What an AI Assistant Can (and Can't) Do to Your Live Site
The MCP connection between Claude or ChatGPT and your site is split into read tools and write tools on purpose — here's what that split actually buys you.
Connecting an AI assistant to your website sounds like it should be an all-or-nothing decision: either the assistant can help, or you keep it at arm's length because you don't trust what it might do to a live site. The MCP connection between Claude or ChatGPT and a Piskes site isn't built that way. It's split into two distinct categories of tool, and the split is the point.
Ten tools that only look
Most of what an assistant can do through mcp.piskes.com is read-only: list your sites, get a site's details, check its publish info, list pages, run an audit, list past deploys, list redirects, list branches, and search or fetch content. None of these can change anything. An assistant with only these tools available can answer "what's on my pricing page" or "did the last deploy actually publish" as competently as someone with editor access looking at the dashboard — but it cannot touch a single byte of your site.
That's a meaningfully different trust boundary than "the assistant is connected to your website." It's "the assistant can see your website," which is a much easier thing to grant.
Four tools that act
The write side is small on purpose: publish a site, create a redirect, delete a redirect, create a branch. That's it. Notice what's missing — there's no "edit this page's content," no "delete this site," no "change these settings." The write tools are narrowly scoped to actions that are either reversible (a redirect can be deleted as easily as it was created) or already gated by a branch (publishing and branching are the two places where a change actually reaches a visitor or gets staged for review).
Why the boundary sits where it does
The obvious alternative design — give the assistant full editing access and let it change anything a human editor could — would make for a flashier demo and a much scarier support conversation the first time an assistant misreads an instruction. Scoping the write surface to publish/redirect/branch means the worst case of a misfire is a bad redirect or an unwanted publish, both of which are things a human already does routinely and can undo. It's not that the tools are weak; it's that the tools that exist are chosen so their failure mode is recoverable.
If you want an assistant that can actually edit page content, that's a different, larger grant than connecting it through MCP today gives you — and that gap is deliberate, not a missing feature nobody's gotten to yet.
What this means when you connect one
When you authorize Claude or ChatGPT against your site, you're not deciding "how much do I trust this AI in general." You're deciding whether you're comfortable with it reading everything about your site's structure and content, and separately, whether you're comfortable with it publishing, branching, and managing redirects. Those are two different comfort levels, and the tool split lets you reason about them separately instead of accepting a single all-or-nothing risk.