Mark Whitby hi,
Just 3 clicks and 1 copy-paste.
It’s super simple and designed for non-technical users.

Go to AI Connect > Settings >Turn on Course piloting.

• Open the Claude tab, click Generate new API key and copy it

• In Claude Desktop >Settings > Developer, then on Edit Config.

• Paste what you just copied from the Fcom AI Connect plugin.

Save the file.
- Completely close Claude Desktop

Restart Claude Desktop.

Vidéo : https://youtu.be/MoaS5-w3gdA

Thanks! Happy it clicks.

On stacking with other MCPs, yes, no problem. Claude Desktop runs several connectors at once. Fcom AI Connect sits alongside your other MCPs and Claude picks the right tool per task.*

• On querying the community side, not in this release, and that was a deliberate call. The 28 capabilities here are all course-side: courses, sections, lessons, quizzes, students.

  Reading the social layer (spaces, feed posts, comments, replies) means letting Claude ingest content written by community members, and that opens the door to prompt injection: a malicious or even just careless comment can contain instructions that try to hijack what Claude does next. On a platform where your students write freely, that risk has to be handled seriously, not waved away.

• It can absolutely be added in a future update, but it will ship with the right safeguards: explicit admin warning when the feature is enabled, two-factor activation (opt-in toggle + confirmation) so it cannot be turned on by accident, and capability isolation so social reads and destructive writes cannot be chained in the same session.

D@vid Amazing, thank you!

Vibe Code
Don’t hesitate to comment again once you’ve understood. ;)

D@vid let me comment again... do you charge for mcp server that is just using fluentcommunity api (free) or you made something nice extension

Vibe Code 
let me comment again... 
Don’t hesitate to comment again once you’ve understood. ;)

D@vid alright... looks like you trying to fool community members... however, it's capitalism... you can sell whatever you want just need to find consumers... paying for mcp will be dumb consumers

Vibe Code 
Just a wrapper" is what a naive MCP integration looks like. This isn't one.

A wrapper exposes API calls 1:1, hardcodes a token, and ships. Here's what actually sits between Claude and FluentCommunity in this plugin:

• Dedicated scoped bot account created at activation. Cannot log in interactively, cannot reach wp-admin. Claude impersonates this account, never a real admin.
• Bearer token stored in the OS secret store (DPAPI on Windows, Keychain on macOS, libsecret on Linux). Not plaintext in wp_options.
• 28 abilities, each individually toggleable from the admin UI. Not "all or nothing."
• Permission callback gate on every single call, filtering tools out of both tools/list AND tools/call, so a client that cached a tool name from an earlier session still gets 403 when access is revoked.
• No hard delete, anywhere. Not courses, not sections, not lessons, not quizzes. Removals stay human.
• Destructive operations gated behind a separate admin toggle, off by default.
• HMAC-signed tamper-evident audit log, every line anchored to a per-install epoch derived via HKDF from AUTH_SALT. A "Verify audit integrity" button detects any post-facto edit, including direct database edits.
• Ed25519 signed releases. The public key is embedded in the plugin. Your WordPress refuses to install any update whose signature does not verify.
• SHA-256 vendor manifest. At every boot, bundled vendored files are hashed against a baked-in manifest. One altered byte, the plugin refuses to start rather than run modified code.
• ZIP structural checks — traversal, symlinks, absolute paths rejected before extraction, even when signature verification is disabled.
• DNS pinning on outbound HTTP via CURLOPT_RESOLVE. Fails closed when cURL is unavailable. Prevents DNS rebinding.
• IPv6 SSRF guard that extracts embedded IPv4 from 6to4 (2002::/16) and NAT64 (64:ff9b::/96) addresses before CIDR filtering.
• CORS preflight lockdown on the MCP route. Cross-origin preflight rejected, CORS headers scrubbed.
• Untrusted content wrapping to reduce prompt injection surface.
• PII allowlist on export abilities, multilingual (covers email field synonyms in FR, DE, ES, IT, PT).
• Rate limiting, IP allowlist, path-free error messages, throttled logs, signed option values.
• 130 regression tests backing all of the above.
• 5 locales bundled (English source, French curated, Spanish, German, Italian, Portuguese).

Now, to be direct: your comment makes it clear you're conflating three different things that are not the same.

MCP is not an API. MCP is a protocol where the caller is an LLM, not a human. That single fact rewrites the threat model. A REST API assumes an intentional, rational caller. An MCP server has to assume a caller that can be prompt-injected by any text it reads, hallucinated into making calls the user never asked for, or fed malicious instructions by another MCP server running in the same Claude Desktop session. If your server doesn't defend against that, you've shipped a footgun with a bow on it. This is MCP 101 and it's clearly been skipped.

Mirroring the full FluentCommunity REST surface to an LLM is a bad idea. FC's API has DELETE endpoints, admin settings writes, bulk operations, auth configuration. Plug all of it into Claude and a single prompt injection or hallucinated call can wipe a course, drop every enrolled student, or rewrite the email configuration of the site. The question is never "can I reach the FC API from Claude" — any weekend hack does that. The real work is "which subset do I expose, under which permission gate, with what audit trail, and with what hard stops when things go sideways." That distinction is exactly what you missed.

