WordPress MCP server

Showing 10 of 10 tools

• elementor_document_replace

  Write

  Destructive

  [ADM WordPress] Replaces a page's entire Elementor document. The JSON is parsed and structurally validated before anything is written — a document with a missing or duplicate element id renders as a blank page with no error, so it is refused rather than saved. This REPLACES the whole layout: everything not in the new document is gone. Call elementor_document_replace_preview first to see what that removes. Takes a checkpoint of the whole previous document and regenerates the CSS. Modifies the live site.

• elementor_document_replace_preview

  Read-only

  [ADM WordPress] Validates a replacement Elementor document and reports what swapping it in would do — how many elements and widgets go, arrive and stay — without changing anything. Read-only, so it works on a site with writes switched off. Call it before elementor_document_replace.

• elementor_page_create

  Write

  [ADM WordPress] Creates a new page AND makes it a real Elementor document in one call — the page, its layout, its page template and its builder flags. Creating a page with wordpress_page_create and then writing Elementor data to it does NOT work: a page only renders through Elementor when its builder flags are set at creation, which is what this does. Copy a layout with `template_id` (any id from elementor_pages, including a library template) or supply one with `document` from elementor_document_get. DEFAULTS TO DRAFT — nothing is visible to visitors until you pass status='publish' or publish it later with wordpress_page_update. Modifies the live site.

• elementor_text_replace

  Write

  Destructive

  Replaces text in one Elementor widget setting, identified by post id, element id and setting key. Parses the document, changes that one setting, and writes the whole document back — it never does text substitution across the raw JSON, because a blind replace can match inside a CSS class or URL and corrupt the document, which renders as a blank page with no error. Takes a checkpoint of the whole document first and regenerates Elementor's CSS afterwards. Modifies the live site.

• elementor_text_replace_preview

  Read-only

  Shows exactly what one Elementor text change would do — the current value, the proposed value, and how many occurrences match — without changing anything. Call this before elementor_text_replace so the change can be described before it is made. Read-only.

• elementor_text_search

  Read-only

  Searches the visible text of Elementor pages for a phrase and returns every match with its post id, element id and setting key — exactly what elementor_text_replace needs. This is how you find a typo that ordinary post search cannot see, because Elementor text is not in post_content. Read-only.

• elementor_widget_settings_update

  Write

  Destructive

  [ADM WordPress] Sets any settings on one Elementor widget — images, links, colours, shortcodes, alignment, anything the widget stores — identified by post id and element id. This is the general editor; elementor_text_replace is the narrow one that only touches prose. Because this can write ANY setting, it can also break a layout, so call elementor_widget_settings_update_preview first. The document is parsed, the named settings are changed, and the whole document is written back — it never does text substitution across the raw JSON. Takes a checkpoint of the whole document first and regenerates Elementor's CSS afterwards. Modifies the live site.

• elementor_widget_settings_update_preview

  Read-only

  [ADM WordPress] Shows exactly what changing one widget's settings would do — the current value and the proposed value for every key — without changing anything. Call this before elementor_widget_settings_update. It is read-only, so it also works on a site that has writes switched off, which makes it the way to check a whole page build before enabling writes. Read-only.

• seo_indexing_issues

  Read-only

  Scans published posts and pages for the settings that quietly keep them out of search results: per-post noindex, a missing or over-length meta description, a missing SEO title, and a canonical pointing elsewhere. Combines that with the site-wide robots.txt and 'discourage search engines' setting. Read-only. This reports what the site is telling search engines, not what Google has actually done with it -- for that, pair it with the Google Search Console connector: google_search_console_inspect_url gives Google's real index status for a specific URL.

• seo_metadata_get

  Read-only

  Reads the SEO title, meta description, canonical URL, robots directives and focus keyword for one post or page, from whichever supported plugin is active. An empty title or description means the plugin is falling back to its template, not that the page has none. Read-only.

