Labsco
MCP SERVER

Elementor MCP Agent

by Mogacode-ma ↗

Edit Elementor pages across a fleet of WordPress sites with a backup before every write, JSON validation after it, and rollback when the result is invalid.

CMS & Blog Publishing
Summary
It assumes the write API lies, and checks.

Every mutating widget tool re-reads the page from WordPress after writing and reports what actually persisted — `mutated`, `reread_ok`, `matches_requested` and the canonical state. That exists because REST can return 200 while plugin filters silently drop the payload; when `matches_requested` comes back false, treat it as a failure regardless of the HTTP status and restore from the backup key in the response. The guardrails are hard-coded rather than advisory: backup before write, validate JSON after edit, global-widget writes blocked by default, and `rm -rf`, `sudo` and database resets blocked through WP-CLI no matter what you confirm.

What it is

An MCP server aimed at agencies running many client sites on Elementor. It covers pages, widgets, templates, screenshots and a WP-CLI escape hatch, and wraps every mutation in the same contract: back up, apply, validate, flush CSS, roll back if the JSON came out invalid.

What you get
  • Site handling — `list_sites`, `ping_site` for an auth and version probe, `site_health` for a multi-call snapshot
  • Page work: `list_elementor_pages`, `read_page_elementor` for a parsed summary or the full tree, `list_widgets_in_page`, `duplicate_elementor_page`
  • `elementor_find_replace`, which runs dry-run then token then apply then backup then validate, and rolls back if the result does not parse
  • Widget-level CRUD — `read_widget`, `update_widget_settings`, `delete_widget`, `duplicate_widget`, `swap_widget_type`, `add_widget`, `move_widget`
  • `list_global_widgets` and `preflight_check`, which warn before you edit a shared widget that other pages depend on
  • Templates across sites: `export_elementor_template` to portable JSON, `import_elementor_template`, `apply_template_to_page`
  • Backup and restore chain — `list_elementor_backups`, `restore_elementor_backup`, `restore_from_file`, each taking a pre-restore safety backup first
  • Fleet operations: `bulk_find_replace_site` across one site's Elementor pages, `fleet_find_replace` across every site in the pool with a mandatory dry run, `check_elementor_versions` against the wordpress.org latest
  • Visual checks — `screenshot_page` renders any URL through headless Chrome and `compare_screenshots` diffs by SHA-256 and byte delta
  • A WP-CLI route for what REST cannot do safely: `wp_cli_run` with destructive-pattern detection, `wp_search_replace` with a mandatory dry run, `wp_elementor_flush_css`, `wp_plugin_list` and `wp_plugin_update`
Requirements

A WordPress Application Password per site, generated from the user profile page, plus the site URL and username. Sites are declared as a JSON array in `ELEMENTOR_MCP_SITES`, or in a file pointed at by `ELEMENTOR_MCP_CONFIG_PATH`; `ELEMENTOR_MCP_DEFAULT_SITE_ID` sets which site a tool uses when none is named. Run with `npx -y elementor-mcp-agent` — the npm package is `elementor-mcp-agent`, 1.3.0 in package.json and server.json. The `ssh` block is optional but unlocks 8 additional tools (the WP-CLI escape hatch and postmeta-backed backups); without it backups fall back to local JSON files. `wp_cli_path` auto-detects if omitted. MIT licensed.

Setup effort

One command plus a key — npx -y elementor-mcp-agent, then supply credentials