The first question almost everyone asks about Membership MCP is a good one: what stops my AI from doing something dumb to my membership site?

It’s the right question. A membership site holds people’s subscriptions, payment history and access to things they paid for. Mistakes there cost money and trust. So we treated safety as part of the product from day one, not a settings page we’d get to later.

This post walks through the guardrails, layer by layer, and is honest about the one thing they can’t do for you.

Layer one: your AI can only do what a tool allows

Membership MCP doesn’t give your AI open access to WordPress. It doesn’t hand over your database, run arbitrary code, or let the AI click around your admin.

Instead, it offers a fixed set of tools, each built for one membership job. Look up a member. List subscriptions. Run a churn report. Create a coupon. Every tool has a defined set of inputs, and the plugin checks those inputs before anything runs.

That means the question “what can my AI do?” has a precise answer. If there’s no tool for something, your AI can’t do it, no matter how the request is worded. We wrote these tools ourselves, as the team that builds MemberPress, so each one works through MemberPress the way the plugin expects to be used.

Layer two: WordPress permissions still apply

When you connect a site, Membership MCP acts as the WordPress user who connected it. Your AI can’t do more than that person could do in the admin.

The plugin also hides tools a connection isn’t allowed to use. If a tool needs a permission the user doesn’t have, your AI never sees it in the list, so it can’t try.

Layer three: read-only connections

Tools come in two kinds. Read tools look things up. Write tools change something.

You can connect a site read-only. A read-only connection only receives the read tools. Your AI can answer “how did renewals go last month?” all day long, but it has no way to change a member, a plan or a payment. Read-only is a good fit for reporting, for a bookkeeper or virtual assistant, or for your first week while you get comfortable.

Layer four: changes start as a preview by default

This is the one you’ll notice most.

Every write tool previews by default. When your AI asks to add a member, the plugin doesn’t add them. It returns a description of exactly what would happen: the name, the email, the plan. Your AI can show you that preview and ask if it’s right.

For everyday changes like this one, the change happens when your AI calls the tool again with permission to go ahead. The plugin doesn’t stop to ask you itself, so your AI can do it in one step. If you want to see it first, say so in your ask (“show me before you add anyone”), and most AI apps also show you a card to approve before a tool runs.

New posts and pages go one step further. Even once saved, they’re drafts, not published. You publish when you’re ready.

Layer five: big changes need a second key

Some changes are hard to take back. A refund sends money. A cancellation can end someone’s access. Changing a subscription affects their next bill. Publishing or overwriting a post changes what the public sees. Deletes, bulk imports and new coupons are in this group too.

For these, the preview comes with a one-time confirmation token. The token is tied to the exact change in the preview: this member, this subscription, this amount. It’s only good once, and it expires after a minute, or five for refunds and cancellations.

If anything about the request changes between the preview and the confirmation, even one number, the token no longer matches and the plugin refuses the change. Your AI has to preview again and get a new code before the change can run. So the thing you approved is exactly the thing that happens.

Layer six: a log on your own site

Every action is written to an activity log on your WordPress site. It records which tool ran, what it touched, whether it was a confirmed change, and how it turned out.

The log lives on your site, not just on our servers, so you can check it any time in your WordPress admin. If you ever wonder “did my AI do that?”, you can find out.

Layer seven: a pause switch

The plugin has a switch that pauses all changes. Flip it and every write tool is refused, while reads keep working. It’s handy during a busy launch, a site migration, or any time you want your AI to look but not touch for a while.

How the connection itself is protected

A few things happen behind the scenes that you never have to think about, but they’re worth knowing.

  • We never store your WordPress password. The connection is authorized on your own site, and you can end it there any time.
  • Requests to your site are signed. Each call from our relay to your site is signed, timestamped and usable once. Your site checks all three, so a copied or forged request gets turned away.
  • We don’t run an AI. Your conversation stays between you and the AI app you chose. Our relay carries your AI’s actions between that app and your site.
  • Daily limits act as a brake. Every plan has a daily allowance of actions, which caps how much your account can do in a day across all its sites.

Our security page has the full list of what we store and what we don’t.

What the guardrails can’t do

Here’s the honest part. The preview step only protects you if you read the preview.

If your AI says “I’m about to refund $190 to Luis Ferreira for his March payment” and you approve it in your AI app without looking, the refund happens. The system makes sure what you approve is exactly what happens. It can’t decide for you whether you meant it.

A few habits help:

  • Read the preview the first few times for any kind of change. Once you’ve seen how your AI describes a coupon or a plan, you’ll know what to look for.
  • Start read-only if you’re nervous. Ask questions for a week. Turn on write access when you’re ready.
  • Ask your AI to explain before it acts. “Tell me what you’d change, don’t do it yet” is a perfectly good request.
  • Glance at the activity log after a busy session. It takes a minute.

Where to go from here

The docs page on safety and approvals covers the settings in more detail. If you want to see the guardrails in action, try a playbook that makes a change, like create a launch coupon. Watch the preview come back before anything is created.

We built Membership MCP so you could hand routine membership work to your AI without worrying about it. The guardrails are how that works. When you’re ready, connect your site and start with a question.