All 84 tools. Nothing hidden.
Every tool your assistant can call: what it does, the scope it needs, and whether it reads, writes or asks twice. Search, or filter by group and access level.
Content
13 · Posts, pages, terms and search.wp_list_posts
ReadList posts, or any public post type, filtered by status, category, tag, author or language.
List my 20 most recent drafts in the News category.
wp_get_post
ReadFetch one post or page with its content, and optionally its meta and translations.
Open post 412 and summarise it in three bullet points.
wp_create_post
WriteCreate a post as a draft. Publishing straight away needs content:publish.
Draft a post announcing our summer opening hours.
wp_update_post
WritePatch the title, content, excerpt, terms or meta of a post. A revision is saved first.
Fix the typos in post 412 and leave everything else as it is.
wp_delete_post
DangerousMove a post to the trash, or delete it for good through the two-step confirmation.
Move the duplicate “Spring sale” post to the trash.
wp_publish_post
DangerousPublish a post now, or schedule it for a date in the future.
Schedule post 418 for Monday at 9:00.
wp_list_pages
ReadList pages, filtered by status or search.
Which pages are still drafts?
wp_create_page
WriteCreate a page, as a draft unless the token may publish.
Create a draft Careers page with three open roles.
wp_update_page
WritePatch the title, content, excerpt or meta of a page. A revision is saved first.
Update the opening hours on the Contact page.
wp_delete_page
DangerousMove a page to the trash, or delete it for good through the two-step confirmation.
Move the old Summer 2025 landing page to the trash.
wp_list_terms
ReadList the terms of a taxonomy: categories, tags or any custom taxonomy.
Show all categories and how they are nested.
wp_create_term
WriteCreate a category, a tag or a term in a custom taxonomy.
Add a Case studies category under Blog.
wp_search
ReadFull-text search across posts and pages, ranked by relevance, with snippets.
Find every page that still mentions our old phone number.
Media
7 · Uploads, alt text, image optimisation, clean-up.wp_list_media
ReadList media library items, filtered by search or file type.
List every PDF in the media library.
wp_upload_media_url
WriteImport an image from a URL into the media library, with alt text and caption. Private network addresses are refused.
Import the logo from our press kit and set its alt text.
wp_upload_media_b64
WriteUpload a file sent as base64, up to 10 MB, when WordPress allows its type.
Upload this screenshot and caption it “New dashboard”.
wp_set_media_meta
WriteSet the alt text, caption, description or title of an attachment.
Write descriptive alt text for every image on the homepage.
wp_delete_media
DangerousDelete an attachment for good. Always goes through the two-step confirmation.
Delete the unused 2023 banner image.
wp_optimize_image
WriteResize and recompress an image in place, optionally converting it to WebP.
Convert the hero image to WebP at quality 80.
wp_find_unused_media
ReadFind attachments not used as a featured image, a parent or inline. A heuristic: page builders may still use some.
Which uploads are not used anywhere?
SEO
6 · Meta through your SEO plugin, audits, broken links.wp_get_seo
ReadRead the SEO meta of a post from the active SEO plugin, and say which adapter answered.
What is the meta description of the pricing page?
wp_set_seo
WriteWrite the SEO title, description, social and robots fields through the active SEO plugin. Only the fields you send change.
Rewrite the meta description of post 412 in under 155 characters.
wp_analyze_seo
ReadScore one post from 0 to 100 on title, description, focus keyword, image alts and length, with a list of issues.
Analyse the SEO of our main landing page and list the fixes.
wp_audit_seo_bulk
WriteAudit many posts at once; each issue has a severity and a suggestion. With fix_safe and seo:write it also fills in missing meta descriptions, only on posts the user may edit.
Audit the SEO of the last 50 posts and group the issues by severity.
wp_get_sitemap_status
ReadReturn the sitemap URL and its last change for the active SEO plugin.
Where is our sitemap and when did it last change?
wp_find_broken_links
ReadCheck the links in your content and report every one that fails or answers with an error.
Find broken links in the posts of the last 90 days.
Analytics
9 · Traffic from the analytics plugin you already run.wp_analytics_detect
ReadShow which analytics plugins were detected and which one answers.
Which analytics source are you reading from?
wp_analytics_overview
ReadViews, unique visitors and top device for a period.
