Novamira connects an MCP-compatible AI client directly to a WordPress site, with capabilities that can include PHP execution, WP-CLI, database queries, and file operations. That breadth makes it a potentially useful tool for development work—and a consequential one to authorize. Novamira recommends using it on development or staging sites with backups, rather than treating its safeguards as a barrier against risky code.
What is Novamira?
Novamira is an open-source WordPress plugin and MCP server. It connects an MCP-compatible AI client to a WordPress installation so the client can discover and invoke site capabilities. The project says it builds on the WordPress Abilities API and MCP Adapter, which exposes WordPress abilities through the Model Context Protocol.
As an Amazon Associate I earn from qualifying purchases.
The vendor says the connection is direct and does not pass through a Novamira-hosted proxy. The project identifies its license as AGPL-3.0-or-later. These are project statements, not independent assessments. See the project repository, official website, and getting-started guide.
Recommended Free Tools
What can an AI agent do with it?
Novamira’s materials describe access to several kinds of WordPress and server-side work. The exact abilities available depend on what is enabled and the setup. The project’s security documentation warns that an authenticated agent can run PHP with access to the WordPress environment, database, loaded plugins, and PHP runtime.
#1 Best Overall
- Run PHP: execute PHP inside the WordPress process.
- Use WP-CLI: issue command-line operations within the WordPress context.
- Query the database: interact with site data through database capabilities.
- Inspect or edit files: use file abilities, subject to documented restrictions that do not constrain PHP’s native filesystem access.
- Work with content and media: the project describes workflows for native Block Editor content and media.
These capabilities can make an agent useful for site maintenance and development tasks, but they also mean a mistake can affect code, configuration, content, or data. The project’s how-it-works documentation describes the available workflows. Novamira also lists compatibility with clients including Claude, Codex, Cursor, Gemini CLI, Antigravity, and VS Code with GitHub Copilot. Those are vendor compatibility claims; they have not been independently verified here, and the list may change.
What does setup require?
The project lists WordPress 6.9 or later, PHP 8.0 or later, a WordPress administrator account, and an MCP-compatible client or a terminal-based agent using Novamira CLI. Remote connections require HTTPS; local development environments are the stated exception. Check the repository requirements before installing, since minimum versions and client support may change.
- Download the plugin’s release ZIP. The repository warns that GitHub’s automatically generated source archive does not include the bundled Composer dependencies required by the MCP server.
- Install and activate the plugin in WordPress.
- Open Novamira’s configuration screen and enable AI Abilities. The vendor says abilities are off by default.
- Connect an MCP client using the vendor’s setup prompt workflow or follow its manual configuration instructions in the quick start.
- For a remote connection, configure HTTPS and an available authentication method. Novamira describes OAuth and WordPress Application Passwords; security plugins may disable Application Passwords and interfere with that authentication route.
The vendor’s security documentation says abilities require an administrator. An administrator-level connection should be treated as a high-trust integration, not a narrow content-only permission.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How should you assess the security trade-off?
Novamira’s security page puts the core issue plainly: “Your AI runs PHP inside your WordPress process.” This is the vendor’s description of the execution model, not a guarantee that every action is predictable or safe. An agent with this access may affect the same environment, database, plugins, and runtime that power the site.
The PHP file sandbox is a guardrail for new PHP files, not a security boundary. The documentation says arbitrary PHP execution can bypass it. File abilities have filesystem restrictions, but those restrictions do not limit PHP’s native filesystem access. The documented recovery feature for fatal errors in sandbox files assists with recovery; it is not a rollback mechanism for all changes an agent may make.
Novamira’s security documentation recommends development and staging environments and keeping backups. Its live-site guidance notes that code, configuration, and database changes made through an agent are real changes to the site. A staging environment provides a place to assess the workflow without putting production changes directly at stake; backups remain important because the documented recovery assistance does not reverse arbitrary database, file, or configuration changes.
Rank #4
Can you use Novamira on a live WordPress site?
The vendor’s live-site guidance addresses production use, but its prominent recommendation is for development and staging environments, with backups. If you choose to connect a production site, do so only after weighing the broad access, confirming your authentication and transport setup, and deciding how you will detect and recover from unwanted changes. The documentation does not establish that the sandbox makes production use safe or that agent actions can be undone.
Who should consider Novamira?
Novamira may suit a developer or technically experienced site owner who wants an MCP client to work with WordPress capabilities and can provide a staging environment, backups, and careful oversight. It is a poor fit if your requirement is strictly limited access to routine content editing, or if you cannot tolerate an agent operating with administrator-level capabilities and access to PHP, the database, and filesystem-related operations.
Best Value
- Confirm the WordPress and PHP versions meet the stated minimums.
- Check that your preferred MCP client is supported for your intended workflow.
- Determine whether OAuth or Application Password authentication works in your environment.
- Use staging and maintain backups before enabling abilities.
- Decide whether broad execution and data access match your risk tolerance.
What does Novamira Pro add?
The vendor describes Pro as adding specialized tools, memory between sessions, and guided skills. Its website advertises Pro from €49 per year. That is a vendor-listed starting price, not an independently verified quote; check the current product page for present pricing and packaging. The core plugin is described as free.
There are no independent performance measurements or controlled comparisons established for this review. Compatibility, capabilities, safeguards, and pricing above are based on Novamira’s own repository, website, and documentation, and should be checked against those sources when making a deployment decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
