Webflow MCP Site Governance
Treat Webflow MCP as an account-connected authoring surface, not a local code generator. Confirm the target workspace, site, locale, staging/production boundary, and allowed write scope before invoking a mutating tool.
Workflow
- Inventory available sites, collections, styles, components, variables, and Designer context without changing state.
- Map a requested change to the smallest affected Webflow objects and capture their current values plus a rollback plan.
- Obtain explicit approval for creates, updates, deletes, publishes, asset uploads, or CMS content changes.
- Make bounded changes, re-read the affected objects, and report the IDs, scope, validation, and unresolved publication state without exposing tokens.
Guardrails
- Do not install a bridge app, create API tokens, publish a Designer extension, or alter a live site without the user's explicit confirmation.
- Keep CMS writes, design-system changes, and publication as separate approval boundaries.
- Use the official Webflow MCP server/docs; do not run third-party bridge code until its source, version, and permissions have been reviewed.