Mogacode-ma/elementor-mcp-agent

> **Agency-grade MCP server for WordPress Elementor.** Multi-site management, safe Elementor edits with backup + auto-rollback + CSS flush, template export/import, global widget detection, screenshots, WP-CLI escape hatch.
Built for agencies running many client sites on Elementor / Elementor Pro who want Claude (or any MCP client) to drive the toil — **without breaking pages**.
---
How this was built
elementor-mcp-agent was built end-to-end with Claude Code over ~48 hours. The process is intentionally open:
- Architecture, code, tests, docs — all generated through Claude Code pair-programming sessions
- The 7 bugs documented in this post-mortem were caught in real E2E testing against a live WordPress + Elementor install, not after the fact
- v1.2's post-write verification pattern was shipped 2 hours after a reader's comment (Mads Hansen on Dev.to) — the changelog credits the source
This isn't vibe-coded software thrown over the wall. Every release ran through lint + typecheck + 27 unit tests + (for v1.0) full E2E against a real WordPress install before publishing. The MCP itself hardcodes guardrails that prevent the model from making destructive WP-CLI calls.
I run a small WordPress agency and use this tool every day on client sites. If you're skeptical about agentic codegen for production infrastructure, the entire commit history is in the open — judge for yourself.
---
Why this exists
There are 25+ WordPress MCP servers on GitHub today. None targets the **agency multi-site workflow** with:
- **Real backup before every edit** (postmeta via WP-CLI when SSH available, JSON file fallback — never silently lost)
- **Two-call confirmation** for any destructive op (TTL 60s)
- **JSON validation + auto-rollback** if an edit produces invalid Elementor data
- **3-level CSS flush fallback** (REST → wp-cli native → option/meta delete → re-save)
- **Global widget awareness** — preflight check warns if a page references shared widgets
- **WP-CLI escape hatch** for everything the REST API can't do safely
- **Screenshots** via headless Chrome (no puppeteer dep)
---
Install
Configure
Generate the **WordPress Application Password** at https://{your-site}/wp-admin/profile.php#application-passwords-section.
The ssh block is **optional** but unlocks **8 additional tools** (WP-CLI escape hatch + reliable custom-postmeta backups). The MCP works without SSH — backups go to local JSON files instead.
wp_cli_path auto-detects if omitted (tries wp, then ~/bin/wp.phar, then ~/wp-cli.phar).
Claude Desktop config
---
Tools (34)
Sites & health
- list_sites — enumerate the pool
- ping_site — auth + version probe
- site_health — multi-call health snapshot
Pages
- list_elementor_pages — pages in builder mode
- read_page_elementor — parsed summary + optional full tree
- list_widgets_in_page — flat widget inventory with excerpts
- list_global_widgets — shared widgets (edit one → affects every page using it)
- preflight_check — validate a page is safe to edit
- elementor_find_replace — text replace with **dry-run → token → apply → backup → validate → rollback if invalid**
- list_elementor_backups / restore_elementor_backup — full restore chain with pre-restore safety backup
- duplicate_elementor_page — clone within a site (data + page_settings + edit_mode)
Templates
- list_elementor_templates — Theme Builder distinguished from regular library
- export_elementor_template — portable JSON
- import_elementor_template — drop into target site