How many visitors did we have last month?
wp_analytics_top_posts
ReadThe most viewed posts of a period, with unique visitors.
What were our ten most read posts this quarter?
wp_analytics_top_referrers
ReadThe sites that sent the most visitors in a period.
Where does our traffic come from this week?
wp_analytics_top_keywords
ReadSearch keywords, when the source provides them (Site Kit with Search Console).
Which search queries bring people to the site?
wp_analytics_post_stats
ReadTraffic of one post over a period.
How did post 412 do in its first month?
wp_analytics_compare_period
ReadCompare two periods side by side.
Compare this month with last month.
wp_analytics_trend_by_category
ReadViews per category, or per term of any taxonomy, over a period.
Which category grew the most this quarter?
wp_analytics_no_traffic_pages
ReadPosts and pages old enough to count that had no views in a period.
Which pages had no visits this quarter?
Theme & design
13 · Theme files, custom CSS, menus, widgets, Customizer.wp_get_active_theme
ReadName, version, parent theme and folder of the active theme.
Which theme are we running, and is it a child theme?
wp_list_theme_files
ReadList the files of the active theme, optionally by pattern.
List the CSS files in the theme.
wp_read_theme_file
ReadRead one file of the active theme. Paths cannot leave the theme folder.
Show me the footer template of the theme.
wp_write_theme_file
DangerousWrite a file in the active theme; a missing file is created. The previous version is backed up first.
Add a print stylesheet to the theme.
wp_inject_custom_css
DangerousAppend to, or replace, the site’s custom CSS.
Make the header sticky with a little custom CSS.
wp_switch_theme
DangerousActivate another installed theme, through the two-step confirmation.
Switch to the staging theme once I confirm.
wp_get_widgets
ReadList sidebars and the widgets in each.
What is in the blog sidebar?
wp_set_widgets
DangerousSet the widget list of a sidebar from existing widget instances.
Remove the tag cloud from the sidebar.
wp_get_customizer
ReadRead the allowed Customizer settings: colours, header image, logo, site icon.
Which logo and site icon are set?
wp_set_customizer
DangerousUpdate the allowed Customizer settings; anything else is refused.
Set the header text colour to our brand orange.
Plugins
8 · List, read, scaffold, install, activate.wp_list_plugins
ReadList installed plugins with version, status, any update WordPress knows of, and whether their files may be written.
Which plugins are installed but inactive?
wp_read_plugin_file
ReadRead a file inside a plugin folder. Paths cannot leave that plugin.
Show me the main file of the contact form plugin.
wp_scaffold_plugin
DangerousCreate a new plugin skeleton (header, composer.json, README) and allow writes to it.
Scaffold a plugin called Studio tweaks.
wp_write_plugin_file
DangerousWrite a file in a plugin you have allow-listed. The previous version is backed up.
Add a shortcode to the Studio tweaks plugin.
wp_install_plugin_zip
DangerousInstall a plugin from a .zip on your computer (up to 20 MB, checked by its SHA-256) or from an https link. A link, or replacing an installed plugin, goes through the two-step confirmation.
Install our private plugin from this zip file.
wp_install_plugin_repo
DangerousInstall a plugin from the WordPress.org directory, through the two-step confirmation.
Install Independent Analytics from WordPress.org.
wp_activate_plugin
DangerousActivate an installed plugin.
Activate the plugin we just installed.
wp_deactivate_plugin
DangerousDeactivate a plugin.
Deactivate the old slider plugin.
Site & system
6 · Settings, health, performance, database, WP-CLI.wp_health_check
ReadCheck that the plugin answers, with plugin, WordPress and PHP versions. Needs no scope; on plugin 1.7.0 a valid token also sees its own scopes.
Is the bridge reachable on this site?
wp_get_settings
ReadRead the allowed site settings: title, tagline, timezone, permalinks, front page and more.
Which timezone and permalink structure does the site use?
wp_set_settings
DangerousUpdate the allowed settings. Changing the site address or admin email needs the two-step confirmation.
Change the tagline to “Coffee, roasted in Milan”.
wp_db_query
DangerousRun a SELECT on the site’s tables, capped at 1,000 rows; password hashes never come back. Writes need db:write and the two-step confirmation, and are rolled back if they touch users, roles, tokens or protected options.
