Full ACP control via AI: users, usergroups, bans, add-ons, options, cron, styles
A Servio Protocol Bridge for XenForo. Let ChatGPT, Claude, Copilot, Gemini, and other AI agents securely interact with your site through OAuth 2.0 with PKCE.
Goldnat for XenForo Admin · Goldnat for XenForo Admin — let AI manage users, forums and site config
Capabilities
What it does.
OAuth 2.0 + PKCE
Secure by design
Industry-standard OAuth flow with PKCE. Every AI agent authenticates with proof-of-key exchange — no secrets stored client-side.
Permission-aware
XenForo permissions
Tool calls respect XenForo's native permission model. Users only see content they're allowed to access.
REST + JSON
Servio protocol
Manifest endpoint, tool discovery, structured JSON responses. Compatible with the Model Context Protocol standard.
57 tools
Production ready
57 structured tool calls for XenForo.
Compatible clients
Works with every AI client.
Pre-configured OAuth integrations for every major AI agent — including our own hosted agent at goldnat.ai. Connect in minutes, not hours.
Tools
Available tool calls.
57 tools exposed via the Servio protocol. AI agents call these by name with structured arguments.
xenforo_admin
-
xenforo_admin.addSecondaryGroupAdd a secondary user group to a member. Idempotent. Pro -
xenforo_admin.banUserBan a user (permanent by default). Requires admin scope + is_admin. Super-admin guarded. Pro -
xenforo_admin.changeUserEmailChange another users email address. Marks the new address as unconfirmed by default; pass mark_confirmed:true to bypass. Refuses self-edit. Pro -
xenforo_admin.changeUserPasswordSet a new password for another user. Provide either new_password OR generate_password:true (returns temp). Refuses self-edit (use standard reset flow). Pro -
xenforo_admin.createNodeCreate a forum/category/page/link node. Requires admin OAuth scope + is_admin. Pro -
xenforo_admin.createUserCreate a new user. Requires admin scope + admin visitor. Pro -
xenforo_admin.createUsergroupCreate a new user group with title, priority, banner and CSS styling. Pro -
xenforo_admin.deleteNodeDelete a node. delete_children controls child handling (default: reparent). Pro -
xenforo_admin.deleteUserDelete a user. Super-admins protected (rejected). Requires admin. Pro -
xenforo_admin.deleteUserAvatarRemove another member's avatar. Requires admin + user admin permission. Pro -
xenforo_admin.deleteUsergroupDelete a user group. Refuses built-in groups (id 1-4) and groups containing super admins. Pro -
xenforo_admin.disableAddonDisable an enabled add-on. Refuses to disable AIConnect chain (would lock API). Pro -
xenforo_admin.editNodeEdit a node title/description/parent. Requires admin. Pro -
xenforo_admin.enableAddonEnable a disabled add-on. Rebuilds caches. Pro -
xenforo_admin.getOptionRead a board option by option_id. Returns current value + type. Pro -
xenforo_admin.getStylePropertyRead single style property with inheritance context (local/master/effective/is_overridden) -
xenforo_admin.listAddonsList all installed add-ons (id, title, version, active). No arguments. Pro -
xenforo_admin.listCronTasksList all cron entries (id, description, next_run, active). No arguments. Pro -
xenforo_admin.listStylesList all styles (id, title, parent, user_selectable, is_default). Pro -
xenforo_admin.removeSecondaryGroupRemove a secondary user group from a member. Idempotent. Pro -
xenforo_admin.reorderNodesBulk update display_order for sibling nodes under the same parent. Positions assigned 0,10,20,... to leave room for later inserts. Pro -
xenforo_admin.setDefaultStyleSet the site default style (persists to defaultStyleId option via XF OptionRepository). Pro -
xenforo_admin.setNodePermissionGrant/deny a permission for a usergroup on a specific node. XF content-permission model. permission_value=unset removes the entry. Pro -
xenforo_admin.setOptionSet a board option. Blocklist prevents site-locking keys (boardActive, boardUrl, homePageUrl). Pro -
xenforo_admin.triggerCronTaskManually run a cron entry synchronously (ACP "Run now" equivalent). Pro -
xenforo_admin.unbanUserRemove an active ban on a user. Idempotent. Pro -
xenforo_admin.unsetStylePropertyDELETE style property override on child style; property inherits from Master -
xenforo_admin.updateUserUpdate a user about text and/or primary user group. Pro -
xenforo_admin.updateUsergroupEdit an existing user group (partial update — pass only fields to change). Pro -
xenforo_admin.uploadUserAvatarSet another member's avatar from a URL. Requires admin + user admin permission. Rejects super-admin targets unless caller is also super-admin. Pro -
xenforo_admin.createWidgetCreate a new widget. Common types: html (freeform), new_threads, new_posts, members_online, forum_statistics, share_page, quick_search. -
xenforo_admin.deleteSiteLogoRemove the logo from a style (reverts to default/no logo). -
xenforo_admin.deleteStyleAssetDelete a style asset by filename. -
xenforo_admin.deleteWidgetDelete a widget by widget_key. -
