WordPress.com MCP tools reference

This document provides a comprehensive mapping of MCP tools available for WordPress.com developers. This is a living document and will be updated as new tools are added or existing ones are modified.

For exact input and output schemas, call the tool itself — every STRAP facade exposes action: list (operation catalog) and action: describe (full JSON Schema per operation). Schemas evolve, so always treat the live describe response as the source of truth.

The tools a given user sees can differ from this list. Availability depends on the site’s plan and hosting platform, the user’s permissions on that site, and the tool settings on their WordPress.com account. Call tools/list against the server for the definitive set available to a specific connection.

How WordPress.com MCP tools are organized

The WordPress.com MCP server exposes two kinds of tools:

• STRAP facade tools: A single MCP tool that wraps a family of related operations behind one entry point. Facades use a uniform action-based interface (action: list | describe | execute) so AI agents discover what’s available, fetch parameter schemas, and execute operations through one tool. This keeps the tool catalog small and predictable.
• Standalone tools: Single-purpose tools that take parameters directly. Used for operations that don’t fit a larger family (e.g., listing the user’s sites, generating a checkout URL).

The same tool catalog serves WordPress.com-hosted sites and self-hosted sites connected through Jetpack. There is no separate Jetpack namespace: Jetpack features like Backup, Scan, Monitor, Newsletter, and Account Protection are operations on the Site facade rather than tools of their own.

⚠️ Safety protocol: Write, update, and delete operations can require user confirmation, depending on the user’s approval settings. Sensitive operations, including permanent deletions and DNS or nameserver changes, always require it. When confirmation is required, the agent must (1) describe exactly what it plans to do, (2) ask the user for explicit confirmation, and (3) include the user’s confirmation as user_confirmed: true in the execute params. Some deletions are permanent — categories, tags, media items, and taxonomy terms have no trash, and neither do post types registered without trash support. These need the same user_confirmed: true; the server applies the permanent-delete flag itself.

Action-based interface (STRAP facades)

Every STRAP facade tool accepts the same three top-level inputs:

• action (enum: list / describe / execute): What the agent wants to do.
• list — Discover available operations on this tool. Returns operation names, short descriptions, and disabled-operation reasons.
• describe — Get the full JSON Schema (parameters, types, required fields) for one operation.
• execute — Run an operation.
• operation: The operation name in resource.action form (e.g., posts.create, theme.presets).
• params: Operation-specific parameters. Write operations must include user_confirmed: true.

Most facades also require wpcom_site (a site ID or URL). The wpcom-mcp-account facade is the exception — it operates on the authenticated user.

All operations support an optional include_fields parameter to limit which fields are returned. Use it to keep responses context-efficient.

---

STRAP facade tools

Content Authoring ( wpcom-mcp-content-authoring )

Create, read, update, and delete content on a WordPress.com site: posts, pages, comments, media, categories, tags, block patterns, synced patterns, and content search. Includes block-level editing, so a single section of a page or post can be changed in place, and AI image generation into the media library. It also covers custom post types — WooCommerce products, portfolio projects, and types added by themes, plugins, or ACF — along with the taxonomies those types use.

💡 Recommended sequence: Call wpcom-mcp-site-editor-context first (theme.active, theme.presets) so content uses theme-aligned preset slugs (e.g. "primary", "large") instead of hard-coded colors and sizes.

Available operations

Operation	Description
posts.list	List posts with optional filters (status, author, search, taxonomy, date range, ordering, pagination).
posts.get	Get a single post by ID or slug. Falls back to searching pages if a slug doesn’t match a post.
posts.create	Create a new post — creates as draft by default. Write.
posts.update	Update an existing post. Only provided fields change. If status is publish, changes go live immediately. Write.
posts.delete	Move a post to trash. Restorable from WordPress admin within 30 days. Write.
post-sections.list	List a post’s top-level blocks, each with its index, block name, block hash, attributes, and a content preview. Returns locking tokens that the replace, insert, move, and remove operations require.
post-sections.replace	Replace one top-level block of a post, leaving the rest untouched. Target the block by index from post-sections.list and supply the replacement as serialized block markup. Write.
post-sections.insert	Insert one new top-level block into a post at a given index. Supply the block as serialized block markup. Write.
post-sections.remove	Remove one top-level block from a post, leaving the rest untouched. Target the block by index from post-sections.list. Write.
post-sections.move	Move one top-level block of a post to a new position in a single write. The block’s markup is kept byte for byte, and gaps between blocks, such as classic HTML, stay where they are. Target the block by index from post-sections.list, confirm it with expected_block_type and expected_block_hash, and give its index after the move in to_index. Write.
pages.list	List pages with optional filters (parent, status, search, ordering, pagination).
pages.get	Get a single page by ID or slug.
pages.create	Create a new page — creates as draft by default. Supports hierarchical structures and page templates. Write.
pages.update	Update an existing page. Only provided fields change. If status is publish, changes go live immediately. Write.
pages.delete	Move a page to trash. Restorable from WordPress admin within 30 days. Write.
page-sections.list	List a page’s top-level blocks, each with its index, block name, block hash, attributes, and a content preview. Returns locking tokens that the replace, insert, move, and remove operations require.
page-sections.replace	Replace one top-level block of a page, leaving the rest untouched. Target the block by index from page-sections.list and supply the replacement as serialized block markup. Write.
page-sections.insert	Insert one new top-level block into a page at a given index. Supply the block as serialized block markup. Write.
page-sections.remove	Remove one top-level block from a page, leaving the rest untouched. Target the block by index from page-sections.list. Write.
page-sections.move	Move one top-level block of a page to a new position in a single write. The block’s markup is kept byte for byte, and gaps between blocks, such as classic HTML, stay where they are. Target the block by index from page-sections.list, confirm it with expected_block_type and expected_block_hash, and give its index after the move in to_index. Write.
content-types.list	List the post types a site has, including custom types registered by themes and plugins. Returns each type’s slug, label, whether it is hierarchical, and its taxonomies. post, page, and attachment are omitted — use posts.*, pages.*, and media.* for those.
content-types.get	Get a single post type by slug, including the features it supports (title, editor, thumbnail, custom fields) and the taxonomies attached to it. Each taxonomy carries the rest_base to send when setting that taxonomy’s terms on an item.
content-items.list	List items of a post type with optional filters (status, author, search, slug, ordering, pagination). Filter by term by sending a taxonomy’s rest_base with a term ID.
content-items.get	Get a single item of a post type by ID. Use context=edit for raw block markup and writable meta.
content-items.create	Create a new item of a post type — creates as draft by default. Post meta, taxonomy terms, and plugin fields such as ACF’s pass through as top-level parameters. Write.
content-items.update	Update an existing item. Only provided fields change. If status is publish, changes go live immediately. Sending a taxonomy field replaces that taxonomy’s whole set of terms on the item, so include the existing term IDs to add one. Write.
content-items.delete	Move an item to trash. A post type registered without trash support fails without force=true, which deletes permanently. Write.
content-terms.list	List the terms of a taxonomy. Pass an item ID to list only the terms that item already has. Identify the taxonomy by its slug, not its rest_base.
content-terms.get	Get a single term of a taxonomy by ID.
content-terms.create	Create a term in a taxonomy. Supports a parent term on hierarchical taxonomies. Write.
