MCP server for WordPress agencies

Let Claude fix your clients' sites. Without handing it the server.

PressBridge connects Claude to the WordPress sites you manage. Claude can edit theme files, run plugin updates and write care-plan reports. It can't open a shell, read wp-config.php or touch anything you didn't allow. Every change is backed up and can be undone in one step.

Buy Pro from $49 Try the free version

Self-hosted. Your files never pass through our servers. Works with Claude Code, Claude Desktop and any MCP client.

claude · pressbridge

On acme, the phone number in the header is wrong. It should be 0745 123 456. And check the DB password while you're in there.

search pattern="0744 98" path="wp-content/themes/acme-child"

header.php:41 <a href="tel:074498...">0744 987 001</a>

edit_file header.php "0744 987 001" → "0745 123 456"

✓ saved php -l passed backup 20261014T091322.418302Z

read_file wp-config.php

✗ refused blocked by deny rule 'wp-config*'

wp plugin update contact-form-7

✓ exit 0 5.9.8 → 6.0.1

Done. The header now shows 0745 123 456 (undo with backup 20261014T091322.418302Z). Contact Form 7 is updated. I can't read wp-config.php: PressBridge blocks it so database passwords never reach me.

The problem

Today you either give an AI root, or you copy and paste.

Root SSH means one bad instruction can wipe a client's site. Pasting files into a chat is slow, and the AI never sees the whole theme. PressBridge sits in between.

	SSH key for the AI	Copy-paste into chat	PressBridge
Claude sees the whole theme	Yes	No	Yes
Can read wp-config.php and .env	Yes	If you paste them	Never
Can run any shell command	Yes	No	No. Fixed tools only
Undo a change	Only if you have backups	By hand	One call, every change
Broken PHP reaches the live site	Possible	Possible	Blocked by a syntax check
Log of what the AI did	Shell history, maybe	No	Every call, with arguments
Different rights per client	Separate users and keys	N/A	One line per site

Guardrails

The server enforces the rules, not the AI.

A prompt hidden in a plugin readme or a web page can't talk its way past these limits. They are checked by PressBridge before anything runs.

Allowed Upkeep you'd do yourself

wp plugin update akismetOn sites you mark for maintenance
wp core update && update-dbCore updates, last
wp cache flushAfter theme changes
wp core verify-checksumsSpot hacked core files
edit_file header.phpBacked up and PHP-checked
search-replace --dry-runPreview before migrating

Refused Anything that could sink a site

wp eval / eval-file / shellNo arbitrary PHP
wp db query / export / importNo raw SQL
wp config get DB_PASSWORDSecrets stay secret
wp user create --role=administratorNo new admins
wp option update siteurlProtected options locked
read_file ../../etc/passwdNothing outside the site folder

What's inside

Built for people who look after other people's websites.

One-call undo

Every edit, move and delete copies the original outside the webroot first. Claude tells you the backup ID; restore_backup puts it back.

No white screens

PHP files are checked with php -l before they're saved. A missing semicolon in functions.php never goes live.

Per-client permissions

Read-only for the bistro, full maintenance for staging, edits on the agency site. Set in one YAML file.

Secrets hidden everywhere

wp-config, .env, SQL dumps, keys and .git don't show up in listings, searches or reads. At any folder depth.

Audit log

Every call is written to a JSON Lines log: time, site, tool, arguments, result. Useful when a client asks what changed.

Your server, your data

Runs in Docker on the same machine as the sites. Automatic HTTPS, bearer tokens, or SSH with no open port at all.

Included skills

The monthly care report, written in two minutes.

Pro ships with three Claude skills that turn the tools into agency workflows. The care-report skill checks every site you name and writes a plain-language report you can send to the client.

The other two cover safe theme edits (child theme first, smallest change, verify) and safe updates (one plugin at a time, stop at the first error).

Ask Claude: "Run a care report for all my sites."

bistro-ro · October 2026Needs attention

Updates: 4 plugins and 1 theme have updates. WooCommerce is two minor versions behind.
Security: Core files match wordpress.org. 3 administrator accounts, one named admin.
Housekeeping: 5 inactive plugins. Search engines are allowed to index the site.

What we recommend this month

Update WooCommerce on staging first, then live.
Rename or remove the admin account.
Delete the 5 inactive plugins.

Example output for a fictional site.

New · PressBridge Watch

A night shift for every site you look after.

Every night, Watch compares each site with the night before. A new administrator, a PHP file in uploads, a changed core file: you hear about it before your client does.

New administrator accountsThe first thing most attackers create.
PHP files in the uploads folderAlmost always a web shell.
Backdoor-like codeeval(base64_decode(…)), code run from $_POST, images loaded as PHP.
Core files changed without an updatePlus wordpress.org checksums for core and plugins.
Risky settingsOpen registration with an admin default role, a changed site address.
Sites that crashA PHP fatal error means the site is probably down.

