Tool reference

List or search posts/pages/any post type with filters and pagination.

Get a single post/page including raw content, meta and terms. Set include_protected=true (requires manage_options) to also return protected "_" meta keys such as _elementor_data.

Create a post, page or custom post type entry (title, content, status, terms, meta).

Update an existing post/page. Only provided fields change.

Delete a post (trash by default, or permanently with force=true).

List revisions of a post.

Duplicate a post/page (as a new draft, including its terms).

Get post meta: one key, or all public meta for a post. Set include_protected=true (requires manage_options) to also list protected "_" keys.

Restore a post to one of its revisions.

Set a post meta value (protected keys starting with _ are blocked). Schema: id (integer), key (string), value (any JSON value; objects rejected).

List media library attachments with pagination.

Get a single attachment with URL, sizes, alt text and metadata.

Download a file from a URL and add it to the media library.

Upload a local image or PDF to the media library from base64-encoded content.

Update an attachment title, caption and alt text.

Delete an attachment from the media library.

List terms of a taxonomy (categories, tags, custom).

Create a term in a taxonomy.

Update a term.

Delete a term from a taxonomy.

List comments with status and post filters.

Set a comment status: approve, hold, spam or trash.

Reply to a comment (or comment on a post) as the current user.

Delete a comment (trash by default, force to remove permanently).

Get a single term by id and taxonomy.

Get a single comment by id.

List users with role/search filters.

Get a user by id, login or email.

Create a user with a role.

Update a user (role, name, email, password).

Delete a user, optionally reassigning their content.

List navigation menus.

Get a menu with its items.

Create a navigation menu.

Add an item to a menu (custom link, page or post).

Remove an item from a menu.

List the theme's registered sidebars (widget areas) with their widget counts.

List widgets and their settings, optionally filtered to one sidebar.

Update the settings of an existing widget instance (merges the given fields). Settings are written directly to the widget option and do NOT pass the widget's own WP_Widget::update() sanitisation.

Add a widget of a given type to a sidebar and return its new id. Settings are written directly to the widget option and do NOT pass the widget's own WP_Widget::update() sanitisation.

Remove a widget instance from its sidebar and delete its settings. The widget option is rewritten directly, without the widget's own cleanup routines.

Get common site settings (title, tagline, url, admin email, timezone, language, posts per page).

Create or update an option value. Security-relevant options are blocked, but the block list only knows what it knows: other plugins may keep security-relevant options under unremarkable names.

Delete an option. Security-relevant options are blocked, but the block list only knows what it knows: other plugins may keep security-relevant options under unremarkable names.

Update common site settings (title, tagline, admin email, timezone, start of week, posts per page).

List installed plugins with active state and version.

Activate a plugin by its file path (e.g. akismet/akismet.php).

Deactivate a plugin by its file path.

List installed themes.

List files inside a theme (defaults to the active theme).

Read the contents of a theme file.

Write (overwrite or create) a theme file. Content is raw by default; set "encoding":"base64" to write binary/base64 data. Blocked when DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT is set.

Delete a file inside a theme. Blocked when DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT is set.

List database tables with row counts.

Describe the columns of a table.

Run a read-only query: a single, comment-free SELECT. Dangerous ("mighty") tool, off by default. Only SELECT — SHOW/DESCRIBE/EXPLAIN are handled by wp_db_tables/wp_db_schema, and EXPLAIN ANALYZE would actually execute the query. Blocked: prepared statements, CTEs, UNION, system schemas (mysql/information_schema/performance_schema/sys), file and timing functions, and the users/usermeta/options AND the postmeta/termmeta/commentmeta tables (read those through the structured meta tools, which redact secrets). An outer LIMIT and a statement timeout are enforced; results are capped by row count and total payload size (truncated=true means more matched — narrow the query or raise limit).

Write a row set with a STRUCTURED statement (no raw SQL). Pass operation (insert/update/delete), table, and values/where as objects; the query is built with prepared statements, so the whole class of injection and "whole-table rewrite" bypasses is gone. update and delete REQUIRE a non-empty where object. The users, usermeta, options and network tables are refused — use the dedicated user/option tools for those. Dry-run by default: set apply=true to run it. The object cache is flushed after a successful write. Prefer the structured content/meta/option tools where they fit; this is the escape hatch for custom and plugin tables.

Environment overview: WordPress/PHP/MySQL versions, active theme, plugin counts, URLs, multisite, memory, HTTPS.

List registered post types.

List registered taxonomies.

List scheduled cron events.

Return the tail of the WordPress debug.log if enabled.

Flush the WordPress object cache (and OPcache if available).

Flush permalink / rewrite rules (fixes 404s after structural changes).

Full-text search across content (title + body) for any post type. Set search_meta=true to also scan postmeta values — finds text stored by meta-driven themes and builders such as Elementor, ACF or WooCommerce; returns the matching meta keys per post. Meta hits are limited to posts you may read and to keys you may read anyway; protected "_" keys are only reported when allow-listed.

Serialisation-safe search & replace across the site. tables: any of posts (content/title/excerpt), postmeta, options, terms (name/description/termmeta); default posts+postmeta. Handles PHP-serialized arrays/objects and JSON payloads (Elementor _elementor_data is replaced losslessly and its CSS cache reset) and also matches JSON-escaped occurrences (Gutenberg block attributes, e.g. https:\/\/…). Trash and auto-drafts are always skipped; revisions are skipped unless exclude_revisions=false; protected options, transients, term slugs and the guid column are never touched. Dry-run by default with a per-table preview — review it, then set apply=true. Writes go through the WordPress APIs (post revisions created, serialization regenerated, caches invalidated).

Change the status of many posts at once by id list.

Report available core, plugin and theme updates as of WordPress's own last scheduled check (read-only, cached data; triggers no remote request).

Install a plugin from the WordPress.org directory by slug, optionally activating it.

Install a plugin from an uploaded ZIP (base64 "content", a "url" or a committed upload "session"), optionally activating it.

Install a theme from an uploaded ZIP (base64 "content", a "url" or a committed upload "session"), optionally activating it.

Update an installed plugin to the latest version.

Delete an installed plugin (deactivates it first if active).

Install a theme from the WordPress.org directory by slug.

Update an installed theme to the latest version.

Delete an installed theme (cannot delete the active theme).

Update WordPress core to the latest available version. High impact — use with care.

WooCommerce: list orders, filterable by status. Requires WooCommerce.

WooCommerce: get one order with items, totals and customer. Requires WooCommerce.

WooCommerce: change an order status (e.g. mark as completed/shipped). Requires WooCommerce.

WooCommerce: list products with search and status filters. Requires WooCommerce.

WooCommerce: get one product (price, stock, sku, status). Requires WooCommerce.

WooCommerce: update a product price, stock quantity or status. Requires WooCommerce.

WooCommerce: list coupons. Requires WooCommerce.

WooCommerce: create a coupon. Requires WooCommerce.

WooCommerce: list customers with order counts. Requires WooCommerce.

Detect the active SEO plugin (Yoast, Rank Math, AIOSEO or none).

Get the SEO title, meta description and focus keyword for a post.

Set the SEO title, meta description and/or focus keyword for a post (Yoast or Rank Math).

Get standard profile fields (user meta) for a user: one field, or all standard fields. Only a fixed list of non-sensitive profile keys is available.

Get term meta: one key, or all public meta for a term.

List a user's application passwords (names, created/last-used, never the secret).

Set a user meta value (privilege/auth keys are blocked).

Set a term meta value.

Create an application password for a user. The secret is returned once.

Revoke a user's application password by its UUID.

Site health summary: PHP/WordPress versions, HTTPS, debug, memory, object cache, and pending updates.

Content at a glance: posts by type/status, users by role, comments and media counts.

Schedule a cron event: a one-off at a timestamp, or recurring (hourly/twicedaily/daily/weekly). Only hooks explicitly allowed via the "ab_mcp_pro_cron_hook_allowlist" filter can be scheduled; the list is empty by default.

Clear all scheduled events for a hook.

Set a transient value with an optional expiration (seconds).

Delete a transient by name.

Run OPTIMIZE TABLE on this site's database tables.

Delete expired transients to tidy the options table.

List files inside an installed plugin folder.

Read a file inside a plugin folder. Raw source access: plugin code may contain hardcoded API keys, credentials or other secrets.

