// SCAN REPORT

WordPress MCP Server

190 tools. 92 can modify or destroy data without limits.

25 destructive tools with no built-in limits. Policy required.

Last updated:

92 can modify or destroy data
98 read-only
190 tools total

Community server · catalogue entry verified 11/06/2026

How to control WordPress MCP Server ↓

TOOL MAP

Read (98) Write / Execute (67) Destructive / Financial (25)

MOST DANGEROUS TOOLS

Critical Risk
Destructive · High wordpress_bulk_delete_media The tool's name unambiguously describes deletion of media assets at scale. Destructive · Critical wordpress_bulk_delete_posts Bulk deletion of posts is a destructive operation that irreversibly removes data at scale. Destructive · Medium wordpress_clear_cache Cache clearing irreversibly removes cached data, which cannot be undone. Destructive · High wordpress_delete_backup Deleting backups is destructive because it removes the ability to recover from data loss, system failures, or malicious changes.

92 of WordPress MCP Server's 190 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

HOW TO CONTROL WORDPRESS MCP SERVER

PolicyLayer is an MCP gateway — it sits between your AI agents and WordPress MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "wordpress_bulk_delete_media": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "wordpress_bulk_optimize_images": {
    "limits": [
      {
        "counter": "wordpress_bulk_optimize_images_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "wordpress_parse_blocks": {
    "limits": [
      {
        "counter": "wordpress_parse_blocks_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register WordPress MCP Server — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON WORDPRESS →

Free to start. No card required.