content-terms.update	Update an existing term. Renaming a term changes it on every item filed under it. Write.
content-terms.delete	Permanently delete a term — taxonomy terms have no trash. Items filed under it lose the term; on a hierarchical taxonomy, child terms move up to its parent. Write.
comments.list	List comments with optional filters (status, post, author, search, date range, pagination).
comments.get	Get a single comment by ID.
comments.create	Create a comment on a post. Comments from authenticated users auto-populate author fields. Write.
comments.update	Update an existing comment. If status is approved, changes are visible immediately. Write.
comments.delete	Move a comment to trash. Write.
media.list	List media items with optional filters (mime type, post, author, search, date range, pagination).
media.get	Get a single media item by ID.
media.upload	Get a short-lived grant to upload one file directly to WordPress.com storage — the first step of adding a file to the media library. Returns an upload URL, an upload token, and a ready-to-run command. The file bytes travel over HTTPS from wherever the file is, so they are never re-encoded into a tool argument. Offered only when media.create is enabled for the user, because media.create is the step that adds the uploaded file to the media library.
media.create	Add a new media item (image, video, audio, document) to the library from the reference returned by media.upload, from base64 file content, or from a public source_url. A source_url must use https and point to a file up to 50 MB. Private and internal addresses are refused. The filename defaults to the last segment of the URL path. Write.
media.generate	Generate an image from a text prompt and save it to the media library. Returns the new media item ID and URL, ready to use as a featured image or in an Image block. Optional aspect_ratio (16:9, 4:3, 1:1, 3:4, or 9:16) overrides orientation, where landscape produces 4:3. The first model in the generation chain returns the exact ratio; if generation falls back to the second, the result rounds to 3:2, 2:3, or square. Arbitrary pixel dimensions are not supported. Write.
media.update	Update media item metadata (not the file). Changes to alt_text and caption update immediately wherever the media is used. Write.
media.delete	Permanently delete a media item. WordPress.com does not trash attachments, so the file cannot be recovered and any content using it loses the image. Write.
categories.list	List categories with optional filters.
categories.get	Get a single category by ID.
categories.create	Create a new category. Supports hierarchical parent-child relationships. Write.
categories.update	Update an existing category. Changing the slug affects archive URLs immediately and may break links. Write.
categories.delete	Permanently delete a category — taxonomy terms have no trash. Assigned posts move to Uncategorized; child categories are reassigned to the deleted category’s parent. Write.
tags.list	List tags with optional filters. Tag search is case-insensitive.
tags.get	Get a single tag by ID.
tags.create	Create a new tag. Write.
tags.update	Update an existing tag. Changing the slug affects archive URLs immediately. Write.
tags.delete	Permanently delete a tag — removed from all associated posts. Write.
patterns.list	List block patterns available on the site (theme, core, pattern directory).
patterns.get	Get a single block pattern by name, including its block markup.
synced-patterns.list	List the site’s synced (reusable) patterns.
synced-patterns.get	Get a single synced pattern by ID, including its block markup.
synced-patterns.create	Create a synced (reusable) pattern from a title and block markup. The pattern is always published, because a draft synced pattern renders nothing where it’s inserted. Returns the new ID. Insert it into content as <!-- wp:block {"ref":ID} /-->. Write.
synced-patterns.update	Update a synced pattern’s title or block markup by ID. Only provided fields change. The new content appears immediately everywhere the pattern is inserted. Write.
synced-patterns.delete	Move a synced pattern to trash by ID. Every post and page that uses the pattern stops showing it. A force parameter is ignored. The Site Editor has no trash view, so restore a trashed pattern in WP Admin at /wp-admin/edit.php?post_type=wp_block. Write.
content.search	Free-text search across the site’s public content. Searches published content only — for drafts, private, or pending content, use posts.list, pages.list, or content-items.list with a status filter. Filter by subtype to search one type, including a custom post type slug. A result with type post and a subtype other than post or page is a custom post type item — read it with content-items.get, since posts.get cannot address one. A result with type term is a taxonomy term — read it with content-terms.get.