Showing 10 of 10 tools

• elementor_css_regenerate

  Write

  Clears and regenerates Elementor's compiled per-page CSS. Low risk — the CSS is derived and rebuilds on the next page load — but on a busy site it causes a brief load spike while it does. The usual fix for 'I changed something in Elementor and the site still shows the old styling'. Modifies live site state.

• elementor_document_get

  Read-only

  [ADM WordPress] Returns one page's complete Elementor document as JSON — every element with all of its settings, exactly as stored. This is the round-trip format: what comes back here is what elementor_page_create and the document tools accept. It is large; for reading a page use elementor_page_structure, and for one widget use elementor_widget_get. Read-only.

• elementor_globals_get

  Read-only

  Reads the site's Elementor kit — the global colour palette, global fonts and site-wide defaults that individual widgets inherit from. This is where a brand palette actually lives. A widget whose colour shows as `globals/colors?id=a291686` is not holding a colour at all, it is pointing here, so changing that widget's own colour setting would break the link rather than restyle the site. The kit is a real Elementor document but its content is not an element tree, which is why elementor_page_structure reads it as empty. Read-only.

• elementor_globals_update

  Write

  Destructive

  [ADM WordPress] Changes the site's Elementor kit — the global colour palette and global fonts that widgets inherit from. ONE CALL RESTYLES EVERY PAGE AT ONCE. A widget bound to a global shows it as `globals/colors?id=...`, and changing the global here is what restyles all of them together; changing the widget instead detaches that one widget from the palette. Merges into the kit rather than replacing it, takes a checkpoint first, and regenerates the CSS. Modifies the live site everywhere.

• elementor_pages

  Read-only

  Lists every Elementor document on the site: the pages and posts built with Elementor, AND the library templates — including the Theme Builder header, footer and popups. Templates matter as much as pages and are easy to miss: a header and footer are applied to every page on the site but are not pages themselves, so text living in them is invisible to anything that only looks at pages. `template_kind` says what a template is and `applies_to` says where it is used — `include/general` means site-wide. Read-only.

• elementor_page_settings_update

  Write

  Destructive

  [ADM WordPress] Sets one page's Elementor settings — page template (elementor_canvas for a blank landing page), background, hide_title and the rest. Merges into the existing settings rather than replacing them. Takes a checkpoint first and regenerates the CSS. Modifies the live site.

• elementor_page_settings_update_preview

  Read-only

  [ADM WordPress] Shows what changing one page's Elementor settings would do — page template, background, whether the title is hidden — without changing anything. Read-only.

• elementor_page_structure

  Read-only

  Returns the element tree of one Elementor page: every section, column and widget with its element id, widget type and a short text preview. The element ids are what elementor_text_replace targets. Structure only — it does not return full settings, which are large and mostly styling. Read-only.

• elementor_restore_checkpoint

  Write

  Destructive

  Puts one page's Elementor document back to a checkpoint -- the undo for any Elementor change Serve MCP made (wordpress_ability_run, elementor_widget_settings_update, elementor_text_replace, elementor_document_replace and the rest). List checkpoints with wordpress_list_checkpoints; this tool restores those whose target is elementor:<post id>. The current document is checkpointed first, so a restore can itself be undone. Requires confirm: true. Works over SSH, or over the REST API on a site connected with only an application password; over REST, Elementor's cached CSS for the page is not regenerated, and the result says how to do it. On a published page this changes the live page.

• elementor_status

  Read-only

  Reports whether Elementor is active, its version, and whether Elementor Pro is present. Call this before any other elementor_ tool. Read-only.

Showing 10 of 10 tools

• woocommerce_action_scheduler_failed

  Read-only

  Lists WooCommerce background actions that failed, with their hook, group and scheduled time. Each row is work the store intended to do and did not — a renewal not charged, an email not sent, a webhook not delivered. Read-only.

• woocommerce_action_scheduler_run

  Write

  Destructive

  Runs WooCommerce's due background actions now, which is the documented way to drain a stuck queue. Modifies the live store, and the side effects are whatever the queued work does — sending customer emails, charging subscription renewals, delivering webhooks, adjusting stock. Draining a large backlog can therefore send a burst of real customer emails. Bounded by a batch limit and a hard timeout; run it repeatedly rather than raising the batch.

