Skip to main content
Glama

Add media from a URL

wp_upload_media_from_url
Destructive

Download a file from a public http(s) URL and add it to the media library; the file is public under its new URL afterwards, and each call adds a new file. The site fetches the file itself through WordPress' safe-URL check, repeated on every redirect: private and internal hosts are refused unless WordPress allows them (such as the site's own host); at most 3 redirects, 20 seconds per request, 20 MB by default (filter ab_mcp_upload_max_bytes). The URL or the content type must name JPEG, PNG, GIF, WebP or PDF; HTML, SVG, XML and script responses are refused, and WordPress then checks the file as for any upload. No third-party API is involved. Returns {uploaded: true, id, url}. Needs upload_files, and the right to edit post_id when given. File content at hand is uploaded as base64 with wp_upload_media. Forwarded by AlphaBridge Connect to the one site this connection reaches.

Input Schema

NameRequiredDescriptionDefault
altNoAlternative text for an image, stored as plain text.
urlYesPublic http(s) URL of the file. Your site downloads it; nothing is sent anywhere else.
titleNoTitle of the new attachment.
post_idNoId of a post to attach the file to; needs the right to edit that post. Default: attached to no post.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changed
    • addedInput schema / properties / alt / description
      Added value: +"Alternative text for an image, stored as plain text."
    • changedInput schema / properties / post_id / description
      Previous value: -"Attach to this post id."New value: +"Id of a post to attach the file to; needs the right to edit that post. Default: attached to no post."
    • addedInput schema / properties / title / description
      Added value: +"Title of the new attachment."
  2. Added

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare non-read-only, destructive, non-idempotent, open-world, and the description substantiates each: 'each call adds a new file' explains non-idempotency, 'the file is public under its new URL afterwards' explains the destructive/exposure angle. It adds limits the annotations cannot carry — 3 redirects, 20s per request, 20 MB default with a filter name — plus the safe-URL check, the content-type allowlist with explicit refusals, and the required capabilities (upload_files, edit rights on post_id).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and effect before the caveats, and the sentences are information-dense rather than padded. It runs long as a single block, though every clause carries operational detail (limits, allowlist, permissions, return shape) rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description supplies the return shape ('{uploaded: true, id, url}'), the security model, the failure modes, and the capability requirements. For a remote-fetch write tool that is everything an agent needs before invoking it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so url, title, alt and post_id are already documented, and the description mostly restates them. The one addition beyond the schema is the permission requirement attached to post_id, which the schema also mentions. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource: 'Download a file from a public http(s) URL and add it to the media library.' It also differentiates itself from the near-neighbour wp_upload_media by naming that tool for the base64 case, so an agent can choose between the two without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the alternative case: 'File content at hand is uploaded as base64 with wp_upload_media.' It also states when the tool will refuse (non-public URLs, internal hosts, unsupported content types), which is the equivalent of when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources