Basehim Dev Tools: build and manage your site with an AI agent

Basehim Dev Tools is a free app that lets an AI agent such as Claude work on your site through its MCP server: manage content, build and change themes and apps, read logs and fix problems. You install it from the Marketplace in your dashboard, connect the agent and choose what it may do. Every code change is checked before it is kept, and every change can be undone.

1. What an agent can do
2. Requirements
3. Set up in five steps
4. Modes: what the agent is allowed to do
5. Working with the agent
6. How changes are kept safe
7. When something goes wrong
8. Tool reference
9. Good practice

What an agent can do

Every Basehim site has a built-in MCP server at /mcp. On its own, it gives an agent the content tools: search, read, create and update posts and pages, manage categories and tags, browse the media library, moderate comments, and read settings, users, menus and widget areas.

Dev Tools adds the tools for code:

In practice, that means you can ask an agent for work like this, and it does it on the site itself:

• Write and publish posts, tidy categories and tags, fill in missing excerpts.
• Restyle the theme, add a template for one category, or build a new theme from a description or a screenshot.
• Build an app: an admin screen, a contact form, a dashboard card, a scheduled import, a public page.
• Find out why an app was switched off or a page shows an error, by reading the logs, then fix it.
• Check every page of the site at phone width and fix what overflows.

Requirements

Set up in five steps

Step 1: Install Dev Tools from the Marketplace

1. In your dashboard, open Marketplace and find Basehim Dev Tools (category Development).
2. Click Install. The download is checked against its checksum before it is installed.
3. Click Activate.

Basehim Dev Tools now appears in the sidebar under Apps. It starts in Disabled mode, so nothing is reachable until you choose otherwise.

Step 2: Set up recovery

Do this before the agent changes anything. It gives you a way back that works even if the site, the admin and MCP are all down.

1. Open Basehim Dev Tools → Recovery.
2. Click Create key. The key is shown once: save it in your password manager.
3. Click Install endpoint. This places devtools-recovery.php next to index.php. If the site folder isn't writable, download the script and upload it there with your file manager.
4. Click Test recovery.

Step 3: Connect the agent

Claude (OAuth). In Claude, add a custom connector with the address https://your-site.com/mcp and keep OAuth as the sign-in method. A window opens your site: sign in as an administrator, check the permissions on the Authorize screen, and click Allow access. The full walkthrough, with screenshots, is in Connect an AI assistant to your site.

Other MCP clients (API key). Open API → Keys, create a key for an administrator account, and tick only the scopes you need:

Add the content scopes too (for example posts:read and posts:write) if the agent should also work on content. For Claude Code:

claude mcp add --transport http my-site https://your-site.com/mcp \
  --header "Authorization: Bearer basehim_your_key"

Step 4: Choose the mode

Open Basehim Dev Tools → Controls and choose Read-only to let the agent look, or Development enabled to let it change apps and themes. The mode is checked on every call, so the change applies at once, also to connections that are already open. The modes are explained below.

Step 5: Start

Start a new conversation with the connector switched on, and ask the agent to call dev_status first. It reports the mode, exactly which tools work now and which checks this server can run. Then give it the first task.

Modes: what the agent is allowed to do

Allow PHP execution is a separate switch under Controls, off by default, and works only in Development mode. With it, the agent can run PHP inside the site, which is how it can change things that have no tool of their own, such as menus and settings. PHP it runs is not snapshotted or rolled back, so switch it on only for the task that needs it.

The MCP tools tab lists all 21 tools with a switch for each, so you can turn off any tool you never want used. The content tools are controlled separately, by the scopes of the connection and the role of the account.

Working with the agent

Describe the result you want, and let the agent read before it writes. For example:

Read the active theme and tell me how the home page template is built. Don't change anything yet.

Add a "Blog" page template to the active theme that lists posts from the Blog category, 12 per page, with pagination. Check it at phone width with dev_render_page.

Build an app called "Opening hours": an admin screen to set the hours for each day, and a widget that shows them. Follow basehim.com/docs/ai-context, then activate it and check the logs.

