Free61 abilities

WordPress core

These abilities ship in WPPilot Free and register on every install where the plugin is enabled.

At a glance

WordPress core registers 61 abilities: 0 that only read, 60 that write, and 1 marked destructive. That split is the practical answer to how much of this module can run unattended. Reads cost nothing and are safe to repeat, so discovery is the part to be generous with; the writes are where review belongs, and the destructive calls stop for an explicit confirmation every single time regardless of which profile is active.

What this module is for

Give AI clients a discoverable toolset for WordPress content, media, menus, users, extensions, settings, snapshots, and Gutenberg workflows.

Before you rely on it: WordPress capabilities, WPPilot safety profiles, and per-ability controls remain authoritative on every request.

Typical workflows

Research existing content before drafting a new page
Stage Gutenberg changes for browser review
Inspect site state and permissions before any write

The WordPress Core integration page covers the same module from the workflow side, with the capability map and the questions worth asking before a first write.

Availability on your site

The WordPress core module ships in WPPilot Free, so it registers on every install where the plugin is active. No licence check and no dependency detection stand between the agent and these 61 abilities. What the connected agent can actually call is then narrowed twice more: by the safety profile active on the site, and by the WordPress capabilities of the user behind the credential. A read that succeeds for an administrator can be absent entirely for an editor.

Every write these abilities perform is recorded in the change ledger, and destructive calls can be routed through the approval queue so a person signs off before anything is applied. A successful tool result means the operation returned, not that the front end, the cache, and every dependent template are correct: that still needs a look.

Writes

Gated by the active profile and your WordPress capabilities. Rate limited to 120 per minute per credential.

