The Future Of Web design With AI
In this video, I put Claude AI to the test.
First, I gave Claude a prompt without KrafterPRO. It built the website—but the result failed the design audit.
Then I gave Claude the exact same prompt with KrafterPRO connected.
This time, Claude used my complete design system—including the correct variables and presets—and the website passed the design audit with a perfect 100% score.
Same AI. Same prompt. The difference was KrafterPRO.
That sounds like exactly what I need!!
I just need to learn to connect Ckaude to KrafterPro
Colibri Miami I will do some some tutorials soon. I've ran out of AI credits at the moment 😩
Brilliant! That’s excellent.
WPTierz Laurent Thank you 😀
Will this also work with Codex?
Edwin van t Hek yes, I have both Claude Code and OpenAI Codex connected to NovaMira MCP. Claude Code keeps running out of tokens but Codex does not..
Susruta Chatterjee Do you know whether there´s a big difference between NovaMira MCP and WPVibe MCP. I use that right now and it seems to working quite ok for my use case, generating some pages on my website.
Edwin van t Hek I am not familiar with the WPVibe MCP but will take a look. I use NovaMira and it has integrations to not only Wordpress core but a lot of other plugins some of which I use.
Edwin van t Hek This is what came back from an AI request but it does not expand on capabilities:
Core Capabilities & Focus
-
WPVibe:
-
Novamira:
Susruta Chatterjee This is interesting, I will look into it 😀
Susruta Chatterjee So I think for my purpose WPVibe is suficient for this moment. Thanks for the explanation.
Mak . look into making a video about using Krafterpro with Codex pleasssse
Edwin van t Hek The flow for Claude Desktop and Codex in ChatGPT Desktop is exactly the same. The tutorials for Claude will work for Codex as well.
Hi Mak,
To use Novamira with Krafter Pro, can we use the free version of the plugin or do we need to invest in Pro?
Mark Fletcher Hi Mark, you need the pro version.
I have this hooked up, and while it's pretty impressive, be REALLY careful. Really believe it when it says to only work on a test site.
I had a text module that had mixed headings and text in the same module. That makes Krafter's audit bark at mixing the two types of elements. This was a temporary privacy policy...
Heading
Text
Heading
Text
Heading
Text
I asked Claude to:
- take that text
- create a new row
- create a group
- insert a heading, and take the text from the first heading from the mixed row above
- insert a text module, and grab the text from under the first heading above
Repeat until all text in the first module is spread to the individual modules.
It did it!
Then tested it by having it assign some Krafter presets. It performed okay here. Sometimes assigned an h2 preset to an h1 heading. Sometimes assigned a text size when one was already assigned through the preset. It appears to integrate really well with Krafter, which I love.
It is fun to see the potential. I did lose an entire section of content while playing around, so that is where caution comes in here.
Novamira Pro is reasonably priced.
Have fun! This will be a huge tool for WP and Krafter together.
Hello Mak and All,
I am very interested in using AI in my DIVI 5 and KrafterPro sites going forward. I have not yet been able to figure out how to get this described set up working (Claude, Novamira, etc.) There seem to be some issues, maybe with my specific setup using Cloudflare DNS, and perhaps my cloud hosting setup... I'm not sure. I just keep getting various errors like: Unknown client_id, Oauth, etc.
I am wondering if it is still worth my time and energy to get it working, or to just wait for the DIVI 5 update with their AI.
Are there advantages to using the Claude setup, or other AI engines?
I asked ChatGPT about Novamira. The answer was that I should install it in a productive system. It seems that Novamira could open doors for attacks. It could make my installation unsafe. Is this true or false or something in between?
Thomas Köppe
That is true in practice, but with a caveat: Novamira isn't a "hacked" plugin by default, but it grants an AI agent power equivalent to PHP's eval() with administrator privileges. On a production site, this creates a real risk if the agent is misdirected, if a prompt injection occurs, or if an error arises.
Why "production = risky"
Novamira is designed solely for dev/staging environments, and the authors state this explicitly:
When "AI abilities" are enabled, the agent can:
Execute arbitrary PHP code with full access to WordPress, the database ($wpdb), and all plugins.
Read, write, edit, or delete files within the WordPress directory structure (with some safeguards, though these can be bypassed using native PHP).
Create PHP code in a sandbox (wp-content/novamira-sandbox/) that is auto-loaded with every request.
There is no read-only mode: AI capabilities are either ON (read + write + execute) or OFF.
The plugin does not perform backups or roll back changes.
Result: a bad instruction, a poorly named prompt, or confusion between staging and production can lead to live changes on the actual site (files, database, options, etc.).
What Novamira secures (and what it doesn't)
Novamira includes several layers of protection, but they do not turn the site into a safe environment for production:
Authentication: WordPress application passwords + HTTPS; no anonymous access.
Permissions: only accounts with manage_options (admin) capabilities can use the tools.
Filesystem safeguards: default restrictions around ABSPATH and blocks on deleting certain core folders.
Sandbox + crash recovery: detection of fatal errors originating from the sandbox and a switch to safe mode.
However:
The "Execute PHP" feature can bypass the sandbox and access any file path using native PHP functions. The sandbox is intended as a convenience safeguard, not a security boundary.
Prompt injection risk: the model reads site content (database, files, plugin outputs) and can be manipulated by adversarial instructions.
Concrete recommendations (aligned with documentation and testing)
The stance consistent with the documentation and usage feedback:
Use Novamira only on:
local sites,
development environments,
staging sites.
In production:
You can leave the plugin installed and active if you want to deploy files generated in staging,
but keep "AI abilities" disabled (never enable them on a live site).
Always:
maintain recent backups,
test changes in staging,
assign the agent small, well-defined tasks,
verify manually before deploying.
Some developers sum it up well: "an agent capable of executing PHP with admin privileges can break things just as effectively as it fixes them."
In summary
"Novamira opens the door to attacks and makes the installation vulnerable":
False if used as intended (dev/staging, with backups, AI abilities OFF in production).
True in practice if you enable AI capabilities on a production site: you are granting an agent admin-level eval() power—without rollback capabilities—while exposing the system to risks of human error and prompt injection.