Nobody approves their own change to a client site.
WPVibe pauses for your own in-chat approval before it runs a destructive command. WP MCP Server sends the same change to a separate approver first.
Same session, same person, same click.
WPVibe's approval pause happens in the same chat or browser session as the request. It's logged, but nothing in that flow requires a second, different person to sign off.
One session, one approver
The pause happens in the same chat or browser session the request came from. WPVibe's docs don't describe a distinct second identity confirming it.
Backup coverage is narrower
WPVibe documents theme-file backups and trash. A general pre-write snapshot across options, meta, and post content isn't documented.
Every write gets a proposer, an approver, and a receipt.
Three tiers, one shared guard: read-only recon needs no packet, named verbs dry-run by default, and raw eval is a separate, harder-to-reach tier. Here's what happens on the guarded path.
packet_open describes the change — site, verb, target — and locks that target so a second agent can't race it.
packet_approve authorizes it. Nothing requires the approver to be the same person who proposed it.
The write only runs if the live payload matches the approved SHA-256 digest exactly. The previous value is snapshotted first.
Limited to what's actually documented by each project.
| WPVibe | WP MCP Server | |
|---|---|---|
| Raw PHP/eval as the default interface? | No — allowlisted WP-CLI (40+ commands), no eval | No — named verbs default; raw eval gated to Tier 3, SSH-only |
| Dry-run before write? | Yes — required before destructive ops; explicit --dry-run for search/replace |
Yes — apply=False is the default on every verb |
| Backup/snapshot before write? | Theme-file backups + trash — no general pre-write snapshot documented | Yes — before every write, plus optional durable re-verify |
| Change-approval gate (beyond role permission)? | Yes — pauses for in-chat/browser approval, logged separately | Yes — propose/approve change packet, distinct from role/token |
| Block-structural edits? | — not documented | No — raw search/replace today (block-aware verb planned) |
| Transport | Plugin + hosted WPVibe service (HTTPS) | SSH+WP-CLI or companion plugin (plugin has no eval) |
Choose WPVibe if…
- You're a single operator and an in-chat approval pause already fits how you work
- Zero raw-eval surface matters more to you than a gated escape hatch for rare cases
- You'd rather use a hosted service than run your own approval infrastructure
Choose WP MCP Server if…
- More than one person should sign off before a client site changes
- You want every approval bound to one exact payload instead of a general go-ahead
- Credentials should stay on your own infrastructure instead of a vendor's
- You manage more than one client site and want one evidence trail across the fleet
- WPVibe — wordpress.org/plugins/vibe-ai
Feature claims verified 2026-07-16. Verify against each project's current docs before relying on a cell — this space moves fast.
See who approves your next change.
Founding agencies get 50% off for 12 months — first 20, no setup fee.