Leitvia Studio lets AI agents such as Claude Code, Codex or Cursor build and maintain WordPress sites with block themes through 59 abilities, and every change passes checks for design, accessibility and content before it goes live. It is free and made for developers, agencies and site owners who want an AI agent to do the work without administrator rights.<\/p>\n\n
The abilities belong to the WordPress Abilities API<\/a> and run over MCP or the REST API. Everything Studio creates is stored in WordPress core structures (patterns, global styles, post types, block bindings), so the site keeps working when you deactivate the plugin. It works with any block theme and fits best with the free theme Leitvia<\/a>.<\/p>\n\n Everything above is free and stays free, and no feature is locked. The separate paid add-on Leitvia Pro adds the blocks Slider, Scroll story, Before and after and Entry list, and eight industry kits with their own brand, pages and patterns. See Leitvia plans and prices<\/a>.<\/p>\n\n Leitvia Studio follows the standards WordPress sets for AI agents and will keep following them:<\/p>\n\n The Leitvia agent skills on GitHub<\/a> add eleven skills for setup, design, pages, patterns, maintenance, accessibility, migration, shop catalog, news, SEO and reports, and three workflows. They work side by side with the WordPress skills. The Leitvia developer guide<\/a> shows the calls with real answers.<\/p>\n\n Core preset slugs such as base, contrast or spacing 50 map to the roles of the design contract, so content written by AI agents trained on default themes still fits. Theme files of your own go into the child theme Leitvia Child<\/a>, blocks of your own into a plugin built from Leitvia Block Starter<\/a>. No agent writes files into the theme.<\/p>\n\n Leitvia Studio sends no visitor data anywhere and sets no cookies. Embeds from other sites (the Embed block and its variations such as YouTube, and iframes from other sites in classic content and in Custom HTML blocks) show a placeholder until the visitor clicks \"Load content from\" followed by the name of the provider (for example \"Load content from YouTube\"); only then does the visitor's browser contact the provider. When a visitor ticks \"Always allow YouTube on this site\" (with the name of the provider), the list of allowed providers is stored in the visitor's browser (localStorage, key The list carries the path of the site in its key ( The Accessibility bar stores text size and high contrast in the visitor's browser (localStorage, key The Contact form block sends the name, email address and message a visitor enters by email to the address set in the block, or to the administration address of the site, and stores none of it on the site. To limit the messages per connection it keeps a counter for one hour under a salted hash of the IP address; the address itself is not stored. It sets no cookies and contacts no other service. Name the form in your privacy policy.<\/p>\n\n This plugin does not connect to any external service by default. The check after an AI agent changed a page live loads that page from your own site (a loopback request, see the question on requests from your server); it contacts no other host.<\/p>\n\n AI provider of the site owner: only when an agent or a user calls the ability \"Plan page\" (leitvia\/plan-page) with ai set to true, Leitvia Studio sends one request through the AI client of WordPress to the AI connector an administrator set up under Settings, Connectors (for example OpenAI, Anthropic or Google). Leitvia Studio has no provider of its own and stores no keys. The request holds the goal and the content points given in that call, the page frame and composition rules of the contract, and the names and metadata of the patterns; no posts, no user data and no other content of the database. Without that call, nothing is sent. The terms and privacy policy of the provider the administrator chose apply.