The product is not the wrapper. The product is everything layered above the wrapper. The scoped bot account. The per-ability toggles. The HMAC audit log. The signed release pipeline. The SSRF and DNS rebinding defenses. The 130 regression tests that keep breaking every time someone tries to re-open a hole. Strip those layers out and yes, you have a free PHP proxy with a hardcoded token. Run that in production and the cleanup after the first breach costs more than the license. That's the capitalism math you were pitching, by the way.

I warned you: Understand and master before attacking.

Have a good day Vibe Code 😉

D@vid I talk to person or Claude?

Vibe Code

Don’t hesitate to comment again once you’ve understood. ;)
Have a good day Vibe Code 😉

D@vid good luck with sales. hopefully it will cover your ai bill

Vibe Code 
Thx ! And if you want to learn even more about the MCP protocol and computer security, don't hesitate to contact me again.... Vibe Code 😄

D@vid I'm always happy to learn as I do many modelcontextprotocol contributions... share what you have. feel free to share tips for community developers... it's always nice to learn something which is not documented anywhere

Vibe Code 
Tip: Work on security issues. You'll learn a lot of really useful things, especially in Vibe Coding.

D@vid 

Cointacter 
Codex via CLI: Can be done fairly quicklyChatGPT Plus/Pro/Business/Enterprise/Edu
Requires a fair amount of development

I can start with Codex CLI. Interested?

D@vid its interesting but i dont think i will buy, i believe i have plans to do it myself for my infra. My question was about your product in general whether you plan to build a proper product for wp and many other plugins along with other agents, or fcom and claude only...

Cointacter 
Official connectors (WordPress) do exist: AI Provider for Anthropic, AI Provider for Google, and AI Provider for OpenAI.

However, they are very limited and include no security safeguards. This may explain why they are rarely used: 300 installations for OpenAI, 400 for Google, and 800 for Anthropic.
https://profiles.wordpress.org/wordpressdotorg/#content-plugins

As for my own creations, I have several, but only two are currently available: Fcom AI Connect (here) and Fcom Certificates: https://community.wpmanageninja.com/portal/space/community-meta/post/fcom-certificates-automated-training-c

D@vid cool keep grinding!

Nicolas D 

Thx !

Screenplay Unlimited There is a LearnDash MCP that can retrieve the data.

https://learndash.com/support/kb/learndash-mcp-server/getting-started-with-learndash-mcp-server/mcp-setup/

I've never used LeanDash. Can't the administrator save their courses locally?

D@vid I'm using the version of Learndash that is hosted in my own site, not the Learndash version in the cloud, that comes with its own hosting. So yes, I have all my courses saved locally, in the same Wordpress install where FluentCommunity is installed. But moving my existing courses to FluentCommunity would be a bear, as I have very complex courses (8-15 hours of content, many modules and topics, lots of videos, transcripts and PDFs for each topic... Doing this by hand would take me days, so if your tool was able to recreate the course structures in FluentCommunity and copy most of the content over, that would be a huge timesaver that would justify investing in your tool (I don't plan to use AI to create new courses, at least not for now). Not sure if the MCP works with the non-cloud version of Learndash, and if it needs a certain license level, I'd have to ask them if you think your tool might help with this.

Screenplay Unlimited 
Perfect and more economical if they're stored locally. You don't even

1 - Claude Desktop can work locally to extract course content. (Always work from a copy)
2 - Claude connects to your FluentCart installation to recreate the courses.

Screenplay Unlimited 
Here's an example of what you can do with the help of AI. You can ask the AI ​​to create a custom CSS stylesheet to format your courses and give them a completely unique look without using Elemontor or anything else. Everything will be done in HTML in one step.

I give the AI ​​two different text files:
1 - the course content
2 - the content of my custom CSS (the one from FluentCommunity)

And I ask the AI ​​to format the course by applying the custom CSS.

Here's an example of what it looks like:
https://comprendre.ai/formation-ia-intelligence-artificielle/course/analyses-et-alertes-publiques-en-rapport-avec-lintelligence-artificielle/lessons/agents-ia-et-automatisations-ia-responsabilites-et-obligations-quand-tu-crees-integres-ou-vends/view

D@vid Sorry for the late reply, multi-tasking at the moment...

Styling looks good!

I've started looking into setting up an MCP server for Learndash using Cursor to create a connection with Claude. That looks possible. Regarding your plugin side, Cursor is asking me to ask you:

• “Can it import LearnDash course → lesson → topic hierarchy, or do we need custom mapping prompts/scripts?”
• “Can it ingest existing HTML/course text in bulk and preserve formatting/media?”
• “Does it support idempotent migration (safe re-run without duplicates)?”
• “Can it return stable IDs for mapping table (learndash_id to fluent_id)?”
• “Any hard limits on batch size/rate/API timeout?”
• “Do you provide migration support for first pilot run?”

Screenplay Unlimited If your courses are hosted locally, you don’t need MCP for LearnDash.

D@vid I need more details. My courses are hosted on Wordpress, so on a server (Rocket.net). They are not hosted locally as on my own PC/server. I said locally because Learndash has two options 1) a Wordpress plugin (what I use) and 2) a cloud subscription service that comes with hosting, so not your own Wordpress hosted site. What about the other questions, and I'll add another one, what happens if you decide to stop your business, does the plugin still work or does it need your server to work? Thanks!