Download

Tools reference

The MCP server registers 84 tools, all named wp_*. Here they are grouped by job, with the scope each group needs. For every tool’s parameters and an example call, open the full catalogue.

Open the tools catalogue
On this page

How tools reach your site

Your assistant never sees WordPress directly. It calls a tool such as wp_set_seo on the MCP server; the server turns that into one HTTPS request to the plugin’s REST API under /wp-json/wpcb/v1, signed with your token. The plugin checks the token’s scopes and the WordPress capability of the user it belongs to, runs the change, and writes an audit log entry.

In Claude Code a tool shows up as mcp__<server name>__wp_set_seo, where the server name is whatever you called the site when you added it. The assistant picks the right one when you name the site in your prompt.

A tool only works when the token has its scope. Read tools need …:read; anything that changes the site needs the matching write scope. See Token scopes.

Posts and pages

Read, write and publish content. Writes save a WordPress revision first; a post created with status “publish” stays a draft unless the token has content:publish.

Scopescontent:read · content:write · content:publish

wp_list_postswp_get_postwp_searchwp_create_postwp_update_postwp_delete_postwp_publish_postwp_list_pageswp_create_pagewp_update_pagewp_delete_page

Categories and tags

List terms of any taxonomy and create new ones.

Scopescontent:read · content:write

wp_list_termswp_create_term

Media

List the library, upload from a URL or base64, set alt text, captions and descriptions, optimise images, find files nothing uses, delete with confirmation.

Scopesmedia:read · media:write

wp_list_mediawp_upload_media_urlwp_upload_media_b64wp_set_media_metawp_optimize_imagewp_find_unused_mediawp_delete_media

SEO

Read and write SEO meta in the fields your SEO plugin already uses, analyse a post, audit many at once, check the sitemap, find broken links.

Scopesseo:read · seo:write

wp_get_seowp_set_seowp_analyze_seowp_audit_seo_bulkwp_get_sitemap_statuswp_find_broken_links

Analytics

Read traffic from the site’s analytics plugin: overview, top posts, keywords, referrers, a single post, period comparison, trends by category, pages without traffic.

Scopesanalytics:read

wp_analytics_detectwp_analytics_overviewwp_analytics_top_postswp_analytics_top_keywordswp_analytics_top_referrerswp_analytics_post_statswp_analytics_compare_periodwp_analytics_trend_by_categorywp_analytics_no_traffic_pages

Multilingual

Languages, post and media translations, string translation audits. Works with WPML; on sites without a supported multilingual plugin these tools report no languages.

Scopescontent:read · content:write · media:write

wp_multilingual_detectwp_list_languageswp_get_post_translationswp_link_post_translationwp_set_post_languagewp_get_media_translationswp_set_media_translation_metawp_audit_media_translationswp_list_string_translationswp_audit_string_translations

Theme and appearance

The active theme and its files, custom CSS, theme switching, menus, widgets and the Customizer. Theme file writes keep the previous version.

Scopestheme:read · theme:write · site:read · site:write

wp_get_active_themewp_list_theme_fileswp_read_theme_filewp_write_theme_filewp_inject_custom_csswp_switch_themewp_get_menuswp_create_menuwp_update_menuwp_get_widgetswp_set_widgetswp_get_customizerwp_set_customizer

Plugins

List plugins with their available updates, install from the WordPress.org directory, a zip URL or a local zip of up to 20 MB (with confirmation), activate, deactivate, read and write plugin files, scaffold a new plugin.

Scopesplugin:read · plugin:write · plugin:install

wp_list_pluginswp_install_plugin_repowp_install_plugin_zipwp_activate_pluginwp_deactivate_pluginwp_read_plugin_filewp_write_plugin_filewp_scaffold_plugin

Files

List, read, search and download files; write, upload, create folders, rename and delete. Since plugin 1.7.0, site:write changes files only inside the uploads folder (inert types only); anywhere else needs fs:admin as well, and every overwrite, rename or delete there asks for confirmation. Secrets such as wp-config.php and .env are never read or changed. All file tools need an administrator account.

Scopessite:read · site:write · fs:admin

wp_fs_listwp_fs_readwp_fs_searchwp_fs_downloadwp_fs_writewp_fs_uploadwp_fs_mkdirwp_fs_renamewp_fs_delete

Site and system

Settings (changing the site address or admin email asks for confirmation), health and performance checks, full backups and restore.

Scopessite:read · site:write · system:backup

wp_get_settingswp_set_settingswp_health_checkwp_performance_checkwp_backup_createwp_backup_listwp_backup_restore

Advanced

SQL through a guard that allows only SELECT by default and confirms every write, and WP-CLI limited to an allowlist and disabled until the site owner turns it on.

Scopesdb:read · db:write · cli:exec

wp_db_querywp_cli_exec

What is not a tool

Some of the plugin’s REST routes have no MCP tool, because Xaflo Desktop uses them directly: maintenance mode (/maintenance), the debug.log console (/debug/log), the audit log and token management. The one-time wp-admin sign-in link (/admin/login-link) is left out on purpose: it is a credential for a person, not for a model. All routes are in the REST API reference.