Royal MCP alternative
Royal MCP vs GoBuildWP: undo tokens and a sealed log, or builder edits with a checked undo.
Royal MCP vs GoBuildWP compares two self-hosted servers with OAuth/PKCE and documented recovery for supported writes. Royal returns an undo token on destructive writes, seals its Pro log with a hash chain, and ships WebMCP plus its own backup and firewall plugins. GoBuildWP also edits Elementor in Free, checks supported batch restores and offers scoped credentials. Recovery depends on the action and retained snapshot.
A test you can repeat on staging
Start here: three checks for Royal MCP and GoBuildWP
Let an undo token expire
Delete a test page with Royal and keep the undo token; delete another with GoBuildWP. Use disposable fixtures, record each configured retention window and try before and after expiry. Neither recovery path substitutes for an independent backup.
Tamper with the log
On disposable database copies only, retain the original export and alter one synthetic entry. Test the documented verifier, record the result and restore the fixture. This is a proposed test, not an executed finding.
Edit an Elementor widget on the free plugins
With only the free editions installed, ask each agent to change one Elementor heading. Both now document Free Elementor writes. Record the installed versions, operation scope, saved state and independent browser result.
Where Royal MCP leads
Royal's lead: WebMCP, a tamper-evident log and its own plugins
Royal's free plugin already covers a lot of the stack. These strengths come from its listing, repository, Pro page and releases, read on 29 September 2026.
A log built for compliance
Royal Pro chains each log entry to the last by hash, so tampering shows, and adds Legal Hold. GoBuildWP's ledger is redacted and attributed but not tamper-evident.
WebMCP and a Claude Desktop bundle
Beyond Streamable HTTP across protocol versions from 2024-11-05, Royal serves in-browser agents over WebMCP and ships a Claude Desktop bundle. GoBuildWP also generates a .mcpb bundle; WebMCP remains the distinction.
Backups and a firewall of its own
Royal connects to UpdraftPlus and Duplicator and to its own SiteVault backups, Solid Security and Royal's firewall plugins.
WooCommerce in the free plugin
Products, variations, coupons, orders and customers are free, with full CRUD and bulk edits in Pro. GoBuildWP Free reads the store and edits one product at a time; coupons, order writes and bulk edits are Pro.
Forms and more SEO plugins at no cost
Free Royal covers WPForms and Contact Form 7, and Yoast, Rank Math, AIOSEO and SEObolt. GoBuildWP Free reads those forms' entries and sets a post's SEO title, description and robots; the rest is Pro.
Where GoBuildWP leads Royal MCP
Compare configured credentials, recovery and builder operations
Narrow, checkable differences, taken from Royal's listing, repository and Pro pages on 29 September 2026.
Builder writes without Pro
GoBuildWP Free writes Elementor classic widgets and atomic elements through 18 abilities. Royal also documents Free Elementor and Divi edits. Compare the exact operation and installed builder version, rather than Free write access alone.
Undo from the ledger, not a token
Royal's token reverses one destructive write inside its window. GoBuildWP offers supported single, batch, filtered and session recovery from retained ledger snapshots, with restore comparison. Irreversible actions and expired records are excluded.
Review the configured credential
Royal Pro documents role/scope-gated endpoints. GoBuildWP connections need an administrator (manage_options, or super admin on multisite); what narrows the agent is an expiring token with an ability scope and a profile ceiling, not a lower WordPress role. Verify the actual connected user's authority and a denied call on each installed release.
Approval by a person, not a dry-run flag
Royal documents a dry-run flag the model sets on high-impact option writes. GoBuildWP also starts from a model-set confirm flag, but with "A person approves" switched on it holds destructive calls until a person approves them, and its profiles are named and set per site.
Page conversion between builders
Royal Pro moves Divi shortcodes into blocks. GoBuildWP Pro rebuilds pages between Elementor, Divi, Bricks, WPBakery and its other builders, listing what each element lost.
More caches, languages and safe updates
Pro reaches 26 cache and optimisation layers against Royal's two, edits WPML, Polylang and Weglot, and attempts file rollback after selected update checks fail; database changes and external effects need separate recovery. Royal documents neither translation plugins nor update rollback.
Feature by feature
WebMCP, logs and backups first, then builders and credentials
Royal's strongest rows lead. Its column quotes the WordPress.org listing, repository, Pro page, pricing and releases. Royal's pages give different tool totals, so the rows compare what each server does.