Ability	What it does
`wppilot/activate-plugin`Activate Plugin	Activates an installed plugin by its plugin file (the "dir/file.php" value returned by wppilot/list-extensions or wppilot/get-extension). Activation runs the plugin's own activation hooks and can fatal the site, so it requires explicit confirmation. On multisite, `network_wide: true` activates across the network and needs network administrator rights. The change is recorded in the change ledger and can be rolled back with wppilot/rollback-change.
`wppilot/assign-menu-location`Assign Menu Location	Puts a menu into one of the theme's navigation locations, or clears the location when menu_id is 0. The previous assignment map is captured first, so this is reversible from the change ledger.
`wppilot/assign-terms`Assign Terms	Assigns terms to a post, or removes them. Mode "replace" sets the exact term list, "add" appends, and "remove" detaches. Requires the taxonomy's assign_terms capability and edit access to the post.
`wppilot/attach-media`Attach Media	Links an attachment to a post, which is what the media library shows as "uploaded to" that post. This does not place the media in the post's content and does not set a featured image.
`wppilot/create-comment`Create Comment	Posts a comment, or a reply when parent_id is supplied. Refused when the target post has comments closed. The comment is attributed to the connected account; a different author may only be named by an account that can moderate comments.
`wppilot/create-menu`Create Menu	Creates an empty classic navigation menu and returns its ID. Add entries with wppilot/upsert-menu-item and put it on the site with wppilot/assign-menu-location.
`wppilot/create-post`Create Post	Creates a WordPress post of any registered post type and returns its ID, permalink, and edit URL. Use this before opening a live builder editor or calling a builder-specific content ability. When Breakdance is active, non-empty `content` / `post_content` is gated and rejected unless the user explicitly confirms the raw WordPress write and the re-call sets `allow_raw_content_on_breakdance_post:true`; leave content empty and use `wppilot/breakdance-set-content` plus the element abilities for a Breakdance page. Accepts both short names (title, slug, status, content, excerpt, parent, author, date) and WordPress-native aliases (post_title, post_name, post_status, post_content, post_excerpt, post_parent, post_author, post_date).
`wppilot/create-term`Create Term	Creates a term in a taxonomy. Requires the taxonomy's own edit_terms capability. A parent may only be set on a hierarchical taxonomy.
`wppilot/create-user`Create User	Creates a WordPress account with an explicit role. Critical account creation is blocked by Production Safe and requires explicit confirmation in Developer Full Access.
`wppilot/deactivate-plugin`Deactivate Plugin	Deactivates an active plugin by its plugin file. Deactivation removes whatever the plugin provides — shortcodes stop rendering, blocks disappear from saved content, integrations go dark — so it requires explicit confirmation. WPPilot and WPPilot Pro cannot be deactivated through this ability: doing so would sever the connection carrying the call. The change is recorded in the change ledger and can be rolled back.
`wppilot/delete-comment`Delete Comment	Permanently deletes a comment, bypassing the trash. This cannot be undone and requires explicit confirmation. To reversibly remove a comment, use wppilot/moderate-comment with action "trash" instead.
`wppilot/delete-media`Delete Media	Permanently deletes a Media Library attachment and its generated files. This is irreversible and requires explicit confirmation through WPPilot safety enforcement.
`wppilot/delete-menu`Delete Menu	Permanently deletes a navigation menu and every item in it, and clears any theme location it occupied. There is no trash for menus, so this cannot be undone and requires explicit confirmation.
`wppilot/delete-menu-item`Delete Menu Item	Permanently deletes a classic navigation menu item. Requires explicit confirmation through WPPilot safety enforcement.
`wppilot/delete-plugin`Delete Plugin	Permanently deletes an installed plugin's files from the server. Critical and irreversible: blocked by Production Safe and Read Only, available in Developer Full Access with explicit confirmation. The plugin must be deactivated first — deactivate it with wppilot/deactivate-plugin, confirm the site still behaves, then delete. Data the plugin stored in the database is not removed unless the plugin ships an uninstall routine that WordPress runs.
`wppilot/delete-term`Delete Term	Permanently deletes a term. WordPress has no trash for terms, so this cannot be undone and requires explicit confirmation. Content assigned to the term is not deleted; on a hierarchical taxonomy the term's children are re-parented to its parent.
`wppilot/delete-theme`Delete Theme	Permanently deletes an installed theme's files from the server. Critical and irreversible: blocked by Production Safe and Read Only, available in Developer Full Access with explicit confirmation. The active theme, and the parent of the active theme, are refused — switch away with wppilot/switch-theme first.
`wppilot/detach-media`Detach Media	Unlinks an attachment from its parent post, leaving it unattached in the media library. The file is not deleted.
`wppilot/get-comment`Get Comment	Returns one comment with its content, author display name, status, parent, and post. Email and IP are included only for accounts that may moderate comments.
