New Your team’s decisions, in one playbook every coding agent works from. Never answer your agent twice
// SCAN REPORT

Wordpress

314 tools. 162 can modify or destroy data without limits.

39 destructive tools with no built-in limits. Policy required.

Last updated:

162 can modify or destroy data
152 read-only
314 tools total

Community server · catalogue entry checked 12/10/2026

How to control Wordpress ↓

TOOL MAP

What Wordpress exposes to your agents

Read (152) Write / Execute (123) Destructive / Financial (39)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous Wordpress tools

Financial · High stripe_set_payment_method Modifies Stripe payment method availability, directly affecting financial transaction flows. Destructive · High seo_delete_post_seo Irreversibly removes SEO metadata; cannot be automatically undone without backup restoration. Destructive · High seo_delete_term_seo Irreversibly removes all SEO metadata from a term without restoration capability. Destructive · High acf_delete_field_group Irreversibly deletes field group structure; cannot be undone without restores.

162 of Wordpress's 314 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Wordpress

PolicyLayer is an MCP gateway — it sits between your AI agents and Wordpress, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default
{
  "stripe_set_payment_method": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations
{
  "acf_delete_field_group": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "acf_create_field_group": {
    "limits": [
      {
        "counter": "acf_create_field_group_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "acf_export_field_group": {
    "limits": [
      {
        "counter": "acf_export_field_group_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register Wordpress — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON WORDPRESS →

Instant setup, no code required.