A post type is reachable when it is registered with show_in_rest in the standard wp/v2 namespace. Types outside it, and WordPress or Jetpack internal types, are not addressable here.

posts.create, posts.update, pages.create, and pages.update accept password to protect the item, and an empty string removes it. Reads and writes for posts and pages return password_protected (true or false), never the password itself. A protected item’s content comes back empty unless you read it with context=edit. content-items reads also return password_protected, but in content-items.list it is null for post types without excerpt support, so read the item to get the real value.

⚠️ Destructive operations (posts.delete, pages.delete, content-items.delete, content-terms.delete, comments.delete, media.delete, categories.delete, tags.delete, synced-patterns.delete) require the agent to fetch and present the item being deleted (title, author, count of affected posts) before requesting confirmation.

💡 Tip: When creating pages, use patterns.list → patterns.get to fetch block patterns and compose full pages from multiple patterns. After every create or update, check the response’s _content_warnings field — WordPress may strip blocks or HTML during save.

💡 Tip: To change one part of an existing page or post, use the section operations rather than pages.update or posts.update. Call page-sections.list or post-sections.list to find the block by index, then replace, insert, move, or remove that single block. Full-page updates are better suited to new content and complete rewrites.

---

Site Editor Context ( wpcom-mcp-site-editor-context )

Query site design context — theme presets, applied styles, and registered block types. Read-only companion to Content Authoring. Use it before creating or updating content so the markup uses theme-aligned tokens rather than hard-coded values.

This facade uses action: list | describe | get (not execute, since it never writes).

💡 Recommended sequence: theme.active → theme.presets → (optionally) blocks.allowed → then create content via wpcom-mcp-content-authoring.

Available operations

Operation	Description
theme.active	Get the active theme’s stylesheet slug and name. Use the stylesheet value when fetching theme.presets or theme.styles.
theme.presets	Get the site’s design tokens — color palette, font sizes, font families, gradients, spacing scale. Auto-resolves stylesheet from the active theme if omitted.
theme.styles	Get the site’s applied styles from theme.json — block-level overrides and element-level typography/colors. Complements theme.presets: presets are what tokens exist; styles are how they’re applied.
blocks.allowed	List block types registered on the site with name, title, description, category, and style variations. Apply a style variation as is-style-{name}.

💡 Tip: Reference preset slugs in block markup — e.g., has-primary-color or has-large-font-size — rather than inline styles with raw hex or pixel values, so content adapts when the site’s design tokens change.

⚠️ Important: A block being registered does not guarantee its markup survives the REST API save pipeline unchanged. After every create or update via wpcom-mcp-content-authoring, check the _content_warnings field. If markup was stripped, use simpler block alternatives or ask the user how to proceed.

---

Account ( wpcom-mcp-account )

Manage the authenticated user’s WordPress.com account: profile, notifications, achievements, domains, subscriptions and billing, connections, security, and currency. Operates on the calling user; no wpcom_site parameter required.

Available operations

Operation	Description
profile.get	Basic profile (username, email, display name, avatar, locale, timezone), optionally with preferences, stats, account info, social/activity data.
profile.update	Update profile fields (display name, bio, locale, etc.). Write.
notifications.get	Notification preferences across email, push, timeline, and other channels. Includes device list and delivery test.
notifications.update	Update notification settings. Write.
inbox.get	The user’s notification inbox (messages, alerts, mentions, likes, follows). Filter by type, unread, time range.
achievements.get	Earned badges, feats, gamification progress, and trophy case.
domains.list	List the authenticated user’s domains across all sites.
domains.get	Domain details: management capabilities, DNS configuration, DNSSEC, SSL status, maintenance state.
domains.attach	Attach a standalone domain to a site, or move a domain you already own from another WordPress.com site to this one. Optionally sets it as the primary domain. Write.
domains.dns_records	DNS records (A, AAAA, ALIAS, CAA, CNAME, MX, NS, SRV, TXT) for a single domain.
domains.set_primary	Set a custom domain as the primary domain for a site. Write.
connections.get	Social and third-party service connections (list, get details, test health).
security.get	Security status: 2FA, application passwords, active sessions, login history, account age.
subscriptions.get	The user’s WordPress.com subscriptions, with billing history, payment methods, and usage.
subscriptions.renewals.list	Upcoming renewals for the user’s subscriptions.
subscriptions.invoice.get	Retrieve a single invoice.
subscriptions.manage_plan.get_url	Get the WordPress.com URL where the user can manage or cancel a plan.
subscriptions.stop_renewal	Turn off auto-renewal on a subscription. The subscription stays active until the end of the current term. Write.
subscriptions.resume_renewal	Turn auto-renewal back on for a subscription. Write.
subscriptions.payment_method.remove	Remove a stored payment method from the account. Write.
subscriptions.move_to_site.preview	Preview moving a plan subscription the user owns to another site they administer. Takes subscription_id (from subscriptions.get) and target_site (site URL or numeric ID). Returns can_move, blockers, warnings, other_items (other subscriptions on the source site, such as a domain, each with its own can_move), and a state_token. Changes nothing. Off by default unless the user has enabled all Write tools: the user turns on Move a plan to another site in their MCP tool settings.
subscriptions.move_to_site	Move the plan as previewed. Pass action: "move", because the operation defaults to "preview". Also pass the preview’s state_token, and use also_move_subscription_ids only for other_items the user chose. Returns moved_items. The user must own the plan and administer both sites. Shares the Move a plan to another site toggle with the preview. Write.
currency.preview	Preview the impact of changing account currency (does not commit).
currency.change	Change the account’s billing currency. Applies to new purchases only. Existing subscriptions keep renewing in the currency they were bought in. Write.