ALL 190 WORDPRESS MCP SERVER TOOLS

DESTRUCTIVE 25 tools
Destructive wordpress_bulk_delete_media wordpress_bulk_delete_media Destructive wordpress_bulk_delete_posts wordpress_bulk_delete_posts Destructive wordpress_clear_cache wordpress_clear_cache Destructive wordpress_delete_backup wordpress_delete_backup Destructive wordpress_delete_category wordpress_delete_category Destructive wordpress_delete_comment wordpress_delete_comment Destructive wordpress_delete_file wordpress_delete_file Destructive wordpress_delete_media wordpress_delete_media Destructive wordpress_delete_menu wordpress_delete_menu Destructive wordpress_delete_menu_item wordpress_delete_menu_item Destructive wordpress_delete_page wordpress_delete_page Destructive wordpress_delete_plugin wordpress_delete_plugin Destructive wordpress_delete_post wordpress_delete_post Destructive wordpress_delete_redirect wordpress_delete_redirect Destructive wordpress_delete_reusable_block wordpress_delete_reusable_block Destructive wordpress_delete_role wordpress_delete_role Destructive wordpress_delete_term wordpress_delete_term Destructive wordpress_delete_theme wordpress_delete_theme Destructive wordpress_delete_user wordpress_delete_user Destructive wordpress_delete_widget wordpress_delete_widget Destructive wordpress_remove_capability wordpress_remove_capability Destructive wordpress_wc_delete_product wordpress_wc_delete_product Destructive wordpress_cleanup_database wordpress_cleanup_database Destructive wordpress_full_backup wordpress_full_backup Destructive wordpress_restore_backup wordpress_restore_backup
EXECUTE 8 tools
Execute wordpress_execute_shortcode wordpress_execute_shortcode Execute wordpress_execute_sql wordpress_execute_sql Execute wordpress_run_cron wordpress_run_cron Execute wordpress_clone_to_staging wordpress_clone_to_staging Execute wordpress_flush_rewrite_rules wordpress_flush_rewrite_rules Execute wordpress_regenerate_thumbnails wordpress_regenerate_thumbnails Execute wordpress_activate_theme wordpress_activate_theme Execute wordpress_schedule_event wordpress_schedule_event
WRITE 59 tools
Write wordpress_bulk_optimize_images wordpress_bulk_optimize_images Write wordpress_activate_plugin wordpress_activate_plugin Write wordpress_add_capability wordpress_add_capability Write wordpress_assign_menu_to_location wordpress_assign_menu_to_location Write wordpress_assign_role wordpress_assign_role Write wordpress_bulk_create_posts wordpress_bulk_create_posts Write wordpress_bulk_update_posts wordpress_bulk_update_posts Write wordpress_convert_to_webp wordpress_convert_to_webp Write wordpress_copy_file wordpress_copy_file Write wordpress_create_category wordpress_create_category Write wordpress_create_child_theme wordpress_create_child_theme Write wordpress_create_comment wordpress_create_comment Write wordpress_create_menu wordpress_create_menu Write wordpress_create_menu_item wordpress_create_menu_item Write wordpress_create_page wordpress_create_page Write wordpress_create_post wordpress_create_post Write wordpress_create_redirect wordpress_create_redirect Write wordpress_create_reusable_block wordpress_create_reusable_block Write wordpress_create_role wordpress_create_role Write wordpress_create_tag wordpress_create_tag Write wordpress_create_term wordpress_create_term Write wordpress_create_user wordpress_create_user Write wordpress_duplicate_post wordpress_duplicate_post Write wordpress_enable_maintenance_mode wordpress_enable_maintenance_mode Write wordpress_import_content wordpress_import_content Write wordpress_move_file wordpress_move_file Write wordpress_publish_post wordpress_publish_post Write wordpress_schedule_backups wordpress_schedule_backups Write wordpress_schedule_post wordpress_schedule_post Write wordpress_set_canonical_url wordpress_set_canonical_url Write wordpress_set_custom_meta wordpress_set_custom_meta Write wordpress_set_featured_image wordpress_set_featured_image Write wordpress_set_og_tags wordpress_set_og_tags Write wordpress_set_schema_markup wordpress_set_schema_markup Write wordpress_set_seo_meta wordpress_set_seo_meta Write wordpress_set_twitter_cards wordpress_set_twitter_cards Write wordpress_update_category wordpress_update_category Write wordpress_update_comment wordpress_update_comment Write wordpress_update_media wordpress_update_media Write wordpress_update_menu_item wordpress_update_menu_item Write wordpress_update_option wordpress_update_option Write wordpress_update_page wordpress_update_page Write wordpress_update_post wordpress_update_post Write wordpress_update_reusable_block wordpress_update_reusable_block Write wordpress_update_robots_txt wordpress_update_robots_txt Write wordpress_update_settings wordpress_update_settings Write wordpress_update_term wordpress_update_term Write wordpress_update_theme_json wordpress_update_theme_json Write wordpress_update_user wordpress_update_user Write wordpress_update_widget wordpress_update_widget Write wordpress_upload_media wordpress_upload_media Write wordpress_wc_create_coupon wordpress_wc_create_coupon Write wordpress_wc_create_product wordpress_wc_create_product Write wordpress_wc_update_order_status wordpress_wc_update_order_status Write wordpress_wc_update_product wordpress_wc_update_product Write wordpress_wc_update_stock wordpress_wc_update_stock Write wordpress_write_file wordpress_write_file Write wordpress_write_plugin_file wordpress_write_plugin_file Write wordpress_write_theme_file wordpress_write_theme_file
READ 98 tools
Read wordpress_parse_blocks wordpress_parse_blocks Read wordpress_analyze_seo wordpress_analyze_seo Read wordpress_backup_database wordpress_backup_database Read wordpress_backup_files wordpress_backup_files Read wordpress_check_updates wordpress_check_updates Read wordpress_check_user_capability wordpress_check_user_capability Read wordpress_deactivate_plugin wordpress_deactivate_plugin Read wordpress_file_info wordpress_file_info Read wordpress_get_active_plugins wordpress_get_active_plugins Read wordpress_get_active_theme wordpress_get_active_theme Read wordpress_get_block_categories wordpress_get_block_categories Read wordpress_get_block_editor_settings wordpress_get_block_editor_settings Read wordpress_get_block_patterns wordpress_get_block_patterns Read wordpress_get_block_template wordpress_get_block_template Read wordpress_get_block_types wordpress_get_block_types Read wordpress_get_capabilities wordpress_get_capabilities Read wordpress_get_categories wordpress_get_categories Read wordpress_get_comments wordpress_get_comments Read wordpress_get_cron_schedules wordpress_get_cron_schedules Read wordpress_get_debug_log wordpress_get_debug_log Read wordpress_get_failed_logins wordpress_get_failed_logins Read wordpress_get_global_styles wordpress_get_global_styles Read wordpress_get_media wordpress_get_media Read wordpress_get_media_analytics wordpress_get_media_analytics Read wordpress_get_menu_items wordpress_get_menu_items Read wordpress_get_menu_locations wordpress_get_menu_locations Read wordpress_get_menus wordpress_get_menus Read wordpress_get_option wordpress_get_option Read wordpress_get_pages wordpress_get_pages Read wordpress_get_performance_metrics wordpress_get_performance_metrics Read wordpress_get_plugin_status wordpress_get_plugin_status Read wordpress_get_plugins wordpress_get_plugins Read wordpress_get_plugins_detailed wordpress_get_plugins_detailed Read wordpress_get_post wordpress_get_post Read wordpress_get_post_revisions wordpress_get_post_revisions Read wordpress_get_post_type wordpress_get_post_type Read wordpress_get_post_types wordpress_get_post_types Read wordpress_get_posts wordpress_get_posts Read wordpress_get_redirects wordpress_get_redirects Read wordpress_get_reusable_blocks wordpress_get_reusable_blocks Read wordpress_get_robots_txt wordpress_get_robots_txt Read wordpress_get_roles wordpress_get_roles Read wordpress_get_settings wordpress_get_settings Read wordpress_get_sidebar wordpress_get_sidebar Read wordpress_get_sidebars wordpress_get_sidebars Read wordpress_get_site_health wordpress_get_site_health Read wordpress_get_site_info wordpress_get_site_info Read wordpress_get_style_variations wordpress_get_style_variations Read wordpress_get_system_info wordpress_get_system_info Read wordpress_get_table_preview wordpress_get_table_preview Read wordpress_get_table_structure wordpress_get_table_structure Read wordpress_get_tags wordpress_get_tags Read wordpress_get_taxonomies wordpress_get_taxonomies Read wordpress_get_taxonomy wordpress_get_taxonomy Read wordpress_get_template_parts wordpress_get_template_parts Read wordpress_get_terms wordpress_get_terms Read wordpress_get_theme_json wordpress_get_theme_json Read wordpress_get_theme_mods wordpress_get_theme_mods Read wordpress_get_theme_templates wordpress_get_theme_templates Read wordpress_get_themes wordpress_get_themes Read wordpress_get_themes_detailed wordpress_get_themes_detailed Read wordpress_get_unused_media wordpress_get_unused_media Read wordpress_get_users wordpress_get_users Read wordpress_get_version_info wordpress_get_version_info Read wordpress_get_widget_types wordpress_get_widget_types Read wordpress_get_widgets wordpress_get_widgets Read wordpress_list_backups wordpress_list_backups Read wordpress_list_cron_jobs wordpress_list_cron_jobs Read wordpress_list_files wordpress_list_files Read wordpress_list_plugin_files wordpress_list_plugin_files Read wordpress_list_shortcodes wordpress_list_shortcodes Read wordpress_list_tables wordpress_list_tables Read wordpress_list_theme_files wordpress_list_theme_files Read wordpress_optimize_database wordpress_optimize_database Read wordpress_plugin_exists wordpress_plugin_exists Read wordpress_read_file wordpress_read_file Read wordpress_read_plugin_file wordpress_read_plugin_file Read wordpress_read_theme_file wordpress_read_theme_file Read wordpress_scan_permissions wordpress_scan_permissions Read wordpress_search_block_directory wordpress_search_block_directory Read wordpress_search_posts wordpress_search_posts Read wordpress_shortcode_exists wordpress_shortcode_exists Read wordpress_test_connection wordpress_test_connection Read wordpress_theme_exists wordpress_theme_exists Read wordpress_unschedule_event wordpress_unschedule_event Read wordpress_verify_core_files wordpress_verify_core_files Read wordpress_wc_get_coupons wordpress_wc_get_coupons Read wordpress_wc_get_customers wordpress_wc_get_customers Read wordpress_wc_get_orders wordpress_wc_get_orders Read wordpress_wc_get_payment_gateways wordpress_wc_get_payment_gateways Read wordpress_wc_get_product_categories wordpress_wc_get_product_categories Read wordpress_wc_get_products wordpress_wc_get_products Read wordpress_wc_get_sales_report wordpress_wc_get_sales_report Read wordpress_wc_get_shipping_zones wordpress_wc_get_shipping_zones Read wordpress_wc_get_top_sellers wordpress_wc_get_top_sellers Read wordpress_wc_is_active wordpress_wc_is_active Read wordpress_export_content wordpress_export_content Read wordpress_generate_sitemap wordpress_generate_sitemap