FULL CATALOGUE

All 314 Wordpress tools

FINANCIAL 1 tools
Financial stripe_set_payment_method Turn one payment method of a Stripe payment method configuration on or off (display preference). The method mu
DESTRUCTIVE 38 tools
Destructive acf_delete_field_group Delete an ACF field group and its fields (stored post values are kept) Destructive fields_delete_definition Delete a database definition. Stored field values stay in post/term/user meta and options. Destructive fort_cache_purge Purge the fort Destructive legal_delete_section Delete a section from a legal document. Destructive legal_put_document Replace a whole legal document (every section not listed is gone). Sections are ordered; omit slug to derive i Destructive legal_reset_accessibility_report Clear the markup repair report, e.g. after fixing the source, so new page views record afresh. Requires cvrt-l Destructive legal_restore_generator Restore a generated document to how it was before the generator first wrote it, and stop generating it. Requir Destructive mcp_bulk_delete_media Delete multiple media items at once. Returns the deleted and failed IDs. Destructive mcp_clean_comments Permanently delete all spam and trashed comments Destructive mcp_clean_revisions Delete old post revisions, keeping the newest Destructive mcp_delete_cpt_post Delete a post of any post type (moves to trash unless force is true) Destructive mcp_delete_media Delete a media item and its files Destructive mcp_delete_menu Delete a navigation menu Destructive mcp_delete_menu_item Delete a menu item. Its children move up to its own parent; the response lists them as reparented. Destructive mcp_delete_option Delete an option (404 if it does not exist) Destructive mcp_delete_term Delete a term from any taxonomy (permanent; terms have no trash) Destructive mcp_delete_theme Delete an inactive theme (the active theme is refused) Destructive mcp_delete_user Delete a user. WITHOUT reassign, all of the user Destructive mcp_delete_widget Remove a widget from its sidebar Destructive mcp_flush_cache Flush the WordPress object cache and delete all transients and site transients. Does NOT purge a page cache in Destructive seo_clear_monitor_log Delete 404 monitor log entries: one entry by id, or every entry last seen within from..to (inclusive dates, ei Destructive seo_delete_post_seo Delete (reset) every SEO meta field of a post. Returns { deleted: true }. Destructive seo_delete_redirect Delete a redirect by id. Returns { deleted: true }. Destructive seo_delete_term_seo Delete (reset) every SEO meta field of a taxonomy term. Returns { deleted: true }. Destructive stripe_recreate_webhook Recreate this site Destructive woo_delete_category Delete a product category Destructive woo_delete_coupon Delete a coupon permanently Destructive woo_delete_product Delete a WooCommerce product (to trash unless force) Destructive woo_delete_variation Delete a product variation permanently Destructive woo_helper_create_invoice DESTRUCTIVE, IRREVERSIBLE: creates a REAL invoice for this order in the live sevDesk/Lexware ledger. An invoic Destructive wp_delete_category Delete a category permanently (its posts fall back to the default category) Destructive wp_delete_comment Delete a comment (moves to trash, or permanently if force=true) Destructive wp_delete_media Delete a media item and its files Destructive wp_delete_page Delete a page (moves to trash, or permanently if force=true) Destructive wp_delete_plugin Delete an installed plugin (via cvrt-mcp-endpoints; deactivates first) Destructive wp_delete_post Delete a post (moves to trash, or permanently if force=true) Destructive wp_delete_tag Delete a tag permanently Destructive wp_delete_user Delete a user permanently, reassigning their content to another user
EXECUTE 19 tools
Execute fulfillment_fulfill_order Manually (force) run fulfillment for an order: renders the packing slip, creates the ClickUp task, notifies Sl Execute fulfillment_reprint_job Reset a print job to pending so the agent prints it again. Returns { ok: true }; 404 { ok: false, error } for Execute fulfillment_update_check Force an immediate plugin-update check (bypassing PUC Execute mcp_flush_rewrite Flush permalink rewrite rules Execute mcp_install_plugin Install a plugin from WordPress.org by slug. If activation fails the plugin stays installed and activation_err Execute mcp_install_plugin_zip Install a plugin from a ZIP URL (GitHub releases, custom sources). The URL must end in .zip or be a github.com Execute mcp_optimize_tables Run OPTIMIZE TABLE on every table with the site Execute mcp_regenerate_thumbnails Regenerate image thumbnails for a media item (images only) Execute mcp_run_action_scheduler Run due (past-due pending) Action Scheduler actions now through Action Scheduler Execute mcp_run_cron Run the earliest scheduled event of a cron hook now, like Execute mcp_search_replace Search and replace a string in every text column of the site Execute mcp_update_all_plugins Update all plugins with available updates. cvrt-mcp-endpoints itself is never bulk-updated and is listed under Execute mcp_update_core Update WordPress to the latest version. Returns { updated: false, message } when already up to date. Execute mcp_update_plugin Update a single plugin to the latest version. refresh:true first runs a fresh update check for it (wp.org and Execute seo_indexnow_ping Submit URLs to IndexNow (one request per URL). Returns [{ url, ok, error? }]; ok means the site dispatched the Execute seo_sitemap_ping Submit the sitemap to Google Search Console (needs the search_console settings) and return the status Search C Execute woo_helper_invoices_refresh Reload the provider Execute wp_activate_plugin Activate an installed plugin (via cvrt-mcp-endpoints, avoids the often-blocked core route) Execute wp_deactivate_plugin Deactivate an installed plugin (via cvrt-mcp-endpoints)
