MIT licensed

Every safety mechanic is free. Verify it yourself.

WP MCP Core is MIT-licensed and open source. Every guarded operation runs locally, at no cost, and the code is public.

Install free on GitHub See what Cloud adds
Free, forever

Local safety ships complete — nothing held back to force an upgrade.

Crippling local safety would cost more trust than it would earn. So Community ships everything Core can do — no time limit, no site cap.

  • MCP endpoint and client integrations — Claude, Cursor, Codex, Windsurf, or anything else that speaks MCP
  • Local site registry
  • SSH + WP-CLI transport
  • Companion-plugin transport — hard allowlist, no eval capability at all
  • Scoped tokens: recon / mutate / admin
  • Named verbs, dry-run-by-default mutations
  • Local change packets and approvals
  • Target locks and optimistic concurrency (ETags)
  • Pre-write snapshots before every mutation
  • Verification and delayed re-verification
  • Local audit CLI — wpguard audit
  • Optional Slack/Discord notification webhooks
  • Optional Cloud pairing — credentials still never leave your infrastructure
  • Community support
Install

Up and running locally in a few commands.

Docker (recommended) 
$ cp .env.example .env
$ python -c "import secrets; print(secrets.token_hex(32))"
# edit .env: set WPGUARD_MCP_TOKEN to the generated value
$ docker compose up -d

# server comes up on http://127.0.0.1:8642/mcp, bound to loopback

Tagged releases publish multi-arch images (amd64 and arm64) to ghcr.io/cgallic/wpguard-mcp. The packet ledger, snapshots, and site registry persist in a named volume.

Developing on the repo directly? Use pip install -e . instead. For sites you can't reach over SSH, drop the companion-plugin ZIP into wp-content/plugins/ — it ships with checksums.

wpguard-mcp is deliberately not on the WordPress.org plugin directory. WP.org guidelines prohibit arbitrary code execution. The plugin itself has zero eval capability, but its purpose — letting a remote server run admin operations — rarely clears review. Self-hosted from GitHub is the model every comparable tool in this space uses.

Full quickstart on GitHub →

Why open source

A tool that writes to production earns trust by being verifiable.

Enterprise AI-governance buyers already pay for policy enforcement. This wins that trust through transparency: open source, a published threat model, easy self-hosting, and self-serve pricing.

What you can verify yourself
  • MIT license — read it, fork it, self-host it indefinitely
  • A public GitHub issue tracker — safety mechanics are numbered and linked straight from the README
  • CI runs lint, type checks, and the full test suite on every pull request, across Python 3.10–3.12
  • A published SECURITY.md that spells out trust boundaries and known open risks in plain language
When to add Cloud

Community fully serves a single local operator. Install it, register a site, and every guarded-mode mechanic just works.

Add Cloud for three reasons: a second approver who isn't at your keyboard, centralized evidence across more than one site, and client-ready reports you don't want to assemble by hand.

Community & support

Development happens in the open.

GitHub issues

Every safety mechanic ships with a linked issue: propose-vs-approve, per-target locks, optimistic concurrency, durable re-verify. Read the history yourself.

Vulnerability disclosure

SECURITY.md covers what the guard protects against, known open risks, deployment guidance, and how to report a vulnerability.

Public roadmap

Open issues and milestones track what's shipped and what's next, including the Abilities API adapter and block-aware editing.

Install Core. It's free, and it stays that way.

Install free on GitHub See what Cloud adds