Comparison · updated 2026-07-16

Nobody approves their own change to a client site.

WPVibe pauses for your own in-chat approval before it runs a destructive command. WP MCP Server sends the same change to a separate approver first.

Fair's fair: what WPVibe does well
WPVibe allowlists more than 40 WP-CLI commands and skips raw eval entirely. Before a destructive command runs, it pauses for approval in your chat or browser, then logs it separately. For one operator working solo, that's a real safety net.
The gap

Same session, same person, same click.

WPVibe's approval pause happens in the same chat or browser session as the request. It's logged, but nothing in that flow requires a second, different person to sign off.

One session, one approver

The pause happens in the same chat or browser session the request came from. WPVibe's docs don't describe a distinct second identity confirming it.

Backup coverage is narrower

WPVibe documents theme-file backups and trash. A general pre-write snapshot across options, meta, and post content isn't documented.

How WP MCP closes it

Every write gets a proposer, an approver, and a receipt.

Three tiers, one shared guard: read-only recon needs no packet, named verbs dry-run by default, and raw eval is a separate, harder-to-reach tier. Here's what happens on the guarded path.

1
Propose

packet_open describes the change — site, verb, target — and locks that target so a second agent can't race it.

2
Approve, separately

packet_approve authorizes it. Nothing requires the approver to be the same person who proposed it.

3
Write, with a receipt

The write only runs if the live payload matches the approved SHA-256 digest exactly. The previous value is snapshotted first.

Fact comparison

Limited to what's actually documented by each project.

WPVibeWP MCP Server
Raw PHP/eval as the default interface? No — allowlisted WP-CLI (40+ commands), no eval No — named verbs default; raw eval gated to Tier 3, SSH-only
Dry-run before write? Yes — required before destructive ops; explicit --dry-run for search/replace Yesapply=False is the default on every verb
Backup/snapshot before write? Theme-file backups + trash — no general pre-write snapshot documented Yes — before every write, plus optional durable re-verify
Change-approval gate (beyond role permission)? Yes — pauses for in-chat/browser approval, logged separately Yes — propose/approve change packet, distinct from role/token
Block-structural edits? not documented No — raw search/replace today (block-aware verb planned)
Transport Plugin + hosted WPVibe service (HTTPS) SSH+WP-CLI or companion plugin (plugin has no eval)

Choose WPVibe if…

  • You're a single operator and an in-chat approval pause already fits how you work
  • Zero raw-eval surface matters more to you than a gated escape hatch for rare cases
  • You'd rather use a hosted service than run your own approval infrastructure

Choose WP MCP Server if…

  • More than one person should sign off before a client site changes
  • You want every approval bound to one exact payload instead of a general go-ahead
  • Credentials should stay on your own infrastructure instead of a vendor's
  • You manage more than one client site and want one evidence trail across the fleet

Install it free and watch the approval flow work

Sources

Feature claims verified 2026-07-16. Verify against each project's current docs before relying on a cell — this space moves fast.

See who approves your next change.

Founding agencies get 50% off for 12 months — first 20, no setup fee.