---

Site ( wpcom-mcp-site )

Manage a WordPress.com site: settings, statistics, plugins, collaborators, activity log, themes, backups, security scans, and Jetpack module configuration. Requires wpcom_site (site ID or URL).

Available operations

Operation	Description
settings.get	General, writing, reading, discussion, media, permalink, and privacy settings. On Simple sites, reading also returns links_public. reading includes advanced_seo_front_page_description when SEO tools are on, and writing includes jetpack_social_message_template.
settings.update	Update site settings, including discussion settings (default comment status, closing comments on old posts, threading, moderation, link limit, and comment pagination) and feed settings (posts_per_rss, rss_use_excerpt). These work on Simple, Atomic, and self-hosted Jetpack sites. links_public sets whether outbound links on a private site go to their destination directly (true) or pass through the WordPress.com referrer hider (false). It is Simple-only: Atomic and Jetpack sites return setting_not_supported and nothing is written. Set the site language with language, a WordPress locale code such as fr_FR or de_DE_formal. A locale the site can’t use is refused before anything is written. If the call updates other settings and one fails after the language has changed, the error says so. advanced_seo_front_page_description sets the homepage meta description. HTML is stripped, the value is capped at 300 characters, and an empty string clears it. The write is refused while the site’s SEO tools are off, which is the case without a plan that includes them or when another SEO plugin has replaced them. jetpack_social_message_template sets Jetpack Social’s default share message, capped at 8,000 characters; an empty string resets it to the default. The write is refused when the site can’t use message templates (a paid feature; self-hosted sites also need a recent Jetpack or Jetpack Social release) or when sharing is turned off. For the placeholders a template accepts, see Use placeholders in your message. Write.
statistics.get	Site totals — published posts, pages, subscribers — plus optional views, visitors, posts published, and pages published for a date range. Does NOT include top-posts, referrers, geo, or per-URL breakdowns.
plugin.list	Installed plugins with status, version, update availability, and permissions.
activity.get	Activity log entries (posts, comments, plugin updates, backups, user actions). Reverse-chronological. Defaults to the last 6 months. Filter by activity_group and activity_action.
backup.rewind_status	Jetpack Backup readiness for the site: the backup system state, a non-sensitive summary of stored server credentials, and backup facts including when the last successful backup ran and how the most recent attempt ended. Its action parameter also accepts storage_status, credentials_status, logs, and restore_status. restore_status returns the site’s latest restore: whether it’s still running, finished, or failed, the failure reason, and the point in time it restored to.
backup.storage_status	Backup storage used against quota, the size of the most recent backup, the retention window, and whether backups have stopped because storage is full. Covers backup storage only, not the site’s media storage.
backup.credentials_status	Stored server credentials without their secrets, plus a live connection test of the main credential.
scan.status	Jetpack Scan state, last-scan metadata, the live threat list with autofix eligibility, ignored threats, and recently fixed threats.
scan.run	Queue a fresh Jetpack Scan. The scan runs in the background and results appear in scan.status. Write.
theme.list	Search and browse block themes available for the site. Filter by subject category or keyword. Returns screenshots, preview links, and style tags for comparing themes before switching. Each theme includes simple_sites_only. When true, WordPress.com doesn’t offer the theme for download, so theme.set installs it on an Atomic or Jetpack site only if WordPress.org has it. Prefer another theme for those sites.
theme.set	Switch the active theme. Write.
users.list	List the site’s collaborators with user ID, login, display name, roles, capabilities, and registration date. Supports role filtering, search, sorting, and pagination.
monitor.status / monitor.activate / monitor.deactivate	Jetpack Monitor uptime checks. activate and deactivate switch the site’s Monitor module, the Downtime monitoring setting in Jetpack → Settings, and read it back before starting or stopping checks. A site that doesn’t apply the change returns monitor_not_changed. status returns monitor_active (module and checks both on) and dashboard_active (module state, or null when the site can’t be reached). Activate/deactivate are writes.
newsletter.status / newsletter.get_settings / newsletter.update_settings	Newsletter diagnostics and settings. status returns subscriber counts, recent sends with delivery counts, and whether the site can currently send. get_settings returns the public-facing Newsletter settings. update_settings applies a partial update: pass any subset of fields and the rest are left unchanged. update_settings is a write.
newsletter.subscribers.add	Add up to 100 email addresses per call as free newsletter subscribers. Requires consent_confirmed: true, which records that the user has consent to email each address. Duplicates are removed, and invalid addresses are refused by name. Runs the Subscribers screen’s import in the background and returns an import_id. A site runs one import at a time, and an import started in the last hour counts as running. Free-plan sites are capped at 100 imported subscribers in total. Paid and complimentary subscribers are out of scope: point the user to the Substack importer or Import subscribers. Off by default: the user turns on Add newsletter subscribers in their MCP tool settings. Write.
newsletter.subscribers.import-status	Result of an import started by newsletter.subscribers.add, looked up by import_id. Returns status (pending, awaiting, importing, imported, failed, or cancelled), finished, and the added, already_subscribed, and failed counts. Off by default, with its own toggle.
account-protection.status / account-protection.activate / account-protection.deactivate	Jetpack Account Protection. Activate/deactivate are writes.
manage-site.status / manage-site.launch / manage-site.set-visibility	Site lifecycle — coming-soon status, launch, visibility. Writes.