• woocommerce_action_scheduler_status

  Read-only

  Counts WooCommerce background actions by status and reports how far behind the queue is. Action Scheduler runs the work WooCommerce defers — emails, subscription renewals, stock sync, webhook delivery, analytics — so a backed-up or failing queue is the usual explanation for 'orders are stuck', 'emails stopped', or 'inventory is not syncing' when nothing else looks wrong. Read-only.

• woocommerce_checkout_diagnostics

  Read-only

  Checks the things that stop customers completing checkout: enabled payment gateways, shipping zones with no method, HTTPS and outbound-request health from WooCommerce's own system status, recent failed orders, and whether the cart and checkout pages resolve. Read-only, safe on a live store. Use when checkout is reported broken but no single order explains it.

• woocommerce_coupon_create

  Write

  Destructive

  Creates a discount coupon. Modifies the live store: the code is usable by customers as soon as it exists, so a mistyped amount or a missing expiry is immediately spendable. Prefer setting an expiry and a usage limit.

• woocommerce_coupons_list

  Read-only

  Lists discount coupons with their code, type, amount, usage counts and limits, and expiry. Read-only.

• woocommerce_customer_get

  Read-only

  Full detail for one customer including billing and shipping addresses and order history totals. Returns personal data; off by default. Read-only.

• woocommerce_customers_list

  Read-only

  Lists store customers with email, name, order count and spend. Returns personal data, so this is off by default and must be enabled deliberately. Read-only.

• woocommerce_inventory_diagnostics

  Read-only

  Investigates why a SKU's stock is not what someone expects: resolves the SKU to its product and variations, reports which record actually holds the stock, checks whether stock management is enabled at all, and surfaces the background-queue and log evidence that explains a sync that is not running. Built for 'inventory is not updating'. Read-only.

• woocommerce_inventory_get

  Read-only

  Resolves a SKU to its product or variation and reports the authoritative stock state: managed or not, quantity, status, backorder policy, and which record actually holds the stock. Built for 'why does the site say out of stock' -- it checks the variation as well as the parent, which is where that question usually goes wrong. Read-only.

Showing 10 of 10 tools

• hosting_disk_usage

  Read-only

  Free and used disk space on the filesystem holding the site, plus the size of the site root and of wp-content's largest subdirectories. A nearly-full disk causes failed uploads, failed updates and database write errors, and is worth ruling out early on any 'suddenly broken' report. Read-only.

• hosting_environment_info

  Read-only

  Server-level facts for one site: PHP version and the limits that matter (memory_limit, max_execution_time, upload_max_filesize, post_max_size), loaded PHP extensions, OPcache status, the operating system, and the web server. Read-only. This is server configuration, distinct from wordpress_get_site_info which reports WordPress itself.

• hosting_list_logs

  Read-only

  Finds the log files ServeMCP can read for this site -- the WordPress debug log, PHP error logs, and common host log locations -- with their sizes and last-modified times. Call this before hosting_read_log to find out what exists. Read-only.

• hosting_read_log

  Read-only

  Reads the last N lines of a log file found by hosting_list_logs, newest last, with secrets redacted. Optionally filters to lines matching a term, which is the fast path to 'show me the fatal errors'. Logs frequently contain database credentials and customer personal data in stack traces, so this is OFF BY DEFAULT and its output is redacted. Read-only.

• hosting_recently_modified_files

  Read-only

  Lists files under wp-content modified within the last N hours, newest first. This is one of the highest-value diagnostics available: when a site breaks without explanation, the files that changed just before it are usually the cause, and unexpected recently-modified PHP files are also a primary compromise signal. Reports observed filesystem modification times, which is evidence of a change but not proof of who made it. Read-only.

• wordpress_cron_due_events

  Read-only

  Returns only the cron events that are due or overdue, with how far behind each is. A large or growing backlog here is one of the clearest signals behind 'the site is slow', 'emails stopped sending', or 'orders are stuck' -- WP-Cron only fires on page requests, so a low-traffic site silently stops processing. Read-only.

• wordpress_db_autoload_options

  Read-only

  Lists the largest autoloaded options with their exact sizes and a running total. Autoloaded options are read from the database on EVERY request, so their combined weight is one of the few numbers that reliably correlates with a slow site — WordPress itself flags totals above 800KB. This gives the per-option breakdown that makes the total actionable, rather than just the number. Read-only.

• wordpress_db_health

  Read-only

  Reports total database size and runs MySQL's own CHECK TABLE across the WordPress tables, reporting any that are not OK. Read-only. This uses WP-CLI's structured subcommands, not raw SQL -- ServeMCP does not expose arbitrary queries.

• wordpress_db_orphaned_metadata

  Read-only

  Counts post, comment and term metadata rows whose parent no longer exists. These accumulate when plugins are removed or posts are hard-deleted, and on an old site they can be a large fraction of the database. Reports counts only and deletes nothing — cleaning them up is a write this integration does not offer, because a plugin can legitimately store metadata against ids it manages itself. Read-only.

• wordpress_db_search

  Read-only

  Searches post content, titles and option values for a string and reports where it appears, with counts per table. Built for questions ordinary WordPress search cannot answer: finding a hardcoded old domain, a stray tracking script, or which option holds a value. Uses the read-only credential and returns bounded results. Read-only.

Showing 10 of 10 tools

• cpanel_provision_readonly_db_user

  Write

  Destructive

  Creates a MySQL user through cPanel with SELECT and nothing else, granted on one database, and stores its credentials encrypted for the database tools to use. Run this once per site to enable the wordpress_db_* query tools. The point is that the resulting credential physically CANNOT write, and specifically has no FILE privilege — so `SELECT ... INTO OUTFILE` (which writes a webshell) and `LOAD_FILE()` (which reads arbitrary server files) are impossible rather than filtered. That is a guarantee from MySQL rather than from our own parsing, which is why database access waited for this. Modifies the hosting account by creating a database user.

• hosting_file_delete

  Write

  Destructive

  Deletes one file under wp-content/, after copying it to a checkpoint so it can be restored. DESTRUCTIVE. Refuses directories — removing a directory tree is not something this offers, because the blast radius of a wrong path is unbounded. Modifies the live site.

• hosting_file_metadata

  Read-only

  Size, permissions, owner and modification time for one file or directory inside the site root, without reading its contents. Useful for checking whether a file changed recently, or why it is not writable. Read-only.

• hosting_file_patch

  Write

  Destructive

  Replaces one exact occurrence of a string in a file, leaving the rest untouched. Safer than hosting_file_write for a targeted change — fixing a typo, changing a constant — because it cannot accidentally discard the rest of the file. Fails if the search string is absent or appears more than once, so the change is unambiguous. Takes a checkpoint first. Modifies the live site.

• hosting_file_permissions_get

  Read-only

  Reads the octal mode, owner and group of a file or directory, and says whether the SSH user can write to it. The usual answer to 'the update failed' and 'the media upload failed' is here. Read-only.

• hosting_file_permissions_set

  Write

  Destructive

  Sets the octal mode of one file or directory under wp-content/. Restricted to a safe set of modes: 644 and 664 for files, 755 and 775 for directories. World-writable modes such as 777 are refused outright — they are a common bad fix for an upload problem and they let any other account on a shared host modify the site. Modifies the live site.

• hosting_file_write

  Write

  Destructive

  Writes content to a file under wp-content/, replacing it entirely, after taking a checkpoint of the current version. Creates the file if it does not exist. DESTRUCTIVE: this replaces the whole file, not part of it — use hosting_file_patch to change one section. Writing to a PHP file that WordPress loads can take the site down immediately; the tool verifies WordPress still bootstraps afterwards and reports if it does not.

• hosting_file_write_preview

  Read-only

  Shows exactly what a write would change without changing anything: whether the file exists, its current size and a diff-style summary of the replacement. Call this before hosting_file_write when the content is generated or the file is important, so the change can be described before it is made. Read-only.

