Novamira vs Kitepod: Full Access or Checked Access

Updated October 31, 2026

"For dev and staging environments. With backups. Always." That warning sits near the top of Novamira's own README, and it's the most useful line you'll read when choosing between Novamira and Kitepod.

Novamira is an open-source WordPress plugin (AGPL-3.0) that turns your site into an MCP server. Your agent gets PHP execution, WP-CLI, the filesystem and the database, acting as an administrator. The core is free on unlimited sites, and the connection runs straight from your AI client to your site with no Novamira server in the middle.

Kitepod is free too, on unlimited sites. It's built for the site Novamira tells you to keep it away from: the live one a client is paying you for. The AI acts as whichever WordPress user you pick, PHP stays off until an admin switches it on, and every write can be undone for 90 days.

If you're a developer on a staging copy who wants the agent to have everything, Novamira is the better fit, and it costs you nothing. If an AI is going to touch production, Kitepod's checks are the reason to use it.

Side by side, as of October 2026

Novamira facts come from its GitHub README and from InstaWP's review, which checked Novamira's pricing on 12 October 2026.

What "full access" means in practice

Novamira's README lists what the agent gets: PHP execution with $wpdb, every loaded plugin and the WordPress APIs, WP-CLI in the foreground or background, and file editing. It runs as an admin. It doesn't hide any of this, and for building real features against a real install, that directness is the point.

Novamira does have guardrails. New PHP files go into a recoverable sandbox folder. But its docs, as InstaWP quotes them, call the sandbox "a convenience guardrail, not a security boundary," and say the Execute PHP ability skips it entirely.

Kitepod takes the opposite default. Connect it as an Editor and the AI can't install a plugin, because an Editor can't. Running PHP needs an admin to switch it on in wp-admin with an expiry date, and then every single run waits for a person. The AI can't approve its own work, so a confused agent stops at a button instead of at your database.

When a change goes wrong

Say the agent rewrites the Fernhill Pottery shop's product descriptions and gets the tone badly wrong on 40 of them.

With Novamira, nothing in the database rolls back automatically, by its docs' own account. Crash recovery only catches fatal errors from sandbox files, and it doesn't undo anything either. You're restoring from the backup the README told you to keep.

With Kitepod, those 40 edits are one change set. You undo the set, and the old descriptions are back, with nothing else on the site touched. That works for 90 days, and there's more on how it compares to core revisions on what WordPress revisions miss.

Builders, source code and no middleman

Builders. Pro's 53 builders and plugins plus 8 themes cover ground Kitepod doesn't: WPBakery, Oxygen 6 and ACF among them. Your assistant can still reach any plugin through its REST routes and the Abilities API on Kitepod, but that's not the same as a skill that already knows where the plugin keeps its data.

Openness. The code's on GitHub with 748 stars, and the latest release, 1.12.13, shipped on 27 October 2026. You can read every line that runs on your server.

And no middleman. Kitepod carries each request from your assistant to your site and signs it, which is what makes the shared audit trail and client approvals possible. Novamira doesn't, and if your agency's rules say no third-party services touch client sites, that settles it.

Running Novamira on staging and Kitepod on production

You don't have to choose one for every site.

1. Keep Novamira on dev and staging copies, where its own README says it belongs.
2. On each live site, install the Kitepod plugin (Plugins → Add New → Upload).
3. In wp-admin click Connect, sign in to Kitepod and pick the WordPress user the AI should act as. An Editor is a sensible start.
4. Add https://kitepod.com/mcp to your assistant, sign in and click Allow.
5. If Novamira's AI Abilities were switched on for that live site, switch them off under Novamira → Configuration.

Then try the job you'd least want to get wrong on production:

For the full list of ways to connect an assistant to WordPress, see WordPress MCP. If you're also weighing a hosted connector with a daily call cap, there's WPVibe vs Kitepod.

Finer points

Is Novamira free?

The core plugin is free under AGPL-3.0 on unlimited sites. As of 12 October 2026, Pro cost €49 a year for 3 sites (€69 regular), €149 a year for 1,000 sites, or €299 once.

Does Novamira limit tool calls?

Not on Pro, which has "no credits and no action quotas," per InstaWP's review. The server runs on your own site, so the limits you'll hit are your AI provider's.

Can I use Novamira on a live site?

Nothing stops you, but its README says dev and staging, with backups. Pro's Read Mode removes the abilities that change content, files and settings, which makes it safer for looking around production.

Does Kitepod remember my site between chats?

You can save skills with your own workflows and site conventions, and later conversations can load them. It isn't the same as the memory Novamira sells with Pro.

What does Novamira need to run?

WordPress 6.9 or later, PHP 8.0 or later, an administrator account, and HTTPS for remote connections, per its README.