XeroWP
Leitvia Studio: AI Agents, MCP and Design Tokens for Block Themes
Leitvia Studio: AI Agents, MCP and Design Tokens for Block Themes

Leitvia Studio: AI Agents, MCP and Design Tokens for Block Themes

0/5 (0 ratings) — active installs Updated Nov 12, 2026
abilities-apiAI agentblock-themedesign tokensmcp
Download v1.3.46 Plugin Website
Agents: connection status, application passwords, checks and the MCP Adapter at a glance, plus the AI agents with access to the site.

Agents: connection status, application passwords, checks and the MCP Adapter at a glance, plus the AI agents with access to the site.

Leitvia Studio lets AI agents such as Claude Code, Codex or Cursor build and maintain WordPress sites with block themes through 59 abilities, and every change passes checks for design, accessibility and content before it goes live. It is free and made for developers, agencies and site owners who want an AI agent to do the work without administrator rights.

The abilities belong to the WordPress Abilities API and run over MCP or the REST API. Everything Studio creates is stored in WordPress core structures (patterns, global styles, post types, block bindings), so the site keeps working when you deactivate the plugin. It works with any block theme and fits best with the free theme Leitvia.

What it does

  • AI agent gateway with review and rollback. Agents read the design contract, tokens, patterns and page outlines, then build pages from patterns, change single blocks, fix links and alt text or set up navigation. Every write runs through one pipeline: identity, scope, a hash check against stale reads, content checks (headings, alt text, link text, contrast, landmarks), a snapshot and an audit entry. An autonomy level per area decides whether a change goes live, lands as a draft or waits in the inbox as a change package with a block diff, which a person applies, rejects or rolls back.
  • MCP server for WordPress. With the plugin MCP Adapter active, Studio adds its own MCP server “leitvia” with one tool per ability; the default server of the adapter offers the same abilities. Without the adapter, every ability runs over the REST API, and wp leitvia runs them from WP-CLI.
  • Limited rights for agents. An agent signs in as a “Leitvia Agent” user with an application password that an administrator creates and revokes on the Agents screen. It never installs or changes plugins, themes, users or code. Site settings, the content model and global styles always wait for a person.
  • Design tokens. Token sets in the W3C Design Tokens format (DTCG) are imported, exported, kept with revisions and compiled into the global styles. A set whose text or control colors miss WCAG 2.2 AA contrast cannot be saved, and overlays change tokens for a scheduled period.
  • Pattern Lab. All patterns with live previews in every style variation at 390, 782 and 1440 px, state variants, an axe accessibility check per preview, status, version and a usage index.
  • Content model and block bindings. Post types, taxonomies, fields, relations and site settings declared as JSON, registered through core APIs and shown in paragraphs, headings, buttons and images through block bindings.
  • Site recipes. One command or one agent call sets up a site from style variation, header, footer, pages from patterns, navigation and settings that send less data: Blog, Company, Publication, Documentation and, with WooCommerce, Shop. A second run adds nothing.
  • Privacy by default. Embeds from YouTube, Vimeo, X and other sites wait behind a consent placeholder, the Map block loads OpenStreetMap tiles only after consent, Gravatar and the emoji script of WordPress stay off, and fonts are served from your own site.
  • Accessibility blocks. An accessibility bar, an easy language switch for pages in easy language (Leichte Sprache), a form error summary, a table of contents and tabs that stay readable without JavaScript.
  • Structured data. NewsArticle or BlogPosting, CollectionPage and ProfilePage as JSON-LD and a news sitemap, switched off while an SEO plugin such as Yoast SEO or Rank Math is active.
  • WooCommerce. A product comparison block, 10 abilities for products and categories and the recipe Shop, all registered only while WooCommerce is active.

Leitvia Pro

Everything above is free and stays free, and no feature is locked. The separate paid add-on Leitvia Pro adds the blocks Slider, Scroll story, Before and after and Entry list, and eight industry kits with their own brand, pages and patterns. See Leitvia plans and prices.