• hosting_list_directory

  Read-only

  Lists the contents of one directory inside the site root, with sizes, permissions and modification times. Paths are relative to the WordPress root and confined to it -- traversal outside, and credential files such as wp-config.php, are refused. Read-only.

• hosting_read_file

  Read-only

  Reads a text file inside the site root. Output is capped and secret-looking content is redacted before it leaves the server. wp-config.php is always refused, read included -- it holds the database password and every authentication salt; the safe constants from it are available through wordpress_get_site_info instead. OFF BY DEFAULT: reading arbitrary site files is a meaningful disclosure and should be enabled deliberately. Read-only.

Showing 10 of 10 tools

• wordpress_cache_purge

  Write

  [ADM WordPress] Purges the page caches in front of the site, optionally for one URL, and reports LAYER BY LAYER which ones it actually reached. Different from wordpress_flush_cache, which clears only the object cache and has no effect on a page cache. Some caching plugins offer no command-line purge at all; those are named in the result as not reached rather than being quietly counted as success, because 'the cache is cleared' followed by a stale page is the confusion this exists to prevent. Also regenerates Elementor's CSS when Elementor is active. Low risk — a cache is derived and rebuilds on the next request — but on a busy site it causes a brief load spike. Modifies live site state.

• wordpress_checkpoint_create

  Write

  Copies one plugin or theme directory to a checkpoint on the site's own server, so a change you are about to make by hand can be undone. The write tools create their own checkpoints automatically -- this is for changes made outside ServeMCP. Scoped to a single component and capped at 200MB; a whole site is far too large and needs a real backup. Checkpoints are operation rollback, not backups: they are stored on the site's own server, are scoped to a single component, and expire after 7 days. They do not survive server loss. Modifies the customer's server by writing files.

• wordpress_comment_moderate

  Write

  Destructive

  Approves, holds, spams or trashes one comment. Marking as spam trains the site's spam filter, which is a side effect beyond this one comment. Modifies the live site — approving publishes the comment for all visitors immediately.

• wordpress_comments_list

  Read-only

  Lists comments with their status, author and the post each belongs to. Filter to status='hold' to see the moderation queue. Returns commenter names and email addresses, so this is off by default. Read-only.

• wordpress_core_check_updates

  Read-only

  Asks wordpress.org whether a newer WordPress core version is available for this site. Read-only: it reports what is available and changes nothing. ServeMCP does not perform core updates -- the only honest rollback for one is a full-site backup, which is not yet available.

• wordpress_core_verify_checksums

  Read-only

  Compares every WordPress core file against the official wordpress.org manifest for the installed version and reports mismatches or unexpected files. The strongest single signal that core has been tampered with. Read-only, and slow on large installs. A clean result does not prove a site is uncompromised -- it only covers core files, not plugins, themes or uploads.

• wordpress_flush_cache

  Write

  Flushes the WordPress object cache. Low risk and trivially reversible -- the cache simply repopulates -- but on a busy site it causes a brief load spike as caches rebuild. Has no effect on page caches served by a plugin or CDN. Modifies live site state.

• wordpress_get_checkpoint

  Read-only

  Full detail for one checkpoint, including the manifest recording the state before the change -- previous plugin versions, the prior option value, or the files copied. Read this before restoring, and to recover a previous value you intend to set back by hand. Checkpoints are operation rollback, not backups: they are stored on the site's own server, are scoped to a single component, and expire after 7 days. They do not survive server loss. Read-only.

• wordpress_get_option

  Read-only

  Reads one WordPress option by name. Values are returned both interpreted and raw where they differ, because many plugin options are PHP-serialized. Secret-looking values are redacted before they leave the server -- plugin option blobs routinely contain payment-gateway keys. Read-only.

• wordpress_get_site_info

  Read-only

  Core facts about one WordPress install: version, whether an update is available, multisite status, site and home URLs, environment type, debug configuration, and whether maintenance mode is on. This is the cheapest orientation call for a site you have not looked at yet. Read-only.