Let AI work on WordPress. Keep production under control.
Built for agencies connecting Claude, Cursor, or Codex to client sites — every risky write needs approval from someone other than the requester.
Free and open source, permanently. No credit card. No credentials leave your infrastructure.
# 1. propose — dry-run only, apply=False by default
wp_mutate_option(option="blogdescription",
new_value="Spring Sale — 20% off")
→ {previous, proposed, etag, change_digest}
# 2. propose a packet bound to that exact digest
packet_open(target="option:blogdescription",
change_digest="9f21ac…")
→ status: proposed
# 3. a different identity approves it
packet_approve(packet_id="a1b2c3", approver="connor")
→ status: approved // requester ≠ approver
# 4. execute — refuses if payload or live state drifted
wp_mutate_option(…, apply=True, expected_etag="…")
→ digest verified · snapshot taken · write applied ✓Works with the MCP clients you already use
Nothing stops an agent, a requester, or a stolen session from touching production.
Give an AI agent SSH or admin access to a client site. Any one of these three can change production alone.
The agent itself
An agent can misread a value, grab the wrong ID, or act broader than intended. Nothing double-checks it before the write lands.
The person prompting it
The requester and the approver are usually the same person. Whoever's at the keyboard can ask for a change and authorize it too.
A compromised session
A leaked token or hijacked session inherits whatever access the agent had. Nothing else stands between it and production.
Every write follows the same five-step path, every time.
Named verbs are the front door. Raw code execution is a separate, harder-to-reach tier. Nothing writes without a packet someone other than the requester approved.
apply=False). The response returns the previous value, the proposed value, an ETag, and a SHA-256 digest of the exact change. You see precisely what will change before it changes.apply=True refuses to run without an approved packet matching that exact payload and state. The prior value is backed up first — every write is a rollback if something goes wrong.Six things that stay true no matter which AI client you use.
Governance for changes that already matter
This governs writes that already carry real risk to a live client site. That's the whole wedge.
Credentials stay local
SSH keys, WordPress application passwords, and companion-plugin secrets stay on your infrastructure. Cloud authorizes and records — it never executes and never holds them.
Requester and approver can differ
The person who prompted the agent doesn't have to approve what it does next. A second person can sign off on a client site change.
Approvals bind exact payload + pre-state
An approval locks onto the packet's exact digest: the specific payload and the pre-change state together. Change the arguments, or let the live value drift, and the approval no longer applies.
One evidence trail across the fleet
The same packet ledger, policy model, and audit CLI apply across every client site an agency runs. One evidence trail, fleet-wide.
Works with tools you already use
Claude, Cursor, Codex, Windsurf, or anything else that speaks MCP — the governance model doesn't change per client.
Core is free forever. Cloud is optional.
Core is the local execution and enforcement engine. Cloud is the collaboration, policy, and evidence layer on top of it — it never executes a mutation itself.
WP MCP Core
The MCP endpoint, guarded named verbs, local packets and approvals, snapshots, verification, and the audit CLI. Genuinely useful with nothing else installed.
WP MCP Cloud
Approval inbox across every site, team roles, policy templates and inheritance, a centralized evidence timeline, and client-ready reports. Cloud authorizes and records — the local core still enforces and executes.
WP MCP Enterprise
SSO/SCIM, custom retention and data residency, a private control plane, and customer-managed keys. SLA-backed support for hosting providers and platform-scale fleets.
Evidence a competitor can't hand-wave.
Human-in-the-loop review and dry-run previews are common across WordPress AI tools now. What's tested here is what happens when something tries to go wrong.
- An agent tries to alter the wrong WordPress option — and is refused before anything is touched.
- An approved packet's argument is tampered with after approval — the digest no longer matches, and it's refused.
- The live value changes after preview, before execution — the stale ETag is refused, and the write never happens.
- A guarded mutation writes without an approved packet at all —
PacketRequiredError, no write, no snapshot, nothing touched.
"Guarded" means apply=True raises PacketRequiredError unless an approved packet exists for that exact site, target, payload, and pre-change state.
Every dry-run returns a SHA-256 digest over the site, verb, target, normalized payload, and current ETag. That digest-bound approval can't be reused for different values, targets, or stale state.
Three doors in.
For agencies
Run more client sites per operator, with independent approval, cross-site policy, and one evidence trail across the fleet.
For Claude, Cursor, or Codex users
Connect the AI client you already use to client WordPress sites without giving up production control.
For security review
Understand the guarded-mode mechanism, the change-packet integrity model, and exactly what WP MCP Cloud can and can't see.
Evaluating alternatives? Factual, sourced comparisons.
WP MCP Server isn't trying to out-breadth every WordPress + AI tool. Here's exactly where it differs from three you're likely already looking at.
vs WPVibe
Action breadth vs. independent governance. WPVibe covers more single-tool ground today — WP MCP separates requester from approver across a team.
vs WordPress MCP Adapter
The official Adapter is the standard, free connectivity layer. WP MCP adds approval, evidence, and policy on top of it — same foundation, different job.
vs InstaWP
Hosting-bundled MCP vs. host-neutral governance — for agencies whose client sites aren't all on one host.
Governance priced by the sites you protect.
Core safety is free and open source, permanently. Cloud adds collaboration, policy, and evidence — priced by governed sites, however many changes you make.
- ✓ Unlimited local sites, no Cloud required
- ✓ All local recon and guarded verbs
- ✓ Local packets, snapshots, audit CLI
- ✓ 25 governed sites, 5 seats
- ✓ Approval inbox, policy templates
- ✓ 1-year evidence retention, client reports
Give AI a way to work on WordPress that survives an audit.
Install Core locally in minutes, or bring Cloud in when a second approver or fleet-wide evidence matters.