WRITE 104 tools
Write acf_create_field_group Create an ACF field group with fields (active, shown in REST, labels on top) Write acf_import_field_groups Import ACF field groups from JSON export format (each needs key, title and fields). The endpoint does not look Write acf_update_field_group Update an existing ACF field group. Only the given group settings change. The endpoint re-imports the whole gr Write acf_update_post_field Update a single ACF field value for a post (updated is false when the value did not change) Write acf_update_post_fields Update multiple ACF field values for a post (field names are run through sanitize_key, so use lowercase names Write fields_create_definition Create a definition (field group, post type, taxonomy or options page). The body is the definition itself; omi Write fields_sync_definition Copy a JSON-sourced definition into the database. Only JSON definitions can be synced. Write fields_update_definition Replace a definition as a whole: omitted keys fall back to the kind Write fields_update_settings Update cvrt-fields settings. github_token is write-only and stored encrypted; a blank or omitted token keeps t Write fort_backup_create Start a backup of the site Write fulfillment_update_settings Update cvrt-order-fulfillment settings. Only provide the keys you want to change; omitted keys keep their stor Write legal_add_section Append a section to a legal document (creates the document if it is still empty). On a generated document the Write legal_consent_log_export Export the raw consent decision log as CSV for a day range (same optional from/to rules as legal_consent_log_s Write legal_link_page Link a legal document to its WordPress page (post type page only; posts and products are refused). The rendere Write legal_put_accessibility Configure the self-hosted accessibility tool (replaces the Ally widget; no third-party request, needs no conse Write legal_put_consent Configure the consent banner and every tracking credential the site uses. Merges: only the keys given change, Write legal_put_facts Set Impressum fields. Merges: only the keys given change; an empty string clears a field. An unknown key, a va Write legal_put_generator Tick or untick modules and options, then regenerate the document (the Datenschutz tab over the API). Merges in Write legal_put_generator_library Import the text library of a generated document and regenerate it if active. Give the library inline or as lib Write legal_put_shop_withdrawal Change the withdrawal function settings; only the keys given change, an invalid value is a 400 and nothing is Write legal_put_social Switch social networks and set their profile URLs (plain https only), then rewrite the Datenschutz social-medi Write legal_put_social_modules Import the social-media text modules, inline or as modules_file (websites/bin/legal-v4/social-media/library.js Write legal_put_theme Set the banner theme preset and/or individual CSS custom properties. All or nothing: one invalid name or value Write legal_update_section Update a section. The slug is never rewritten, so shortcodes already placed on a page keep working when a head Write legal_update_settings Update cvrt-legal settings. github_token (PUC auto-updates on a private repo) is write-only: a blank value kee Write mcp_add_menu_item Add an item to a menu. A custom link needs url; a page/post or term item needs object_type post_type/taxonomy Write mcp_add_widget Add a widget to a sidebar Write mcp_assign_menu_location Assign a menu to a registered theme location (see mcp_get_menu_locations); menu_id 0 unassigns Write mcp_assign_terms Assign taxonomy terms to a post. Terms can be IDs, slugs or names; slugs/names that match no term are skipped Write mcp_change_user_role Change a user Write mcp_create_cpt_post Create a post of any post type. Meta keys are run through sanitize_key (lowercase a-z0-9_-). Write mcp_create_menu Create a new navigation menu Write mcp_create_term Create a term in any taxonomy Write mcp_create_user Create a new WordPress user. Returns { id, username, created }; the password is never echoed. Write mcp_install_theme Install a theme from WordPress.org by slug Write mcp_install_theme_zip Install a theme from a public ZIP URL (must end in .zip). Unlike mcp_install_plugin_zip there is no GitHub tok Write mcp_move_widget Move a widget to a different sidebar Write mcp_reorder_widgets Set the widget order of a sidebar. Pass the COMPLETE list: widgets of the sidebar left out are removed from it Write mcp_set_option Create or update an option (any option, no allow-list: be careful with siteurl, home, active_plugins etc.). A Write mcp_sideload_media Upload media to WordPress from a public external URL (private/internal hosts are refused) Write mcp_update_all_themes Update all themes with available updates