xenforo_admin.editPhraseEdit a phrase (change its text). XF automatically records history — reverting is available via ACP. -
xenforo_admin.editWidgetEdit an existing widget by widget_key. -
xenforo_admin.getAddonOptionsList all options belonging to a specific add-on (by addon_id). -
xenforo_admin.getEmailTransportConfigRead the site email transport configuration. Password field is always MASKED (e.g. "****1234") — never returned in plain text. -
xenforo_admin.getNodePermissionsRead all explicit + inherited permissions for a node. Use this AFTER setNodePermission to verify your changes actually blocked/granted the way you expected. Returns three sections: entries_on_node (rows on THIS node), entries_inherited (rows inherited from parent chain, each with inherited_from_node_id), effective_view_by_group (final per-group can_view boolean + derivation string showing WHY — e.g. "content=deny/base=allow"). RECIPE — verify a node is truly private after setNodePermission: -
xenforo_admin.getOptionBlocklistReturn the list of option_ids blocked from setOption (site-locking keys like boardActive, boardUrl, homePageUrl). -
xenforo_admin.getPhraseGet a phrase by title (and optionally language_id). -
xenforo_admin.getWidgetGet full details of a widget by widget_key. -
xenforo_admin.listOptionGroupsList all option groups defined in this XF installation. -
xenforo_admin.listOptionsByGroupList all options in a specific option group (e.g. email, payment, <addon_id>). Helps discover valid option_id values without guessing. -
xenforo_admin.listStyleAssetsList style asset files (logos, favicons, custom images, backgrounds) for a style. Read-only. -
xenforo_admin.listStylePropertiesList CSS-level style properties for a style. Returns EVERY property defined on Master (style 0), and for each: local_value (this style s override, or null), master_value, effective_value (what LESS compiler uses = local ?? master), and is_overridden. Agent can immediately see inheritance state without joining. Values are DECODED (native JSON structures, not raw JSON strings). -
xenforo_admin.listWidgetPositionsList all widget position keys available in the current templates (e.g. forum_list_sidebar, thread_view_sidebar, member_view_sidebar). Read-only. -
xenforo_admin.listWidgetsList all widgets with their positions and active state. Read-only. -
xenforo_admin.searchPhrasesSearch phrases by title or content substring. Returns up to 100 matches. Case-insensitive. -
xenforo_admin.setAddonOptionSet a single option belonging to an add-on. Same as setOption but requires addon_id and refuses if the option is not from that add-on (prevents accidentally modifying core options). -
xenforo_admin.setEmailTransportConfigSet email transport (smtp/default). v1.4.11: writes XF native option keys (smtpHost/smtpPort/smtpSsl/smtpLoginUsername/smtpLoginPassword/smtpAuth) so XF Mailer can consume without crashing (bug in v1.4.0-v1.4.10: missing smtpSsl key caused "Undefined array key smtpSsl" on any mail send, including createUser welcome mail). Recommended: call testEmailConfig after. -
xenforo_admin.setNodePrivateToggle a node s "Private" flag — same checkbox XF ACP exposes on the Node Permissions page. When private=true, ONLY groups/users with an explicit content_allow entry (via setNodePermission) can view the node; base group permissions no longer apply. This is XF s intended way to make a node truly private, and it defeats the "deny + base=allow" quirk that setNodePermission alone cannot solve. RECIPE — proper private node: 1. setNodePrivate(node_id, is_private=true) // flip the flag 2. setNode -
xenforo_admin.setStylePropertySet a single CSS property value on a style. For value_type=color properties value MUST be an object {default: ..., alternate: ...} (tool will REJECT plain strings with 400 + hint). For fontFamily/string properties, pass a plain string. Changes flush CSS caches synchronously. -
xenforo_admin.simulatePermissionChangeDry-run a setNodePermission call — computes whether the change would lock out the caller or any admin group, WITHOUT applying it. Use before destructive permission changes to preview impact. -
xenforo_admin.testEmailConfigSend a test email using the current transport config. Verifies connectivity before saving password changes. -
xenforo_admin.uploadSiteLogoUpload/replace the site logo from a URL. Validates file type (png/jpg/svg/webp) and max size (5MB). Applies to the given style or master (style_id=0) by default. -
xenforo_admin.uploadStyleAssetUpload an arbitrary style asset from URL (favicon, custom image). Path is validated — cannot overwrite XF core files.
Pricing
Get the plugin.
Sign in to your Goldnat account to complete purchase — Paddle handles local currency, VAT, and tax automatically. Your license appears in your account immediately.
Admin
Full feature set + support
- ✓ 57 admin tools across 9 bundles
- ✓ User + Node CRUD
- ✓ Usergroups + Bans
- ✓ Add-ons control
- ✓ Site options + Cron + Styles
- ✓ Per-area ACP permissions
- ✓ 1 year updates
XenForo platform
More plugins for XenForo
Questions about Goldnat for XenForo Admin?