Tutorial · October 2026

How to let Claude Code edit your live website, without letting it publish.

An AI agent can change a website faster than any person. The hard part is making sure a bad change never reaches visitors. This is the setup we use on caelo-cms.com, with the real commands and the real output from building this blog.

MCP docs

The problem

Why "let the agent push to main" breaks websites.

For code, an agent that commits and deploys is fine: tests catch most mistakes. A website has failure modes that tests rarely see:

Design drift. The agent writes new markup for every request. After ten pages, buttons, spacing and headings no longer match.
Silent SEO regressions. A missing meta description, a broken canonical or a slower page does not fail a build. It shows up weeks later as lost traffic.
Actions you cannot take back. Deleting pages, switching a theme or moving URLs is quick to do and slow to repair.

The risk is not theoretical. In a widely discussed case, an AI agent deleted a customer's production database through an API with "no confirmation step, no environment scoping". A website needs the opposite: the agent does the work, and a person stays between the agent and the visitors.

Step 1

Connect Claude Code to your site.

You need a Caelo install (your own server with Docker Compose, or your Google Cloud), Claude Code and Bun, because the MCP server runs with bunx.

As the Owner, open /settings/mcp in the Caelo admin and click New token.
Choose the admin scope (Power-MCP). Your agent gets Caelo's full tool catalogue and runs the work on its own model. Leave Agent may use Caelo's AI off.
Copy the token (it is shown once) and the command the page prints for your install. It looks like this:

claude mcp add caelo-admin \
  --env CAELO_ADMIN_URL=https://admin.example.com \
  --env CAELO_MCP_TOKEN=mcp_<token> \
  -- bunx --package @caelo-cms/mcp-server@<your Caelo version> caelo-admin-mcp

On Google Cloud the admin sits behind Identity-Aware Proxy, so also run gcloud auth application-default login once. Tokens expire after 90 days.

Optional but useful: bunx @caelo-cms/mcp-server@<version> export --out . writes a CLAUDE.md and one skill file per active Caelo skill into your project, so Claude Code knows your site's rules before the first prompt.

Step 2

Ask for an outcome, not for code.

We asked Claude Code to create this blog: an index page and two articles. Here is what it actually did over MCP:

Opened a session and read the site context. Every change goes into a shared draft. The context also carries the site's brand-voice rules, which load before any visitor-facing text is written.
Built each page from existing parts. One build_page call per page placed the site's own page header, text sections and closing call to action. Modules created: zero. The new pages look like the rest of the site because they are made of the same parts.
Wrote a meta description per page. Not out of diligence: Caelo refuses to stage a published page without one.
Looked at its own work. It took desktop and mobile screenshots of each page. A full-page capture showed two sections as blank. A screenshot of just that section showed it was a scroll-in animation, not missing content, so nothing was changed.

Small edits work the same way. "Point the Community page at GitHub Discussions" changed three content values on one page and touched nothing else.

Step 3

Stage it, and let the quality gate judge.

When the work is done, the agent calls stage_changes. Caelo merges the draft, rebuilds a staging site (noindex) and runs Lighthouse on every page whose rendering changed: five runs on an emulated mid-tier phone, median taken. The target is 100 in Performance, Accessibility, Best Practices and SEO.

This is an excerpt of the real result for this blog's first draft:

/            SEO 100  Perf 100  A11y 100  BP 100
/blog        SEO 100  Perf 100  A11y 100  BP 100
/blog/...    SEO 100  Perf  99  A11y 100  BP 100
  TBT 110 ms (runs 110 / 268 / 289 / 106 / 102 ms)
  PROBLEM Performance score 99 is below the target 100

Publish live is BLOCKED (1 quality problem)

One article scored 99, and Publish live stayed locked. A 99 would pass most reviews. Here it is a decision a person has to make: fix it, or accept it on the record. The agent cannot wave it through.

Step 4

What the agent cannot do on its own.

Publish. Publish live is always a click by a person in the Caelo admin. No tool on the MCP connection does it.
Hard-to-undo actions. Deploys, users and roles, domains, themes and layouts, plugins, bulk deletes and URL moves are approval-gated. The agent's call puts an approval card in the admin and waits for Approve or Reject.
Skip the checks. The same rules apply to the admin chat, the live-edit overlay and your own agent over MCP.

Everything else the agent may do freely, because it is cheap to reverse. Every write is a snapshot: one chat's changes can be undone as a unit, and pages, modules or the whole site can be reverted to an earlier state (a site revert is itself approval-gated).

Costs

Your agent, your bill.

Over a Power-MCP token, the AI work runs on your agent's account. By default Caelo makes no AI calls of its own on that connection; tools that need AI, such as translations, hand the task back to your agent.

If you would rather have Caelo do the work, use a chat token instead. Caelo then uses the provider you configured (Anthropic, OpenAI, Google or a local OpenAI-compatible endpoint), with an optional cost cap per token, and every call shows up in the cost dashboard.

Checklist

Agent changes land in a draft, never directly on the live site.
New pages are built from existing modules.
Every page has a meta description before it can be staged.
Lighthouse runs on staging; anything below 100 blocks publishing.
Irreversible actions need a person's approval.
A person clicks Publish live.

Try it

Give your agent a site, not a folder.

Caelo is open source under MPL 2.0. Install it on your own server or in your Google Cloud and connect Claude Code in five minutes.

Quickstart MCP and Power-MCP docs Star Caelo on GitHub