<\/p>\n\n Embedded content: when a visitor clicks \"Load content from\" with the name of the provider in the placeholder of an embed, or has chosen to always allow that provider, the visitor's browser loads the embedded content from the provider. The provider receives the visitor's IP address, browser details and the page address, and may set cookies. Nothing is loaded before that action. The providers Leitvia Studio names, with their privacy policies (other embed providers are named after their host):<\/p>\n\n Map tiles: the Map block shows a list of places with links to openstreetmap.org and a placeholder for the interactive map. Only when a visitor clicks \"Load content from OpenStreetMap\", or has chosen to always allow it, does the visitor's browser load map images (tiles) from the tile server. The tile server receives the visitor's IP address, browser details and the page address. Nothing is loaded before that action, and the block editor shows no map. The default tile server is the one of the OpenStreetMap Foundation; administrators can enter another one under Leitvia Studio, Settings, \"Map tile server\" (https only), in which case the placeholder names that server. Check the terms of use and the privacy policy of the server you use.<\/p>\n\n Emoji images: the emoji script of WordPress is off while Leitvia Studio is active. Only if an administrator switches on \"Load the emoji script of WordPress\" in the Leitvia Studio settings, browsers without their own emoji fonts load emoji images from s.w.org, a server of WordPress.org (Automattic Inc. on its behalf), which receives the visitor's IP address, browser details and the page address; feeds and emails then link these images as well.<\/p>\n\n The other exception is Gravatar, a service of Automattic Inc., and only if an administrator switches on \"Allow Gravatar for users and commenters without a local picture\" in the Leitvia Studio settings. Then, on every page view that shows a profile picture of someone without a picture from the media library, the visitor's browser requests that picture from Gravatar. Gravatar receives the visitor's IP address and a hash of the email address of the user or commenter.<\/p>\n\n The accessibility check bundles axe-core<\/a> 4.13.0 by Deque Systems, Inc. into The headings of the Studio admin screens use Open Sans<\/a> by The Open Sans Project Authors, weights 600 and 700, reduced to the Latin characters and stored as WOFF2 in Token sets can name Libre Franklin<\/a> by The Libre Franklin Project Authors (one variable file each for upright and italic, weights 100 to 900, in The Map block bundles Leaflet<\/a> 1.9.4 by Volodymyr Agafonkin and contributors into Icons: 116 icons of Lucide<\/a> 1.60.0, ISC License (some from Feather, MIT), in The pattern illustration The Leitvia Studio is developed and maintained by CMS ADMINS<\/a>. Ask questions in the support forum of the plugin on WordPress.org or write to support@cms-admins.de. Report security issues and accessibility barriers to the same address; we answer within five working days.<\/p>\n\n Leitvia Studio is a product of CMS ADMINS, a brand of Patrick Schlesinger, Parkstra\u00dfe 19, 80339 M\u00fcnchen, Germany. Contact: support@cms-admins.de.<\/p>\n\n Disclaimer: Leitvia Studio is free software under the GNU GPL, version 2 or later. It is provided as is, without any warranty, to the extent permitted by applicable law; see sections 11 and 12 of the GPL. You are responsible for checking that your site meets the legal requirements that apply to it, such as accessibility, privacy and imprint duties; Leitvia Studio helps with these but does not replace that check.<\/p>\n\n Leitvia Studio is a free WordPress plugin that lets AI agents build and maintain sites with block themes through 59 abilities of the WordPress Abilities API, with checks, an autonomy level per area, a review inbox and rollback. It also adds a Pattern Lab, design tokens in the DTCG format, a content model with block bindings, site recipes and blocks for privacy, accessibility and offers. It needs WordPress 7.1 and PHP 8.2 or later.