Questions people ask before letting an AI near a live site
Answers about what ships today. Where something is not included, it says so.
What can an AI client actually change on my site?
Entries, drafts, categories and globals — and only if you switched those tools on, because everything that changes state is off by default. Reading covers content, assets, the schema and operational information. The full list with each tool's access class is on the tool reference.
Can it do more than the person whose token it uses?
No. A token belongs to exactly one Craft user, and every element passes Craft's own permission check for that user, on that site. The token's scope can narrow this further; it never widens it. Give a token the smallest user that still does the job.
Does it run arbitrary PHP, shell commands or templates?
No. There is no tool that executes code you pass in. That is a deliberate absence, not a feature waiting to be added.
Does it deploy, or move files to a server?
No. This plugin does not transfer files and never connects to a server over SSH or FTP. It works inside the Craft installation it is installed in. If you need that, it is not part of this product.
What happens if a token leaks?
Revoke it — in the control panel or with php craft alphabridge-mcp/tokens/revoke <id> — and the next call with it fails. Then read the audit log to see what was done with it. Tokens can also carry an expiry date so a forgotten one stops working on its own. Only a SHA-256 hash of a token is stored, so a database dump does not hand anyone a working token.
What does the audit log store — is it a copy of my content?
No. It records when, which tool, which user and the outcome, plus the names of the arguments. It does not record argument values. You can see that an entry was created with a section and a title; you cannot read that title out of the log.
Does it work with a multi-site Craft installation?
Yes. Site handles are accepted where they matter, and the site permission is part of every check — an editor who may work on one site reaches only that site through the AI client. Where a value differs per site, as with globals, the answer names the site it read.
Which AI clients work with it?
Any client that speaks MCP over Streamable HTTP and can send an Authorization header: Claude Code, Claude Desktop, Cursor and others. Configuration examples are in the documentation. Clients that can only put a token in a URL need a setting that is off by default, and the documentation explains the trade-off before you turn it on.
What does it cost, and can I try it first?
$49 once per production environment, then $19 a year for continued updates, through the Craft Plugin Store under the Craft License — once the listing is live, which is being prepared. Development and staging environments are free to try; that is part of the Craft License, not a trial period we grant.
What happens when I uninstall it?
The migration is reversed: both tables, alphabridge_tokens and alphabridge_audit, are removed and nothing is left behind. Uninstalling is part of the automated end-to-end test on every change, so it is not a path that only gets tried once.
Still unclear? Write to mail@cultureclub.dev, or read how the security chain works.