WP Manifestindependent plugin directory
manifest / ai / novamira

Novamira WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA- #4 in AI

MCP server that gives AI agents full access to WordPress through PHP execution and filesystem operations

★ 720stars
5.2krelease downloads
≈600active sites
v1.12.8latest · 6d ago

Install

Download novamira-1.12.8.zip From the v1.12.8 release on GitHub, Oct 7, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/use-novamira/novamira/releases/download/v1.12.8/novamira-1.12.8.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

Novamira

Give your AI agents full access to your WordPress site. Nothing in between.

Website · Documentation · Novamira CLI · Videos · Download · Discord · Facebook Community

Novamira is an open-source WordPress plugin and MCP server that lets AI agents work directly inside WordPress. Agents can run PHP and WP-CLI commands, inspect the database, manage files, understand the active plugins and theme, and build working functionality against the real site.

The connection is direct between your AI client and your WordPress installation. Novamira is not a hosted proxy and your requests do not pass through Novamira servers.

[!WARNING] For dev and staging environments. With backups. Always.

Videos

See Novamira in real projects, tutorials, and walkthroughs from the WordPress community.

Watch Novamira videos →

What Novamira provides

  • Full WordPress access through PHP execution, including $wpdb, loaded plugins, themes, and WordPress APIs
  • WP-CLI commands with foreground and background execution
  • Filesystem inspection and editing, plus a recoverable sandbox for new PHP files
  • Native Block Editor workflows, media uploads, reusable skills, agent context, and design guidance
  • OAuth and WordPress Application Password authentication
  • Compatibility with Claude, Codex, Cursor, Gemini CLI, Antigravity, VS Code with GitHub Copilot, and other MCP clients
  • Novamira CLI for connecting terminal-based coding agents such as Claude Code, Codex CLI, and Gemini CLI
  • Novamira Visual, an experimental browser workspace where you can watch an agent work in WordPress

Requirements

  • WordPress 6.9 or later
  • PHP 8.0 or later
  • A WordPress administrator account
  • HTTPS for remote connections; local development environments are supported without HTTPS
  • An MCP-compatible AI client, or a terminal-based coding agent using Novamira CLI

Get started

  1. Download the release ZIP.
  2. In WordPress, go to Plugins → Add New → Upload Plugin, upload the ZIP, and activate Novamira.
  3. Open Novamira → Configuration, enable AI Abilities, and follow the instructions for your AI client and authentication method.

Use the release ZIP rather than GitHub's automatically generated source archive. The source archive does not include the bundled Composer dependencies required by the MCP server.

See the quick start guide for the complete connection flow.

Using a terminal-based coding agent? Novamira CLI provides a guided connection for Claude Code, Codex CLI, Gemini CLI, and other agents that can run shell commands.

Documentation

Community

Contributing

Read CONTRIBUTING.md before opening a pull request. Every contribution must start with an approved issue.

License

AGPL-3.0-or-later

Releases

Newest 25 of 43 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.12.8 latest
Oct 7, 2026 6d ago
novamira-1.12.8.zip
189
Oct 1, 2026 12d ago
novamira-1.12.7.zip
164
Sep 28, 2026 15d ago
novamira-1.12.6.zip
132
Sep 18, 2026 25d ago
novamira-1.12.5.zip cohort
601
Sep 15, 2026 28d ago
novamira-1.12.4.zip
73
Sep 9, 2026 1mo ago
novamira-1.12.3.zip
228
Sep 2, 2026 1mo ago
novamira-1.12.2.zip
138
Sep 1, 2026 1mo ago
novamira-1.12.1.zip
55
Aug 29, 2026 1mo ago
novamira-1.12.0.zip
54
Aug 26, 2026 1mo ago
novamira-1.11.6.zip
75
Aug 26, 2026 1mo ago
novamira-1.11.5.zip
20
Aug 13, 2026 2mo ago
novamira-1.11.4.zip
393
Aug 11, 2026 2mo ago
novamira-1.11.3.zip
57
Aug 4, 2026 2mo ago
novamira-1.11.2.zip
115
Jul 30, 2026 2mo ago
novamira-1.11.1.zip
78
Jul 28, 2026 2mo ago
novamira-1.11.0.zip
151
Jul 24, 2026 2mo ago
novamira-1.10.1.zip
64
Jul 21, 2026 2mo ago
novamira-1.10.0.zip
56
Jul 15, 2026 3mo ago
novamira-1.9.2.zip
79
Jul 14, 2026 3mo ago
novamira-1.9.1.zip
834
Jul 8, 2026 3mo ago
novamira-1.9.0.zip
98
Jul 3, 2026 3mo ago
novamira-1.8.1.zip
277
Jun 30, 2026 3mo ago
novamira-1.8.0.zip
166
Jun 18, 2026 3mo ago
novamira-1.7.1.zip
207
Jun 12, 2026 4mo ago
novamira-1.7.0.zip
106
All releases on GitHub →

Active-site estimate ≈600 comes from the v1.12.5 cohort. Method.

A- grade

Security

Novamira 1.12.8 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.12.8
Findings
1
Worst severity
low
Content hash
8579fa2921c97362806bf0e8…

Findings

  • low Intentional privileged execute-php ability

    When AI abilities are enabled, novamira/execute-php evals caller-supplied PHP in the WordPress process. Gated by novamira_permission_callback (manage_options/super admin) and novamira_is_enabled() which defaults false and domain-locks. This is expected staging functionality, not an auth bypass.

    includes/abilities/execute-php.php:16-90

    Recommendation

    Leave abilities disabled on production; restrict admin accounts that can enable Novamira; prefer staging hosts.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.