<\/p><\/dd>\n Leitvia Studio works with any MCP client that connects over HTTP and can send an Authorization header. The AI agent signs in with the application password of a Leitvia Agent user. Studio offers no OAuth sign-in, so a client that connects to MCP servers only through OAuth cannot reach the server \"leitvia\" directly. Any tool that can call a REST API with Basic auth can use the same abilities under An AI agent such as Claude Code, Codex or Cursor connects to your site over MCP or the REST API with the application password of an agent user from Leitvia Studio, Agents. It reads the design contract and the outline of a page first, then calls the Leitvia abilities, and every change runs through the gateway checks and your autonomy levels. No service of ours sits in between: the agent signs in as a user of your site that an administrator created, with the role Leitvia Agent and without administrator rights. It works on content, media, navigation, template parts and token set drafts. It cannot install, activate, update or remove plugins or themes, manage users, log in to wp-admin or edit code. The role itself stores no capability: Studio gives an agent the rights for content, media and theme options only while it runs. Deactivate Studio or remove its folder and the agent has the rights of a user without a role: it can sign in and change its own profile, as any WordPress user can, and nothing on the site. Its application password stays and works again when you activate Studio. Deleting Studio in the admin removes the application passwords of agents and the role; the users and their content stay. Application passwords come into being only when an administrator creates an agent or a new password on the Agents screen, and the password is shown there once. Changes to site settings (such as the front page or the comment defaults), the content model, the active token set or the global styles only ever reach the inbox as a suggestion that a person applies or rejects, whatever the autonomy profile. Ready-made agent skills for setup, design, pages, patterns, maintenance, accessibility and migration, with the full reference of all abilities, are described in the Leitvia documentation<\/a>.<\/p><\/dd>\n No. Leitvia Studio needs no API key, no account and no service of ours. The AI agent is a program you choose, and it signs in to your site with an application password that an administrator creates. Only the ability \"Plan page\" with ai set to true uses an AI provider, and only the one an administrator set up under Settings, Connectors (see External services).<\/p><\/dd>\n Yes. Leitvia Studio is free under the GPL, version 2 or later, with no locked features and no upsell notices. Leitvia Pro is a separate paid plugin with extra blocks and industry kits.<\/p><\/dd>\n Leitvia Studio sends no visitor data to other hosts and sets no cookies, which makes a GDPR compliant site easier to run; compliance itself depends on your whole site and how you run it. Embeds and map tiles load only after the visitor agrees, Gravatar and the emoji images of WordPress stay off unless an administrator switches them on, and fonts come from your own site. Apart from the optional AI planning call described under External services, its only server side request goes to your own site. Every exception is listed under Privacy and External services.<\/p><\/dd>\n No plugin can make a site accessible on its own, and Leitvia Studio does not claim to. Its admin screens and blocks are built to meet WCAG 2.2 level AA and BITV 2.0, and before an AI agent change goes live the gateway checks headings, alt text, link text, contrast and landmarks and refuses changes that bring new findings. Whether your site meets WCAG, the European Accessibility Act or the German BFSG also depends on the theme, the content and other plugins, and needs a test by people.<\/p><\/dd>\n Leitvia Studio is built to meet WCAG 2.2 level AA and BITV 2.0 in its admin screens and in the blocks it adds to the front end:<\/p>\n\nWhat it does<\/h4>\n\n
\n
wp leitvia<\/code> runs them from WP-CLI.<\/li>\nLeitvia Pro<\/h4>\n\n
Works with the official WordPress agent skills<\/h3>\n\n
\n
GET \/wp-json\/wp-abilities\/v1\/abilities?category=leitvia<\/code>.<\/li>\n\/wp-json\/wp-abilities\/v1<\/code>.<\/li>\nPrivacy<\/h3>\n\n