The Events app was switched off after the last update. Find out why from the logs, fix it and activate it again.

List the posts without an excerpt and write one for each, under 160 characters. Show me the list before you save anything.

For apps and themes, point the agent at AI context for Basehim development: a compact page of Basehim's rules and real function names, so it doesn't guess. Prompts for building with AI has ready-made requests for common jobs.

Every change the agent makes appears under Basehim Dev Tools → Operations, with each file before and after, the checks that ran and the result.

How changes are kept safe

Every call goes through the same steps, in this order:

1. Permission. The mode, the per-tool switch, the scopes of the connection and the role of the account behind it are checked on the server for every call.
2. Confirmation. Deleting or renaming a file, uninstalling an app, running PHP and rolling back return a one-time token first. The agent must repeat the exact same call with the token, so a destructive step is never taken by accident. This is on by default.
3. Where it may write. Only inside content/apps/… and content/themes/…. Core files, .htaccess, .env, configuration, version-control folders, links and Dev Tools itself can never be changed. Secret files are never readable, and credentials are removed from logs and query results.

Every change to files is then handled as one operation:

1. Snapshot. Each file it touches is copied, with its hash, before anything changes.
2. Validate. PHP is syntax-checked and JSON is decoded before anything is written. If either fails, nothing changes.
3. Apply. Each file is replaced in one step, so a visitor never sees half a file. A file that changed since the agent read it is not overwritten.
4. Check. The site is started in a separate process, and the home page, the admin sign-in and the MCP endpoint are requested and compared with before the change.
5. Keep or undo. If any check fails, every file of the operation is restored and verified by hash. Changes to several files are applied and undone together.

If an error shows up later, on a page the checks didn't visit, the fatal error sentinel restores the latest change to that app or theme on the first request that fails (within 30 minutes of the change). After three automatic rollbacks in an hour, Dev Tools stops further writes until you look.

A check that couldn't run is reported as skipped, never as passed.

When something goes wrong

In order of convenience; each one works when the ones before it don't:

1. It usually fixes itself. A change that breaks the site is rolled back within the same call, or by the sentinel on the first failing request.
2. Roll back. Ask the agent to call dev_rollback (it needs dev:recover and works in every mode), or open Operations → the operation → Restore snapshot in the admin.
3. The recovery endpoint. If the site, the admin and MCP are all down, open https://your-site.com/devtools-recovery.php, enter your recovery key, and restore the last change or a specific operation. Quarantine there switches every tool off so the agent can't keep trying. It works without Basehim running.
4. File manager only. Rename the folder content/apps/basehim-devtools to switch Dev Tools off completely; its settings and history are kept. The snapshots in storage/devtools/tx/ can be copied back by hand.

Two things Dev Tools can't undo: changes made by PHP the agent ran, and database changes made by an app's own install or upgrade code. Take a backup first when either is involved.

Tool reference

The core content tools (search_content, list_posts, create_post, update_page and the rest) are listed in MCP and AI agents.

Good practice

• Develop on a staging site. Use Development enabled on a copy of your site, then move the finished app or theme to the live site. Checks catch broken code, not code that works but does the wrong thing.
• Switch back to Disabled when you're done. Snapshots, history and recovery keep working.
• Give the least access. Only the scopes the task needs; Read-only when the agent only has to look; Allow PHP execution only for the task that needs it.
• Read what the agent changed. Every operation lists its files before and after. Review them as you would a colleague's work, especially anything that handles payments, personal data, uploads or accounts.
• Back up before uninstalling apps or running PHP. Neither is snapshotted.
• Never paste secrets into a chat. Nothing here needs your .env, database password or recovery key. If a key ends up in a conversation, revoke it under API → Keys.

Dev Tools is an app like any other: its code runs in the same PHP process as Basehim. Its rules keep an honest agent within the limits you set, but it is not a sandbox for untrusted code.

Related

• Build with AI: three ways to work with an AI assistant, and a safe workflow
• Connect an AI assistant to your site
• MCP and AI agents
• AI context for Basehim development and Prompts for building with AI
• App development best practices