Write (overwrite or create) a file inside a plugin folder. Content is raw by default; set "encoding":"base64" to write binary/base64 data. Blocked when DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT is set.

Delete a file inside a plugin folder. Blocked when DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT is set.

List files in the uploads directory (optionally a subfolder). Raw filesystem access to the uploads directory; administrators only. Use wp_list_media / wp_get_media for the attachment-aware tools.

Read a file from the uploads directory. Raw filesystem access to the uploads directory; administrators only. Use wp_get_media / wp_list_media for the attachment-aware tools.

Write a text/asset file to the uploads directory. Raw filesystem access to the uploads directory; administrators only. Content is raw by default; set "encoding":"base64" to write binary/base64 data. Executable and browser-executable extensions (php, js, svg, html, xml …) are blocked. Use wp_upload_media / wp_get_media for the attachment-aware tools.

Delete a file from the uploads directory. Raw filesystem access to the uploads directory; administrators only. Use wp_delete_media / wp_get_media for the attachment-aware tools.

Start a chunked upload session for a large file. Returns a session id; send the file with wp_upload_append and finish with wp_upload_commit.

Append one base64 chunk (recommended 1–4 MB of raw data per call) to an upload session, in order.

Finish an upload session. Optionally verifies a sha256 checksum. The committed file can then be used via the "session" argument of the install and deploy tools.

Abort an upload session and delete its data.

Preview a deploy before it happens: compare the ZIP you are about to push against what is really on the server. Nothing is uploaded, written or deleted — only directory listings and the ZIP index are read, never file contents. Per path it reports new, changed and, with atomic mode, removed.

Check the Site-Deploy connection: configuration, same-server verification and a live directory listing of the deploy root. Opens an authenticated connection with the stored credentials, so it is off by default like the other deploy tools.

List a directory in the deploy area (path is relative to the deploy root).

Read a file from the deploy area (max 2 MB per call). Binary content is returned base64-encoded.

Write one file into the deploy area. Content sources: "content" (with optional "encoding":"base64") or a committed upload "session". Missing directories are created.

Upload and unpack a ZIP archive into the deploy area — deploys a whole site or folder in one step. Source: a committed upload "session" (recommended for large archives) or base64 "content". With "atomic":true (recommended for a full site) the archive is unpacked into a staging folder, every file is size-verified, the current target is moved aside as a backup, and only then swapped in by a near-instant rename — a failed or interrupted upload leaves the live target untouched, and a failed swap rolls back automatically. Without atomic, files are written straight into the target and existing files are overwritten in place.

Delete a file — or, with "recursive":true, a whole directory — in the deploy area.

Export the STRUCTURE of this site as a portable JSON blueprint: writable site settings, taxonomy terms, the page hierarchy, navigation menus with their item tree and theme locations, widget placement, the plugin set and the active theme. Post content is never exported, and neither are widget settings, credentials or user data.

Compare a blueprint against the CURRENT state of this site and return exactly what an apply would do. Works on every plan. Read-only: writes nothing. Per section you get create, update, unchanged and extra_on_target — structure that exists here but not in the blueprint is never touched, there is no delete mode.

Apply the applicable parts of a blueprint to this site. Dry run by default: review the plan, then set apply=true. It NEVER deletes, deactivates or removes anything, and a second run reports everything as unchanged. Every write goes through the ordinary tools, so their permissions, your token scope and the per-tool switches all apply.

List your undo points: the snapshots that destructive tools took before they changed something. Each entry has a token, the tool it came from, a short summary and an expiry. Only your own undo points are visible, and they expire after 24 hours.

Reverse one earlier change using its undo token. Pass dry_run=true first to see exactly what would be restored and what would be refused. Undoing needs the same permission as the original action, and each item is re-checked against the CURRENT state, so an option that has since been protected is reported as blocked rather than restored.

Throw away an undo point and its snapshot without restoring anything. Use it once a change is confirmed good, or pass all=true to drop all of your undo points at once. Other users’ undo points are never touched.

Export content as a WordPress WXR file, saved to the uploads folder; returns a download URL.

Multisite: list the sites in the network. Requires multisite.

Multisite: create a new site in the network. Requires multisite.

Multisite: network-activate a plugin across all sites. Requires multisite.