bedrock regional endpoint you configure. The plugin author runs no relay service, and the plugin sends no usage telemetry to the author. Supported models are the text models your account can use in that region: Anthropic Claude, Amazon Nova, Amazon Titan, Meta Llama, Mistral, DeepSeek, as well as OpenAI gpt-oss, Qwen3, Kimi, and others. Models other than Claude, Nova, and Titan go through the Bedrock Converse API. New installs default to Amazon Nova Lite.

It is not an official AWS product. The readme states that it is an independent open-source plugin with no affiliation to Amazon. The code is licensed GPL-2.0-or-later and requires WordPress 6.4+ and PHP 7.4+. The current version is 1.47.6.

Signing credentials are resolved in this order: wp-config.php constants, encrypted saved settings, environment variables, the ECS/EKS task role, and the EC2 instance role obtained through IMDSv2. A site deployed on AWS can avoid storing long-term keys in WordPress entirely. For a site that is not on AWS, the quickest route is to generate an API key in the Bedrock console and paste it into the settings page; the key is stored encrypted and is not displayed again after saving. You can also define it as the AI_CHAT_BEDROCK_API_KEY constant, or use the AWS_BEARER_TOKEN_BEDROCK environment variable that AWS SDKs recognize. An API key works for chat, streaming, model listing, and embeddings; Knowledge Bases, Prompt Management, and AgentCore Gateway do not accept API keys and still require an IAM role or access keys.

The Diagnostics page sends a real request to test connectivity, shows which credential source is in effect (without showing the secret itself), and generates a least-privilege IAM policy based on the features the site actually has enabled, so you don’t have to attach a broad managed policy.

Chat and agent: designed on the assumption that public chat will be abused

  • Visitor access is off by default; visitors don’t see the chat until it can actually answer. Requests are rate-limited per visitor and per profile; you can also set separate limits per role and a site-wide daily cap.
  • Streaming uses a single authenticated POST with Server-Sent Events, so conversation content never appears in a URL, and each message maps to exactly one Bedrock call. When a visitor stops a response midway, the server-side Bedrock request stops too. If cURL is missing or a proxy buffers the stream, the plugin falls back automatically to a single non-streaming request.
  • Tools run on the server, so the browser cannot forge tool results, and tool output is always passed to the model as untrusted data. Using tools requires the edit_posts capability by default. External MCP tools that look like they modify data are blocked until an administrator allows them, and even then only administrators can use them. Each round allows at most 5 calls, the number of rounds can be set from 1 to 5, and the final round offers no tools, so the conversation is guaranteed to end. Every call is written to an audit log that records only the tool name, round, result, duration, and argument key names, not argument values or output.
  • Retrieval indexes only published content that is not password-protected. Once an embedding model is selected, matching is semantic; questions the site doesn’t cover get an empty context and are listed as “content gaps” on the Conversations page.
  • Also supported: prompts managed in Bedrock Prompt Management, a fallback model used when the primary one is throttled or unavailable, up to 10 chat profiles, a floating launcher button, and Claude prompt caching (the admin screens show the number of cache-read tokens).

MCP: both server and client

As a server, the site provides JSON-RPC 2.0 over Streamable HTTP at /wp-json/ai-chat-bedrock/v1/mcp, using protocol version 2026-07-28 while remaining compatible with clients on versions 2025-11-25 and 2025-06-18. By default it offers 5 read-only content tools that return only published content; with site abilities enabled, it adds SEO suggestions, WooCommerce product lookup, and draft creation. Authentication can use WordPress Application Passwords or OAuth 2.1 (dynamic registration, mandatory PKCE S256, one-hour access tokens, refresh token rotation, and only token hashes stored). Anonymous access and OAuth are both off by default.

As a client, it can call external MCP servers and Amazon Bedrock AgentCore Gateway, with no authentication, an encrypted stored bearer token, or SigV4. Endpoints must be public HTTPS addresses: private, loopback, and link-local addresses and URLs containing credentials are rejected, redirects are disabled, and response size is capped. On WordPress 7.0 and later, the plugin also registers Bedrock with the core AI Client, so when other plugins call wp_ai_client_prompt(), those requests also go through this plugin’s limits and usage tracking.

Answer checks without model grading

You write a set of questions with known correct answers, then run wp ai-chat-bedrock eval. Each question goes through the same pipeline the chat actually uses, and results are reported by category: grounding, match strength, citations, required or forbidden text, tool calls, and token budget. When a check fails, the command exits with a non-zero code, so it can serve directly as a deployment gate; --compare shows per-category differences before and after a change. Every check is decided programmatically: nothing grades style or tone, and no model judges another model. Items that cannot be checked programmatically are reported as “not checked” and never count as passing. WP-CLI also provides subcommands such as index, index-status, diagnose, and usage.

Installation and caveats

  1. First enable access to the target models in your chosen AWS region, and prepare an IAM identity that can invoke only the models you need. Do not give the WordPress site administrator-level AWS permissions.
  2. Search for the plugin in the plugin directory, install and activate it, open AI Chat Bedrock > Settings, choose a region, enter an API key or access keys (or leave both empty to use the server’s IAM role), then choose a model.
  3. After saving, run Diagnostics, then insert the

    Physical AI Lab · AI Assistant

    Hi! I'm the Physical AI Lab's AI assistant. Ask me anything about robotics, embodied AI or the course.
    Powered by Amazon Bedrock
    shortcode or the chat block into a page.
  4. Before opening chat to visitors, check model pricing and your rate-limit settings.

Limitations

  • The token counts shown in the admin screens are the counts Bedrock returns, not cost estimates. Rate limits reduce unexpected usage but do not guarantee a billing cap; set up AWS Budgets on the AWS side before making chat public.
  • Conversation logging is off by default. When enabled, it keeps at most the 200 most recent question-and-answer turns in a WordPress option and supports WordPress’s built-in personal data export and erasure. Whether you need to tell visitors about this or obtain their consent is for the site owner to decide based on their jurisdiction.
  • Short-term Bedrock API keys expire after at most 12 hours, which suits testing but not a production site. Some models require a cross-region inference profile (IDs starting with us., eu., or global.) and the corresponding IAM permissions.

Links

Related Posts