Write mcp_update_cpt_post Update a post of any post type. Only the given fields change; meta keys are merged (update_post_meta per key). Write mcp_update_elementor_element Update settings on a single Elementor element (merge by default). With widget_type, replaces the widget in pla Write mcp_update_elementor_kit Update Elementor global kit settings (colors, fonts, typography). Top-level keys are merged; a nested value su Write mcp_update_elementor_page_settings Update Elementor page-level settings. Top-level keys are merged into the stored settings (a nested value repla Write mcp_update_media Update media item metadata (title, alt text, caption, description). Only the given fields change. Write mcp_update_menu Rename a navigation menu (the menu Write mcp_update_menu_item Partially update a menu item: only the given fields are sent and changed, every other stored field (type, link Write mcp_update_term Update a term in any taxonomy. Only the given fields change. Write mcp_update_theme Update a single theme to latest version Write mcp_update_user Update an existing user. Only the given fields change. Use mcp_change_user_role for the role. Write mcp_update_user_meta Set meta data for a user (merged per key; keys are run through sanitize_key, so lowercase a-z0-9_-) Write mcp_update_widget Update a widget Write seo_bulk_update_posts_seo Bulk update SEO meta of up to 100 posts. Each item is { id, ...fields } with the same fields as seo_update_pos Write seo_create_redirect Create a redirect. Rejects invalid regex, unknown status codes and redirect loops/chains deeper than 5. Return Write seo_create_redirect_from_log Create a 301 redirect from a 404 monitor log entry Write seo_export_csv Export post SEO meta as a CSV string (post_id, post_title, url, seo_title, seo_description, focus_keywords, se Write seo_export_redirects Export every redirect as a CSV string (source, target, type, is_regex, enabled). Write seo_export_settings Export every csm_ option as a flat { csm_name: value } map. Secrets are masked as { set: boolean }. Write seo_import_csv Import post SEO meta from CSV in the seo_export_csv format (header row, then one row per post with at least 7 Write seo_import_migrate Migrate from RankMath or Yoast. Default: per-post/term meta and redirects are migrated (WRITES immediately, dr Write seo_import_redirects Import redirects from CSV in the seo_export_redirects format (header row source,target,type[,is_regex],enabled Write seo_import_settings Import settings from a flat { csm_name: value } map (the seo_export_settings shape). Only csm_ keys are writte Write seo_update_post_seo Update the SEO meta for a post (partial: only the fields you give change; null deletes a field). Purges the po Write seo_update_redirect Update a redirect (partial: omitted fields keep their stored value). Returns the redirect. Write seo_update_settings seo_update_settings Write seo_update_term_seo Update the SEO meta for a taxonomy term (partial; null deletes a field). Returns the term Write woo_add_order_note Add a note to an order Write woo_bulk_update_stock Bulk update product stock; per product only the given fields change Write woo_create_attribute Create a global product attribute (taxonomy pa_{slug}) Write woo_create_attribute_term Create a term for a global attribute Write woo_create_category Create a product category Write woo_create_coupon Create a coupon Write woo_create_customer Create a customer Write woo_create_product Create a WooCommerce product Write woo_create_variation Create a variation of a variable product. Note: wp-pilot-pro 1.1.0 declares Write woo_helper_put_invoices Change cvrt-woo-helper invoice settings; only the keys given change, an invalid value is a 400 and nothing is Write woo_helper_send_test_email SENDS A REAL EMAIL: a WooCommerce order-email preview to Write woo_helper_update_emails Change the WooCommerce email look through cvrt-woo-helper 0.2.0+. Only the keys given change; an invalid value Write woo_helper_update_settings Update cvrt-woo-helper settings. github_token is write-only (blank or omitted keeps the stored one); clear_git Write woo_helper_update_stripe Change Stripe express checkout through cvrt-woo-helper. Only the keys given change. locations maps a button ty Write woo_update_category Update a product category; only the given fields change Write woo_update_coupon Update a coupon; only the given fields change Write woo_update_customer Update a customer; only the given fields (and address keys) change Write woo_update_order_status Update order status (triggers the usual WooCommerce status emails) Write woo_update_product Update a WooCommerce product; only the given fields change (type, images and attributes cannot be changed here Write woo_update_product_meta Update product meta data (merged; _regular_price, _sale_price, _stock, _stock_status, _sku go through the prod Write woo_update_variation Update a product variation; only the given fields change Write wp_activate_theme Activate a theme (switch themes) Write wp_create_category Create a new category Write wp_create_comment Create a comment on a post (or a block note with type=note) Write wp_create_page Create a new WordPress page Write wp_create_post Create a new WordPress post Write wp_create_tag Create a new tag Write wp_create_user Create a new WordPress user Write wp_moderate_comments Batch moderate comments by status Write wp_update_category Update a category (only the given fields change) Write wp_update_comment Update a comment (approve, edit content, move, ...); only the given fields change Write wp_update_media Update media item metadata (title, alt text, caption, description, attachment, ...); only the given fields cha Write wp_update_page Update an existing page (only the given fields change) Write wp_update_post Update an existing post (only the given fields change) Write wp_update_settings Update WordPress site settings (only the given fields change); returns all settings afterwards Write wp_update_tag Update a tag (only the given fields change) Write wp_update_user Update an existing user (only the given fields change)
