Connect an AI client to Craft CMS. Within the rights of one Craft user.
AlphaBridge MCP is an MCP server for Craft CMS 5. MCP is the open standard through which AI assistants use tools. An AI client reaches your content through one endpoint. Each call runs as one Craft user and can do no more than that user.
Status: not on sale yet. It is being prepared for the Craft Plugin Store. This page describes what the plugin does.
What it does — and what it deliberately does not.
A short list is easier to trust than a long one. Each absence below is a decision, not a gap.
In the box
- Content — entries and categories: read, create, update, delete. Drafts: list, create, apply, discard. Globals: read and update.
- Assets and schema — read access to assets, fields, sections, entry types and sites.
- Operations — logs, caches, the queue, routes, system and plugin information.
- One guarded database query — a single
SELECTagainst one table, behind a guard. - An audit log — every tool call with user, outcome and argument names.
Deliberately not in the box
- No arbitrary PHP execution. There is no tool that runs code you pass in.
- No deployment. This plugin does not move files and never connects to another server over SSH or FTP. It works inside the Craft installation it is installed in.
- No plugin lifecycle. Nothing installs, enables or removes plugins.
- No writes to project config or users. Craft protects those in its controllers, not in the element API this plugin uses.
- No tags. Craft has no permission for them, so a boundary would have to be invented.
The boundary is a Craft user, not a promise.
A token belongs to exactly one Craft user and carries that user's permissions. The details are on the security page.
Permissions, per element
Before an entry is listed, saved or deleted, the plugin asks Craft what this user may do with this element, on this site. An unknown or forbidden section yields an empty list, not an error that leaks its existence.
Off until you switch it on
Every tool that changes state is off by default. You enable them one at a time on the settings page. A read-only switch sits above everything and wins.
A log that is safe to keep
The audit log records who called what, when, and whether it was allowed. It records argument names, never argument values — so the log never becomes a second copy of your content.
Scopes narrow further
A token carries a scope: read, content or full. The scope only ever narrows what the user may already do. It never widens it.
One price, one environment.
$49 one time, per production environment
Then $19 a year for continued updates. Sold through the Craft Plugin Store under the Craft License, once the listing is live — it is being prepared.
Development and staging environments are free to try — that is part of the Craft License, not a trial period we grant.
Requirements
- Craft CMS 5.9 or newer
- PHP 8.2 or newer
- MySQL 8.0.17+ / MariaDB 10.4.6+ or PostgreSQL 13+
- An MCP client that speaks Streamable HTTP and can send an
Authorizationheader
The same idea, for WordPress.
AlphaBridge MCP started on WordPress, where it is available today. The two plugins share the approach — one authenticated endpoint, permissions of a real user, a log for every call — but they are separate products with separate feature sets.