Every feature, as the code ships it

Scoped connection keys

Each AI client gets its own key. Start with Read-only. Content Manager, Safe Admin and Developer Mode are wider presets. The WordPress administrator password is not the credential.

Create a key · Security model

Signed requests

Local requests are HMAC-signed. The plugin checks the signature, the timestamp and the nonce before a tool runs.

Security notes

Approvals

A key can require a person to allow writes. Pending actions sit in Bridgistic, then Approvals.

How approval works

Manual playbooks

A playbook is an ordered list of bridge steps. You run it from WordPress or from the MCP tool. It does not recurse into other playbooks.

Playbooks

WooCommerce tools

Commerce tools use the same key, scopes and approval rules. They are not a separate plan.

Feature grid

Multi-site connections

A local client can keep several sites in one connections file and call them by alias.

Connect a client

Health check and setup export

Health Check looks at REST, permalinks and signing. Export Package builds a setup zip for a client. That export is not an audit-log download.

Install

Up to 3 schedules

The free plugin allows 3 enabled schedules. The cap is enforced in code before a schedule is created or enabled. The message on the REST API says 3 enabled schedules are included in the free plugin.

Unlimited scheduled playbooks

The paid name exists, and the cap is skipped only when that gate is open. The public plugin never opens it. A license key pasted into the free zip is refused. This line stays coming soon on pricing until a paid build can turn it on.

Snapshots and restore

Destructive writes can store a snapshot first. You can also take a manual snapshot of posts and post meta, and restore one. The free screen keeps up to 50 snapshots.

Advanced snapshots

The paid name lifts the 50-snapshot cap. Retention policies and rollback analytics are not a separate screen in the public plugin. Do not treat this as included with a purchase today.

Audit log, 90 days

Requests are logged with the key, action, status and time. Secrets are not written into the log. Rows older than 90 days are pruned.

Audit log export

The name is reserved for a paid export of that log. The public plugin has no audit-export action. The Export Package screen downloads a setup bundle, which is a different file.

Skills marketplace

The public plugin does not install a skills marketplace. The directory discussed for the product is not part of the free zip.

Pricing

Agency dashboard, team permissions, white-label

These names are in the paid list inside the plugin and are not active in the free download. The hosted dashboard at dashboard.bridgistic.app is a separate surface.