- Yes
- Partly
- No
- Not documented
| Feature | Royal MCP | GoBuildWP |
|---|---|---|
| WebMCP in the browser | Yes: WebMCP for in-browser agents.1 | No: Not supported; agents connect from an MCP client. |
| Change log | Yes: Activity log free; Pro adds a hash-chained, tamper-evident log with Legal Hold.2 | Yes: A redacted ledger attributes each change to the agent credential, holds 90 days and exports CSV or JSON. It is not hash-chained. |
| Backup plugins | Yes: UpdraftPlus, Duplicator and its own SiteVault.1 | Yes: Free reads UpdraftPlus, Duplicator, BackWPup and All-in-One WP Migration; Pro starts UpdraftPlus, BackWPup or All-in-One WP Migration backups (Duplicator is read-only). It can hold destructive calls until a fresh backup exists, and never restores or deletes one. |
| Updates and backups across sites | Not documented: Not documented by Royal MCP. | Yes: GoBuildWP Cloud lists pending updates and backup status, free for 3 connected sites. Pro adds reviewed bulk plugin/theme updates with per-site backup options. Eligible guarded updates compare selected checks and attempt file recovery on failure; recovery can fail and does not restore database changes. |
| Security plugins or layer | Yes: Solid Security plus Royal's own firewall plugins.1 | Yes: Wordfence and Solid Security findings and lockouts in Free; IP block and unblock, scans and a hardening plan you confirm in Pro, settings recovery where supported; starting a scan is irreversible. No DLP or prompt-injection layer. |
| WooCommerce | Yes: Free products, variations, coupons, orders and customers; full CRUD and bulk in Pro.1 | Yes: Free: 13 for store reads and single-product edits. Pro: 52 more HPOS-safe abilities, from refunds and sales reports to FunnelKit funnel steps. |
| Undo one change | Yes: Undo tokens on destructive writes for 72 hours, up to 168 in Pro.3 | Yes: Supported recorded writes while their before-images remain available; irreversible actions and expired records are excluded. |
| Writes made through other MCP servers | Not documented: Not documented by Royal MCP. | Yes: Free records writes made through Elementor's and WooCommerce's own MCP servers, and EDD's and TranslatePress's abilities, with undo where they can be put back. On WordPress 7.1 an off-by-default setting also holds them to the safety profile and a person's approval. |
| Transport | Yes: Streamable HTTP from MCP 2024-11-05 to 2026-07-28, plus WebMCP and a Claude Desktop bundle.1 | Yes: Streamable HTTP on modern 2026-07-28 and legacy 2025-11-25, 2025-06-18, 2024-11-05. MCP Tasks is available on the modern transport since Free 1.15.0; background execution requires a job-backed ability. Local clients can also use stdio through WP-CLI on the site's machine. |
| OAuth 2.1 sign-in | Yes: OAuth 2.0 and 2.1 with PKCE, DCR and refresh-token rotation.1 | Yes: OAuth 2.1 with PKCE, CIMD first and DCR as fallback, revocable app by app. |
| Scoped, expiring credentials | Partly: 24-hour sliding sessions; the API key runs with administrator capability.1 | Yes: Each token gets an end date, a set of allowed abilities or categories, and a profile ceiling it cannot act above. |
| Safety profiles and read-only | Partly: Pro documents custom Endpoint Profiles with role/scope gates. Current Free default behavior needs an installed-version test.3 | Yes: Named profiles (Developer Full Access, Production Safe, Read Only) and a per-ability switch. |
| Who confirms a destructive call | Partly: A model-set dry-run flag on high-impact option writes.5 | Yes: Confirmation-gated calls use the model flag by default. In person-approves mode they need a human decision through supported client elicitation or a wp-admin link. Ordinary writes need a per-ability rule or Pro approval policy to wait too. |
| Elementor | Yes: Free includes cloning, text/image changes and template operations; Pro adds deeper authoring. Free editing rechecked 2 October 2026.13 | Yes: Free writes classic v3 widgets and atomic v4 elements with 18 abilities; Pro adds 52. |
| Builder quality audit and repair | Not documented: Not documented by Royal MCP. | Yes: Free scores how editable an Elementor page is, 0 to 100, with a fix per finding (layout in HTML widgets, scripts, shortcodes, fixed colours, deep nesting). Pro turns simple HTML-widget markup into native widgets, dry run first, with undo. |
| Other page builders | Partly: Free Divi tools include layout-aware changes; Pro adds authoring depth. Other builder coverage must be checked separately.13 | Yes: Pro: Divi 5, Bricks, Oxygen, Breakdance, WPBakery, Beaver Builder, Etch, Mosaic and Flatsome, with Divi 5 as the Divi version edited. |
| Builder-to-builder conversion | Partly: Pro moves Divi shortcodes to blocks.3 | Yes: Pro turns a page from one supported builder into another, saved as a draft, and lists what each element lost. |
