Security and control

Your agent works only where you allow it, does only what you switched on, and every change it makes is on record.

Nothing connects without you.

When an agent asks to connect, you pick the workspace, the websites, and what it can do. Try it.

Claude wants to connectChoose what it can reach. You can change this later.
WorkspaceAcme Workspace
Websites
  • shop.example.com
  • example.com
  • staging.example.com
AccessFollows the workspace
What an ability returns reaches your agent in full.

MoraWP does not filter it, and that can include private details such as customer or order data. That is what you confirm above, so switch on only what you are comfortable sharing. Questions? [email protected]

Checked on every request.

  1. Is this agent yours?Only agents you approved, on websites you connected.
  2. Can it reach this website?Websites outside its list are invisible to it.
  3. Is this switched on here?Abilities are on or off per website, not per agent.
  4. Is it on record?Every action lands in your activity, done or stopped.

Same request, different answer. Switch WordPress commands on for Atlas Legal and watch it go through.

Codex asksUpdate every plugin on all my websites.
  • North Studionorthstudio.comRun WordPress commandsHigh impactPlugins updated, and listed in Activity
  • Atlas Legalatlaslegal.comRun WordPress commandsHigh impactStopped before it reached WordPress

Careful by default.

Switching an ability on decides what an agent may do. These decide how carefully it does it.

  1. Nothing risky is on until you say so.

    Running WordPress commands, editing files, and deleting for good start off on every website.

  2. See a change before it happens.

    Many changes can run as a dry run first. You see what would change, and nothing is saved.

  3. Files are never overwritten blindly.

    Your agent reads a file before it changes it. If someone changed it in between, the edit stops.

  4. Page changes wait for you.

    Block editor changes can be staged as a batch that you open, check, and finish in WordPress yourself.

  5. No passwords to hand over.

    Agents sign in to MoraWP. When you need to log in, your agent can make a link that works once.

  6. Take access back in one click.

    Remove an agent and its access ends on every website at once, without touching WordPress.