Skip to main content
Glama

WordPress application password

wp_app_password
Destructive

Create a WordPress application password for the site's administrator, for the site's own REST API (posts, pages, media): the answer carries the user, the password (shown once, never stored by the platform) and the REST address; a second create replaces this connection's earlier password. Revoke removes the passwords this connection created and no others; revoking the key on the account page removes them too. Refusals: not-live, migration-open, deploy-open, busy, failed.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "serviceId": "<serviceId>",
      "action": "<action>"
    },
    "name": "wp_app_password"
  }
}

Input Schema

NameRequiredDescriptionDefault
actionYes
serviceIdYesthe id of a service on this account

Output Schema

NameRequiredDescriptionDefault
okYes
dataNo
errorNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / serviceId / description
      Previous value: -"the service id from list_services"New value: +"the id of a service on this account"
  2. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint/readOnlyHint annotations, it discloses that the password is shown once and never stored, that a second create overwrites this connection's earlier password, and that revoke only affects passwords this connection created (while account-page revocation also kills them). The refusal list adds further operational context that annotations cannot express.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core create behavior and the shown-once password note are front-loaded, and the revoke and refusal details follow in logical order. It is a dense, somewhat run-on block rather than cleanly separated sentences, but every clause carries real information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-action lifecycle tool with an output schema already present, the description covers creation semantics, replacement behavior, revocation scope, non-revocable-by-this-tool cases, and failure modes. An agent has everything needed to decide and invoke without further inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50% and the action enum has no schema description, but the description supplies the meaning of both enum values by explaining replace-on-second-create and revoke-scope semantics. serviceId gains nothing beyond the schema's own 'id of a service on this account', so it is additive but not complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource pair (create/revoke a WordPress application password) and scopes it clearly to the site administrator and the site's own REST API (posts, pages, media). It distinguishes the tool conceptually from wp_login by tying it to application passwords for API access, but never names the sibling, so it lands just short of the top mark.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It establishes when the tool applies (gaining REST API access for the site) and enumerates the exact refusal conditions — not-live, migration-open, deploy-open, busy, failed — which tells an agent when the call will not succeed. It does not explicitly route the agent to an alternative tool (e.g. wp_login) for other credential needs, so it stops at clear context without exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources