README

Vibe code your WordPress site. No SSH required.

Respira for WordPress is the bridge between AI coding agents and WordPress. It lets AI coding assistants — Cursor, Claude Code, Codex, Windsurf, Cline, Continue.dev, and any other Model Context Protocol (MCP) client — remotely read and edit a WordPress site through a secure REST API, with no SSH or server access required.

It ships 130+ abilities across 16 page builders, snapshots the site before every change, and offers one-click rollback.

What it does

Respira exposes a curated, safety-gated set of WordPress operations as MCP tools and WordPress Abilities. An AI agent connected to your site can build pages, edit page-builder layouts, manage content and plugins, configure SEO, and run multi-step workflows — entirely through the REST API.

Every destructive operation is duplicate-first and snapshotted: originals are never touched without explicit confirmation, and every action is recorded in an audit log.

Key features

• No SSH required — works on any host, including shared hosting, through the WordPress REST API.
• Duplicate-first editing — changes land on duplicate pages first; originals stay untouched until you approve.
• Snapshots, diff & restore — a snapshot is taken before every change; review the diff and roll back in one click.
• Security first — content is validated for XSS, SQL injection, and other issues before saving; code is checked against WordPress Coding Standards.
• Audit logging — a complete activity log of every AI action, exportable as a client-ready report (generate_activity_report).
• Rate limiting — configurable per-key request limits (default 100/hour).
• Encrypted API keys — stored using WordPress password hashing.
• WordPress AI Stack ready — registers tools as WordPress Abilities, ships a dedicated Respira MCP Adapter server, and can expose a read-only subset on the adapter's default public server.
• Browser AI (WebMCP) built in — bundles a WebMCP bridge plus the bulk of Respira's abilities for Chrome 146+ (PHP 8.1+).
• Elementor Angie integration — optional cookie + REST-nonce bridge that exposes a curated, duplicate-first toolset inside logged-in wp-admin.
• Multisite compatible — works across WordPress multisite networks and supports managing multiple sites from one assistant.

Supported page builders

Gutenberg (Block Editor) · Divi · Elementor (incl. Elementor 4 atomic write path) · Oxygen · Bricks · Uncode (WPBakery) · Beaver Builder · Thrive Architect · Brizy · Visual Composer · Spectra · Kadence Blocks · GenerateBlocks · SeedProd · and more — 16 builders supported.

Supported AI tools

Any MCP-compatible client, including: Cursor · Claude Code / Claude Desktop · Codex · Windsurf · Cline · Continue.dev.

How it works

1. Install and activate the plugin on your WordPress site.
2. Go to Respira → API Keys in wp-admin and generate an API key (copy it — it's shown only once).
3. Download the MCP server for your machine from respira.press.
4. Configure your AI coding assistant with the API key and your WordPress URL.
5. Start editing your site in natural language.

Managing multiple client sites? Use the account-wide MCP setup page at https://www.respira.press/dashboard/mcp.

Installation

From the WordPress admin

1. Go to Plugins → Add New.
2. Search for "Respira for WordPress", click Install Now, then Activate.

Manual / from a release ZIP

1. Go to Plugins → Add New → Upload Plugin.
2. Upload the ZIP and click Install Now, then Activate.

From source (developers)

This repository ships with its Composer vendor/ directory committed, so the plugin runs as-is when cloned into wp-content/plugins/. To work on it from a clean checkout:

git clone git@gitlab.com:hipdevteam/respira-wordpress-plugin.git
cd respira-wordpress-plugin
composer install        # refresh / install PHP dependencies

The plugin uses the Jetpack Autoloader to avoid dependency conflicts with other plugins on the same site.

Project structure

respira-for-wordpress.php   Plugin bootstrap & header (defines RESPIRA_VERSION)
admin/                      wp-admin UI — React-first dashboard, settings, audit log
assets/                     Static front-end / admin assets
includes/                   Core PHP: MCP server, abilities, validators, builder adapters
src/                        Additional source modules
data/                       Bundled data (e.g. manual-install.sql)
tools/                      Developer/QA scripts (e.g. qa-admin-isolation.sh)
docs/                       Documentation and SQL helpers
vendor/                     Composer dependencies (committed so the plugin runs on clone)
composer.json               PHP dependencies and scripts
readme.txt                  WordPress.org plugin readme (canonical changelog & FAQ)

Development

Composer scripts (see composer.json):

composer phpstan        # static analysis (PHPStan, level per phpstan.neon)
composer phpstan:diff   # analyse only the key validator/guard classes

Dev dependencies include phpstan/phpstan, szepeviktor/phpstan-wordpress, and php-stubs/wordpress-stubs.

Security & safety model

• Duplicate-first approach — never modifies original pages without explicit confirmation.
• Catalog-safe WooCommerce approvals — products keep their original live IDs on approval by default to avoid Meta/Google catalog desync.
• Content validation — all content is scanned for security issues before saving.
• Approval tokens — destructive tools require a short-lived (10-minute), single-tool approval token; approval is idempotent within the window so client retries don't fail.
• Audit trail — every API action is logged.

FAQ

Do I need SSH access? No — Respira works entirely through the WordPress REST API, so it runs on any host including shared hosting.

Is it safe to let an AI edit my site? Originals are never touched: changes land on duplicates first, every change is snapshotted, and everything is logged. If you don't like a change, delete the duplicate.

Does it work with the official WordPress MCP Adapter and Abilities API? Yes. Respira registers its tools as WordPress Abilities when the API is available, keeps its dedicated Respira MCP Adapter server, and can expose a safe read-only subset on the adapter's default public server.

Do I need a newer PHP version for Browser AI (WebMCP)? The WebMCP bridge requires PHP 8.1+ (upstream requirement). Core Respira functionality runs on the plugin minimum, PHP 7.4.

Does it work with multisite? Yes — Respira is fully compatible with WordPress multisite networks.

For the full FAQ and the complete, version-by-version changelog, see readme.txt.

Credits

Browser AI / WebMCP integration is based on the WebMCP Abilities plugin by Code Atlantic, licensed under GPL v2.

License

GPL-2.0-or-later. See https://www.gnu.org/licenses/gpl-2.0.html.