With the Novamira plugin, an AI agent such as Claude, ChatGPT or Cursor can work directly inside your WordPress site. The agent can, for example, edit pages, check settings or handle repetitive tasks, without you having to copy code or text back and forth. This article explains how to install Novamira, how to connect your AI tool and how to revoke access later.
Want to know first what Novamira is and what the Pro version adds? Read our blog post Novamira: an AI agent working directly in your WordPress site.
Before you start
- You are an administrator of the WordPress site. Novamira only works with administrator rights.
- Your site runs over https. At Kyzoe, an SSL certificate is included as standard.
- You use an AI tool that supports MCP (Model Context Protocol), such as Claude, Claude Code, ChatGPT, Cursor, VS Code with GitHub Copilot, Windsurf or Gemini CLI.
- Preferably work on a staging site, a separate test copy of your website. It is included in our web hosting and WordPress plans.
- Check that a recent backup exists. We make a backup every day, and you can restore it yourself through the hosting panel.
Step 1: Install Novamira
- Download the plugin. The free version is open source and available on GitHub. Novamira Pro is sold by the makers of Novamira.
- In WordPress, go to Plugins > Add New Plugin > Upload Plugin, choose the zip file and click Install Now.
- Click Activate Plugin. A Novamira item now appears in the left-hand menu.
Step 2: Enable the AI features
- Go to Novamira > Configuration.
- Turn on the AI features for your site.
Novamira remembers which domain you enabled the features on. If you later copy the site to another domain, for example to your staging site, the features stay off there until an administrator confirms the new domain. That way a copy of your site does not quietly get the same access.
Step 3: Connect your AI tool
On the Novamira > Configuration page, choose the AI tool you use. Novamira then shows the exact instructions or configuration for that tool, already filled in with your site’s address. There are two ways to connect.
Option 1: sign in through the browser (recommended)
Your AI tool connects to this address:
https://yourdomain.be/wp-json/mcp/novamira-oauth
The first time you connect, your browser opens. You sign in to WordPress as an administrator and approve the access. You do not need to store a password in your AI tool. A few examples:
- Claude (claude.ai and Claude Desktop): add a custom connector under Settings > Connectors, with a recognisable name and the address above. The Novamira configuration page has a button that fills in that dialog for you.
- Claude Code: run this command in your terminal:
claude mcp add --transport http --scope user novamira-yoursite https://yourdomain.be/wp-json/mcp/novamira-oauth - ChatGPT: turn on developer mode in the settings, create a new plugin and paste the address above as the server URL, with OAuth as the sign-in method.
- Cursor, VS Code, Windsurf and other tools: copy the configuration Novamira shows for your tool into the configuration file it names.
Each time, replace yourdomain.be with your own website’s domain.
Option 2: with an application password
If your AI tool does not support signing in through the browser, you can connect with a WordPress application password. You create it on the Novamira configuration page. Store it somewhere safe straight away: WordPress only shows it once. The tool then connects to https://yourdomain.be/wp-json/mcp/novamira, using your username and that application password. Create a separate application password for each AI tool, so you can revoke access per tool.
Step 4: Test the connection
Start a new conversation in your AI tool and ask, for example: “Which WordPress version and which plugins are running on my site?” If you get a correct answer, the connection works. If not, check that the AI features are turned on (step 2) and that your site’s address is correct.
What can an agent do on Kyzoe hosting?
Novamira works on our hosting. An agent can run PHP code inside WordPress, read and edit files, and with Novamira Pro also manage posts, pages and Elementor designs. To protect the server, functions such as exec and shell_exec are disabled. An agent therefore cannot run server commands. Read more in Why certain PHP functions are disabled by default.
Revoking access
- Signed in through the browser: the Novamira > Configuration page shows which connections are active and lets you revoke them.
- With an application password: go to Users > Profile, scroll to Application Passwords and click Revoke next to that tool’s password.
- Stop everything at once: deactivate the Novamira plugin under Plugins.
Tips for working safely
- Let the agent work on your staging site first, and only put changes live after checking them.
- Review what the agent proposes, just as you would review a colleague’s work. A mistake can look technically correct.
- Never give an agent access to a client’s site without their consent.
- Revoke access for tools you no longer use.
Need help?
Not sure about the right approach, or does the connection get stuck on your hosting? Email support@kyzoe.be. We are happy to help.
