AI Access — Connect an AI Assistant

AI Access lets an external AI assistant — such as Claude, ChatGPT, or any MCP-compatible tool — connect into your store and answer questions about it in plain language:

• "How many orders did we get this week?"
• "What's running low on stock?"
• "Which invoices haven't been sent to myDATA yet?"
• "Show me order #1042."

The assistant connects securely, can only read (it cannot change anything), and only sees what the account you authorize is allowed to see.

Beta feature — opt-in and off by default

AI Access is currently in beta. It requires Flavor Core 2.9.1 or later and WordPress 6.9 or later, and it is off until you turn it on in Flavor → Flavor AI → AI Access.

How it works

1. Install the AI Pack (a small add-on) from the Flavor AI dashboard.
2. Turn AI Access on.
3. Create a WordPress Application Password and give it to your AI assistant.
4. Your assistant connects to your store's secure address and can answer questions about it.

Nothing leaves your store except the answers to the questions your assistant asks — and only the read-only information listed below. The connection runs entirely on your own site; nothing is routed through Flavor's servers.

What the assistant can see (read-only)

When AI Access is on, the assistant can query:

Area	What it can read
Products	Catalog search — titles, SKUs, prices, stock levels
Orders	List and search orders; full detail for a single order
Stock	Per-warehouse stock levels and totals for a product
Customers	Search your CRM contacts
Invoices	Fiscal invoices and their myDATA transmission status
Dashboard	Aggregate order/revenue stats and low-stock alerts

Read-only, always

In this release the assistant can only read your store. It cannot create, edit, cancel, or delete anything. Letting an assistant make changes — with your approval on every action — is planned as a future Business-tier capability.

Your customers' privacy is protected

Personal details — customer names, emails, phone numbers, and addresses — are masked by default. The assistant sees that an order exists, its status, and its totals, but not who placed it. Internal-only figures, such as product cost/margin, are never sent at all.

If you run a trusted internal assistant and genuinely need it to read un-masked customer details, you can allow this deliberately: in Flavor → Flavor AI → AI Access, turn on Allow administrators to receive un-masked customer PII. It is off by default, and every time an assistant reads un-masked data it is recorded under Flavor → Debug. Leave it off unless you specifically need it.

Setting it up

Step 1 — Install the AI Pack

1. Go to Flavor → Flavor AI.
2. Open the AI Access tab.
3. Click Install the AI Pack. It downloads and installs in a few seconds.

Step 2 — Turn AI Access on

After the AI Pack is installed, switch on Enable AI Access (MCP server). The status changes to show a Read-only badge, your store's connection address, and the list of everything the assistant will be able to read.

Step 3 — Create an Application Password

Your AI assistant signs in to your store using a WordPress Application Password — a special password just for apps, separate from your normal login.

1. Go to Users → Profile (your own profile).
2. Scroll to Application Passwords.
3. Type a name you'll recognize (e.g. "Claude") and click Add New Application Password.
4. Copy the password that appears. You won't be able to see it again, so paste it somewhere safe right away.

Don't see "Application Passwords" on your profile?

For security, some sites disable this feature. When AI Access is on, Flavor re-enables it automatically. If it's still missing, check Optimize → Security & API in your theme settings and make sure "Disable Application Passwords" is unchecked.

Step 4 — Get your store's connection address

On the AI Access tab you'll see your store's Endpoint — a web address ending in /wp-json/flavor/mcp. Your AI assistant needs three things to connect:

• Endpoint: the address shown on the AI Access tab (ends in /wp-json/flavor/mcp)
• Username: your WordPress username
• Password: the Application Password from Step 3

Step 5 — Connect your assistant

Your assistant signs in with an Authorization header built from your username and Application Password. That value is the text username:application-password converted to Base64, written as Basic <that-value>. Keep it private — it's equivalent to a login.

A ready-to-copy setup is coming

A future update will show a ready-to-paste configuration (with this value already filled in) right on the AI Access screen, so you won't have to build it by hand. Until then, use the per-assistant steps below.

Claude Desktop — add this to your Claude Desktop configuration file, replacing the placeholders, then restart Claude Desktop:

{
  "mcpServers": {
    "my-store": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://your-store.com/wp-json/flavor/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Basic <your Base64 value>"
      }
    }
  }
}

(The Authorization: in args has no space on purpose — the actual Basic … value, which does contain a space, lives in the AUTH_HEADER env var. This avoids a known Windows quirk.)

Cursor — add to your mcp.json:

{
  "mcpServers": {
    "my-store": {
      "url": "https://your-store.com/wp-json/flavor/mcp",
      "headers": { "Authorization": "Basic <your Base64 value>" }
    }
  }
}

VS Code — add to .vscode/mcp.json:

{
  "servers": {
    "my-store": {
      "type": "http",
      "url": "https://your-store.com/wp-json/flavor/mcp",
      "headers": { "Authorization": "Basic <your Base64 value>" }
    }
  }
}

Which address to use

Always point the client at your full endpoint — the address ending in /wp-json/flavor/mcp shown on the AI Access tab — not just your site's home address.

Staying in control

• You turn it on. AI Access is off until you enable it — installing the AI Pack alone does not expose anything.
• It's read-only. No assistant can change your store through AI Access in this release.
• It respects roles. An assistant can only do what the account you authorized can do.
• Personal data is masked unless you deliberately allow un-masking (see above).
• Every read is recorded. Assistant activity is logged under Flavor → Debug, so you can review what was accessed.
• Requests are rate-limited to prevent runaway querying.
• You can turn it off anytime. Switch off the toggle in Flavor → Flavor AI → AI Access and the connection stops working immediately.
• You can revoke the key. Delete the Application Password under Users → Profile to cut off any assistant using it.

Before you connect an assistant

The assistant can read everything listed above as the account you authorize. Review what your AI client does with that information, and be cautious about connecting several different MCP servers in the same assistant session.

Frequently asked questions

Does this send my data to Flavor? No. AI Access runs entirely on your own site. Your assistant talks directly to your store; nothing is routed through Flavor's servers.

Do I need an AI subscription? You use your own AI assistant and your own AI account (for example, your Claude or ChatGPT subscription). Flavor doesn't charge per question.

Which plans include it? Read-only AI Access is available on every plan. The upcoming ability to let an assistant make changes (with per-action approval) will be a Business-tier feature.

What if I'm on an older WordPress version? AI Access relies on the WordPress feature that powers AI assistant connections, available in WordPress 6.9 and later. If your site is older, the connection won't be available until you update WordPress.