Trust center

WP MCP Cloud can approve a change. It can't make one.

Approvals and audit records live in Cloud. Your SSH keys, WordPress application passwords, and plugin secrets stay on your own server, always.

Read the threat model Install the open-source server
The assumption worth checking

A control plane that approves changes doesn't need your credentials to do it.

Most SaaS dashboards ask for API keys before they're useful. This one doesn't need yours. The local core enforces and executes every mutation — Cloud's job stays narrower than that.

Runs on your infrastructure

Local core

Holds every credential and executes every guarded verb — enforces the packet guard, takes the snapshot, verifies the result. The only part of this system that ever touches WordPress.

Optional, paid

WP MCP Cloud

Authorizes and records, nothing more — approval inbox, policy, evidence timeline. It never holds a credential and never executes a mutation.

Pairing & signing protocol, in plain language

Outbound-only. No inbound firewall opening required.

1
Instance key pair, generated locally
Your local core generates its own key pair during Cloud pairing — the private key never leaves your instance.
2
Short-lived pairing code
Sign in to Cloud and create a short-lived pairing code. It exchanges for an instance ID and a narrowly scoped ingestion credential, nothing with broader account access.
3
Signed packet events, outbound over HTTPS
Your core sends signed packet lifecycle events to Cloud. Cloud never reaches into your instance to pull anything.
4
Outbound decision polling
Your local core polls an outbound endpoint for approve/reject decisions. No inbound firewall opening is ever required on your side.
5
Every decision is verified before it counts
Core checks Cloud's signature, the packet digest, site and target, approver role, and expiry before trusting a remote decision. One that doesn't check out changes nothing locally.
Preview data modes

Your organization picks how much a reviewer sees.

Content doesn't reach Cloud in every mode. It can, by design, in two of the three — this is the exact breakdown.

Available

Metadata-only

No content leaves the instance. A reviewer sees the action, the target, and the risk level — never the payload itself.

Available

Encrypted preview

A sanitized diff, encrypted in transit and at rest with an org-scoped key. A reviewer sees the change; Cloud's own storage never holds it unencrypted.

Future

Zero-knowledge mode

A browser-decrypted preview using a key only your org holds, so Cloud itself never gets the ability to read the content. Planned. Not shipped yet.

The exact boundary

What Cloud may hold, and what it must never hold.

May hold
  • Account/team identity
  • Site aliases and non-secret metadata
  • Packet metadata and policy decisions
  • Optional sanitized/encrypted previews
  • Audit/evidence events
  • Public instance keys
Must never hold
  • SSH private keys
  • WordPress application passwords
  • Companion-plugin API keys
  • Raw environment variables
  • Unrestricted PHP payloads, by default
  • Reusable local MCP bearer tokens
Change Packet integrity
An approval authorizes one exact digest — site, target, verb, arguments, preview, and pre-change state, all hashed together. Change any of those and the approval stops matching. It can't be silently reauthorized for something else. Full explanation on the security model page →
What we don't claim

No compliance theater.

  • No SOC 2, HIPAA, or signed BAA claim today. Formal compliance and SLA support are an Enterprise/Platform-stage conversation — see pricing.
  • No "immutable" claim for the audit ledger. That word gets earned once it's cryptographically tamper-evident and externally anchored.

Vulnerability disclosure & threat model

SECURITY.md on GitHub covers the trust boundaries and exactly what the guard does and doesn't protect against. It also covers open risks, deployment guidance, and how to report a vulnerability.

Roadmap note for enterprise needs

SSO/SCIM, customer-managed keys, a private control plane, and SLA support arrive at the Enterprise/Platform phase. Nothing here is available today. No firm date yet — see the Enterprise row on pricing to start that conversation.

Read the full trust boundaries before you commit.

Read the threat model See the agency page