READ 152 tools
Read acf_export_field_group Export a field group in ACF JSON format (for import/backup) Read acf_get_field_group Get ACF field group with full field configuration Read acf_get_post_field Get a single ACF field value for a post Read acf_get_post_fields Get all ACF field values for a post (name => { value, type, label }) Read acf_list_field_groups List all ACF field groups with their fields (key, name, label, type) Read fields_get_definition Get one definition by kind and key. Read fields_get_location_values Values usable in field-group location rules: post types, page templates, taxonomies, options pages, user forms Read fields_get_schema Editor form schema of one definition kind (fields and their options). Read it before fields_create_definition Read fields_get_settings Get cvrt-fields settings. The GitHub update token is returned as { set: boolean }, never raw; also the JSON sy Read fields_list_definitions List all definitions of one kind from every source (database, JSON, PHP) with their _source. Read fields_list_types List the available field types (text, date_picker, image, relationship, ...) with their settings. Read fields_status cvrt-fields status: plugin version, definition counts per kind, whether ACF / Elementor / Elementor Pro are ac Read fort_backup_list List the fort Read fort_job_get Status of a Bearfort job on this fort (backup, restore, migration, ...). with_log:true adds the job Read fort_logs_read Read the fort Read fulfillment_get_settings Get the cvrt-order-fulfillment plugin settings. Secret values are returned as { set: boolean }, never raw. Read fulfillment_queue Print-queue state: status counts (pending/printing/printed/failed) and the 20 most recent jobs (id, order_id, Read fulfillment_status Pipeline health: which credentials are set, ClickUp list/assignee, when the print agent last polled, and print Read legal_consent_log_get Get every logged consent decision for one consent_id (the banner Read legal_consent_log_stats Aggregate consent decision counts by action and banner_version over a day range [from, to) (both optional, def Read legal_get_accessibility Get the self-hosted accessibility tool Read legal_get_accessibility_report Get the markup repair report: totals per rule (fixed / open) and per page what was repaired and what is still Read legal_get_consent Get the cookie consent banner configuration: enabled, gtm_id, loader_url, ga4_id, ahrefs_key, ads_id, gtm_serv Read legal_get_document Get one legal document including its ordered sections. Read legal_get_facts Get the Impressum fields (company, address, register, VAT id, ...) the generator fills into both Impressum and Read legal_get_generator Get a generated document Read legal_get_generator_library Get the imported text library of a generated document (the texts come from websites/bin/legal-v4/privacy, the Read legal_get_page Get which page a legal document is linked to: linked, page_id, the page Read legal_get_settings Get cvrt-legal settings. Secret values are returned as { set: boolean }, never raw. Read legal_get_shop_withdrawal Withdrawal function settings (Widerrufsbutton, \u00a7 356a BGB / \u00a7 13a FAGG) of cvrt-legal 0.12.1+ on a W Read legal_get_social Get the social-media section configurator: networks on offer, which are switched on with their profile URLs, a Read legal_get_social_modules Get the imported social-media text modules. Requires cvrt-legal 0.6.0+. Read legal_get_theme Get the banner theme: preset name, CSS custom property overrides and the rendered CSS. Read legal_list_documents List all legal document types with their required/filled state and linked page. Read legal_list_withdrawal_requests Withdrawal requests customers submitted through the shop Read legal_render_document Render a document to normalized HTML without saving. Useful to preview the heading hierarchy and slug ids befo Read legal_status Legal document status for a site: which documents are required, filled and published, plus a single compliant Read list_sites List the WordPress sites this server can manage. Every other tool requires a Read mcp_bulk_get_options Get multiple options at once. A missing option comes back as false. ${MASK_NOTE} Read mcp_check_plugin_updates Check for plugin updates now: runs every Plugin Update Checker instance (GitHub-released plugins such as the c Read mcp_check_updates Force a check for WordPress core, plugin, and theme updates. Returns { core: new core version or null, plugins Read mcp_get_action_scheduler Action Scheduler queue (WooCommerce emails, webhooks, PDF jobs): counts per