I built an MCP server that lives inside WordPress - here's the safety model

Shahid Ali — Sat, 12 Sep 2026 10:44:15 +0000

I do WordPress and SEO work for clients. I wanted Claude to operate my sites, but I did not trust an agent with raw database access. So I spent the last year building SiteHelm: a GPL plugin that exposes a WordPress site as 115 typed MCP operations - content, media, menus, Elementor, ACF, SEO plugins.

The safety model is the whole point, so here it is:

Two-phase writes. Every write is two calls. The first is a preview: it writes nothing and returns each field's before and after value with a single-use plan token. The apply is bound to those exact arguments - change one and it is refused. The diff you approved is the diff that lands.

Snapshot and verify. Before a write, the engine records everything a restore would need. After it, the site is read back and compared with the preview's promise. A mismatch is reported as a failure, not a success. This read-back step is where the real bugs hide - a WordPress write can return success while saving into a row the renderer never reads (Elementor is famous for this).

Audit and rollback. Every change lands in a log in wp-admin, in plain sentences, and applied changes roll back from there - with a preview first.

No escape hatches. The agent gets named operations with strict input schemas. It does not get PHP, SQL, a shell, or the filesystem. Plugins install only from WordPress.org by slug, land deactivated, and the owner can pause every write with one switch the agent cannot reach.

Repo: https://github.com/Mrshahidali420/SiteHelm - site: https://wpsitehelm.com

It is free and open source (there is a paid add-on for WooCommerce and Elementor Pro surfaces, which is how I keep it sustainable). I would genuinely like feedback on the two-phase write contract - especially from anyone building write-capable MCP servers.

DEV Community: Shahid Ali

I built an MCP server that lives inside WordPress - here's the safety model