Works with the official WordPress agent skills

Leitvia Studio follows the standards WordPress sets for AI agents and will keep following them:

  • WordPress agent skills: an AI agent with only the official skills finds the Leitvia abilities with GET /wp-json/wp-abilities/v1/abilities?category=leitvia.
  • Abilities API: every ability has described input fields, an output schema and annotations (readonly, destructive, idempotent), and runs under /wp-json/wp-abilities/v1.
  • MCP Adapter 0.7: its default server lists the Leitvia abilities through discover-abilities and execute-ability, with the same checks.

The Leitvia agent skills on GitHub add eleven skills for setup, design, pages, patterns, maintenance, accessibility, migration, shop catalog, news, SEO and reports, and three workflows. They work side by side with the WordPress skills. The Leitvia developer guide shows the calls with real answers.

Core preset slugs such as base, contrast or spacing 50 map to the roles of the design contract, so content written by AI agents trained on default themes still fits. Theme files of your own go into the child theme Leitvia Child, blocks of your own into a plugin built from Leitvia Block Starter. No agent writes files into the theme.

Privacy

Leitvia Studio sends no visitor data anywhere and sets no cookies. Embeds from other sites (the Embed block and its variations such as YouTube, and iframes from other sites in classic content and in Custom HTML blocks) show a placeholder until the visitor clicks “Load content from” followed by the name of the provider (for example “Load content from YouTube”); only then does the visitor’s browser contact the provider. When a visitor ticks “Always allow YouTube on this site” (with the name of the provider), the list of allowed providers is stored in the visitor’s browser (localStorage, key leitvia-consent), never on the server; the Consent Settings block lists and revokes these entries. Without JavaScript the placeholder only links to the content on the provider’s site. The setting “Ask visitors before loading embedded content from other sites” turns the placeholder off; deactivating Leitvia Studio also brings back the embeds as WordPress renders them. When you save a post, WordPress itself asks the provider for the embed code (oEmbed), as without the plugin; that request comes from your server and carries no visitor data.

The list carries the path of the site in its key (leitvia-consent:/ for a site at the root, leitvia-consent:/club/ for a site below /club/), because sites of a subdirectory network or installations in folders of one domain share the local storage of the browser. Consent given on one of them never applies to another. A list stored by an older version under leitvia-consent carries over on a site at the root path only.

The Accessibility bar stores text size and high contrast in the visitor’s browser (localStorage, key leitvia-a11y), only after the visitor changes one of them. Read aloud uses the speech synthesis of the browser with a voice installed on the device; the button only appears when such a voice exists for the language of the page, and voices from online services are never used.

The Contact form block sends the name, email address and message a visitor enters by email to the address set in the block, or to the administration address of the site, and stores none of it on the site. To limit the messages per connection it keeps a counter for one hour under a salted hash of the IP address; the address itself is not stored. It sets no cookies and contacts no other service. Name the form in your privacy policy.

External services

This plugin does not connect to any external service by default. The check after an AI agent changed a page live loads that page from your own site (a loopback request, see the question on requests from your server); it contacts no other host.

AI provider of the site owner: only when an agent or a user calls the ability “Plan page” (leitvia/plan-page) with ai set to true, Leitvia Studio sends one request through the AI client of WordPress to the AI connector an administrator set up under Settings, Connectors (for example OpenAI, Anthropic or Google). Leitvia Studio has no provider of its own and stores no keys. The request holds the goal and the content points given in that call, the page frame and composition rules of the contract, and the names and metadata of the patterns; no posts, no user data and no other content of the database. Without that call, nothing is sent. The terms and privacy policy of the provider the administrator chose apply.

Embedded content: when a visitor clicks “Load content from” with the name of the provider in the placeholder of an embed, or has chosen to always allow that provider, the visitor’s browser loads the embedded content from the provider. The provider receives the visitor’s IP address, browser details and the page address, and may set cookies. Nothing is loaded before that action. The providers Leitvia Studio names, with their privacy policies (other embed providers are named after their host):

Map tiles: the Map block shows a list of places with links to openstreetmap.org and a placeholder for the interactive map. Only when a visitor clicks “Load content from OpenStreetMap”, or has chosen to always allow it, does the visitor’s browser load map images (tiles) from the tile server. The tile server receives the visitor’s IP address, browser details and the page address. Nothing is loaded before that action, and the block editor shows no map. The default tile server is the one of the OpenStreetMap Foundation; administrators can enter another one under Leitvia Studio, Settings, “Map tile server” (https only), in which case the placeholder names that server. Check the terms of use and the privacy policy of the server you use.