status, past_due pending actions a Read mcp_get_audit_log Audit trail of state-changing MCP calls on this site (cron runs, Action Scheduler runs, update checks), newest Read mcp_get_cron_status Get WordPress cron status: schedules and the next 50 events (total_events counts all) Read mcp_get_debug_info Get debug information: WordPress settings, server, database (name, prefix, charset), paths and debug constants Read mcp_get_elementor_build Get full Elementor page build (containers, widgets, settings tree) with element and widget counts Read mcp_get_elementor_conditions Get theme builder display conditions for an Elementor template (Elementor Pro) Read mcp_get_elementor_element Get a single Elementor element with full settings, its parent id and child ids Read mcp_get_elementor_flat Get flat list of all Elementor elements on a page (id, elType, widgetType, parent_id, depth, settings); easier Read mcp_get_elementor_kit Get Elementor global kit settings (colors, fonts, typography, spacing, button defaults) Read mcp_get_elementor_page_settings Get Elementor page-level settings (hide title, custom CSS, etc.). Fails if the post is not built with Elemento Read mcp_get_health Get a quick site health status and score (100 minus 20 per issue: WP_DEBUG on, no HTTPS, pending updates) Read mcp_get_media Get detailed media item info (caption, description, filename, filesize, image sizes, attached_to) Read mcp_get_media_stats Get media library statistics (counts by MIME type, total size, upload path/url, max upload size) Read mcp_get_menu Get a menu with all its items. Each item has id, title, url, type, object, object_id, parent, position, target Read mcp_get_menu_locations Get registered menu locations and the menu assigned to each Read mcp_get_option Get a single option value. ${MASK_NOTE} masked: true says the value (or part of it) was hidden. Read mcp_get_php_info Get PHP configuration details Read mcp_get_plugins_health Get plugin health status and available updates Read mcp_get_post_type Get detailed schema for a post type (supports, taxonomies, counts per status, labels) Read mcp_get_sidebar_widgets Get all widgets in a sidebar Read mcp_get_system_info Get comprehensive system information Read mcp_get_tables List the site Read mcp_get_taxonomy Get taxonomy details (labels, description, hierarchical, post_types, term count) Read mcp_get_user Get user details by ID (profile fields, roles, capabilities, registered, posts_count) Read mcp_get_user_meta Get all meta data for a user (keys starting with _ are hidden; single values are flattened) Read mcp_get_version Get WordPress version and update status Read mcp_get_widget Get a widget Read mcp_list_cpt_posts List posts of any post type (id, title, slug, status, date, modified, author, excerpt, parent) with paging tot Read mcp_list_elementor_templates List Elementor library templates (headers, footers, singles, loop items, popups) with theme builder conditions Read mcp_list_media List media library items (id, title, url, mime_type, date; images also alt, width, height) with paging totals Read mcp_list_menus List all navigation menus (id, name, slug, item count, assigned locations) Read mcp_list_options List WordPress options (name ascending) with an optional name prefix filter. ${MASK_NOTE} Note: autoload is on Read mcp_list_post_types List all public post types (name, labels, hierarchical, has_archive, rest_base, supports, taxonomies, publishe Read mcp_list_roles List all available WordPress user roles (slug, name, capabilities, user count) Read mcp_list_sidebars List all registered sidebars Read mcp_list_taxonomies List all public taxonomies (name, labels, hierarchical, post_types, rest_base, term count) Read mcp_list_terms List terms for any taxonomy (categories, tags, custom taxonomies): id, name, slug, description, parent, count Read mcp_list_users List WordPress users (id, username, email, display_name, first_name, last_name, roles, registered) with role/s Read mcp_list_widget_types List all available widget types Read mcp_scan_uploads Scan the uploads directory for executable files (.php, .phtml, .phar, .pht, .phps, .shtml, .cgi, also double e Read mcp_search_elementor Search published Elementor-built posts for widgets, settings, or text in string setting values (case-insensiti Read mcp_search_plugins Search the WordPress.org plugin repository. Returns { total, plugins: [{ name, slug, version, author, rating, Read mcp_search_themes Search the WordPress.org theme repository. Returns { total, themes: [{ name, slug, version, author, rating, de Read seo_get_post_analysis Run the SEO content analysis for a post: { score, checks }. Read seo_get_post_seo Get the SEO meta for a post (every field, null when unset; plus language and translations when Polylang is act Read seo_get_redirect Get a redirect by id. Read seo_get_settings Get cvrt-seo-manager settings grouped by section (titles, robots, social, knowledge_graph, schema, verificatio Read seo_get_term_seo Get the SEO meta for a taxonomy term: { title, description, robots, og_image, schema } (null when unset). Read seo_keyword_check Check whether a focus keyword is already used by another post (case-insensitive). Returns { unique, posts: [{ Read seo_list_monitor_log List the 404 monitor log: { items: [{ id, url, hits, first_seen, last_seen, ... }], total, pages }. Read