Your Craft site, open to an AI client — on your terms.
AlphaBridge MCP is a security-hardened MCP server for Craft CMS 5. An AI client reaches your content and your operations through one authenticated endpoint. Every call runs as one Craft user and can never do more than that user may, and every call is written to an audit log.
Status: the plugin is finished and tested; the listing in the Craft Plugin Store is being prepared. This page describes what ships.
What it does — and what it deliberately does not.
A short list is easier to trust than a long one. Each absence below is a decision, not a gap.
In the box
- Content — entries and categories: read, create, update, delete. Drafts: list, create, apply, discard. Globals: read and update.
- Assets and schema — read access to assets, fields, sections, entry types and sites.
- Operations — logs, caches, the queue, routes, system and plugin information.
- One guarded database query — a single
SELECTagainst one table, behind a guard. - An audit log — every tool call with user, outcome and argument names.
Deliberately not in the box
- No arbitrary PHP execution. There is no tool that runs code you pass in.
- No deployment. This plugin does not move files and does not touch a server. That belongs to a different tool.
- No plugin lifecycle. Nothing installs, enables or removes plugins.
- No writes to project config or users. Craft protects those in its controllers, not in the element API this plugin uses.
- No tags. Craft has no permission for them, so a boundary would have to be invented.
The boundary is a Craft user, not a promise.
A token belongs to exactly one Craft user and carries that user's permissions. The details are on the security page.
Permissions, per element
Before an entry is listed, saved or deleted, the plugin asks Craft what this user may do with this element, on this site. An unknown or forbidden section yields an empty list, not an error that leaks its existence.
Off until you switch it on
Every tool that changes state is off by default. You enable them one at a time on the settings page. A read-only switch sits above everything and wins.
A log that is safe to keep
The audit log records who called what, when, and whether it was allowed. It records argument names, never argument values — so the log never becomes a second copy of your content.
Scopes narrow further
A token carries a scope: read, content or full. The scope only ever narrows what the user may already do. It never widens it.
One price, one environment.
$49 one time, per production environment
Then $19 a year for continued updates. Sold through the Craft Plugin Store under the Craft License, once the listing is live — it is being prepared.
Development and staging environments are free to try — that is part of the Craft License, not a trial period we grant.
Requirements
- Craft CMS 5.9 or newer
- PHP 8.2 or newer
- MySQL 8.0.17+ / MariaDB 10.4.6+ or PostgreSQL 13+
- An MCP client that speaks Streamable HTTP and can send an
Authorizationheader
The same idea, for WordPress.
AlphaBridge MCP started on WordPress, where it is available today. The two plugins share the approach — one authenticated endpoint, permissions of a real user, a log for every call — but they are separate products with separate feature sets.