How many comments are waiting for moderation?
wp_cli_exec
DangerousRun a WP-CLI command that matches the allow-list exactly, with its values passed separately. Off until an administrator turns it on.
Flush the object cache.
wp_performance_check
ReadA quick performance audit: caching, OPcache, heavy images, database and autoload size.
Why is the site slow? Run a performance check.
Files
9 · Browse and change files: uploads with site:write, anywhere with fs:admin.wp_fs_list
ReadList one folder of the WordPress install. Protected files such as wp-config.php, .env, backups and SQL dumps are hidden.
What is in wp-content/uploads/2026/11?
wp_fs_read
ReadRead a file of the install: text as text, anything else as base64. Protected files are refused.
Show me the robots.txt file.
wp_fs_search
ReadFind files by name under a folder. Protected files are left out.
Find every PDF in uploads with “price” in its name.
wp_fs_download
ReadDownload a file as base64. Protected files are refused.
Download the latest price list PDF.
wp_fs_write
DangerousWrite a file. With site:write only plain file types inside wp-content/uploads; anywhere else needs fs:admin, which asks twice before an overwrite or a code change. The previous version is backed up.
Save this text as uploads/notes/launch.md.
wp_fs_upload
DangerousUpload a file sent as base64, with the same limits as wp_fs_write: uploads only with site:write, elsewhere with fs:admin.
Upload this PDF to uploads/press-kit.
wp_fs_mkdir
DangerousCreate a folder and any missing parents: inside uploads with site:write, elsewhere with fs:admin.
Create the folder uploads/press-kit.
wp_fs_rename
DangerousRename or move a file or folder: inside uploads with site:write; anywhere with fs:admin, after the two-step confirmation.
Rename uploads/2026/11/IMG_0042.jpg to hero-spring.jpg.
wp_fs_delete
DangerousDelete a file, or a folder with everything in it. Non-empty items, and every delete under fs:admin, go through the two-step confirmation; deleted files are backed up.
Delete the uploads/tmp folder and everything in it.
Backups
3 · Snapshots of database and files, and restore.wp_backup_create
DangerousZip the database, the files (themes, plugins, uploads) or both into a backup on the server.
Back up the database before we start.
wp_backup_list
ReadList backups with scope, note, size and date.
Which backups do we have from this week?
wp_backup_restore
DangerousRestore a backup. Overwrites files and tables, so it always goes through the two-step confirmation. The Xaflo plugin, its tokens and settings stay as they are.
Restore the homepage from the backup taken ten minutes ago.
Multilingual
10 · Translations of posts, media and strings (WPML).wp_list_languages
ReadList the site’s languages and the multilingual adapter in use.
Which languages is the site set up for?
wp_multilingual_detect
ReadDetect the multilingual plugin and which adapter answers.
Is this site multilingual?
wp_get_post_translations
ReadEvery translation of a post, grouped by language, including empty slots.
Which languages is the About page missing?
wp_link_post_translation
WriteLink an existing post into another post’s translation group.
Link post 233 as the Italian version of post 120.
wp_set_post_language
WriteSet or change the language of a post.
Mark post 233 as Italian.
wp_get_media_translations
ReadEvery language version of an attachment, with its alt text, caption and description.
Show the alt text of image 88 in every language.
wp_set_media_translation_meta
WriteFill in the alt text, caption, description or title of an attachment in one language.
Write the German alt text for image 88.
wp_audit_media_translations
ReadFind attachments missing a translation, alt text or description in any language.
Which images have no Italian alt text?
wp_list_string_translations
ReadList theme and plugin strings with their translation status per language.
Show the theme strings still untranslated in French.
wp_audit_string_translations
ReadHow complete the interface translation is, per language.
How complete is our German interface translation?
No tool matches. Try a shorter word, or clear the filters.
Three access levels, one scope each.
Looks, never changes anything. Safe to give to an agent that reports.
Changes content or media: drafts, edits, uploads, SEO fields. Revisions and the trash keep a way back.
Needs a scope the plugin itself flags as dangerous, or a second confirmed call. Give these scopes to as few tokens as you can.
Some tools grow with a second scope: the file tools work outside uploads with fs:admin, wp_db_query writes with db:write, and wp_audit_seo_bulk fixes descriptions with seo:write.
Names, scopes and routes are taken from the MCP package bundled with plugin v1.7.0 and checked against its source. Build a token on the plugin page