All WordPress tools for Claude and ChatGPT, in one list.

List or search posts/pages/any post type with filters and pagination.

Get a single post/page including raw content, meta and terms, and which page builder it was made with. In Pro, set include_protected=true (requires manage_options) to also return protected "_" meta keys such as _elementor_data.

Create a post, page or custom post type entry (title, content, status, terms, meta).

Update an existing post/page. Only provided fields change. Where the page builder shows its own data and post_content is only a copy (Elementor, Beaver Builder, SiteOrigin Page Builder, Enfold), a change to the content is refused while the builder is active, with the way to change the page instead.

Delete a post (trash by default, or permanently with force=true).

List revisions of a post.

Duplicate a post/page (as a new draft, including its terms).

Get post meta: one key, or all public meta for a post. In Pro, set include_protected=true (requires manage_options) to also list protected "_" keys.

Restore a post to one of its revisions.

Set a post meta value (protected keys starting with _ are blocked). Schema: id (integer), key (string), value (any JSON value; objects rejected).

Read a page built with a page builder or block library as an outline: the builder, and every element in page order with its id, type and visible text, link and image fields. Elements that cannot be changed safely (code, HTML, shortcodes, forms, dynamic, global or unknown elements) are listed as locked with the reason, without their content. layout_hash changes whenever any stored copy of the page changes.

Change the text, link or image of one element on a page-builder or block page, by its id from wp_get_builder_layout. Dry run by default; apply=true saves. An undo point is recorded first; the change is saved through the builder where it has a save function, the page is read back and put back if a field does not show its new value, then the builder’s caches are emptied. Pass layout_hash so a page that changed in between is refused.

List media library attachments with pagination.

Get a single attachment with URL, sizes, alt text and metadata.

Download a file from a URL and add it to the media library.

Upload a local image or PDF to the media library from base64-encoded content.

Update an attachment title, caption and alt text.

Delete an attachment from the media library.

List terms of a taxonomy (categories, tags, custom).

Create a term in a taxonomy.

Update a term.

Delete a term from a taxonomy.

List comments with status and post filters.

Set a comment status: approve, hold, spam or trash.

Reply to a comment (or comment on a post) as the current user.

Delete a comment (trash by default, force to remove permanently).

Get a single term by id and taxonomy.

Get a single comment by id.

List users with role/search filters.

Get a user by id, login or email.

Create a user with a role.

Update a user (role, name, email, password).

Delete a user, optionally reassigning their content.

List navigation menus.

Get a menu with its items.

Create a navigation menu.

Add an item to a menu (custom link, page or post).

Remove an item from a menu.

List the theme's registered sidebars (widget areas) with their widget counts.

List widgets and their settings, optionally filtered to one sidebar. A setting whose key looks like a credential (an API key, token, secret or password) is left out and named in hidden_keys.

Update the settings of an existing widget instance (merges the given fields). The merged instance passes the widget's own update() sanitisation and the widget_update_callback filter, the same as the widgets screen — so HTML is filtered unless you may post unfiltered HTML. A value that wp_get_widgets leaves out as a credential stays as stored when you leave it out, also inside nested settings, and the answer leaves it out too.

Add a widget of a given type to a sidebar and return its new id. Settings pass the widget's own update() sanitisation and the widget_update_callback filter, the same as the widgets screen.

Remove a widget instance from its sidebar and delete its settings. The widget option is rewritten directly, without the widget's own cleanup routines.

Get common site settings (title, tagline, url, admin email, timezone, language, posts per page).

Create or update an option value. Security-relevant options are blocked, but the block list only knows what it knows: other plugins may keep security-relevant options under unremarkable names.

Delete an option. Security-relevant options are blocked, but the block list only knows what it knows: other plugins may keep security-relevant options under unremarkable names.

Update common site settings (title, tagline, admin email, timezone, start of week, posts per page).

List installed plugins with active state and version.

Activate a plugin by its file path (e.g. akismet/akismet.php).

Deactivate a plugin by its file path.

List installed themes.

List files inside a theme (defaults to the active theme).

Read the contents of a theme file.