leitvia-consent<\/code>), never on the server; the Consent Settings block lists and revokes these entries. Without JavaScript the placeholder only links to the content on the provider's site. The setting \"Ask visitors before loading embedded content from other sites\" turns the placeholder off; deactivating Leitvia Studio also brings back the embeds as WordPress renders them. When you save a post, WordPress itself asks the provider for the embed code (oEmbed), as without the plugin; that request comes from your server and carries no visitor data.<\/p>\n\nleitvia-consent:\/<\/code> for a site at the root, leitvia-consent:\/club\/<\/code> for a site below \/club\/<\/code>), because sites of a subdirectory network or installations in folders of one domain share the local storage of the browser. Consent given on one of them never applies to another. A list stored by an older version under leitvia-consent<\/code> carries over on a site at the root path only.<\/p>\n\nleitvia-a11y<\/code>), only after the visitor changes one of them. Read aloud uses the speech synthesis of the browser with a voice installed on the device; the button only appears when such a voice exists for the language of the page, and voices from online services are never used.<\/p>\n\nExternal services<\/h3>\n\n
\n
\n
\n
\n
Third-party libraries<\/h3>\n\n
build\/axe-runner.js<\/code>. axe-core is licensed under the Mozilla Public License 2.0 (MPL-2.0); the license text is in licenses\/AXE-CORE.txt<\/code> and the notices of the libraries it includes are in licenses\/AXE-CORE-THIRD-PARTY.txt<\/code>. MPL-2.0 is compatible with the GPL: its section 3.3 allows combining the covered code with GPL-licensed code, and axe-core does not use the \"Incompatible With Secondary Licenses\" notice. The unmodified source code is available from the axe-core repository and the npm package axe-core<\/code>. The file is served from your own site and makes no external requests.<\/p>\n\nassets\/fonts\/open-sans\/<\/code>. Open Sans is licensed under the SIL Open Font License 1.1; the license text is in licenses\/OPEN-SANS.txt<\/code>.<\/p>\n\nassets\/fonts\/libre-franklin\/<\/code>, license licenses\/LIBRE-FRANKLIN.txt<\/code>) and Young Serif<\/a> by The Young Serif Project Authors (regular weight without an italic cut, in assets\/fonts\/young-serif\/<\/code>, license licenses\/YOUNG-SERIF.txt<\/code>). Both are reduced to the Latin characters, stored as WOFF2, licensed under the SIL Open Font License 1.1, served from your own site and loaded only on sites whose active token set uses them.<\/p>\n\nbuild\/blocks\/map\/leaflet.js<\/code>, loaded only after the visitor agrees to load the map, and ships its stylesheet as build\/blocks\/map\/leaflet.css<\/code>. Leaflet is licensed under the BSD 2-Clause License, which is compatible with the GPL; the license text is in licenses\/LEAFLET.txt<\/code>.<\/p>\n\nassets\/icons\/lucide.json<\/code>, license in licenses\/LUCIDE.txt<\/code>.<\/p>\n\nassets\/images\/landscape.webp<\/code> was drawn for Leitvia by CMS ADMINS and is licensed under the GPL, version 2 or later, like the plugin.<\/p>\n\nSource code<\/h3>\n\n
src\/<\/code> folder contains the source code of the files in build\/<\/code>, and webpack.config.js<\/code> and bin\/guard-blocks-manifest.mjs<\/code> are the build configuration. To create build\/<\/code> yourself, run npm ci<\/code> and then npm run build<\/code> in the plugin folder with Node.js 24 (or 22.22.2 and later). package-lock.json<\/code> holds the exact versions of all build tools and libraries, so the result matches the files in build\/<\/code> of this release. The same source is in the Leitvia Studio repository on GitHub<\/a>.<\/p>\n\nSupport<\/h3>\n\n
Legal<\/h3>\n\n
\n
\n
leitvia-studio<\/code> folder to \/wp-content\/plugins\/<\/code>. With WP-CLI: wp plugin install leitvia-studio --activate<\/code>.<\/li>\nhttps:\/\/your-site.example\/wp-json\/leitvia-studio\/v1\/mcp<\/code> with that password. The getting started guide<\/a> has the configuration for Claude Code, Codex CLI, Gemini CLI and Cursor.<\/li>\n<\/ol>\n\n\n\n
What is Leitvia Studio?<\/h3><\/dt>\n
Does Leitvia Studio work with Claude, ChatGPT or Cursor?<\/h3><\/dt>\n
\/wp-json\/wp-abilities\/v1<\/code>.<\/p><\/dd>\nHow do AI agents use Leitvia?<\/h3><\/dt>\n
Does Leitvia Studio need an API key or an account?<\/h3><\/dt>\n
Is Leitvia Studio free?<\/h3><\/dt>\n
Is Leitvia Studio GDPR compliant?<\/h3><\/dt>\n
Does Leitvia Studio make my site accessible under WCAG 2.2, the EAA or the BFSG?<\/h3><\/dt>\n
How accessible are the admin screens and blocks?<\/h3><\/dt>\n