admin_delete_app_password

What admin_delete_app_password does on WordPress MCP Server

AI agents call admin_delete_app_password to permanently remove resources in WordPress MCP Server, typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.

Why admin_delete_app_password is rated Critical

Deleting an application password is a destructive action that cannot be undone—the credential is permanently removed from the system. This is more severe than Write (which is reversible) because the deletion is irreversible. While not directly financial, the loss of valid authentication credentials could lock out legitimate access or be used to sever integrations, making it a high-severity destructive operation.

From the tool's definition Tool name 'admin_delete_app_password' explicitly indicates deletion of an application password. Description 'Löscht ein Application Password' (German: 'Deletes an Application Password') confirms irreversible removal of authentication credentials.

Risk signalsAdmin/system-level operation

The rule that runs admin_delete_app_password safely

PolicyLayer is an MCP gateway: it sits between your AI agents and WordPress MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For admin_delete_app_password, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "hide": [
    "admin_delete_app_password"
  ]
}

Questions about admin_delete_app_password