Emoji images: the emoji script of WordPress is off while Leitvia Studio is active. Only if an administrator switches on “Load the emoji script of WordPress” in the Leitvia Studio settings, browsers without their own emoji fonts load emoji images from s.w.org, a server of WordPress.org (Automattic Inc. on its behalf), which receives the visitor’s IP address, browser details and the page address; feeds and emails then link these images as well.

The other exception is Gravatar, a service of Automattic Inc., and only if an administrator switches on “Allow Gravatar for users and commenters without a local picture” in the Leitvia Studio settings. Then, on every page view that shows a profile picture of someone without a picture from the media library, the visitor’s browser requests that picture from Gravatar. Gravatar receives the visitor’s IP address and a hash of the email address of the user or commenter.

Third-party libraries

The accessibility check bundles axe-core 4.13.0 by Deque Systems, Inc. into build/axe-runner.js. axe-core is licensed under the Mozilla Public License 2.0 (MPL-2.0); the license text is in licenses/AXE-CORE.txt and the notices of the libraries it includes are in licenses/AXE-CORE-THIRD-PARTY.txt. MPL-2.0 is compatible with the GPL: its section 3.3 allows combining the covered code with GPL-licensed code, and axe-core does not use the “Incompatible With Secondary Licenses” notice. The unmodified source code is available from the axe-core repository and the npm package axe-core. The file is served from your own site and makes no external requests.

The headings of the Studio admin screens use Open Sans by The Open Sans Project Authors, weights 600 and 700, reduced to the Latin characters and stored as WOFF2 in assets/fonts/open-sans/. Open Sans is licensed under the SIL Open Font License 1.1; the license text is in licenses/OPEN-SANS.txt.

Token sets can name Libre Franklin by The Libre Franklin Project Authors (one variable file each for upright and italic, weights 100 to 900, in assets/fonts/libre-franklin/, license licenses/LIBRE-FRANKLIN.txt) and Young Serif by The Young Serif Project Authors (regular weight without an italic cut, in assets/fonts/young-serif/, license licenses/YOUNG-SERIF.txt). Both are reduced to the Latin characters, stored as WOFF2, licensed under the SIL Open Font License 1.1, served from your own site and loaded only on sites whose active token set uses them.

The Map block bundles Leaflet 1.9.4 by Volodymyr Agafonkin and contributors into build/blocks/map/leaflet.js, loaded only after the visitor agrees to load the map, and ships its stylesheet as build/blocks/map/leaflet.css. Leaflet is licensed under the BSD 2-Clause License, which is compatible with the GPL; the license text is in licenses/LEAFLET.txt.

Icons: 116 icons of Lucide 1.60.0, ISC License (some from Feather, MIT), in assets/icons/lucide.json, license in licenses/LUCIDE.txt.

The pattern illustration assets/images/landscape.webp was drawn for Leitvia by CMS ADMINS and is licensed under the GPL, version 2 or later, like the plugin.

Source code

The src/ folder contains the source code of the files in build/, and webpack.config.js and bin/guard-blocks-manifest.mjs are the build configuration. To create build/ yourself, run npm ci and then npm run build in the plugin folder with Node.js 24 (or 22.22.2 and later). package-lock.json holds the exact versions of all build tools and libraries, so the result matches the files in build/ of this release. The same source is in the Leitvia Studio repository on GitHub.

Support

Leitvia Studio is developed and maintained by CMS ADMINS. Ask questions in the support forum of the plugin on WordPress.org or write to [email protected]. Report security issues and accessibility barriers to the same address; we answer within five working days.

Legal

Leitvia Studio is a product of CMS ADMINS, a brand of Patrick Schlesinger, Parkstraße 19, 80339 München, Germany. Contact: [email protected].

Disclaimer: Leitvia Studio is free software under the GNU GPL, version 2 or later. It is provided as is, without any warranty, to the extent permitted by applicable law; see sections 11 and 12 of the GPL. You are responsible for checking that your site meets the legal requirements that apply to it, such as accessibility, privacy and imprint duties; Leitvia Studio helps with these but does not replace that check.