Local by default
Your sites run on your computer and your agent works on that copy. Nothing reaches your live site until you review a push and press the button.
Security
BuildPress security:
your sites stay in your control
The BuildPress app builds on a copy of your site on your own computer, and the plugin runs inside your own WordPress install. There is no BuildPress cloud in between.
The desktop app
Built so a mistake never reaches visitors
Your AI gets a full working copy to change. Your live site only changes when you say so, and every push can be undone.
Credentials in your keychain
Host API tokens and SSH keys live in the macOS keychain, are encrypted with Windows data protection, or sit in the system keyring (libsecret) on Linux. They never sit in a plain file.
Host keys pinned
The app remembers each server's SSH host key. If it ever changes, the connection is refused instead of silently trusted.
Pushes leave your defences alone
Security plugin settings, 2FA secrets, server rules like .htaccess, and wp-config are never overwritten on production.
Rollback built in
Every push is staged beside the live site first. If a step fails it rolls back on its own, and after a push you can still choose Undo.
Telemetry you control
The app sends anonymous usage and crash reports, never site content, files, paths or prompts, and you can turn them off in settings.
The WordPress plugin · Architecture
Self-hosted by design
The BuildPress plugin boots an MCP server inside your site. When your AI creates a page or reads your design tokens, it connects straight to your WordPress install.
- No BuildPress-operated cloud, no proxy, no analytics pipeline
- Connects the same way the official WordPress mobile app does
- Direct connection, encrypted via HTTPS
Your AI Client
Claude / Cursor
Your Server
BuildPress MCP
No cloud in between. Direct connection, encrypted via HTTPS.
Authentication
WordPress App Passwords. Nothing custom
The plugin authenticates with WordPress Application Passwords, the same system behind the WordPress mobile and desktop apps and thousands of integrations. No proprietary tokens, no separate user store.
No proprietary auth
Standard WordPress security, maintained by the core team. Nothing custom to audit.
Instantly revocable
Revoke any App Password from wp-admin. Access stops immediately.
Per-user access
Each team member gets their own App Password. Track who did what in the audit log.
Plugin compatible
Works with Wordfence, Sucuri, iThemes Security, and any WordPress security plugin.
Access control
Three independent kill switches
Layered controls you flip from wp-admin. Each one works on its own: disabling any single layer blocks all MCP access.
Master switch
One toggle turns the entire MCP server off. When it's off, the server returns nothing: no tools, no data, no responses, no auth. Flip it off when you're not building, on when you are.
Domain locking
On activation, BuildPress locks itself to your site's domain. If the domain changes (a migration, a DNS hijack, an accidental staging clone), MCP access blocks until you re-authorize it from wp-admin.
Idle timeout
If you step away, BuildPress switches MCP access off for you. Pick a window of 1 to 10 hours; after that much inactivity, access stays off until you re-enable it (optional, off by default).
Transparency
Every AI action, logged
The plugin keeps a complete audit trail of every MCP tool call: timestamp, tool name, user, IP address, parameters and result.
- Stored in your WordPress database, with retention you control
- Append-only from the AI's side: no tool can modify or delete it
- Recorded on your own site, inside your wp-admin, nowhere else
Audit LogAppend-only
10:24:15elementor_create_pageadminsuccess
10:24:18elementor_add_elementadminsuccess
10:24:22elementor_update_elementadminsuccess
10:24:25wp_check_frontend_renderadminsuccess
10:24:31wp_upload_mediaadminsuccess
10:24:36elementor_save_as_templateadminsuccess
10:24:40buildpress_rememberadminsuccess
AI can't modify or delete the audit log. If something happened, it's recorded.
Plugin permissions
What AI can and cannot do
Every MCP tool is scoped to content and design. Anything that could compromise the install simply has no tool.
Can do
- Create, read, update, delete WordPress content
- Manage Elementor pages, colors, typography
- Create JetEngine data structures
- Manage ACF field groups and values
- Upload media from URLs
- Write to project memory
- Read site configuration
Cannot do
- Access wp-config.php or credentials
- Install, activate, or delete plugins
- Create or modify user accounts
- Execute arbitrary PHP code
- Access the filesystem directly
- Modify the audit log
- Write to security-sensitive memory
Data handling
Where everything lives
Nothing about your sites is hosted by us. Here is every piece of data the app and the plugin touch, and where it goes.
| Data | Where it lives | Sent externally? |
|---|---|---|
| Your local sites | Your computer | No, until you push to your own host |
| Host tokens and SSH keys | OS keychain or Windows data protection | Only to your host |
| Prompts and agent threads | Your computer and your AI provider | To Anthropic or OpenAI by their CLI, never to us |
| App usage and crash reports | Anonymous, can be turned off | Yes, without site content |
| License check | Once a day, 14 days offline grace | License and device only |
| Plugin: site content | Your WordPress database | No |
| Plugin: App Passwords | Your database (hashed) | No |
| Plugin: audit log and memory | Your WordPress database | No |
| Plugin: MCP requests | In transit (HTTPS) | To your AI client only |
| Plugin: updates | Version check to our CDN | Version number only |
Found a vulnerability? Email [email protected].
FAQ
Security questions
Straight answers about prompts, credentials and your live sites.
Ask us anythingNo. The app runs the official Claude Code or Codex CLI on your computer, signed in with your own account. Your prompts go from that CLI to Anthropic or OpenAI. BuildPress never sees your login and never proxies a model.
No. Your agent only works on the local copy. The live site changes only when you review a push and confirm it, and a database push asks you to type the domain first.
BuildPress itself never sends data to an AI provider. With the plugin, your AI client talks to your server directly, and the provider sees the tool responses your server returns, as with any AI tool. In the app, your agent reads the local site and its CLI sends what it reads to your provider.
Yes, that's the intended workflow. With the plugin each site has its own App Password and audit log, and you revoke access from wp-admin when the project wraps. With the app, client hosts connect with their own credentials, kept in your keychain.
MCP access stops immediately. Everything the AI created remains as standard WordPress content, and your widget library, project memory and audit log are preserved. Feedback pins and their screenshots are review artifacts, so deleting the plugin cleans those up.
Yes. The plugin uses standard WordPress authentication and REST API patterns, and works with Wordfence, Sucuri, iThemes Security and similar plugins. App pushes never overwrite their settings.
Build safely
Let AI build on a copy.
Push only what you approve.
Download the free app, connect Claude Code or Codex, and build your first site today.