seo_list_posts_seo List SEO meta of published posts, newest ID first: [{ id, title, url, seo, language?, translations? }]. Read seo_list_redirects List redirects, newest first: { items: [{ id, from_url, to_url, type, is_regex, hits, enabled, created_at, upd Read seo_sitemap_status Get sitemap status: { sitemap_url, post_types, taxonomies, total_urls, search_console? }. Read seo_status Get cvrt-seo-manager status: { version, configured, dependencies: { php, wordpress } }. Read stripe_get_account The Stripe account behind the gateway: country, default currency, charges/payouts enabled, details submitted, Read stripe_get_settings WooCommerce Stripe Gateway settings, secrets masked, plus the active mode (live/test). Read stripe_list_charges Recent Stripe charges: id, amount, currency, status, created, paid/refunded, payment method type, outcome, fai Read stripe_list_payment_method_configs Stripe payment method configurations: per configuration every payment method with available, preference (what Read stripe_list_refunds Recent Stripe refunds: id, amount, currency, status, created, charge, reason, WooCommerce order_id. Read-only; Read stripe_list_webhooks Webhook endpoints of the Stripe account: id, url, status, api_version, number of events; configured:true marks Read woo_gateway_status WooCommerce payment gateways for a customer country: id, title, enabled, available (offered at checkout, WooCo Read woo_get_coupon Get coupon details Read woo_get_customer Get customer details (incl. billing and shipping address) Read woo_get_customer_orders Get a customer Read woo_get_order Get WooCommerce order details (payment, billing, shipping, line items, totals) Read woo_get_order_notes Get order notes Read woo_get_product Get WooCommerce product details (descriptions, stock, tags, images, attributes, dates) Read woo_get_product_meta Get all product meta data plus _regular_price, _sale_price, _price, _stock, _stock_status, _sku Read woo_helper_get_emails WooCommerce email look managed by cvrt-woo-helper 0.2.0+: logo (id, url, warning for unsafe formats), logo wid Read woo_helper_get_invoice_order Invoice state of one order: status, invoice number, error, attempts, has_pdf, the dry-run request preview, and Read woo_helper_get_invoices Invoice settings of cvrt-woo-helper 0.4.0+ (sevDesk / Lexware Office): settings, API keys per provider as { se Read woo_helper_get_settings cvrt-woo-helper settings (secrets as { set }, never raw). Read woo_helper_get_stripe The Stripe express-checkout settings cvrt-woo-helper manages: express checkout on/off, button locations per ty Read woo_helper_invoices_test_connection Test the invoice provider connection (read-only GETs: company, tax type, small-business status). Read woo_helper_list_invoice_orders Orders by invoice status: done, dry_run, queued, retry or failed. Read woo_helper_status cvrt-woo-helper status: plugin version, WooCommerce and Stripe Gateway active/version, whether the CVRT hub is Read woo_helper_stripe_status Read-only WooCommerce Stripe Gateway status from cvrt-woo-helper (recursively masked): mode, enabled methods, Read woo_list_attribute_terms List terms of a global attribute (including empty ones) Read woo_list_attributes List global product attributes Read woo_list_categories List product categories Read woo_list_coupons List published WooCommerce coupons Read woo_list_customers List WooCommerce customers (users with the given role) Read woo_list_orders List WooCommerce orders (slim) Read woo_list_products List WooCommerce products (slim: id, name, slug, type, status, sku, prices, stock, category ids) Read woo_list_tags List product tags (including empty ones) Read woo_list_variations List the available (purchasable, visible) variations of a variable product Read woo_sales_report Get sales report (completed + processing orders) Read woo_stock_report Get stock status report (stock-managed products, lowest stock first) Read woo_top_sellers Get top selling products by quantity (completed + processing orders) Read wp_get_active_theme Get the currently active theme Read wp_get_comment Get a comment by ID Read wp_get_media Get a media item by ID Read wp_get_namespaces List available REST API namespaces (plugins may add custom endpoints) Read wp_get_page Get a single page by ID (content, when requested, is the raw stored markup) Read wp_get_plugin Get plugin details by slug Read wp_get_post Get a single post by ID (content, when requested, is the raw stored markup) Read wp_get_settings Get the WordPress settings exposed by wp/v2/settings (title, tagline, url, email, timezone, date/time format, Read wp_get_theme Get theme details by stylesheet name Read wp_get_user Get a user by ID Read wp_list_categories List categories Read wp_list_comments List comments Read wp_list_media List media library items Read wp_list_pages List WordPress pages Read wp_list_plugins List all installed plugins Read wp_list_posts List WordPress posts with optional filters Read wp_list_tags List tags Read wp_list_themes List all installed themes Read wp_list_users List WordPress users Read wp_me Get the currently authenticated user Read wp_search_posts Search posts by keyword (shortcut; wp_list_posts has every filter) Read wp_site_info Get WordPress site information (name, description, URL, timezone)
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

