LocalHero is an application platform that uses WordPress as its kernel. Most of what makes it distinctive is custom-built on top: its own tables, services and protocols. Its organising idea is digital sovereignty: you own your data, your infrastructure, and the state of your AI-assisted work.
The platform keeps the state; the AI is interchangeable
- Shared task queue. People and AI agents work from the same queue: create, claim, hand off, complete, or escalate to a human when a decision is needed. Work in progress survives any session, model or person.
- Per-site knowledge base. Procedures and conventions are published as plain Markdown URLs and are also queryable by AI clients.
- Generated documentation. Docs, changelogs and capability references are produced from the running system, so they cannot drift from it.
- Model indifference. Switch AI provider, including to a self-hosted model, and nothing is lost.
AI access through MCP, with real access control
- Every site exposes an MCP (Model Context Protocol) endpoint.
- Hundreds of capabilities are built on the WordPress Abilities API: typed, documented actions, each checked against the user's role. An AI can do only what its user is allowed to do.
- A built-in OAuth 2.1 server lets ordinary members connect their own AI assistant, and revoke it, with no developer setup.
- Any block can be rendered as an interactive widget inside an AI chat (MCP Apps). The interface goes to the user, not through the model's context, so personal data can be shown and acted on without the AI reading it.
A self-maintaining codebase, with a human in the loop
- Code changes are proposed through AI, reviewed as diffs, and applied only after explicit approval.
- Each applied change bumps the version and records an immutable changelog entry.
- Static analysis, coding-standards checks and PHP profiling run as built-in capabilities.
- Readmes are compiled from the documentation, and a plugin's public or private status decides whether it is published.
- One developer maintains around 400 plugins this way.
Open standards
- Contacts sync over CardDAV, and the platform federates over ActivityPub. Calendar sync over CalDAV is experimental.
- Content is readable by AI systems through llms.txt and Markdown content negotiation.
- An experimental relationship graph, built with RDF vocabularies (Schema.org, FOAF, ActivityStreams), describes people, organisations and content in a form other systems can read.
Observability without third parties
Audit trail, API and MCP request log, JavaScript error log, access-log warehouse and code-integrity monitoring are all built in, and all of it can be queried by people or AI.
Why WordPress
WordPress was chosen for its primitives, not as a website builder:
- Users, roles and capabilities that every human and AI action passes through.
- A document model: posts, metadata, taxonomies and revisions form a versioned content store.
- Blocks: composable UI components, which is what makes in-chat interfaces possible.
- The Abilities API: a native registry of permission-checked actions that maps directly onto MCP.
- Multisite: many independent sites on one install, with shared identity.
- Longevity: GPL-licensed, it outlives any vendor and runs on any PHP and MySQL host.
LocalHero runs on inexpensive shared hosting, using PHP, MariaDB and Redis. The public plugins are on GitHub and the plugin documentation covers each one.