Write (overwrite or create) a theme file. Content is raw by default; set "encoding":"base64" to write binary/base64 data. Blocked when DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT is set. Before a PHP file is written it is parse-checked (up to 512 KB; the answer says when the check could not run) and, where the server has a PHP command line of the same version, compiled with php -l; a file that fails is not written. After a PHP file of an active plugin or theme is written, test requests check the home page, this endpoint and admin-post.php, and a fatal error puts the previous file back. By default each write records an undo point first.

Delete a file inside a theme. Blocked when DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT is set. By default it records an undo point first (wp_undo puts the file back). Deletes are not test-requested: make sure nothing loads a PHP file before you delete it.

List database tables with row counts.

Describe the columns of a table.

Run a read-only query: a single, comment-free SELECT. Runs only with write access on, like every database tool. Only SELECT — SHOW/DESCRIBE/EXPLAIN are handled by wp_db_tables/wp_db_schema, and EXPLAIN ANALYZE would actually execute the query. Blocked: prepared statements, CTEs, UNION, system schemas (mysql/information_schema/performance_schema/sys), file and timing functions, and the users/usermeta/options AND the postmeta/termmeta/commentmeta tables (read those through the structured meta tools, which redact secrets). An outer LIMIT and a statement timeout are enforced; results are capped by row count and total payload size (truncated=true means more matched — narrow the query or raise limit).

Write a row set with a STRUCTURED statement (no raw SQL). Pass operation (insert/update/delete), table, and values/where as objects; the query is built with prepared statements, so the whole class of injection and "whole-table rewrite" bypasses is gone. update and delete REQUIRE a non-empty where object. The users, usermeta, options and network tables are refused — use the dedicated user/option tools for those. Dry-run by default: set apply=true to run it. The object cache is flushed after a successful write. Prefer the structured content/meta/option tools where they fit; this is the escape hatch for custom and plugin tables.

Environment overview: WordPress/PHP/MySQL versions, active theme, plugin counts, URLs, multisite, memory, HTTPS.

List registered post types.

List registered taxonomies.

List scheduled cron events.

Return the tail of the WordPress debug.log if enabled.

Flush the WordPress object cache (and OPcache if available).

Flush permalink / rewrite rules (fixes 404s after structural changes).

Full-text search across content (title + body) for any post type. In Pro, set search_meta=true to also scan postmeta values — finds text stored by meta-driven themes and builders such as Elementor, ACF or WooCommerce; returns the matching meta keys per post. Meta hits are limited to posts you may read and to keys you may read anyway; protected "_" keys are only reported when allow-listed.

Serialisation-safe search & replace across the site. tables: any of posts (content/title/excerpt), postmeta, options, terms (name/description/termmeta); default posts+postmeta. Handles PHP-serialized arrays and JSON payloads and finds the text in the forms WordPress and page builders store it in. scope (default "text"): a page that its page builder keeps in its own data and that a writer of this version writes is changed only through that writer — texts, links and images, with an undo point for these pages, at most 25 per call; matches in locked places are counted in locked_matches. scope "raw" replaces the stored data as text everywhere. Trash and auto-drafts are always skipped. Dry-run by default with a per-table preview — review it, then set apply=true.

Change the status of many posts at once by id list.

Report available core, plugin and theme updates as of WordPress's own last scheduled check (read-only, cached data; triggers no remote request).

Install a plugin from the WordPress.org directory by slug, optionally activating it.

Install a plugin from an uploaded ZIP (base64 "content", a "url" or a committed upload "session"), optionally activating it.

Install a theme from an uploaded ZIP (base64 "content", a "url" or a committed upload "session"), optionally activating it.

Update an installed plugin to the latest version.

Delete an installed plugin (deactivates it first if active).

Install a theme from the WordPress.org directory by slug.

Update an installed theme to the latest version.

Delete an installed theme (cannot delete the active theme).

Update WordPress core to the latest available version. High impact — use with care.

WooCommerce: list orders, filterable by status. Requires WooCommerce.

WooCommerce: get one order with items, totals and customer. Requires WooCommerce.

WooCommerce: set an order to one of the statuses this shop knows (e.g. completed); unknown statuses are refused. Requires WooCommerce.

WooCommerce: list products with search and status filters. Requires WooCommerce.

WooCommerce: get one product (price, stock, sku, status). Requires WooCommerce.

WooCommerce: update a product price, stock quantity or status. Requires WooCommerce.