UnClick 1662 tools
adminautomation
Apibase 1384 tools
adminautomation
Delx Mcp A2a 1068 tools
adminautomation
MCP Framework Personal 912 tools
adminautomation
Hermoso 896 tools
adminautomation
Nodebench 824 tools
adminautomation
Altium-MCP-Suite 817 tools
adminautomation
Eda Agent 777 tools
adminautomation
FAQ

Questions about Wordpress

Can an AI agent move money through the Wordpress MCP server? +

Yes. The Wordpress server exposes 1 financial tools including stripe_set_payment_method. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the Wordpress MCP server? +

Yes. The Wordpress server exposes 38 destructive tools including acf_delete_field_group, fields_delete_definition, fort_cache_purge. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Wordpress? +

The Wordpress server has 104 write tools including acf_create_field_group, acf_import_field_groups, acf_update_field_group. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Wordpress.

How many tools does the Wordpress MCP server expose? +

314 tools across 4 categories: Destructive, Execute, Read, Write. 152 are read-only. 162 can modify, create, or delete data.

How do I enforce a policy on Wordpress? +

Register the Wordpress MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Wordpress tool call.

Deterministic rules across all 314 Wordpress tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON WORDPRESS →

Instant setup, no code required.

314 Wordpress tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Wordpress's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.