WordPress core (Pro shim)
These abilities register when WordPress core (Pro shim) is detected on the site and a Pro licence is active. If either is missing the module stays absent rather than failing at call time.
At a glance
WordPress core (Pro shim) registers 23 abilities: 0 that only read, 22 that write, and 1 marked destructive. That split is the practical answer to how much of this module can run unattended. Reads cost nothing and are safe to repeat, so discovery is the part to be generous with; the writes are where review belongs, and the destructive calls stop for an explicit confirmation every single time regardless of which profile is active.
What this module is for
Give AI clients a discoverable toolset for WordPress content, media, menus, users, extensions, settings, snapshots, and Gutenberg workflows.
Before you rely on it: WordPress capabilities, WPPilot safety profiles, and per-ability controls remain authoritative on every request.
Typical workflows
- Research existing content before drafting a new page
- Stage Gutenberg changes for browser review
- Inspect site state and permissions before any write
The WordPress Core integration page covers the same module from the workflow side, with the capability map and the questions worth asking before a first write.
Availability on your site
The WordPress core (Pro shim) module needs three things at once: WPPilot Free as the MCP foundation, an active Pro licence, and the companion plugin detected on the site. Miss any one and the module does not register, which is deliberate: an ability that appears in the tool list but fails at call time is worse than an ability that was never offered. What the connected agent can actually call is then narrowed twice more: by the safety profile active on the site, and by the WordPress capabilities of the user behind the credential. A read that succeeds for an administrator can be absent entirely for an editor.
Every write these abilities perform is recorded in the change ledger, and destructive calls can be routed through the approval queue so a person signs off before anything is applied. A successful tool result means the operation returned, not that the front end, the cache, and every dependent template are correct: that still needs a look.
Writes
Gated by the active profile and your WordPress capabilities. Rate limited to 120 per minute per credential.
| Ability | What it does |
|---|---|
wppilot/create-postCreate Post | Creates a WordPress post of any registered post type and returns its ID, permalink, and edit URL. Use this before opening a live builder editor or calling a builder-specific content ability. When Breakdance is active, non-empty content / post_content is gated and rejected unless the user explicitly confirms the raw WordPress write and the re-call sets allow_raw_content_on_breakdance_post:true; leave content empty and use wppilot/breakdance-set-content plus the element abilities for a Breakdance page. Accepts both short names (title, slug, status, content, excerpt, parent, author, date) and WordPress-native aliases (post_title, post_name, post_status, post_content, post_excerpt, post_parent, post_author, post_date). |
wppilot/create-userCreate User | Creates a WordPress account with an explicit role. Critical account creation is blocked by Production Safe and requires explicit confirmation in Developer Full Access. |
wppilot/delete-mediaDelete Media | Permanently deletes a Media Library attachment and its generated files. This is irreversible and requires explicit confirmation through WPPilot safety enforcement. |
wppilot/delete-menu-itemDelete Menu Item | Permanently deletes a classic navigation menu item. Requires explicit confirmation through WPPilot safety enforcement. |
wppilot/get-contentGet WordPress Content | Returns a normalized post, page, attachment, or CPT snapshot with content, author, dates, terms, featured image, permalink, edit URL, and optionally non-protected metadata. |
wppilot/get-mediaGet Media | Returns one attachment with file metadata, generated sizes, alt text, caption, description, parent, and edit URL. |
wppilot/get-page-snapshotGet Page Snapshot | Returns a compact normalized page digest: identity, template, content fingerprints, block outline, builder signals, SEO candidates, and modification state. |
wppilot/get-site-settingsGet Site Settings | Returns a curated, non-secret set of WordPress reading, discussion, locale, date, URL, and front-page settings. |
wppilot/get-userGet User | Returns a WordPress user by ID with roles, safe profile fields, and public capability names. Password hashes, sessions, application passwords, and private user meta are never returned. |
wppilot/import-media-urlImport Media from URL | Safely downloads an HTTP(S) asset through WordPress, validates the resulting upload, creates a Media Library attachment, and optionally sets title, caption, alt text, and a parent post. |
wppilot/list-contentList WordPress Content | Lists posts, pages, attachments, and custom post types with bounded pagination and search. Returns stable summaries for discovery before a targeted read or edit. |
wppilot/list-extensionsList Plugins and Themes | Lists installed plugins and themes with active state, versions, update availability, network activation, and current theme identity. Read-only and does not expose filesystem contents. |
wppilot/list-mediaList Media | Lists Media Library attachments with bounded pagination, filename/title search, MIME filtering, dimensions, alt text, URLs, and parent content. |
wppilot/list-menu-itemsList Navigation Menu Items | Lists one classic navigation menu as an ordered flat collection with parent relationships, object targets, URLs, labels, and CSS classes. |
wppilot/list-menusList Navigation Menus | Lists classic WordPress navigation menus and their registered theme locations. |
wppilot/list-usersList Users | Lists WordPress users with bounded pagination, role/search filters, capabilities, and safe profile fields. Passwords and secrets are never returned. |
wppilot/search-contentSearch Site Content | Searches public WordPress content types and returns ranked, bounded excerpts with edit targets. This is a live lexical search and creates no persistent index. |
wppilot/update-mediaUpdate Media | Partially updates an attachment title, caption, description, alt text, or parent without replacing the underlying file. |
wppilot/update-postUpdate Post | Updates an existing WordPress post of any post type with partial-update semantics. A non-empty content / post_content write to a Breakdance-owned post is gated and rejected unless the user explicitly confirms the raw WordPress write and the re-call sets allow_raw_content_on_breakdance_post:true; use wppilot/breakdance-set-content plus the element abilities for the native canvas. Use this ability for status, title/slug, featured-image, and ordinary-meta changes. Identifies the target via post_id (short alias: id). Accepts both short names (title, slug, status, content, excerpt, parent, author, date) and WordPress-native aliases (post_title, post_name, post_status, post_content, post_excerpt, post_parent, post_author, post_date). |
wppilot/update-site-settingsUpdate Site Settings | Partially updates an allowlisted set of ordinary WordPress settings. Secrets, arbitrary options, rewrite internals, and authentication settings are not accepted. |
wppilot/update-userUpdate User | Partially updates a WordPress account profile, email, password, or role. Critical account changes are blocked by Production Safe and require explicit confirmation in Developer Full Access. |
wppilot/upsert-menu-itemCreate or Update Menu Item | Creates or partially updates a classic navigation menu item. Supports custom URLs and post, page, taxonomy, or other registered object targets. |
Destructive
Marked destructive in the source, so each call needs an explicit confirmation flag, every time.
| Ability | What it does |
|---|---|
wppilot/delete-postDelete Post | Deletes a WordPress post of any post type. By default moves it to the trash; set force=true to bypass the trash and delete permanently. Identifies the target via post_id (short alias: id). |