WordPress MCP plugins, compared on facts.
Several products connect an AI assistant to WordPress, and their marketing pages rarely help you tell them apart. This page tries something else: eight questions that matter when you hand an AI the keys to a site, each cell checked against the vendor's own pages on one stated date, with every source listed below the table.
Eight things you can verify yourself.
All statements as published on 2026-09-26. Products change quickly — check the vendors' own pages before deciding, and tell us if anything here has gone stale. "Not described" means: not found in the vendor's public documentation on that date, which is not a claim that the product lacks it.
| What | AlphaBridge MCP | Novamira | Easy MCP AI | Cowboy MCP | WP Umbrella |
|---|---|---|---|---|---|
| Rights per connection: scope and expiry | ✓ read-only, content-only or full per connection, optional expiry — in the free plugin | — abilities are on or off for every connection alike; no read-only mode; expiry not described | ✓ per token: WordPress user, tool subset, expiry (30 days by default) | ✓ full, read-only or a custom tool list per key or OAuth connection; expiry not described | — one account-level token for every site; no per-connection scope described |
| What the AI may do right after install | Content, media, taxonomies, comments, widgets, settings; the dedicated delete tools and reading profile fields stay off until you switch them on (comment moderation can already move a comment to the trash). No file, database or user-management tools in the free plugin. Pro adds them with the reads on (users, tables, theme files) and every writing or otherwise powerful tool off until an admin enables it. No PHP execution tool in any tier | Nothing until one switch enables the abilities; then PHP execution, WP-CLI, file writes and the database ($wpdb) | Content and site data; no PHP, SQL or theme-file writes; user and site-control tools are off on a fresh install | WP-CLI, files in wp-content, database and users are on; safe mode asks for confirmation only for tools marked destructive and WP-CLI commands outside its allowlist; schema-destroying SQL, eval and shell need Power mode; no PHP shell | Fleet actions only: plugin and theme updates, database optimisation, reports; no PHP, SQL, file or user endpoints |
| A way back | Pro: undo per change with a token, 24 hours; Agency: ZIP deploys optionally atomic, rolled back when the swap fails | — no backups, no rollback; crash recovery only isolates a broken sandbox file | Not yet (on the roadmap); before/after snapshots in a change history; post revisions can be restored | ✓ undo journal per change (7 days), database checkpoints, file backup on plugin and theme updates | Rollback of plugin and theme updates (backup, update, health check); backups in the dashboard |
| Audit log inside WordPress | ✓ every tool call, in the free plugin | Not described; usage details per connection | ✓ every tool call including refused ones, when logging is on; 30 days | ✓ every tool call, error and authentication event; 30 days | On the vendor's side, in the WP Umbrella dashboard |
| Deploy from the plugin | ✓ Agency: files, themes and whole builds onto your own hosting over SFTP; ZIP deploys optionally atomic with rollback | Uploads of plugins, themes, media and ZIPs through a temporary link; file abilities | — uploads to the media library only | Files in wp-content; plugin and theme installs from WordPress.org; no build push described | — no file or deploy operation in the API |
| Many sites in one chat | ✓ free hosted hub in every edition: up to 10 sites in one chat, each approved on its own login | Plugin: one connection per site; the free desktop app Novamira HQ (beta) bundles sites on your own computer | — each site is its own endpoint | — configured per site, not network-aware | ✓ one token and hosted MCP server for all sites in the account |
| EU hosting and data processing agreement | Plugin: contacts no service on its own. Hub: connection data in Cloudflare Durable Objects with the EU jurisdiction, requests served at the nearest location; the Claude credentials (client registration, grant, token hashes) in Workers KV, stored centrally and cached worldwide, no jurisdiction can be set; DPA published | No hosted part; no DPA found | No hosted part; sends nothing to the vendor | No hosted part; no telemetry | Hosted by Scaleway in France; DPA published; location of the MCP host not stated separately |
| Price | Free plugin $0 (39 tools); Pro $49/year or $9/month; Agency $299/year or $49/month; hub free | Free plugin €0; Pro Personal €49/year (3 sites), Agency €149/year, Lifetime €299; HQ free | Free, all 244 tools; no paid tier | Free, GPL-2.0; no paid tier | €1.99 per site and month, 14-day trial; add-ons extra; MCP and API included |
Sources, all read on 2026-09-26. AlphaBridge: the plugin on WordPress.org, tool reference, pricing, hub privacy notice, hub DPA. Novamira (not listed on WordPress.org): security, authentication, live site, recommended setup, getting started, Novamira HQ, pricing. Easy MCP AI: WordPress.org, API tokens, audit log, roadmap, changelog, privacy. Cowboy MCP: WordPress.org, security, undo guide, safety guide. WP Umbrella: umbrella-skill on GitHub, pricing, legal notice, DPA, its plugin on WordPress.org. Spotted an error? Tell us — we correct quickly.
Why we don't compare tool counts.
Because the numbers don't measure the same thing. Easy MCP AI counts 244 tools, some of them useful only with an SEO or analytics provider you connect yourself. Cowboy MCP lists 168. Novamira ships nine abilities — and one of them is "Execute PHP", which by itself stands in for many single operations. WP Umbrella exposes 37 API operations for fleet maintenance, not content tools at all.
AlphaBridge's own count — 134 tools, 39 of them free — has the same caveat: the WooCommerce and SEO tools are only useful with those plugins installed. A single number tells you very little about any of these products. What the tools let you actually do, does.
Managing and publishing share one plugin.
The row that separates the table above is the deploy row — so here is exactly what it means, and no more.
Deploy lives inside the plugin
Standalone MCP file-transfer tools exist — as separate software running outside WordPress. AlphaBridge is a WordPress plugin: site management and file publishing sit behind the same endpoint, the same permissions and the same audit log.
Credentials stay on your server
FTP/SFTP credentials are encrypted with libsodium inside WordPress and are never readable through MCP — they don't sit in a desktop config file or pass through the AI client.
Built for the handover
A provider builds and publishes the site on the Agency edition, then hands it over — and the owner keeps running it at pro level on Pro or Free. No agency lock-in, by design.
When another tool is the better pick.
- Easy MCP AI — free with 244 tools, per-token scopes and an audit log. A fit for one site that needs neither undo, deploy nor a hub.
- Cowboy MCP — an undo journal per change, database checkpoints and a safe mode that asks before destructive calls. Free, and built for single sites.
- Novamira — PHP execution and WP-CLI with full WordPress access (the sandbox only confines where persistent PHP files are written), for developers who want the AI to write code on the site itself, plus a free desktop app that bundles your sites locally.
- WP Umbrella — fleet maintenance for agencies: updates, backups, uptime and reports for many sites, hosted in the EU with a DPA. Not a content tool, and not meant to be one.
See the difference in practice.
Pro has a 7-day trial without a card; Agency adds Site Deploy for client sites. Or start with the free plugin and add an edition later.
Try Pro free for 7 days Or get the free plugin