// AGENT ACCESS // EARLY ACCESS
EARLY ACCESS

A WORDPRESS MCP SERVER FOR THE WHOLE HOSTING STACK

Move work from prompt to audited action across content, hosting, and growth.

Signup starts the hosting journey; Nova enables Agent access for your account separately during early access.

// PROTOCOL

WHAT IS A WORDPRESS MCP SERVER?

Model Context Protocol gives supported assistants a structured way to call approved tools. Nova runs an authenticated, stateless Streamable HTTP endpoint at https://mcp.nova.host/mcp. There is no separate MCP plugin to install: Nova's preinstalled platform plugins on every Nova site provide the tenant-side APIs. One account-wide key connects Claude Code CLI, .mcp.json, Codex, and Cursor; claude.ai uses OAuth 2.1.

// OUTCOMES

GIVE YOUR AGENT A REAL JOB

DRAFT & UPDATE

Create drafts, update with optimistic concurrency, upload media, preview content, and inspect revisions.

POLICY-CHECKED PUBLISHING

Publish only through Nova's content link gate.

OPERATE THE SITE

Purge cache, capture screenshots, create change requests, and inspect activity.

READ GROWTH SIGNALS

Review keyword rankings, Search Console connection status, Chrome UX, analytics, and form entries with values hidden by default.

PROTECT RECOVERY

List or trigger backups without granting restore authority.

CONFIRM RESTORES

Prepare a restore, then execute only with a five-minute single-use confirmation.

// CAPABILITY MAP

WHAT CAN NOVA'S WORDPRESS MCP SERVER DO?

Capability map // September 2026

CONTENT

  • read
  • draft
  • update
  • preview
  • revisions
  • media
  • policy-checked publishing

SITE DATA

  • keyword rankings
  • Search Console connection status
  • Chrome UX
  • analytics
  • forms
  • entries with values hidden
  • backups
  • activity

OPERATIONS

  • backup triggers
  • cache purge
  • screenshots
  • change requests
  • confirmed restores

Where most WordPress MCP integrations cover posts and pages, Nova's also reaches the hosting layer: backups, confirmed restores, cache, screenshots, and growth data.

// SITE GRANTS

AI AGENT ACCESS FOR WORDPRESS HOSTING, SITE BY SITE

SITE.PERMISSION.CONSOLE

Content read

Read pages, posts, media, previews, and revisions.

OFF

Content write

Create and edit drafts and media.

OFF

Publish

needs Content write

Publish or update live content through Nova's link gate.

OFF

Site data read

View keyword rankings, Search Console connection status, Chrome UX, analytics, forms, backup listings, and activity.

OFF

Operations

Trigger backups, purge cache, capture screenshots, and create change requests.

OFF

Destructive

acknowledge + confirm

Prepare and execute backup restores that overwrite the live site.

OFF

Every capability starts off for every site. Publish turns off with Content write. The dashboard asks you to acknowledge that a restore overwrites the live site before you enable Destructive, and every restore still needs a five-minute single-use confirmation. One account key identifies the account but never bypasses a site grant; OAuth consent never expands site permissions.

// SIGNAL PATH

FROM ACCOUNT TO FIRST AUTHORIZED CALL

STEP 01 // CREATE YOUR ACCOUNT

CREATE YOUR ACCOUNT

Sign up, verify your email, and provision the WordPress site your agent will help run. Already hosted elsewhere? We migrate it for free. Agent access needs a site to attach to, so the site comes first.

ACCOUNT VERIFIED → SITE PROVISIONED

STEP 02 // SWITCH ON AGENT ACCESS

SWITCH ON AGENT ACCESS

During early access Nova enables Agent access for your account. Open it in your dashboard and turn on only the per-site capabilities you want. All six start off. Publish depends on Content write, and Destructive asks you to acknowledge that restores overwrite the live site.

AGENT ACCESS ENABLED → SITE GRANTS SELECTED

STEP 03 // CONNECT YOUR AGENT

CONNECT YOUR AGENT

Create your API key, copy it from the one-time reveal, and paste one command into Claude Code, Cursor, or Codex. On claude.ai, add Nova as a connector and approve with OAuth. Then make your first call. One key is active per account: Regenerate replaces it, Revoke disconnects key-based agents.

CREDENTIAL SAVED → CONNECTOR ADDED → FIRST CALL AUTHORIZED

// TOOL MANIFEST

23 TOOLS. SIX SITE-BOUND GRANTS.

NOVA.MCP: TOOL MANIFESTEARLY ACCESS

CONTENT READ // 4

content_listread
content_getread
content_preview_urlread
content_revisions_listread

CONTENT WRITE // 3

content_create_draftwrite
content_update[optimistic concurrency]write
media_uploadwrite

PUBLISH // 1

content_publish[Nova link gate]write

SITE DATA READ // 9

seo_keywords_getread
search_console_get[connection status + properties]read
crux_getread
analytics_getread
forms_listread
form_entries_list[values hidden by default]read
form_entry_get[values hidden by default]read
backups_listread
activity_listread

OPERATIONS // 4

backup_triggerwrite
cache_purgewrite
screenshot_capturewrite
change_request_createwrite

DESTRUCTIVE // 2

backup_restore_prepareread
backup_restore_execute[five-minute single-use confirmation]destructive
TOTAL // 23 · ALL GRANTS // OFF BY DEFAULT
// CONNECTORS

CONNECT CLAUDE TO WORDPRESS

https://mcp.nova.host/mcp
claude mcp add --transport http nova https://mcp.nova.host/mcp --header "Authorization: Bearer $NOVA_MCP_API_KEY"

The first four use your account API key. claude.ai uses OAuth 2.1: add the connector, sign in, review the named scopes, approve. One active key per account; Regenerate replaces it, Revoke disconnects key-based agents; revoke OAuth apps under Connected apps.

// CONTROL PLANE

REMOTE MCP SERVER. NO SEPARATE PLUGIN.

REQUESTCREDENTIAL SCOPEAGENT ACCESSPILOTSITE OWNERSHIPSITE GRANTRATE LIMITTOOL

TENANT-BOUND DELEGATION

Backends receive one-shot delegation tokens bound to your site.

IDEMPOTENT WRITES

Write calls carry idempotency keys, so retries never double-apply.

APPEND-ONLY AUDIT

Tool calls are written to an append-only audit trail.

CONFIRMED RESTORE

Prepare first; execute only with a five-minute single-use confirmation.

Limits apply per user, site, and operation, with 24-hour caps on screenshots, backups, and restores.

// AVAILABILITY

EARLY ACCESS, PILOT-GATED

Agent access is not generally available. Nova enables it per account during the pilot; you need an account and a provisioned Nova site first. If you open Agent access in your dashboard before you are enabled, you will see a pilot-interest message.

Signup and hosting purchase do not by themselves grant pilot admission.

// DIAGNOSTICS

WORDPRESS MCP SERVER FAQ

PROVISION THE SITE. GET EARLY ACCESS. CONNECT YOUR AGENT.