// SCAN REPORT

WP Astro MCP

60 tools. 30 can modify or destroy data without limits.

5 destructive tools with no built-in limits. Policy required.

Last updated: 12 Jun 2026

30 can modify or destroy data

30 read-only

60 tools total

Community server · catalogue entry verified 12/06/2026

How to control WP Astro MCP ↓

TOOL MAP

What WP Astro MCP exposes to your agents

Read (30) Write / Execute (25) Destructive / Financial (5)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous WP Astro MCP tools

Destructive · High site_remove This tool performs a site-level deactivation action that, while technically reversible, constitutes an irreversible operational change from the user's perspective without requiring explicit reactivation. Destructive · High sync_delete sync_delete performs irreversible deletion of local project artifacts (Markdown files and URL mappings). Destructive · High sync_full While this tool has Read (check for changes, pull posts) and Write (update caches) components, the explicit capability to 'delete removed posts' places it in the Destructive category. Destructive · Medium sync_reset The tool irreversibly destroys sync tracking data.

30 of WP Astro MCP's 60 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control WP Astro MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and WP Astro MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "site_remove": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "github_deploy_config": {
    "limits": [
      {
        "counter": "github_deploy_config_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "cache_authors": {
    "limits": [
      {
        "counter": "cache_authors_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register WP Astro MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON WP ASTRO →

Free to start. No card required.

FULL CATALOGUE

All 60 WP Astro MCP tools

DESTRUCTIVE 5 tools

Destructive site_remove Deactivate a site (soft delete, can be reactivated). Destructive sync_delete Remove local Markdown files for posts that have been deleted or trashed in WordPress. Also cleans up URL map e Destructive sync_full Complete content sync: check for changes → pull new/updated posts → delete removed posts → update caches → opt Destructive sync_reset Clear sync tracking data to force a full re-sync on next sync_pull. Does not delete content files. Destructive export_cleanup Delete export job data from database (does not delete files). Requires confirm=true.

EXECUTE 5 tools

Execute wp_astro_run Execute a WordPress-to-Astro frontend action. Use wp_astro_help to list available actions. Common workflows: Execute export_resume Resume an in-progress export. Processes the next batch of pending posts. Call repeatedly until complete. Execute export_retry Retry all failed posts in an export job. Execute github_push Push commits to the remote repository. Execute setup_wizard Guided setup: register a WordPress site, analyze content, configure export, scaffold an Astro project, export

WRITE 20 tools

Write github_deploy_config Generate deploy platform configuration (Vercel, Netlify, or Cloudflare Pages). Write scaffold_project Create an Astro project structure: package.json, astro.config, layouts, content collections, pages, RSS feed, Write convert_html Convert raw HTML to Markdown. Useful for testing conversion rules or converting arbitrary HTML content. Write convert_post Convert a single WordPress post to Astro Markdown. Returns full frontmatter + body with conversion issues repo Write export_start Start a full batch export. Creates a job in SQLite, fetches all post IDs, and begins processing in batches. Re Write generate_redirects Generate a redirects file from the WordPress→Astro URL map. Supports Netlify, Vercel, Cloudflare, Apache, and Write github_commit Stage all changes and create a commit in the output directory. Write github_create_repo Create a GitHub repository and set it as the remote origin. Requires github_token in config. Write github_init Initialize a git repository in the output directory. Creates .gitignore and initial commit. Write media_rewrite Bulk rewrite media URLs in all exported content files. Replaces one domain with another (e.g., example.com → a Write shortcode_configure Configure how a specific shortcode should be handled during conversion. Actions: strip (remove entirely), keep Write site_add Register a new WordPress site. Requires URL, username, and application password. Auto-detects WP version, SEO Write site_export_config Configure export settings for a site: output directory, content format, media strategy, post type filters, dat Write site_set_default Set a site as the default (used when site_id is omitted). Write site_update Update site credentials or settings. Write sync_pull Fetch and write only changed content from WordPress. Creates new files for new posts, overwrites files for upd Write sync_schedule Generate automated sync configuration: GitHub Actions workflow, cron job, or platform-specific webhook. Keeps Write sync_webhook Process a webhook from wp-astro-bridge. Validates signature, syncs the specific post (fetch, convert, write). Write write_batch Convert and write a page of posts to disk. Use with pagination for incremental writing. Supports dry_run mode. Write write_post Convert a single WordPress post and write it as a Markdown file to the Astro content directory. Supports dry_r

READ 30 tools

Read cache_authors Fetch ALL authors and cache them in SQLite. Should be run before a full export for fast author lookups. Caches Read cache_terms Fetch ALL terms for ALL taxonomies and cache them in SQLite. Should be run before a full export for fast term Read content_audit Sample posts and analyze content patterns: detect shortcodes, Gutenberg blocks, page builders, embeds, galleri Read extract_all_ids Fetch post IDs for a post type (lightweight). Used for two-phase fetch strategy on large sites. Returns a boun Read extract_authors Fetch authors/users from the site. Returns a bounded page (default 1000, max 10000) plus total/has_more/next_o Read extract_comments Fetch approved comments, optionally filtered by post ID. Read extract_media Fetch media items. Either a specific item by ID or paginated list. Read extract_menus Fetch navigation menus and menu items. Works with WP 5.9+ navigation blocks and classic menus. Read extract_post Fetch a single post by ID with full content (edit context), embedded data, and content analysis (shortcodes, b Read extract_posts Fetch posts from WordPress with pagination. Supports any post type, status filters, date filters. Returns post Read extract_settings Fetch site settings (title, tagline, timezone, date/time formats, permalink structure, language). Read extract_terms Fetch taxonomy terms (categories, tags, or custom taxonomies) with pagination. Read extract_widgets Fetch sidebar/widget areas and their widgets (WP 5.8+). Read github_status Show git status of the output directory (branch, changes, remote). Read list_output List all files in the output directory with stats (file count, total size, content types). Read shortcode_list List all configured shortcode handling rules for a site. Read shortcode_scan Scan posts for all shortcodes in use and return a report. Helps identify which shortcodes need configuration b Read site_analyze Deep analysis of a WordPress site: count all content types, detect plugins, audit shortcodes, check media, and Read site_get Get full details for a specific site including detected capabilities and export config. Read site_list List all registered WordPress sites with status and content stats. Read site_test Test connection to a site and refresh detected capabilities. Read sync_check Compare WordPress content against local exported files. Reports new posts, updated posts (content/SEO/images c Read sync_status Show sync history: last sync time, number of posts synced, changes made. Helps track when the Astro site was l Read wp_astro_describe Get the full input schema for a specific action. Read wp_astro_help List available actions, optionally filtered by category. Read convert_preview Convert a sample of posts to preview Markdown output. Shows frontmatter structure and content quality before f Read export_plan Generate a full export plan: content counts by type, estimated time, recommended batch size, and pre-flight ch Read export_progress Show progress of an export job: completion percentage, posts done/failed/pending, estimated time remaining. Read export_validate Validate an export job: check all output files exist, report issues, and verify completeness. Read media_audit Scan exported Markdown files for media references. Reports domains, counts, and broken references. Use before

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about WP Astro MCP

Can an AI agent delete data through the WP Astro MCP server? +

Yes. The WP Astro MCP server exposes 5 destructive tools including site_remove, sync_delete, sync_full. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through WP Astro MCP? +

The WP Astro MCP server has 20 write tools including github_deploy_config, scaffold_project, convert_html. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach WP Astro MCP.

How many tools does the WP Astro MCP server expose? +

60 tools across 4 categories: Destructive, Execute, Read, Write. 30 are read-only. 30 can modify, create, or delete data.

How do I enforce a policy on WP Astro MCP? +

Register the WP Astro MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every WP Astro MCP tool call.

Deterministic rules across all 60 WP Astro MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON WP ASTRO →

Free to start. No card required.

60 WP Astro MCP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.