WooCommerce: list coupons. Requires WooCommerce.

WooCommerce: create a coupon. Requires WooCommerce.

WooCommerce: list customers with order counts. Requires WooCommerce.

Detect the active SEO plugin (Yoast, Rank Math, AIOSEO or none).

Get the SEO title, meta description and focus keyword for a post.

Set the SEO title, meta description and/or focus keyword for a post (Yoast or Rank Math).

Get standard profile fields (user meta) for a user: one field, or all standard fields. Only a fixed list of non-sensitive profile keys is available.

Get term meta: one key, or all public meta for a term.

List a user's application passwords (names, created/last-used, never the secret).

Set a user meta value (privilege/auth keys are blocked).

Set a term meta value.

Create an application password for a user. The secret is returned once.

Revoke a user's application password by its UUID.

Site health summary: PHP/WordPress versions, HTTPS, debug, memory, object cache, and pending updates.

Content at a glance: posts by type/status, users by role, comments and media counts.

Schedule a cron event: a one-off at a timestamp, or recurring (hourly/twicedaily/daily/weekly). Only hooks explicitly allowed via the "ab_mcp_pro_cron_hook_allowlist" filter can be scheduled; the list is empty by default.

Clear all scheduled events for a hook.

Set a transient value with an optional expiration (seconds).

Delete a transient by name.

Run OPTIMIZE TABLE on this site's database tables.

Delete expired transients to tidy the options table.

List files inside an installed plugin folder.

Read a file inside a plugin folder. Raw source access: plugin code may contain hardcoded API keys, credentials or other secrets.

Write (overwrite or create) a file inside a plugin folder. Content is raw by default; set "encoding":"base64" to write binary/base64 data. Blocked when DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT is set. Before a PHP file is written it is parse-checked (up to 512 KB; the answer says when the check could not run) and, where the server has a PHP command line of the same version, compiled with php -l; a file that fails is not written. After a PHP file of an active plugin or theme is written, test requests check the home page, this endpoint and admin-post.php, and a fatal error puts the previous file back. By default each write records an undo point first.

Delete a file inside a plugin folder. Blocked when DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT is set. By default it records an undo point first (wp_undo puts the file back). Deletes are not test-requested: make sure nothing loads a PHP file before you delete it.

List files in the uploads directory (optionally a subfolder). Raw filesystem access to the uploads directory; administrators only. Use wp_list_media / wp_get_media for the attachment-aware tools.

Read a file from the uploads directory. Raw filesystem access to the uploads directory; administrators only. Use wp_get_media / wp_list_media for the attachment-aware tools.

Write a text/asset file to the uploads directory. Raw filesystem access to the uploads directory; administrators only. Content is raw by default; set "encoding":"base64" to write binary/base64 data. Executable and browser-executable extensions (php, js, svg, html, xml …) are blocked. Use wp_upload_media / wp_get_media for the attachment-aware tools.

Delete a file from the uploads directory. Raw filesystem access to the uploads directory; administrators only. Use wp_delete_media / wp_get_media for the attachment-aware tools.

List the snippets of Code Snippets or WPCode, whichever is active: id, name, type, location, active, priority, sha256 of the code and the last error WPCode recorded. AlphaBridge keeps no snippets of its own. Administrators only (manage_options and edit_plugins); not on multisite; blocked by DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS.

Read one snippet of Code Snippets or WPCode with its code. Raw code access: a snippet may hold API keys or other secrets.

Create or change a PHP snippet in Code Snippets or WPCode. Without apply=true a preview. Checked without running it: a parse check (up to 512 KB; the answer says when it could not run), php -l where the server has a PHP command line of the same version, and no function or class that exists already. By default each change records an undo point first. The snippet is saved switched off, then switched on, and test requests follow; a changed snippet whose test requests fail goes back to its previous version, a new one stays saved and off. Single-use snippets are refused.

Switch a PHP snippet of Code Snippets or WPCode on or off. Switching on runs the checks of wp_save_php_snippet first; both directions are followed by test requests, and a fatal error puts the previous state back.

Move a PHP snippet of Code Snippets or WPCode to the plugin’s trash, or delete it for good with force=true. An active snippet stops running, so test requests follow; a fatal error brings it back.

List the abilities that plugins and WordPress register with the Abilities API (WordPress 6.9 and newer): name, label, category, the read-only and destructive annotations, a short input schema, whether it can run and, if not, the way there, and whether a run has a way back.

Run an ability by its name from wp_list_abilities, through the Abilities API. The ability checks the input and your permission itself. It runs when write access is on and the connection has full access. Then every ability runs that an administrator has not switched off under Fine-tuning. Read-only ones run at once. Every other one previews by default and runs with apply=true. Where the input names a post, an undo point of that post comes first (up to 25 posts per call). The posts are read back afterwards. Without such a post, the preview says there is no way back.

Start a chunked upload session for a large file. Returns a session id; send the file with wp_upload_append and finish with wp_upload_commit.

Append one base64 chunk (recommended 1–4 MB of raw data per call) to an upload session, in order.

Finish an upload session. Optionally verifies a sha256 checksum. The committed file can then be used via the "session" argument of the install and deploy tools.

Abort an upload session and delete its data.

Preview a deploy before it happens: compare the ZIP you are about to push against what is really on the server. Nothing is uploaded, written or deleted — only directory listings and the ZIP index are read, never file contents. Per path it reports new, changed and, with atomic mode, removed.

Check the Site-Deploy connection: configuration, same-server verification and a live directory listing of the deploy root. Opens an authenticated connection with the stored credentials, so like every deploy tool it runs only with write access on.

List a directory in the deploy area (path is relative to the deploy root).

Read a file from the deploy area (max 2 MB per call). Binary content is returned base64-encoded.

Write one file into the deploy area. Content sources: "content" (with optional "encoding":"base64") or a committed upload "session". Missing directories are created.

Upload and unpack a ZIP archive into the deploy area — deploys a whole site or folder in one step. Source: a committed upload "session" (recommended for large archives) or base64 "content". With "atomic":true (recommended for a full site) the archive is unpacked into a staging folder, every file is size-verified, the current target is moved aside as a backup, and only then swapped in by a near-instant rename — a failed or interrupted upload leaves the live target untouched, and a failed swap rolls back automatically. Without atomic, files are written straight into the target and existing files are overwritten in place.

Delete a file — or, with "recursive":true, a whole directory — in the deploy area.

Export the STRUCTURE of this site as a portable JSON blueprint: writable site settings, taxonomy terms, the page hierarchy, navigation menus with their item tree and theme locations, widget placement, the plugin set and the active theme. Post content is never exported, and neither are widget settings, credentials or user data.

Compare a blueprint against the CURRENT state of this site and return exactly what an apply would do. Works on every plan. Read-only: writes nothing. Per section you get create, update, unchanged and extra_on_target — structure that exists here but not in the blueprint is never touched, there is no delete mode.

Apply the applicable parts of a blueprint to this site. Dry run by default: review the plan, then set apply=true. It NEVER deletes, deactivates or removes anything, and a second run reports everything as unchanged. Every write goes through the ordinary tools, so their permissions, your token scope and the per-tool switches all apply.

List your undo points: the snapshots that destructive tools took before they changed something. Each entry has a token, the tool it came from, a short summary and an expiry. Only your own undo points are visible. They expire after the site’s undo window, 7 days unless an administrator set 1 to 30 days; by default the store keeps the newest 50 (100 MB in total). Listing also clears out what these limits already drop — expired points and the oldest beyond the bounds, of every user, with their snapshots — as recording a new point does.

Reverse one earlier change using its undo token. Pass dry_run=true first to see exactly what would be restored and what would be refused. Undoing needs the same permission as the original action, and each item is re-checked against the CURRENT state, so an option that has since been protected is reported as blocked rather than restored. An undo of a page-builder change or of an ability run puts every stored copy of the page back byte for byte and refuses a page someone changed since, unless force=true.

Throw away an undo point and its snapshot without restoring anything. Use it once a change is confirmed good, or pass all=true to drop all of your undo points at once. Other users’ undo points are never touched.

Export content as a WordPress WXR file into a protected uploads subfolder with no public URL; returns upload_path. Fetch the file over the filesystem or SFTP, then delete it.

Multisite: list the sites in the network. Requires multisite.

Multisite: create a new site in the network. Requires multisite.

Multisite: network-activate a plugin across all sites. Requires multisite.