Skip to main content
Glama
726,822 tools. Updated 2026-10-30 23:38

"wordpress" matching MCP tools:

  • Get common site settings: title, tagline, home URL (url), WordPress URL (wp_url), admin email, timezone, language, posts per page, date format and permalink structure. timezone is the named timezone, empty when the site uses a fixed UTC offset; permalink is empty for plain permalinks. Needs manage_options. Read-only; takes no arguments. Versions, theme and plugins are reported by wp_site_info. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    ConnectorOAuth
  • Have Seonix apply fixes on the live site through the WordPress plugin (write scope — tell the user exactly which issue codes and get a yes first). Works for get_fix_plan items with fix_tier auto or ai_assist (wp_plugin_fixable); the site must have a connected WordPress channel. Starts a run (preview → Seonix suggestions → apply) and returns its id; poll get_fix_run until status is completed, partial or failed. Undo with rollback_fix.
    Connector
    Destructive
    No auth
  • Create a WordPress DRAFT from the brief's markdown (Gutenberg blocks; never live). Uses the brand's verified WordPress connection — the caller's own or a teammate's under the org model — and the normal WordPress write gates. Use dry_run=true first to show the user the title, post type, a block preview and any writing blockers (would_refuse). The user reviews and publishes from wp-admin. WRITING BLOCKERS (placeholders, figures or superlatives with no source) refuse the publish. You cannot waive them: fix them (suggest_sources + accept_source for sources, assist_writing_fix for wording), or give the user the dashboard_url from the error — only a person can choose 'Publish anyway', with a reason, in the XeoRank dashboard. For non-WordPress platforms, hand the user the markdown from get_content_brief, then record the live URL with update_content_brief(published_url=...).
    ConnectorOAuth
  • CLOUD FOR WORDPRESS ONLY. Mint a WordPress Application Password for a domain's managed WordPress site so you can drive it over the WP REST API at https://<domain>/wp-json/ using HTTP Basic auth. The password is returned ONCE (WordPress stores only a hash) — save it immediately. Defaults to a dedicated least-privilege `porkbun-agent` user with the `editor` role (created on first use), which can manage content but cannot install code. `role: "administrator"` grants FULL site control including plugin installation (i.e. arbitrary code execution on the site) and therefore requires `acknowledge_full_access: true` — only request it if the user explicitly asked for admin-level access. The site must be provisioned and ACTIVE (poll get_hosting) — this works on any Cloud for WordPress site in the account however it was provisioned, but free $0 preview sites are excluded. Revoke any time with delete_wp_credentials. Rate limit: 20 mints per account per hour.
    ConnectorOAuth
  • Update WordPress core itself (not plugins or themes) to the first version WordPress offers, with WordPress's own core updater; it checks for offers first, and wp_get_update_status shows them. Already current: updated false with a message; otherwise updated true and new_version, or the updater's error. Needs update_core; refused when DISALLOW_FILE_MODS is set. Replaces core files site-wide. Unlike wp_update_plugin, AlphaBridge runs no test requests and puts nothing back; no undo point is recorded. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    Connector
    Destructive
    OAuth
  • Create or overwrite one user meta value (all stored values of the key are replaced). Refused: keys starting with "_", role and capability keys of any site (…capabilities, …user_level), session_tokens, default_password_nonce, use_ssl and credential-like keys; role and password are changed by wp_update_user. Needs edit_users, the right to edit this user and to edit this key; an unknown user is a not-found error. WordPress strips backslashes from the value. Returns updated, user_id and key. No undo point is recorded; wp_get_user_meta reads the value. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    Connector
    Destructive
    OAuth

Matching MCP Servers

Matching MCP Connectors

  • Liste les sites WordPress connectés au compte (plugin Everlange Connect) : domaine, statut, modules actifs, version du bundle.
    ConnectorNo auth
  • Liste les sites WordPress connectés au compte (plugin Everlange Connect) : domaine, statut, modules actifs, version du bundle.
    ConnectorNo auth
  • Get one term by id and taxonomy. Returns {term_id, name, slug, taxonomy, description, count, parent}; count is the number of objects WordPress counts for the term, parent is 0 at the top level. Terms of a non-public taxonomy need the right to assign them. A term that does not exist in that taxonomy returns a not-found error. A term known only by name or slug is found with wp_list_terms (search); the term's custom meta comes from wp_get_term_meta. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    ConnectorOAuth
  • Create a new term (category, tag or custom taxonomy term) in a taxonomy. Returns {created: true, term_id}. Needs the taxonomy's right to manage terms (for categories and tags: manage_categories). WordPress refuses a parent that does not exist and, without a distinct slug, a name the taxonomy already has (in a hierarchical taxonomy: under the same parent). Existing terms are changed with wp_update_term. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    ConnectorOAuth
  • Check whether the team is connected to a WordPress blog and get a snippet of the most recent blog post. Returns blogConnected (an active WordPress integration exists), the integration summary (no secrets), and the latest post's title + snippet + publish status/URL. Read-only, no credit cost. Use before create_blog_plan or test_blog_connection to see if a blog is wired up and what was last published.
    ConnectorAPI key
  • Changes the title of one post or page on the user's WordPress site, the most common fix for a page people see in Google but rarely click. Always call it first WITHOUT confirm to show the current title and the proposed one, then call again with confirm: true only after the user says yes. The old title is kept so undo_fix can put it back, and the change is marked automatically so the Monday email reports whether it worked about 4 weeks later. Needs WordPress connected in SearchLink Settings. Starter plan and up. Uses the WordPress REST API on the user's site (https://developer.wordpress.org/rest-api/reference/posts/).
    Connector
    Destructive
    OAuth
  • CLOUD FOR WORDPRESS ONLY. Revoke a WordPress application password by `uuid` (from list_wp_credentials), or every one for the user with `all: true`. Anything using that credential stops authenticating immediately.
    Connector
    Destructive
    OAuth
  • Sites the user connected without a server: a WordPress site through its REST API (any host, no SSH) or a WhizzyCommerce shop through the shop's own connector. For each: name, address, kind, its mode, and for WordPress the kinds of content it has and the fields content_save takes for each. Use the content_ tools on a WordPress site, and whizzy_tools and whizzy_call on a WhizzyCommerce shop. A site on one of the user's servers is not listed here: for that use list_sites, wp and db_query.
    ConnectorOAuth
  • Report available core, plugin and theme updates as of WordPress's own last scheduled check (read-only, cached data; triggers no remote request). WordPress repeats that check on its own, about twice a day. Returns core {update_available, new_version}, plugins [{plugin, name, new}] and themes [{stylesheet, name, new}]; empty lists mean no update was known at that check. Needs update_core. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    ConnectorOAuth
  • List the application passwords of one user: {user_id, passwords: [{uuid, name, created, last_used}]}, dates in ISO 8601 UTC, last_used null when never used; the password itself is not returned. Suited to reviewing which applications can sign in as that user. An empty list means the user has none. Needs list_users and the right to edit that user (in the standard roles: administrators). Where WordPress does not offer application passwords (it needs HTTPS or a local environment), an error says so. Read-only. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    ConnectorOAuth
  • List the installed themes, all in one answer (no paging); the files inside one theme are listed by wp_list_theme_files. Returns themes: one entry per theme with slug (the folder name the theme tools take, "collection/theme" for a theme inside a collection), name, version and active (true only for the theme in use; the parent of an active child theme shows false). Themes WordPress counts as broken, such as a folder without style.css, are left out. Requires edit_theme_options. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    ConnectorOAuth
  • Download a file from a public http(s) URL and add it to the media library; the file is public under its new URL afterwards, and each call adds a new file. The site fetches the file itself through WordPress' safe-URL check, repeated on every redirect: private and internal hosts are refused unless WordPress allows them (such as the site's own host); at most 3 redirects, 20 seconds per request, 20 MB by default (filter ab_mcp_upload_max_bytes). The URL or the content type must name JPEG, PNG, GIF, WebP or PDF; HTML, SVG, XML and script responses are refused, and WordPress then checks the file as for any upload. No third-party API is involved. Returns {uploaded: true, id, url}. Needs upload_files, and the right to edit post_id when given. File content at hand is uploaded as base64 with wp_upload_media. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    Connector
    Destructive
    OAuth
  • Set the moderation status of one comment: approve marks it approved, hold sets it back to pending, spam marks it as spam, trash moves it to the trash. Returns {moderated: true, comment_id, status}, status being the one asked for: the answer does not confirm that WordPress stored it, and wp_get_comment shows the stored status. Needs moderate_comments and the right to edit this comment (edit_comment), which follows the right to edit its post. Approving shows the comment wherever the post's comments are public, and WordPress may notify the post's author. Where the site's trash is off (EMPTY_TRASH_DAYS 0), trash deletes the comment for good, as in WordPress; every other change can be reversed by a later call. Trashing a top-level note (comment_type note) also trashes its reply notes, and setting the note to approve or hold later does not bring those back. An unknown comment_id returns a not-found error. Deleting outright is done by wp_delete_comment. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    Connector
    Destructive
    OAuth
  • Change the status of many posts at once by id list (posts, pages, other post types and media files alike) to publish, draft, pending, private or trash; at most 500 ids per call (over_limit counts the rest, which are not touched). Suited to batches; one post's status and other fields change with wp_update_post. Unknown ids are skipped, posts already in the status are left as they are and an id given twice counts once, so a repeated call changes nothing more, except where WordPress stores another form than asked (stored_as below): those posts are written again. Publishing makes posts public at once. On a site without a trash, "trash" is refused, since WordPress would delete for good. A media file set to draft, pending or publish becomes "inherit" (shown wherever its parent is published, everywhere without one), which needs the right to publish. Returns updated (the count); ids, the posts that have the status now, with stored_as where WordPress stores a form of its own ("future" for a post dated ahead, "inherit" for a file); failed, each with the status it has (null if unreadable) and, where telling, an error: update_failed, trash_refused or untrash_refused (refused by WordPress or a plugin), unreadable (nothing written) or unverified (written, not readable back); forbidden, the posts the account may not change (edit right per post, delete right for trash). failed and forbidden list 100 each; failed_omitted and forbidden_omitted count the rest. undo is the token of an undo point with the previous statuses, for wp_undo (null when none was recorded). A call begins no further post once the request has run 60 seconds (the first post is always handled, and one already begun is finished), so a long list is answered in parts; remaining lists the ids it did not reach, in their order (empty when it reached all), and those ids, sent in a further call, continue where it stopped, with an undo point of their own. Needs edit_others_posts. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    Connector
    Destructive
    OAuth
  • Create or overwrite one meta value of a term (category, tag or any taxonomy); all stored values of the key are replaced. Keys starting with "_" and credential-like keys are refused. Needs manage_categories and the right to edit this term's meta. WordPress strips backslashes from the value. Returns updated, term_id and key; an unknown term is a not-found error. No undo point is recorded; the term's name, slug and description change with wp_update_term. Forwarded by AlphaBridge Connect to the one site this connection reaches.
    Connector
    Destructive
    OAuth