`wppilot/get-content`Get WordPress Content	Returns a normalized post, page, attachment, or CPT snapshot with content, author, dates, terms, featured image, permalink, edit URL, and optionally non-protected metadata.
`wppilot/get-extension`Get Plugin or Theme	Returns one plugin or theme in detail: the installed copy (version, active state, network activation, update availability, plugin file path) and, when the slug exists on WordPress.org, the directory record (latest version, requirements, last update, homepage). Read-only. Use it to confirm a slug before installing, to read the exact `file` value that wppilot/activate-plugin needs, or to check whether an update is actually available before calling wppilot/update-plugin.
`wppilot/get-media`Get Media	Returns one attachment with file metadata, generated sizes, alt text, caption, description, parent, and edit URL.
`wppilot/get-page-snapshot`Get Page Snapshot	Returns a compact normalized page digest: identity, template, content fingerprints, block outline, builder signals, SEO candidates, and modification state.
`wppilot/get-revision`Get Revision	Returns one revision's title, content, and excerpt, alongside the parent post's current values so the two can be compared directly.
`wppilot/get-site-settings`Get Site Settings	Returns a curated, non-secret set of WordPress reading, discussion, locale, date, URL, and front-page settings.
`wppilot/get-term`Get Term	Returns one term with its name, slug, description, parent, count, and taxonomy.
`wppilot/get-user`Get User	Returns a WordPress user by ID with roles, safe profile fields, and public capability names. Password hashes, sessions, application passwords, and private user meta are never returned.
`wppilot/import-media-url`Import Media from URL	Safely downloads an HTTP(S) asset through WordPress, validates the resulting upload, creates a Media Library attachment, and optionally sets title, caption, alt text, and a parent post.
`wppilot/install-plugin`Install Plugin	Downloads and installs a plugin from the WordPress.org directory by slug, or from an explicit HTTPS ZIP URL. Writes executable code to the server, so it is a critical operation: blocked by Production Safe and Read Only, available in Developer Full Access with explicit confirmation. The plugin is left INACTIVE — review it, then call wppilot/activate-plugin separately. Resolve the slug with wppilot/search-extensions first. Not reversible through the change ledger; remove it with wppilot/delete-plugin.
`wppilot/install-theme`Install Theme	Downloads and installs a theme from the WordPress.org directory by slug, or from an explicit HTTPS ZIP URL. Writes code to the server, so it is a critical operation: blocked by Production Safe and Read Only, available in Developer Full Access with explicit confirmation. The theme is installed but NOT activated — call wppilot/switch-theme separately once the site is ready for it. Not reversible through the change ledger; remove it with wppilot/delete-theme.
`wppilot/list-comments`List Comments	Lists comments, newest first, filtered by post, author, type, search term, or moderation status. Commenter email and IP address are omitted unless the connected account may moderate comments.
`wppilot/list-content`List WordPress Content	Lists posts, pages, attachments, and custom post types with bounded pagination and search. Returns stable summaries for discovery before a targeted read or edit.
`wppilot/list-extensions`List Plugins and Themes	Lists installed plugins and themes with active state, versions, update availability, network activation, and current theme identity. Read-only and does not expose filesystem contents.
`wppilot/list-media`List Media	Lists Media Library attachments with bounded pagination, filename/title search, MIME filtering, dimensions, alt text, URLs, and parent content.
`wppilot/list-menu-items`List Navigation Menu Items	Lists one classic navigation menu as an ordered flat collection with parent relationships, object targets, URLs, labels, and CSS classes.
`wppilot/list-menu-locations`List Menu Locations	Lists the navigation locations the active theme registers, with the human label of each and the menu currently assigned to it. Call this before assigning a menu so the location slug is known rather than guessed.
`wppilot/list-menus`List Navigation Menus	Lists classic WordPress navigation menus and their registered theme locations.
`wppilot/list-revisions`List Revisions	Lists the stored revisions of a post, newest first, marking which entries are autosaves rather than saved revisions. Returns the size of each revision's content and title so an agent can spot where a change happened without fetching every body.
`wppilot/list-taxonomies`List Taxonomies	Lists the taxonomies exposed to agents, with their labels, hierarchy, capability names, and the post types each applies to. Call this before working with terms so the taxonomy slug and hierarchy are known rather than guessed.
`wppilot/list-terms`List Terms	Lists or searches the terms of one taxonomy, newest-count first by default. Supports a name search, parent filtering for hierarchical taxonomies, and bounded pagination.
`wppilot/list-users`List Users	Lists WordPress users with bounded pagination, role/search filters, capabilities, and safe profile fields. Passwords and secrets are never returned.
`wppilot/moderate-comment`Moderate Comment	Approves, holds, marks as spam, unspams, trashes, or restores a comment. Every action is reversible and is recorded in the change ledger with the previous status. Requires moderate_comments.
`wppilot/remove-featured-image`Remove Featured Image	Clears a post's featured image. The attachment itself is not deleted and stays in the media library.
`wppilot/reorder-menu-items`Reorder Menu Items	Sets the order, and optionally the nesting, of a menu's items in one call. Supply the item IDs in the order they should appear; each item's position becomes its index in the list. Items may only be re-parented to another item in the same menu.
`wppilot/restore-post`Restore Post	Restores a trashed post, page, or custom post type back out of the trash. WordPress returns it to the status it held before it was trashed, which is usually draft rather than published — the response names the status it actually landed on.
`wppilot/restore-revision`Restore Revision	Restores a post to one of its revisions. This is a write to the live post: the current state is captured first, so the restore itself appears in the change ledger and can be rolled back.
`wppilot/search-content`Search Site Content	Searches public WordPress content types and returns ranked, bounded excerpts with edit targets. This is a live lexical search and creates no persistent index.
`wppilot/search-extensions`Search Plugins and Themes	Searches the WordPress.org directory for plugins or themes and returns slug, name, version, author, rating, active-install count, last update, and the WordPress/PHP versions each one requires. Read-only: it installs nothing. Call this before wppilot/install-plugin or wppilot/install-theme to resolve a human name ("a contact form plugin") into the exact slug those abilities need, and check the returned `requires` and `requires_php` against wppilot/system-status before installing.
`wppilot/set-featured-image`Set Featured Image	Sets a post's featured image (post thumbnail) to an existing attachment. The attachment must be an image and the post type must support thumbnails.
`wppilot/switch-theme`Switch Theme	Activates an installed theme by its stylesheet directory name. Switching themes changes every page on the front end, drops widget assignments the new theme has no sidebars for, and re-maps navigation menu locations, so it requires explicit confirmation. Themes reporting an error (a missing parent, for instance) are refused. The previous theme is recorded in the change ledger and the switch can be rolled back.
`wppilot/update-comment`Update Comment	Edits a comment's content or author display name. Requires edit access to that specific comment.
`wppilot/update-media`Update Media	Partially updates an attachment title, caption, description, alt text, or parent without replacing the underlying file.
`wppilot/update-menu`Update Menu	Renames an existing classic navigation menu.
`wppilot/update-plugin`Update Plugin	Updates one installed plugin to the latest version its update source offers, refreshing the update check first. Replaces code on the server and can introduce breaking changes, so it requires explicit confirmation. Returns the version before and after; when no update is available it reports that without touching the files. Not reversible through the change ledger — the previous version is not retained.
`wppilot/update-post`Update Post	Updates an existing WordPress post of any post type with partial-update semantics. A non-empty `content` / `post_content` write to a Breakdance-owned post is gated and rejected unless the user explicitly confirms the raw WordPress write and the re-call sets `allow_raw_content_on_breakdance_post:true`; use `wppilot/breakdance-set-content` plus the element abilities for the native canvas. Use this ability for status, title/slug, featured-image, and ordinary-meta changes. Identifies the target via `post_id` (short alias: `id`). Accepts both short names (title, slug, status, content, excerpt, parent, author, date) and WordPress-native aliases (post_title, post_name, post_status, post_content, post_excerpt, post_parent, post_author, post_date).
`wppilot/update-site-settings`Update Site Settings	Partially updates an allowlisted set of ordinary WordPress settings. Secrets, arbitrary options, rewrite internals, and authentication settings are not accepted.
`wppilot/update-term`Update Term	Updates a term's name, slug, description, or parent. Only the supplied fields change.
`wppilot/update-theme`Update Theme	Updates one installed theme to the latest version its update source offers, refreshing the update check first. Overwrites theme files — customizations made directly to a non-child theme are lost — so it requires explicit confirmation. Returns the version before and after. Not reversible through the change ledger.
`wppilot/update-user`Update User	Partially updates a WordPress account profile, email, password, or role. Critical account changes are blocked by Production Safe and require explicit confirmation in Developer Full Access.
`wppilot/upsert-menu-item`Create or Update Menu Item	Creates or partially updates a classic navigation menu item. Supports custom URLs and post, page, taxonomy, or other registered object targets.

Destructive

Marked destructive in the source, so each call needs an explicit confirmation flag, every time.

Ability	What it does
`wppilot/delete-post`Delete Post	Deletes a WordPress post of any post type. By default moves it to the trash; set force=true to bypass the trash and delete permanently. Identifies the target via `post_id` (short alias: `id`).

PreviousYoast SEO NextBlock editor