// SCAN REPORT

mcp-wordpress-instaWP

37 tools. 18 can modify or destroy data without limits.

5 destructive tools with no built-in limits. Policy required.

Last updated: 1 Jul 2026

18 can modify or destroy data

19 read-only

37 tools total

Community server · catalogue entry verified 01/07/2026

How to control mcp-wordpress-instaWP ↓

TOOL MAP

What mcp-wordpress-instaWP exposes to your agents

Read (19) Write / Execute (13) Destructive / Financial (5)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous mcp-wordpress-instaWP tools

Destructive · High delete_comment The tool permanently removes a comment from a WordPress site without the ability to undo the action (absent explicit recovery mechanisms in the description). Destructive · High delete_content Deletion of content is a destructive operation that cannot be undone. Destructive · High delete_media The tool permanently removes media files from a WordPress installation without possibility of reversal. Destructive · High delete_term This tool performs irreversible deletion of taxonomy terms (categories, tags, or custom taxonomies) from a WordPress site.

18 of mcp-wordpress-instaWP's 37 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control mcp-wordpress-instaWP

PolicyLayer is an MCP gateway — it sits between your AI agents and mcp-wordpress-instaWP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_comment": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "assign_terms_to_content": {
    "limits": [
      {
        "counter": "assign_terms_to_content_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "deactivate_plugin": {
    "limits": [
      {
        "counter": "deactivate_plugin_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register mcp-wordpress-instaWP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON MCP-WORDPRESS-INSTAWP →

Instant setup, no code required.

FULL CATALOGUE

All 37 mcp-wordpress-instaWP tools

DESTRUCTIVE 5 tools

Destructive delete_comment Deletes a comment Destructive delete_content Deletes content of any type Destructive delete_media Deletes a media item Destructive delete_term Deletes a term from any taxonomy Destructive delete_user Deletes a user

EXECUTE 1 tools

Execute activate_plugin Activates a plugin

WRITE 12 tools

Write assign_terms_to_content Assigns taxonomy terms to content of any type Write create_comment Creates a new comment Write create_content Creates new content of any type Write create_media Creates a new media item Write create_plugin Creates a plugin from the WordPress.org repository Write create_term Creates a new term in any taxonomy Write create_user Creates a new user Write edit_media Updates an existing media item Write update_comment Updates an existing comment Write update_content Updates existing content of any type Write update_term Updates an existing term in any taxonomy Write update_user Updates an existing user

READ 19 tools

Read deactivate_plugin Deactivates a plugin Read discover_content_types Discovers all available content types (built-in and custom) in the WordPress site Read discover_taxonomies Discovers all available taxonomies (built-in and custom) in the WordPress site Read find_content_by_url Finds content by its URL, automatically detecting the content type, and optionally updates it Read get_comment Gets a comment by ID Read get_content Gets specific content by ID and content type Read get_content_by_slug Searches for content by slug across one or more content types Read get_content_terms Gets all taxonomy terms assigned to content of any type Read get_plugin Retrieves plugin details Read get_plugin_details Get detailed information about a plugin from the WordPress.org repository Read get_term Gets a specific term by ID from any taxonomy Read get_user Gets a user by ID Read list_comments Lists comments with filtering, sorting, and pagination options Read list_content Lists content of any type (posts, pages, or custom post types) with filtering and pagination Read list_media Lists media items with filtering and pagination options Read list_plugins Lists all plugins with filtering options Read list_terms Lists terms in any taxonomy (categories, tags, or custom taxonomies) with filtering and pagination Read list_users Lists all users with filtering, sorting, and pagination options Read search_plugin_repository Search for plugins in the WordPress.org plugin repository

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about mcp-wordpress-instaWP

Can an AI agent delete data through the mcp-wordpress-instaWP MCP server? +

Yes. The mcp-wordpress-instaWP server exposes 5 destructive tools including delete_comment, delete_content, delete_media. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through mcp-wordpress-instaWP? +

The mcp-wordpress-instaWP server has 12 write tools including assign_terms_to_content, create_comment, create_content. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach mcp-wordpress-instaWP.

How many tools does the mcp-wordpress-instaWP MCP server expose? +

37 tools across 3 categories: Destructive, Read, Write. 19 are read-only. 18 can modify, create, or delete data.

How do I enforce a policy on mcp-wordpress-instaWP? +

Register the mcp-wordpress-instaWP MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every mcp-wordpress-instaWP tool call.

Deterministic rules across all 37 mcp-wordpress-instaWP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON MCP-WORDPRESS-INSTAWP →

Instant setup, no code required.

37 mcp-wordpress-instaWP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.