Plugin updates and changes made through PressBridge are recognised, so they don't wake you up. On quiet weeks you get a short all-clear, so you know Watch is running.

From PressBridge Watch

Subject [PressBridge] CRITICAL on acme: New administrator account: wpsupport

Claude thinks this site is compromised.

A plugin named site-assets was installed at 02:11 and runs code sent in a URL parameter. The administrator wpsupport was created four minutes later, and a PHP shell appeared in uploads.

Critical New administrator account: wpsupport
Critical PHP file in uploads: 2026/10/cache.php
Critical Backdoor code in plugins/site-assets
Critical Registration opened with role 'administrator'
Warning New plugin activated: site-assets

What to do: 1. Put the site in maintenance mode and keep a copy as evidence. 2. Remove wpsupport and site-assets. 3. Change every admin and hosting password.

Example alert. The findings come from a simulated hack on a test site; Claude's text is illustrative.

Can't change your sites

Watch runs in its own container, with your site folders mounted read-only.

Claude explains what it found

Add your Anthropic API key and Claude reads the flagged files, then writes a verdict and next steps. It can't hide or downgrade an alert.

Alerts where you already are

Email, Slack, Discord, or push notifications on your phone through ntfy.

Start Agent: $15/month Includes everything in Agency. Cancel anytime.

Setup

About ten minutes on a server you already run.

You need SSH access and Docker on the server where your WordPress sites live. No Docker? A plain Python install over SSH works too.

List your sites

sites:
  acme:
    root: /var/www/acme/public_html
    mode: write
    wp_profile: maintenance
  bistro:
    root: /var/www/bistro/htdocs

Start it

echo "PB_TOKEN=$(openssl rand -hex 32)" > .env
echo "PB_DOMAIN=mcp.agency.com" >> .env
docker compose --profile tls up -d

Caddy gets an HTTPS certificate automatically.

Connect Claude

claude mcp add --transport http \
  pressbridge https://mcp.agency.com/mcp \
  --header "Authorization: Bearer $PB_TOKEN"

Claude Desktop setup is in the install guide.

Pricing

Pay once for the tools. Add the night watch monthly.

One-time licenses include a year of updates and email support, and keep working after that. Agent is monthly: everything in Agency, plus Watch. Cancel anytime. 14-day refund on every plan.

Free

1 site, read-only
Read, list and search files
Read-only WP-CLI and site overview
Care-report skill
SSH connection

Download free

Solo

$49 one-time

Everything in Agency
For one person
Unlimited sites
Upgrade to Agency anytime for the difference

Buy Solo

Most agencies

Agency

$100 one-time

Unlimited sites and servers
Your whole team
Edits with backups and undo
Updates, cache, options, posts
HTTPS server, Docker, tokens
Audit log and all 3 skills

Buy Agency

New

Agent

$15 / month

Everything in Agency
Watch: nightly security checks on every site
Alerts by email, Slack, Discord or phone
Claude reviews every alert (your API key)
All updates while subscribed
Cancel anytime

Start Agent

Prices in USD. Taxes such as EU VAT are calculated at checkout. Orders are processed by our online reseller, which is the merchant of record. See the terms and refund policy. Claude's review in Watch runs on your own Anthropic API key, billed by Anthropic.

Questions

Before you buy

Does my site's content go through your servers?

No. PressBridge runs on your server. Claude connects to it directly. The only party that sees the files Claude reads is the AI provider you already use.

Which hosting does it work on?

Any Linux server where you have SSH and can run Docker or Python: VPS, dedicated, RunCloud, Ploi, SpinupWP, GridPane, Coolify and similar. Shared hosting without SSH is not supported.

Does it work with Claude Desktop, or only Claude Code?

Both. Claude Code connects over HTTPS with a token. Claude Desktop connects over SSH or through a small local bridge; the install guide has copy-paste configs for each. Other MCP clients like Cursor work the same way.

What if Claude breaks something anyway?

Every file change has a backup outside the webroot and can be restored in one call. Database changes (plugin updates, option updates) are not covered by those backups, so keep your normal database backups running. The updates skill updates one plugin at a time and stops at the first error.

Can I use it for client sites?

Yes. Every paid plan covers unlimited sites, including sites you maintain for clients. You can't resell PressBridge itself.

What's the difference between Agency and Agent?

Agency is a one-time license for the tools Claude uses to work on your sites. Agent is monthly and adds Watch, which checks every site every night and alerts you when something changes that shouldn't have.

Does Watch need an Anthropic API key?

No. The checks and alerts work without one. With a key, Claude also investigates what was found and explains it. That usage is billed to you by Anthropic, and only happens on nights with findings.

What happens if I cancel Agent?

Your Agent license ends with the paid period, so Watch and the Agent edition stop. To keep the tools without Watch, buy a one-time Solo or Agency license.

Is the code open?

You get the full Python source with every paid plan, and the Free edition is MIT-licensed on GitHub. Read every line before you run it on a client server.