Title: RockScout AI Author: netbiel Published: May 15, 2026 Last modified: August 1, 2026 --- Search plugins ![](https://ps.w.org/rockscout-ai/assets/banner-772x250.png?rev=3630871) ![](https://ps.w.org/rockscout-ai/assets/icon-256x256.png?rev=3533185) # RockScout AI By [netbiel](https://profiles.wordpress.org/netbiel/) [Download](https://downloads.wordpress.org/plugin/rockscout-ai.0.10.1.zip) * [Details](https://ewe.wordpress.org/plugins/rockscout-ai/#description) * [Reviews](https://ewe.wordpress.org/plugins/rockscout-ai/#reviews) * [Installation](https://ewe.wordpress.org/plugins/rockscout-ai/#installation) * [Development](https://ewe.wordpress.org/plugins/rockscout-ai/#developers) [Support](https://wordpress.org/support/plugin/rockscout-ai/) ## Description RockScout AI tells you what is happening on your WordPress site in language you can act on — which security gaps matter, what changed since last week, and what to do about it. **Vulnerability Scanner** — Checks your installed plugins, themes, and WordPress core against the Wordfence Intelligence vulnerability database. For every match you get the severity, the affected versions, and the recommended action, sorted so the urgent ones come first. Matching runs entirely on your own site. Requires a free Wordfence Intelligence API key. **Plain-Language Explanations** — For any finding, get an explanation of what the vulnerability actually means for your site, what the real-world risk is, what to do, and how urgently. Explanations are strictly grounded in the vulnerability record— no invented details. Requires an AI provider (see FAQ). **Activity Tracker** — Automatically logs plugin updates, theme changes, content edits, media uploads, user role changes, and logins. When something looks different, you can see what changed and when instead of guessing. **Site Health Check** — WordPress version, PHP version and end-of-life status, active plugins with pending updates, scheduled task status, recent errors, and database info in one place. **Site Assistant** — Ask questions about your site in plain language: “What changed this week?”, “Are any plugins outdated?”, “Why is the site slow?”. The assistant reads your activity log, health data, and vulnerability findings to answer. Two ways to connect a provider: paste an API key directly in plugin settings (OpenAI, Anthropic, Google Gemini), or use the WordPress AI Client on WordPress 7.0+. **AI Agent Integration** — Registers WordPress Abilities so MCP-compatible agents such as Claude Desktop or Cursor can read your site health, activity log, plugin status, and vulnerability findings. Read-only. Requires the MCP Adapter plugin. #### What it helps with * Knowing which security gaps on your site actually matter, and which one to fix first * Seeing what changed after a site went live — updates, edits, logins — without digging through logs * Getting an answer in plain language instead of a technical dashboard Works the same whether you look after one site or twenty. #### How it works 1. Install and activate the plugin 2. Activity logging and the site health check start immediately — no configuration needed 3. Add a free Wordfence API key to enable vulnerability scanning 4. (Optional) Configure an AI provider for plain-language explanations and the site assistant ### External Services **Nothing is sent anywhere until you enable a feature that needs it.** Activity logging, the site health check, and vulnerability matching all run entirely on your own site. #### 1. Wordfence Intelligence — vulnerability data feed Optional. Requires a free Wordfence API key, configured in RockScout AI Settings. Downloaded to your site: vulnerability records — title, CVE identifier, severity score, affected version ranges, and remediation guidance. Uploaded: nothing. Your list of installed plugins, themes, and versions is never sent to Wordfence. All matching happens locally on your site. * Wordfence Intelligence — https://www.wordfence.com/threat-intel/ | [Terms](https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/) | [Privacy](https://www.wordfence.com/privacy-policy/) Vulnerability records include data from the MITRE CVE Program and from Defiant, Inc. Attribution is displayed with each record. #### 2. AI provider — explanations and site assistant Optional. Active only once you configure an AI provider, and only at the moment you send a message or click “Explain in plain language”. There is no background or scheduled AI request. What is sent with a request: * Your question, as you typed it * A site summary: WordPress version, environment type, PHP version, time zone and local time, HTTPS status, site language, active theme, number of active plugins, number of pending updates, number of administrator accounts, and a count of vulnerability findings by severity * A summary of recent changes on the site: what changed, when, and the **role** of the account that made the change Depending on what you asked about, one additional group of details may be included— for example plugin and theme names with version numbers, matched vulnerability records, recent lines from the PHP error log, scheduled task status, content counts, or upload and memory limits. Details unrelated to your question are not sent. What is never sent: * Passwords or API keys * Usernames, display names, email addresses, or IP addresses * Post, page, or product content * Customer, order, or form submission data * Media files A note on the error log: PHP error messages can contain absolute file paths from your server. Error log lines are included only when your question relates to errors or something being broken, and are limited to the last few entries. RockScout AI does not operate a server of its own for these features. Requests go directly from your site to the provider you chose, and are subject to that provider’s terms: * OpenAI — https://openai.com | [Terms](https://openai.com/policies/terms-of-use) | [Privacy](https://openai.com/policies/privacy-policy) * Anthropic — https://www.anthropic.com | [Terms](https://www.anthropic.com/legal/consumer-terms) | [Privacy](https://www.anthropic.com/legal/privacy) * Google Gemini — https://ai.google.dev | [Terms](https://ai.google.dev/gemini-api/terms) | [Privacy](https://policies.google.com/privacy) When using the WordPress AI Client on WordPress 7.0+, requests are routed through whichever provider plugin you have installed, and that provider’s terms apply instead. ### Troubleshooting #### Vulnerability scan fails with “rate limit reached” The Wordfence Intelligence API allows one request per 30 minutes on the free tier. Clicking Scan Now repeatedly will hit this limit. **Fix:** Wait 30 minutes. The plugin enforces its own cooldown, and daily scans via WP Cron are unaffected. Saving your API key always succeeds even when the feed is temporarily unavailable. #### Vulnerability scan takes a long time or times out The Wordfence production feed is roughly 120 MB. On slow connections or low-memory hosting the download may time out. **Fix:** Ensure PHP `max_execution_time` is at least 120 seconds. The plugin raises the memory limit automatically. If the scan still times out from the admin button, it retries in the background via WP Cron. #### Google Gemini: “You exceeded your current quota” (limit: 0) Google’s free tier API keys may have a quota of zero requests for new projects or accounts without billing enabled. This is a Google restriction, not a plugin bug. **Fix:** Enable billing in the [Google Cloud Console](https://console.cloud.google.com/billing). Even on the free tier this raises the quota from 0 to 15 requests per minute. Alternatively switch to OpenAI or Anthropic in RockScout AI Settings. #### Google Gemini: “This model only supports Interactions API” Some newer Gemini models, such as deep-research and preview builds, do not support the standard generateContent endpoint used by this plugin. **Fix:** The plugin clears its model cache and selects a compatible model on the next request. If the problem persists, set the model manually to `gemini-2.5-flash` in RockScout AI Settings. #### Site assistant shows “Not connected” No AI provider is configured. Go to **RockScout AI Settings** and either paste an API key, or configure a provider in **Settings Connectors** on WordPress 7.0 +. #### Scheduled scans are not running If `DISABLE_WP_CRON` is defined on your site, or WP Cron is not being triggered, daily refreshes will not happen. The site health data shows scheduled task status, including overdue tasks. **Fix:** Use Scan Now manually, or configure a real server cron job to hit `wp-cron. php`. ## Screenshots [[ [[ [[ [[ [[ [[ ## Installation 1. Upload the `rockscout-ai` folder to `/wp-content/plugins/`, or install through Plugins Add New 2. Activate the plugin through the Plugins menu in WordPress 3. Activity logging and the site health check start immediately 4. Go to **RockScout AI Settings** and add a free Wordfence API key to enable vulnerability scanning 5. (Optional) Configure an AI provider in the same screen — see the FAQ below 6. Visit **RockScout AI Vulnerabilities** to see what needs attention ## FAQ ### Do I need an API key to use this plugin? The activity logger and site health check work with no keys at all. Vulnerability scanning needs a free Wordfence Intelligence API key. Plain-language explanations and the site assistant need an AI provider. ### How do I get a Wordfence API key? Create a free account at wordfence.com, open the Wordfence Intelligence section, and copy the API key from Integrations. The free tier allows commercial use. Paste the key in RockScout AI Settings. ### How do I set up AI features? You have two options. **Option A — Direct API key (WordPress 6.9+):** 1. Go to **RockScout AI Settings** 2. Choose your provider (OpenAI, Anthropic, or Google Gemini) 3. Paste your API key and save **Option B — WordPress AI Client (WordPress 7.0+):** 1. Install an AI provider plugin from the WordPress.org repository 2. Go to **Settings Connectors** and add your API key 3. RockScout AI will use the configured provider automatically If both are configured, the direct API key takes priority. ### What data is sent to the AI provider? See the **External Services** section above for the complete list of what is sent and what is never sent. In short: your question, a technical summary of the site, and recent changes by account role — never usernames, email addresses, passwords, or page content. ### How does the vulnerability scanner work? The plugin downloads vulnerability records from the free Wordfence Intelligence API and matches them locally against your installed plugins, themes, and WordPress core. Your list of installed software never leaves your site. Findings refresh daily via WP Cron, after any plugin activation, deactivation, or update, and on demand with the Scan Now button. ### What does “Explain in plain language” do? For each finding, it produces an explanation of what the vulnerability means, the real-world risk to your site, what action to take, and how urgent it is. The explanation is generated strictly from the vulnerability record — the AI is not permitted to add details that are not in the data. ### Can external AI agents read my site data? Only if you set that up yourself. RockScout AI registers four WordPress Abilities— site health, activity log, plugin status, and vulnerability check. All four are read-only and require administrator permissions. Nothing is exposed until you install the MCP Adapter plugin and connect a client such as Claude Desktop or Cursor, at which point data flows to that client, not to us. ### What WordPress version do I need? WordPress 6.9 or later. The WordPress AI Client integration requires WordPress 7.0 +. The Abilities API integration for AI agents requires the MCP Adapter plugin. Where a feature is unavailable, the plugin degrades gracefully rather than failing. ### Does this plugin slow down my site? No. The activity logger uses lightweight hooks and writes to a local database table. The site health check runs on demand or once daily via WP Cron. Vulnerability data refreshes in the background. No scripts are loaded on the front end. ### How do I delete all plugin data? Deactivate and delete the plugin. All data — the activity log table, cached vulnerability data, and settings — is removed automatically on deletion. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “RockScout AI” is open source software. The following people have contributed to this plugin. Contributors * [ netbiel ](https://profiles.wordpress.org/netbiel/) [Translate “RockScout AI” into your language.](https://translate.wordpress.org/projects/wp-plugins/rockscout-ai) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/rockscout-ai/), check out the [SVN repository](https://plugins.svn.wordpress.org/rockscout-ai/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/rockscout-ai/) by [RSS](https://plugins.trac.wordpress.org/log/rockscout-ai/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.10.1 * Privacy: user logins are no longer stored in activity events or included in AI requests — only the account role is used * Privacy: failed login attempts no longer record the submitted username * Privacy: added a final filter that strips email addresses and account identifiers from any AI request * AI requests now include only the details relevant to your question instead of everything available — roughly 60% smaller requests * Added per-section limits to AI context: plugin list, vulnerability findings, error log lines, and activity events * Added scheduled task (WP Cron) status and PHP end-of-life warning to site health data * Site health snapshot cached for 15 minutes for the assistant; AI agent abilities always read live data * Added a safeguard preventing the assistant from commenting on data you did not ask about * Renamed ability `rockscout/check_vulnerabilities` to `rockscout/check-vulnerabilities` for naming consistency * Readme: full disclosure of data sent to AI providers, reorganised feature list #### 0.10.0 * Add vulnerability scanner: match installed plugins/themes/core against Wordfence Intelligence database * Add Wordfence API key setting with AES-256 encrypted storage * Add Vulnerabilities admin page with severity-sorted findings table * Add “Explain in plain language” AI-powered vulnerability explanation per finding * Add daily WP Cron for vulnerability data refresh + on-demand “Scan Now” * Add vulnerability summary to dashboard widget * Add Wordfence external service disclosure in readme * Add vulnerability check endpoint to the Abilities API (MCP-ready) * Auto-refresh scan on plugin activation, deactivation, or update * Strictly grounded AI explanations: only uses provided vulnerability facts * MITRE and Defiant copyright attribution displayed per vulnerability record #### 0.9.0 * Add log source adapters: auto-detect WP Activity Log, Simple History, or built- in logger * AI chat now uses the richest available activity data automatically (WSAL > Simple History > Built-in) * Enrich built-in logger: post create/edit/delete, media uploads, menu changes, user role changes, profile updates * Add Activity Source section in Settings showing active source and event count * External adapter results cached via transients (5 min TTL) * DB schema versioning with automatic migration on upgrade #### 0.8.1 * Fix readme: correct AI provider policy URLs (Anthropic, OpenAI, Google Gemini) * Update readme: add WordPress.org username to Contributors * Update readme: clarify dual AI mode (Direct API key + WordPress AI Client) * Update readme: sync WordPress version requirements between header, Description, and FAQ * Remove screenshots section pending visual assets #### 0.8.0 * Add UX onboarding: welcome banner, AI status bar, setup notice, recent activity on chat page * Add API key encryption at rest (AES-256-CBC) * Add rate limiting for AI chat (20 requests/hour per user) * Add provider validation: require provider selection before saving API key * Fix WordPress Abilities API registration (correct hooks, category support, show_in_rest) * Fix chat not appearing on WordPress 6.9.4 when API key is saved * Fix double-encryption bug in API key migration path * Fix admin notice shown incorrectly when WordPress AI Client is installed * Fix REST route registration (always available, AI check moved inside handler) * Fix WP AI Client compatibility: method_exists guards, system prompt fallback * Pass Plugin Check: variable prefixing, phpcs annotations, load_plugin_textdomain removed #### 0.7.0 * Initial release * Activity logger (plugin updates, theme changes, content edits, logins) * Site health collector (WP version, PHP, plugins, theme, errors) * AI chat powered by WordPress AI Client (supports any configured provider) * WordPress Abilities API integration (MCP-ready) * Dashboard widget with site overview * Automatic cleanup of old events via WP Cron ## Meta * Version **0.10.1** * Last updated **5 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.9 or higher ** * Tested up to **7.0.2** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/rockscout-ai/) * Tags * [Activity Log](https://ewe.wordpress.org/plugins/tags/activity-log/)[maintenance](https://ewe.wordpress.org/plugins/tags/maintenance/) [security](https://ewe.wordpress.org/plugins/tags/security/)[site health](https://ewe.wordpress.org/plugins/tags/site-health/) [vulnerability](https://ewe.wordpress.org/plugins/tags/vulnerability/) * [Advanced View](https://ewe.wordpress.org/plugins/rockscout-ai/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/rockscout-ai/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/rockscout-ai/reviews/) ## Contributors * [ netbiel ](https://profiles.wordpress.org/netbiel/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/rockscout-ai/)