// SCAN REPORT

Wp Cli

58 tools. 34 can modify or destroy data without limits.

5 destructive tools with no built-in limits. Policy required.

Last updated: 29 Jun 2026

34 can modify or destroy data

24 read-only

58 tools total

Community server · catalogue entry verified 29/06/2026

How to control Wp Cli ↓

TOOL MAP

What Wp Cli exposes to your agents

Read (24) Write / Execute (29) Destructive / Financial (5)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Wp Cli tools

Destructive · High wp_transient_delete_all This tool irreversibly deletes all transient data across a WordPress installation. Destructive · Critical wp_plugin_delete This tool permanently removes plugin files from disk with no recovery mechanism. Destructive · High wp_theme_delete This tool permanently removes a theme from WordPress. Destructive · High wp_theme_file_delete This tool deletes theme files irreversibly.

34 of Wp Cli's 58 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Wp Cli

PolicyLayer is an MCP gateway — it sits between your AI agents and Wp Cli, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "wp_plugin_delete": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "wc_coupon_create": {
    "limits": [
      {
        "counter": "wc_coupon_create_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "wc_order_get": {
    "limits": [
      {
        "counter": "wc_order_get_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Wp Cli — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON WP CLI →

Instant setup, no code required.

FULL CATALOGUE

All 58 Wp Cli tools

DESTRUCTIVE 5 tools

Destructive wp_plugin_delete Permanently delete a WordPress plugin from the filesystem. The plugin must be deactivated first. This cannot b Destructive wp_post_delete Delete a post Destructive wp_theme_delete Delete a theme Destructive wp_theme_file_delete Delete a file from a WordPress theme. Cannot be undone. Destructive wp_transient_delete_all Delete all WordPress transients (cached temporary data). Useful for clearing stale caches.

EXECUTE 7 tools

Execute wp_cli_raw Execute any WP-CLI command directly Execute wp_cron_run Manually trigger a specific WordPress cron event by its hook name. Execute wp_db_query Execute a raw SQL query against the WordPress database. Use for read-only SELECT queries. WARNING: Write queri Execute wp_eval Execute arbitrary PHP code in the WordPress environment. Has access to all WordPress functions, hooks, and the Execute wp_plugin_activate Activate an installed but inactive WordPress plugin. The plugin must already be installed. Execute wp_search_replace Search and replace strings across all WordPress database tables. Essential for domain migrations (e.g. staging Execute wp_theme_activate Activate a theme

WRITE 22 tools

Write wc_coupon_create Create a WooCommerce discount coupon. Write wc_product_create Create a new WooCommerce product with price and type. Sets up all required product meta automatically. Write wc_product_update_price Update WooCommerce product pricing. Set regular price and optional sale price. Write wp_cache_flush Flush the WordPress object cache Write wp_maintenance_mode Enable or disable WordPress maintenance mode. When enabled, visitors see a Write wp_media_import Import media from URL Write wp_menu_create Create a new navigation menu Write wp_menu_item_add Add a custom link to a menu Write wp_option_update Update a WordPress option Write wp_plugin_deactivate Deactivate an active WordPress plugin without removing it. The plugin files remain on disk and can be reactiva Write wp_plugin_install Install a WordPress plugin from the official wordpress.org plugin directory. Optionally activate it immediatel Write wp_post_create Create a new WordPress post, page, or custom post type entry. Returns the new post ID. Content supports full H Write wp_post_meta_update Set or update a meta value for a post. Used for custom fields, featured images, WooCommerce data, etc. Write wp_post_update Update an existing post Write wp_rewrite_flush Flush rewrite rules (fix permalink issues) Write wp_scaffold_block Generate a Gutenberg block skeleton Write wp_scaffold_plugin Generate a plugin skeleton Write wp_scaffold_theme Generate a child theme skeleton Write wp_term_create Create a new term in a taxonomy (category, tag, or custom taxonomy). Write wp_theme_file_write Create or overwrite a file in a WordPress theme. Use this to edit templates, add new PHP files, modify CSS/JS, Write wp_theme_install Install a WordPress theme from the official wordpress.org theme directory. Optionally activate it immediately. Write wp_user_create Create a new user

READ 24 tools

Read wc_order_get Get detailed WooCommerce order info including total, currency, billing email, and payment method. Read wc_order_list List WooCommerce orders with ID, status, and date. Read wc_product_get Get detailed WooCommerce product info including price, sale price, SKU, and stock status. Read wc_product_list List WooCommerce products with ID, title, status, and date. Requires WooCommerce to be installed and active. Read wp_core_check_update Check if WordPress core updates are available. Returns a list of available versions with download URLs. Use th Read wp_core_version Get the currently installed WordPress core version. Returns the version string (e.g. Read wp_cron_list List all scheduled WordPress cron events with hook name, next run time, and recurrence. Read wp_db_export Export database to SQL file Read wp_menu_list List all navigation menus Read wp_option_get Get a WordPress option value Read wp_plugin_list List all installed WordPress plugins with their name, status (active/inactive/must-use), version, and update a Read wp_plugin_search Search the official wordpress.org plugin directory for plugins matching a search term. Returns top 10 results Read wp_post_get Get a single post by ID Read wp_post_list List WordPress posts, pages, or any custom post type. Returns ID, title, status, date, and type for each item. Read wp_post_meta_get Get a specific meta value for a post. Used for custom fields, ACF fields, WooCommerce product data, etc. Read wp_post_meta_list List all meta key-value pairs for a post. Shows custom fields, ACF data, WooCommerce product meta, SEO meta, e Read wp_sidebar_list List all registered widget areas (sidebars) in the active theme. Read wp_site_info Get a comprehensive overview of the WordPress installation including version, site URL, site name, active them Read wp_term_list List all terms in a taxonomy (categories, tags, or custom taxonomies). Returns term ID, name, slug, and post c Read wp_theme_file_list List all files in a WordPress theme directory. Returns file paths and sizes. Defaults to the active theme if n Read wp_theme_file_read Read the contents of a file in a WordPress theme. Use this to inspect template files, functions.php, style.css Read wp_theme_list List all installed WordPress themes with their name, status (active/inactive), version, and update availabilit Read wp_user_list List all users Read wp_widget_list List all widgets in a specific sidebar or all sidebars.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Wp Cli

Can an AI agent delete data through the Wp Cli MCP server? +

Yes. The Wp Cli server exposes 5 destructive tools including wp_plugin_delete, wp_post_delete, wp_theme_delete. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Wp Cli? +

The Wp Cli server has 22 write tools including wc_coupon_create, wc_product_create, wc_product_update_price. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Wp Cli.

How many tools does the Wp Cli MCP server expose? +

58 tools across 4 categories: Destructive, Execute, Read, Write. 24 are read-only. 34 can modify, create, or delete data.

How do I enforce a policy on Wp Cli? +

Register the Wp Cli MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Wp Cli tool call.

Deterministic rules across all 58 Wp Cli tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON WP CLI →

Instant setup, no code required.

58 Wp Cli tools catalogued and risk-classified — across an index of 43,000+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Wp Cli's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →