Wordpress Wae

WordPress Abilities Extended (WAE)

WordPress MCP capability plugin built on top of the WordPress Abilities API and MCP Adapter.

This plugin currently exposes 86 public mcp-wp/* abilities on the MCP endpoint and is designed for AI agent workflows.

What It Covers

• Full CRUD for posts/pages (prefer mcp-wp/search-replace-content for targeted text edits)
• Full CRUD for comments
• Generic CPT CRUD (post_type-driven)
• Menu CRUD (menus, menu items, menu locations)
• Pattern CRUD + block validation
• Media upload/list/get/edit/replace/delete
• Taxonomy list/create/edit/delete
• User list/get/current/create/edit
• FSE block entities (wp_navigation, templates, template parts)
• Controlled settings reads/writes (allowlisted updates)
• Plugin/theme lifecycle operations (install/update/delete/activate/deactivate/switch)
• Advanced helpers (batch update, clone, custom REST calls, pattern import/export)
• Rendered frontend HTML inspection for selector-safe styling work

Ability Modules

• posts (11)
• comments (5)
• cpt (5)
• menus (10)
• fse (5)
• patterns (7)
• media (6)
• users (5)
• taxonomy (6)
• settings (4)
• plugins (14)
• advanced (8)

Total: 86 abilities

Full Ability List

posts

• mcp-wp/create-page
• mcp-wp/edit-page
• mcp-wp/get-page
• mcp-wp/list-pages
• mcp-wp/delete-page
• mcp-wp/create-post
• mcp-wp/edit-post
• mcp-wp/get-post
• mcp-wp/list-posts
• mcp-wp/delete-post
• mcp-wp/search-replace-content

comments

• mcp-wp/list-comments
• mcp-wp/get-comment
• mcp-wp/create-comment
• mcp-wp/edit-comment
• mcp-wp/delete-comment

cpt

• mcp-wp/list-content
• mcp-wp/get-content
• mcp-wp/create-content
• mcp-wp/edit-content
• mcp-wp/delete-content

menus

• mcp-wp/list-menus
• mcp-wp/get-menu
• mcp-wp/create-menu
• mcp-wp/edit-menu
• mcp-wp/delete-menu
• mcp-wp/list-menu-locations
• mcp-wp/assign-menu-location
• mcp-wp/create-menu-item
• mcp-wp/edit-menu-item
• mcp-wp/delete-menu-item

fse

• mcp-wp/list-block-entities
• mcp-wp/get-block-entity
• mcp-wp/create-block-entity
• mcp-wp/edit-block-entity
• mcp-wp/delete-block-entity

patterns

• mcp-wp/list-patterns
• mcp-wp/get-pattern
• mcp-wp/create-pattern
• mcp-wp/edit-pattern
• mcp-wp/delete-pattern
• mcp-wp/get-block-types
• mcp-wp/validate-blocks

media

• mcp-wp/upload-media
• mcp-wp/list-media
• mcp-wp/get-media
• mcp-wp/edit-media
• mcp-wp/replace-media-file
• mcp-wp/delete-media

users

• mcp-wp/list-users
• mcp-wp/get-user
• mcp-wp/get-current-user
• mcp-wp/create-user
• mcp-wp/edit-user

taxonomy

• mcp-wp/list-categories
• mcp-wp/list-tags
• mcp-wp/create-category
• mcp-wp/create-tag
• mcp-wp/edit-term
• mcp-wp/delete-term

settings

• mcp-wp/get-settings
• mcp-wp/get-gutenberg-settings
• mcp-wp/get-site-stats
• mcp-wp/update-settings

plugins

• mcp-wp/list-plugins
• mcp-wp/get-plugin
• mcp-wp/activate-plugin
• mcp-wp/deactivate-plugin
• mcp-wp/install-plugin
• mcp-wp/update-plugin
• mcp-wp/delete-plugin
• mcp-wp/get-theme
• mcp-wp/get-theme-supports
• mcp-wp/get-dynamic-part
• mcp-wp/edit-dynamic-part
• mcp-wp/list-theme-files
• mcp-wp/get-theme-file
• mcp-wp/edit-theme-file (writes limited to the FSE file set, existing or new: theme.json, styles/.json, templates/.html, parts/.html, patterns/.php; plus tailwind.css and inc/Theme/Ai.php, the only PHP class; it is created and registered in inc/Init.php on first write. Site editor first: PHP only for queries, pagination and rewrite rules, never for blocks or patterns; header and footer go through edit-dynamic-part)

Both write abilities take a required summary. The API proxy on the host commits every theme file write to the site's theme repo (wp-content/themes/mild-boilerplate, initialised on first write) as ai-mcp: <summary>, with the changed files in the commit body. PHP cannot commit itself: it runs in a container without git.

• mcp-wp/list-themes
• mcp-wp/switch-theme
• mcp-wp/install-theme
• mcp-wp/update-theme
• mcp-wp/delete-theme

advanced

• mcp-wp/custom-rest-call
• mcp-wp/get-rendered-page-html
• mcp-wp/query-posts-advanced
• mcp-wp/batch-update
• mcp-wp/export-pattern
• mcp-wp/import-pattern
• mcp-wp/get-pattern-usage
• mcp-wp/clone-item

Installation

Prerequisites

• WordPress 6.9+ (Abilities API)
• MCP Adapter plugin active
• Application Password for the WordPress user that will authenticate MCP

Steps

1. Install and activate mcp-adapter.
2. Copy this plugin to wp-content/plugins/wordpress-wae.
3. Activate this plugin.
4. Use endpoint:
   • https://<site>/wp-json/mcp/mcp-adapter-default-server

MCP Client Example

{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://your-site/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "your-username",
        "WP_API_PASSWORD": "your-application-password"
      }
    }
  }
}

MCP Call Pattern

MCP Adapter exposes 3 tools:

• mcp-adapter-discover-abilities
• mcp-adapter-get-ability-info
• mcp-adapter-execute-ability

Execution example:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "mcp-adapter-execute-ability",
    "arguments": {
      "ability_name": "mcp-wp/create-content",
      "parameters": {
        "post_type": "page",
        "title": "Hello",
        "content": "Created over MCP",
        "status": "draft"
      }
    }
  }
}

Security Notes

• Every ability uses capability checks.
• Inputs are validated with input schemas and sanitized in handlers.
• Keep MCP auth credentials scoped and site-specific.
• For destructive workflows, keep confirmation gates in your AI orchestration layer.

Operational Notes

• Plugin/theme install or update requires outbound access to WordPress.org and usable filesystem credentials.
• Active theme/plugin guardrails are enforced by WordPress core behavior and ability logic.

Development Utilities

• bash diagnose.sh for endpoint and registration diagnostics
• bash tests.sh for local scripted checks
• bash tests/run-all.sh (when present) for the full smoke-test harness — see Local Test Setup for credentials.
• bash agent/tests/smoke/run-agent-tests.sh for Socket.IO smoke tests against the running AI agent (connect, ensure_repo, get_history, optional chat_message)
• bash agent/tests/e2e/run-agent-mcp-e2e.sh for full real usage E2E (agent + MCP): list pages, create page with CTA, replace text, verify, and cleanup (stored in git-excluded agent tests so plugin updates do not remove it).
• tests/README.md for detailed test setup, environment variables, outputs, and troubleshooting for both MCP ability tests and agent smoke tests.

License

MIT (see LICENSE).