Skip to main content
Glama

Update a plugin

wp_update_plugin
Destructive

Update an installed plugin to the version WordPress offers for it (wp_get_update_status lists the offers); new plugins are installed by wp_install_plugin. Needs update_plugins; refused under DISALLOW_FILE_MODS, for a plugin of a single file and when nothing is offered. A kept update answers with updated, version_before, version_after, probe, warning and note. It works like WordPress's update button: an active plugin stays active, a theme stays in use, and the previous version is moved aside first. Where the code runs on this site (an active plugin, the active theme or its parent), visitors see the maintenance page (HTTP 503) until the check ends (before WordPress 6.6 only while files are copied), and test requests check the home page, this MCP endpoint, wp-admin/admin-post.php and the dashboard before and after, logged in as this connection's account. A new fatal error, a target that stops answering or an MCP endpoint that loses its own answer puts the previous version back in the same call, and the answer, an error, says what failed where. After a new fatal error or a lost MCP answer, AlphaBridge also asks WordPress's automatic updates to leave that version alone, and the answer says whether and for how long that holds; a new call of this tool tries it again. A fatal error that was there before, or a redirect or wp_die() at the home page or admin-post.php, keeps the update with a warning. Updated without a test, with the warning "not checked": an inactive plugin or theme, a site that cannot reach itself, an update that leaves no time for the test (a large package on a slow host). Not checked: other wp-admin screens, cron, AJAX, code that runs only on some pages or for other users. Only files are put back; what the new version changes in the database stays. No undo point: the previous version comes back only within this call. One update per site (per network on multisite) runs at a time, and none during an activation or a deploy into running code; a second call is refused and changes nothing. A call that timed out can still finish: about a minute later nothing is offered any more if the update was kept, and a new call names its result. AlphaBridge itself is not updated through this tool. Forwarded by AlphaBridge Connect to the one site this connection reaches.

Input Schema

NameRequiredDescriptionDefault
pluginYesExact plugin file of an installed plugin as wp_list_plugins lists it, e.g. akismet/akismet.php.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / plugin / description
      Previous value: -"Plugin file, e.g. akismet/akismet.php."New value: +"Exact plugin file of an installed plugin as wp_list_plugins lists it, e.g. akismet/akismet.php."
  2. Added

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Far exceeds what the annotations (destructive/idempotent=false/openWorld) convey: it discloses the maintenance-page 503 window, self-testing behavior, in-call rollback rules (files restored, DB changes kept), no undo beyond the call, and the pinning request to automatic updates. It also clarifies the return fields (updated, version_before/after, probe, warning, note).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded, but the body is one dense run-on paragraph dense with concentrated detail. Every clause is substantive, yet the lack of structure makes it hard to scan for the few facts an agent needs before calling; a few sentences (timeout specifics, AlphaBridge forwarding) could be trimmed or segmented.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, non-idempotent mutation with no output schema, it covers capabilities, refusal conditions, rollback semantics, concurrency, timeouts, and return shape—everything needed to call correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single required parameter's format (exact plugin file, e.g. akismet/akismet.php) is already documented in the schema. The description reinforces 'as wp_list_plugins lists it' but adds little beyond the schema, so it sits at baseline rather than above it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and resource (update an installed plugin to the offered version) and immediately differentiates from both siblings: wp_get_update_status lists offers and wp_install_plugin handles new installs. An agent can place this tool without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when NOT to use it (new plugins go to wp_install_plugin; AlphaBridge itself is never updated here) and enumerates refusal conditions: missing update_plugins, DISALLOW_FILE_MODS, single-file plugins, nothing offered, and concurrency contention. Alternatives and exclusions are all named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources