The useful version of "AI edits my website" is not an assistant with the keys to the server. It is an assistant with a job, a scope and a short leash. That is what AI access in cmsspot is built to be.
How it connects
cmsspot has a built-in MCP server, which is how assistants such as Claude talk to tools. On the AI access tab you create a token for one site. You give it a name, choose what it may do, and choose when it expires. You see the token once, paste one command into the assistant, and the assistant can now work on that site and nothing else.
The three levels
- Read. The assistant can list and read pages, search the site, see the fields on a page and check HTML. It cannot change anything. Good for audits and questions.
- Edit content. Everything above, plus changing fields, creating pages from the site's template and uploading images. It cannot write files or code. This is the level for SEO and copy work.
- Files. Everything above, plus writing, moving and deleting files. For a developer who wants the assistant to work on the markup too.
What it never sees
Files with passwords and keys are always hidden. You can hide any other folder or file yourself, and a hidden file looks to the assistant like a file that does not exist. The assistant never sees the server login, cannot reach any other site, and cannot run code on the server. Everything it does is written to a log you can read.
What to ask it
The best tasks are the ones that are tedious for a person and well-defined for a machine:
- "List every page with a title over 60 characters and suggest a shorter one."
- "Read the services page and rewrite the intro so it answers what we do and where, in two sentences."
- "Check all pages for images without alt text and write one for each."
- "Create a page for winter storage based on the services page, and give it a title and description."
Review what it did before the client sees it. Every change is backed up first, so undoing one is a click.
What not to expect
It will not redesign the site at the content level, and at the files level it will do what you ask, including things you did not mean. Give it the level the job needs, not the highest one, and set an expiry so a forgotten token does not live forever.
More articles: WordPress or a hand-built site? How to choose for a small business · Why a plain HTML page is the easiest thing for Google and AI to read