| SEO plugins | Yes: Yoast, Rank Math, AIOSEO and SEObolt; Pro bulk meta adds SEOPress.1 | Yes: Free sets a post's title, description and robots in Yoast, AIOSEO, Rank Math and SEOPress, which overlap with Royal, plus The SEO Framework, Slim SEO and SmartCrawl; Pro edits the rest, and bulk meta reaches 100 posts a call. |
| Form plugins | Yes: WPForms and Contact Form 7.1 | Yes: Free reads Contact Form 7, WPForms, Gravity Forms and Forminator entries, contact data withheld. Pro edits Contact Form 7 and WPForms, as Royal does, plus Gravity Forms, Fluent Forms, Formidable and Ninja Forms; Forminator and WS Form get small label edits. |
| Cache and optimisation plugins | Partly: W3 Total Cache and its own ForgeCache.1 | Yes: Pro: 26 caching and optimisation layers. Free flushes transients only. |
| Rate limits | Yes: Vendor documents 60 unauthenticated and 300 OAuth-authenticated requests/minute per IP; configurable hooks. Rechecked 2 October 2026.6 | Yes: Writes are rate-limited for each credential. |
| Price and usage caps | Free with unlimited calls. Pro plans and founder offers vary; verify current checkout and renewal terms.4 | Free has no per-call metering charge; per-credential write rate limits still apply; Pro is $39–$99.99 a year, or $59.99–$199.99 once. |
Weighing more than Royal MCP and GoBuildWP? The best WordPress MCP server comparison puts every option on one table. Running several sites, GoBuildWP Cloud adds reviewed bulk plugin updates with backup options, backup status for every site and one safety policy across sites.
Pricing and hosting model
Current Royal offers and GoBuildWP tiers
Royal MCP
Royal MCP Free on WordPress.org has unlimited tool calls. Royal publishes changing founder offers; confirm the current plan, site allowance and renewal terms at checkout. It runs on your site with no relay and no telemetry in the free plugin.
GoBuildWP
GoBuildWP Free has no per-call metering charge; per-credential write rate limits still apply. Pro is $39–$99.99 a year, or $59.99–$199.99 once, and unlimited sites cost $99.99 a year.
Who should pick which
Compliance logs and WebMCP, or builders and bounded keys
Choose GoBuildWP when
- Agents change Elementor or other builder pages, not just post content.
- Rollback has to cover a batch and report whether the restore matched.
- The administrator who connects should hand agents tokens that expire, cover only named abilities and stay under a profile ceiling such as Read Only.
Royal MCP is a good fit when
- In-browser agents need Royal's documented WebMCP route.
- Auditors ask for a hash-chained, tamper-evident log with Legal Hold.
- You already run Royal's SiteVault backups or firewall plugins and want them on the same connection.
FAQ
Royal MCP questions: tokens, defaults and logs
How long does a Royal MCP undo token last?
72 hours, and up to 168 in Pro. Royal's GitHub README and its WordPress.org page disagree on whether the 72-hour token is a free or a Pro feature, so check the version you install.
Is Royal MCP read-only out of the box?
The current listing does not establish that default. Royal Pro documents custom Endpoint Profiles with role/scope gates; verify Free defaults on the installed release. GoBuildWP defaults to Production Safe, so select Read Only explicitly.
What do the two logs document?
Royal Pro's hash-chained log with Legal Hold is built to show that entries were not altered, which GoBuildWP's ledger does not claim. GoBuildWP's ledger is redacted, tied to each agent credential, exportable, and it is what powers undo.
Do both speak MCP 2026-07-28?
Yes. Royal lists every protocol version from 2024-11-05 to 2026-07-28; GoBuildWP supports 2026-07-28 and 2025-11-25.
Sources, checked 29 September 2026
Royal MCP vs GoBuildWP: the sources behind each row
Free builder edits and bundle support were rechecked against the current listing on 2 October 2026. Royal pages still describe different undo-tier scopes and tool totals; verify the installed release and current checkout. Proposed tests above have not been executed.
- 1. Royal MCP on WordPress.orgTransport, OAuth, integrations, rate limits and installs. Checked 29 September 2026.
- 2. Royal MCP repositoryActivity log and the Pro hash-chained log. Checked 29 September 2026.
- 3. Royal MCP ProBuilder editing, undo tokens and Divi migration. Checked 29 September 2026.
- 4. Royal MCP Pro pricingPro plans. Checked 29 September 2026.
- 5. Royal MCP releasesDry-run flag and prompts support. Checked 29 September 2026.
- 6. Royal MCP current product documentationFree builder operations and authenticated/unauthenticated rate limits rechecked 2 October 2026. Vendor pages disagree on undo tier details; match the installed version.
- GoBuildWP changelog
- GoBuildWP capability directory
- GoBuildWP pricing
Let a Royal undo token lapse, then try GoBuildWP's ledger.
Install GoBuildWP Free on staging beside Royal MCP, connect in Read Only, and start with the three checks at the top of this page.