uploadAttachment and uploadMyAvatar fetch files from a user-supplied URL. Up to 1.2.14 this used PHP file_get_contents() directly, which has no built-in protection against internal network addresses, unsafe redirects, oversized downloads, or slow-loris timeouts.
1.2.15 switches to XF's built-in XF\Http\Reader::getUntrusted() — the same hardened fetcher XF uses internally for Gravatar fetch, image proxy, and oEmbed. It provides:
Private/reserved IP rejection (127.0.0.0/8, 169.254/16, RFC1918).
Private TLD rejection.
Scheme/port whitelist (http/https on 80/443 only).
Per-hop redirect validation.
timeout + size cap.
Thanks to the forum member @CrazyChef who flagged this in the 1.2.14 review.
Metadata — tool count description
addon.json description was stuck at "81 tools across 11 bundles" from v1.1.3, before three bundles were added in v1.1.4 (Users & Groups, Watched & Bookmarks, Forum Watch). The real manifest always carried 84/14; only the description string was stale. Fixed.
If you already own this add-on, the upgrade is free.
What's new
17 new tools, bringing the total from 67 to 84, organised across 14 permission groups.
The new tools cover:
• Users & Groups — user lookup and group listing
• Watched & Bookmarks — follow state and bookmark lists
• Activity & Analytics — board-level engagement stats
• Forum Watch — watch/unwatch nodes
Direct Messages (Conversations) — 9 tools for reading, replying, inviting, dismissing, and creating DMs. These moved from the Free add-on to Pro.
Security
XSS hardening in attachment uploads — filenames are now basename-stripped, Unicode-sanitised, and capped at 128 bytes.
Write-scope enforcement — 5 write tools that previously relied on the token scope check alone now also verify the matching XenForo permission.
Edition gating now flows exclusively through the licence check (no local environment override).
🏗 Reliability
R2 / abstract-filesystem compliance for attachments — fixes uploads and downloads on S3/R2-backed stores.
Self-rebuilds the listener cache on install, upgrade, and uninstall — tool changes appear immediately with no manual cache rebuild.
Licence key validation now accepts any prefix.
Launch pricing
$59 — currently $39 as a launch price, until 31 October 2026.
A purchase includes one year of update eligibility from the date of purchase.
Requirements
XenForo 2.2+
PHP 7.2+
AI Connect 1.2.41 or later — this add-on extends it and will not install standalone
Read and manage conversations, invite participants, alerts
Media
9
Attachments, PDF reading, thumbnails, your own avatar
Engagement
7
Reactions, votes, polls, read state
Profile
6
Profile posts, comments, your own profile
Core
6
Create threads, reply, edit posts, send conversations, forum list, member lookup
Writing
5
Thread tags, conversation replies and edits
Moderation (14) — lock and unlock threads, stick and unstick, feature and unfeature, move between nodes, delete threads and posts, mark question solutions, change discussion type, delete profile posts and comments.
Discovery (11) — the node tree in full, nested or flat, a single node, board statistics, recent and trending threads, thread tags, thread polls, post reactions including who reacted, and member profiles.
Conversation (9) — read conversation messages, mark read, star, leave, invite participants, list and read alerts, mark alerts read.
Media (9) — upload and delete attachments, list attachments by upload key, attachment details and thumbnails, read the text of an attachment including PDF documents, list a post's attachments, upload and remove your own avatar.
Engagement (7) — react to posts, profile posts and conversation messages, vote on posts, vote in polls, create polls, mark threads read.
Profile (6) — post on profiles, edit profile posts, comment, edit comments, read profile posts, update your own profile.
Core (6) — create threads, reply to threads, edit posts, send conversations, list forums, find a member by name. Available whenever any other group is enabled.
Writing (5) — add and remove thread tags, reply to conversations, edit conversation messages, update conversation settings.
New in this release
Read PDF documents. An agent can now read the text of a PDF attachment directly. Extraction is built into the add-on — nothing needs installing on your server. Scanned documents that hold images rather than text are detected and reported as such, instead of returning meaningless output an agent might treat as real content.
Attach files in one step. Uploading a file and attaching it to a thread, reply or edit is now a single action. Previously a file could be uploaded but there was no way to bind it to the content being created, which left the upload stranded.
Eleven discovery tools. A new Discovery group covers reading the shape of the forum: board statistics, recent and trending threads, the node tree, thread tags, polls, post reactions including who reacted, and member profiles.
Permissions are per tool
This is the part worth understanding before you point an agent at a live forum.
Every one of the 67 tools has its own permission entry under Groups & Permissions. You can allow an agent to reply to threads without allowing it to delete them. You can allow moderation actions for a staff account and nothing but reading for a general one.
Underneath, XenForo's own permission system does the enforcement. An agent operating as a given account cannot do anything that account could not do through the web interface. The add-on adds no privileged path of its own — if a moderator cannot delete posts in a node, neither can an agent connected as that moderator.
For finer control over what a specific agent may reach within those permissions, https://goldnat.ai lets you scope each connected agent to a subset of the tools already exposed to it.
Domain binding. A licence is bound to one domain, matched against your boardUrl. If you move the forum or run staging separately, change the licensed domain from https://goldnat.ai/account/licenses — three changes are included.
Pricing
$59 — currently $39 as a launch price, until 31 October 2026.
The original price was $29 for five tools. The tool count is now 67. The increase reflects that; the launch price gives a window before it settles at $59.
A purchase includes one year of update eligibility from the date of purchase.
Existing customers
If you already own this add-on, the upgrade is free. Your existing licence covers the full tool set — there is nothing to buy and nothing to do.
Requirements
XenForo 2.2+
PHP 7.2+
AI Connect 1.2.41 or later — this add-on extends it and will not install standalone
What's new
Security
Launch pricing