Webflow MCP on a live marketing site: what AI tools can change, and what we would allow.

The Webflow MCP server lets AI tools such as Claude, ChatGPT, and Cursor read and change your site, up to publishing it. It works within your Webflow role, and some of its actions can't be undone. This guide covers what it can change and what a marketing team should allow, for B2B SaaS marketing leads, as of October 2026.

What is the Webflow MCP server?

It's how outside AI tools connect to Webflow. MCP, the Model Context Protocol, is "an open-source standard for connecting AI applications to external systems," and the Webflow MCP server "connects agents and AI tools directly to your Webflow projects." You ask in natural language, and your AI tool, the MCP client, turns your prompts into calls to the Webflow APIs.

• Where it runs. Remotely, at mcp.webflow.com/mcp. You connect with OAuth and "authorize the sites and Workspaces you want your AI tool to access." Each authorization covers one Webflow Workspace.
• Which AI tools. Webflow documents setup for Claude, Claude Code, ChatGPT, Codex, Cursor, Gemini, and others, through a built-in connector or a manual setup.
• Cost. It's "available on all Site plans, including the free Starter plan," and using it "doesn't consume Webflow AI credits." Usage counts toward your AI tool's own plan. MCP 2.0 launched on July 21, 2026, at no additional cost.
• Who can connect. Webflow's Help Center says any site role except Reviewer can connect, but its developer FAQ says only site owners and admins can authorize the server. Check which applies in your Workspace before you plan access.

When do you need the Bridge App?

Only for a few tasks. Most Webflow MCP tools run without the Webflow Designer open. A few, such as element snapshots and image uploads, need the Designer open with the Webflow MCP Bridge App connected, which installs automatically when you authorize the MCP server. Webflow also runs a separate beta MCP server for experimental tools. We'd keep production sites off it.

What can the Webflow MCP server change on a live site?

Almost everything a Webflow user can change: CMS content, design, code, and some settings. The Webflow MCP server's data tools "don't require an open Designer session or the companion bridge app," so an AI agent can work on your site while nobody on your team has it open.

Webflow's developer docs list no action that deletes a page or a whole CMS collection.

Which controls does Webflow give you over AI agents?

Four, and the role you connect the MCP server with matters most.

1. Your role. "The MCP server enforces your Webflow permissions and roles, including custom roles." An agent "can do through the MCP server only what you can do in the Webflow Designer, and nothing more." Connect as a Content editor without "Can publish," and the agent gets the same limits.
2. Approvals in your MCP client. "By default, Claude will ask you to approve any actions it wants to take in Webflow," and ChatGPT asks too. In Claude, you can also "block or always allow specific actions" under Customize > Connectors > Webflow.
3. AI agent instructions. Site managers and Designers can create and manage instructions in the Instructions panel, which give agents context on your design system, voice, CMS, and policies; Marketers and Content editors can only read them. Webflow notes that "AI can make mistakes" and suggests having agents read your site's instructions at the start of a session.
4. The Site Activity log (Enterprise). It records changes made by agents, and since early June 2026 you can filter it to changes made through Webflow MCP. Its history doesn't expire, and anyone with the Content editor role or above can see it.

Enterprise adds more. Your AI tool can build and edit in an isolated page branch before changes are merged, and Webflow lists "granular access per site, CMS collection, page, and locale" among its MCP features for Enterprise. Our Webflow Enterprise guide covers custom roles, approvals, and the activity log in more depth.

Webflow's own advice is short: "Only authorize sites you're actively working on to maximize security and performance." It also says it "does not use customer or partner data to train generative AI models." The AI tool you connect has its own data terms, so check how it handles your site's content before you authorize a site.

What would we allow, ask about, or block?

Treat a new Webflow MCP server connection like a new contractor: read-only first, writes with review, and nothing irreversible. These are our defaults for a B2B marketing site; adjust them to your team.

If your AI tool can't block a single action, the role does the work: an agent connected through a role without "Can publish" can't push changes live, however the request is worded.

How should a marketing team review AI edits before they go live?

With a short, written review workflow. Webflow's advice for fully independent agents is to "publish to a staging domain and verify changes there," and the MCP specification says there "SHOULD always be a human in the loop with the ability to deny tool invocations."

1. Back up first. Webflow doesn't offer scheduled backups; it creates a restore point on every 50th auto-save, and only Site managers can restore one. Restoring updates the "Published on" date of CMS items, so plan a rollback before you need it. Our Webflow security post covers manual backups and roles.
2. Connect with the smallest role. Authorize the MCP server only for the site you're working on, and use a role without "Can publish" for drafting sessions.
3. Work in drafts or a branch. CMS Collection items are created and updated as drafts. On Team and Enterprise Platform plans, page branching keeps design work off the live page, and content editors and marketers can create branches but not merge them. Through MCP, the branch tools need Enterprise.
4. Review on staging. A person pushes changes to the webflow.io staging domain, checks the changed pages on desktop and mobile, then publishes to the live site. On Enterprise, Webflow's publishing workflow builds that staging step in before "Publish to production."
5. Treat outside text as untrusted. Form submissions, comments, and imported content can carry instructions an agent might follow. Prompt injection is first on OWASP's 2025 Top 10 for LLM applications, including indirect injection from "external sources, such as websites or files." Don't let an agent with write access act on text from forms or comments.
6. Log what changed. On Enterprise, filter the Site Activity log by Webflow MCP. On other plans, keep your AI tool's record of the actions you approved with the ticket.

Add AI tool connections to the access review in your website maintenance checklist.

How does MCP fit with Webflow's other AI tools?

The MCP server brings your own AI tool, such as Claude or Cursor, into Webflow. Webflow's built-in AI features run inside the product, and some of them use Webflow AI credits, which have had limits since June 29, 2026.

At Webflow Conf in September 2026, Webflow said agents in its upcoming Releases feature would be "subject to the same roles and permissions as your teammates," with a beta planned for later in the year. For whether AI-written copy hurts SEO, see our AI SEO myths post. Whatever the tool, the rule stays the same: give agents the access you'd give a new hire, and keep a person on the publish button.

We build and support Webflow sites for B2B SaaS companies, so we have an interest in this topic. If you want a second pair of eyes on AI edits before they go live, see our ongoing website support page.

Questions about the Webflow MCP server