Skip to main content
Glama

Set bridge safety flags

wp_bridge_flags
Destructive

Toggle WordPress server-side capabilities such as PHP, shell, DB writes, file writes, and plugins. Starts read-only and widens access only when a task demands it.

Instructions

Toggle server-side capabilities: allow_php, allow_shell, allow_db_write, allow_file_write, allow_plugins. Start read-only and widen only when the task demands it.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
allow_phpNo
allow_shellNo
allow_pluginsNo
allow_db_writeNo
allow_file_writeNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint and openWorldHint. The description adds concrete capability names and a least-privilege instruction beyond the annotations, though it omits auth, rate-limit, and irreversibility details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The purpose is front-loaded before the safety guideline, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a security-sensitive flag tool, the description omits whether flags persist, whether omitted flags change, and what the call returns. Annotations cover destructive/openWorld behavior and all parameters are named, but key toggle semantics remain unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has zero description coverage and five booleans. The description lists all five parameter names and frames them as server-side capabilities, but does not explain individual flag effects or omitted-flag behavior; the names themselves carry much of the meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Toggle') and resource ('server-side capabilities'), and enumerates five flags. It does not explicitly relate to sibling tools such as wp_php_run or wp_db_query that these flags may gate, so sibling differentiation is implicit rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear usage principle: start read-only and widen only when the task demands it. Lacks explicit when-not or alternative-tool guidance, but the posture guidance is actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.