wp_flush_cache · Mcp Wordpress MCP: Risk & Policy

WHAT IT DOES

What wp_flush_cache does on Mcp Wordpress

AI agents invoke wp_flush_cache to trigger actions in Mcp Wordpress. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why wp_flush_cache needs a policy

Flushing caches is an operational action that runs server-side processes to invalidate and clear cached content. It is not a simple read or write of data, nor is it irreversibly destructive (caches are regenerated), but it triggers external operations with real side effects (temporary performance degradation, cache invalidation).

From the tool's definition 'Flush WordPress, Elementor, and page caches' — triggers an external server-side operation that clears cached data

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

wp_flush_cache Rate-limited

wp_flush_cache stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "wp_flush_cache": {
      "limits": [
        {
          "counter": "wp_flush_cache_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Mcp Wordpress, so you can run agents against it safely.

FAQ

Questions about wp_flush_cache

What does the wp_flush_cache tool do? +

Flush WordPress, Elementor, and page caches. Requires the mcp-wordpress-flush-cache mu-plugin on the server (see examples/). It is categorised as a Execute tool in the Mcp Wordpress MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on wp_flush_cache? +

Register the Mcp Wordpress MCP server in PolicyLayer and add a rule for wp_flush_cache: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Mcp Wordpress. Nothing to install.

What risk level is wp_flush_cache? +

wp_flush_cache is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit wp_flush_cache? +

Yes. Add a rate_limit block to the wp_flush_cache rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block wp_flush_cache completely? +

Set action: deny in the PolicyLayer policy for wp_flush_cache. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides wp_flush_cache? +

wp_flush_cache is provided by the Mcp Wordpress MCP server (leonardobora/mcp-wordpress). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.