RELATED SERVERS

Other MCP servers with similar tools — same risk classification, starter policies for each.

BNB Chain MCP 1240 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Nodebench 724 tools
adminautomation
GoHighLevel MCP Server 566 tools
adminautomation
UnClick 451 tools
adminautomation
NowAIKit — ServiceNow AI Toolkit 446 tools
adminautomation
Mcp Windows 441 tools
adminautomation
0nmcp 407 tools
adminautomation

FAQ

Can an AI agent delete data through the WordPress MCP Server MCP server? +

Yes. The WordPress MCP Server server exposes 25 destructive tools including wordpress_bulk_delete_media, wordpress_bulk_delete_posts, wordpress_clear_cache. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through WordPress MCP Server? +

The WordPress MCP Server server has 59 write tools including wordpress_bulk_optimize_images, wordpress_activate_plugin, wordpress_add_capability. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach WordPress MCP Server.

How many tools does the WordPress MCP Server MCP server expose? +

190 tools across 4 categories: Destructive, Execute, Read, Write. 98 are read-only. 92 can modify, create, or delete data.

How do I enforce a policy on WordPress MCP Server? +

Register the WordPress MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every WordPress MCP Server tool call.

Deterministic rules across all 190 WordPress MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON WORDPRESS →

Free to start. No card required.

190 WordPress MCP Server tools catalogued and risk-classified — across an index of 42,500+ MCP servers.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.