💡 Tip for activity.get: combine activity_group (e.g. ["plugin"]) and activity_action (e.g. ["activated", "deactivated"]) to narrow investigations. Call without filters first to discover what’s available for a given site.

User Management ( wpcom-mcp-user-management )

Manage collaborators on a WordPress.com site: list them, invite new ones, change roles, and remove access. Requires wpcom_site (site ID or URL).

⚠️ Invites reach a real inbox. user.invite and user.resend-invite send email as soon as they execute, so they should never be run to explore or test the tool. user.change-role and user.remove-access return a preview first, and apply only when the call is repeated with user_confirmed: true. Removing access removes the person from that site and does not delete their WordPress.com account.

Available operations

Operation	Description
user.list	List current collaborators with their site-local user ID, login, display name, roles, and capabilities. The user ID returned here is the one user.change-role and user.remove-access expect.
user.pending-invites	List invitations that have been sent but not yet accepted.
user.invite	Invite someone to the site by email address or WordPress.com username, at a chosen role. Sends email. Write.
user.cancel-invite	Cancel a pending invitation. Write.
user.resend-invite	Resend a pending invitation. Sends email. Write.
user.change-role	Change a collaborator’s role. Returns a preview unless user_confirmed: true is passed. Accepts the five standard WordPress roles only. Write.
user.remove-access	Remove a collaborator from the site. Returns a preview unless user_confirmed: true is passed. Irreversible for that site. Write.

Plugin Management ( wpcom-mcp-plugin-management )

Manage plugins on a WordPress.com site across their full lifecycle: search the catalog, install, upload, activate, deactivate, update, and uninstall. plugin.search works at account level and needs no site. Every other operation requires wpcom_site.

Plugin operations need a plan that includes plugin installation. On other sites these operations return an unsupported response rather than an error.

Available operations

Operation	Description
plugin.list	Installed plugins with status, version, update availability, and per-plugin permissions. Includes summary statistics.
plugin.search	Search the WordPress.org and WordPress.com commercial catalogs. Results arrive pre-ranked, so keep that order when presenting them. Each paid result includes a url to WordPress.com checkout for that plugin. Install free or already-owned plugins with plugin.install, and offer the checkout URL only for plugins the site doesn’t own. Account level, no site required.
plugin.install	Install a plugin by WordPress.org slug, marketplace slug, or plugin file identifier. A marketplace plugin installs only when the site has an active purchase. Without one, the call returns purchase_required. The call waits for the plugin to activate before it reports success. If installation is still pending, check plugin.list instead of calling plugin.install again. Write.
plugin.upload	Install a plugin from a ZIP file, or replace an installed one. Provide exactly one source: zip_base64 (base64-encoded ZIP contents, up to 10 MiB decoded, preferred) or zip_url (an existing HTTPS URL, up to 100 MiB). Never publish a private plugin just to get a URL. The ZIP must contain a single plugin directory whose name starts with a lowercase letter or digit and uses only lowercase letters, digits, hyphens, or underscores. Set overwrite: true to replace an installed plugin; it defaults to false. Write.
plugin.activate	Activate an installed plugin. Write.
plugin.deactivate	Deactivate a single plugin, or every active plugin at once with deactivate_all. Jetpack and Akismet are pinned by WordPress.com and cannot be deactivated. Write.
plugin.update	Update one installed plugin to its latest version. One plugin per call. Write.
plugin.uninstall	Uninstall a plugin. Called without user_confirmed: true it returns a preview of what will be removed, so use that preview to confirm with the user before repeating the call. Write.

Site Editing ( wpcom-mcp-site-editing )

Read and change site structure: templates, template parts, navigation, classic theme widgets, global styles, and installed themes. Requires wpcom_site (site ID or URL).

Read the current state before any write. The sequence is {entity}.list, then {entity}.get, then {entity}.update. All writes need user_confirmed: true.

Block themes use navigation.* for their menus. Classic themes use menus.*, menu-items.*, and menu-locations.list for menus, and sidebars.list and widgets.* for widget areas. Template and template part IDs take the form {theme}//{slug}, for example twentytwentyfive//header.

⚠️ Deletion behaviour differs here. Deleting a template or template part removes a user customization and restores the theme default, so nothing is lost. Deleting a block navigation menu moves it to trash. Deleting a classic menu or menu item is permanent and has no trash. Deleting a widget moves it to Inactive Widgets, so it can be restored in WP Admin.

Available operations

Operation	Description
templates.list / templates.get / templates.lookup	List block templates, fetch one by ID, or find which template WordPress would use to render a given URL or post type. templates.lookup avoids listing everything when you only need the template behind one page type.
templates.create / templates.update / templates.delete	Create a custom template override, update an existing one, or delete an override to return to the theme default. Changes to index, singular, archive, or 404 templates affect every page using them. Writes.
template-parts.list / template-parts.get	List template parts by area (header, footer, sidebar, uncategorized) and fetch one by ID, including its block markup.
template-parts.create / template-parts.update / template-parts.delete	Create, update, or remove a template part override. Header and footer parts appear on every page of the site, so these carry the widest impact of any operation here. Writes.
navigation.list / navigation.get	List block navigation menus and fetch one, including its block markup. For block themes.
navigation.create / navigation.update	Create a block navigation menu, or update an existing one’s title or content. A navigation referenced by a header template part goes live for all visitors immediately. Writes.
navigation.delete	Move a block navigation menu to trash by ID. A force parameter is ignored. A Navigation block that used the menu, such as one in the header, shows a fallback (another published menu or a list of pages). The Site Editor has no trash view, so restore a trashed menu in WP Admin at /wp-admin/edit.php?post_type=wp_navigation. Write.
menus.list / menus.get	List classic navigation menus and fetch one, with its location assignments. For classic themes.
menus.create / menus.update / menus.delete	Create a classic menu, update its name or theme location assignments, or delete it. A location holds one menu. Assigning a location that another menu holds is refused with menu_location_taken, which names each location and the menu ID holding it. Retry with replace_locations: true once the user agrees. On menus.update, locations replaces the menu’s whole set of locations. Deleting a menu removes it and all of its items permanently. Writes.
menu-locations.list	List the classic menu locations the active theme registers, such as primary or footer, keyed by slug. Each location includes its label and the ID of its assigned menu (0 if none). Use these slugs for location assignments in menus.create and menus.update. For classic themes.
menu-items.list / menu-items.get	List the items in a classic menu, or fetch one item with its title, URL, type, parent, and order.
menu-items.create / menu-items.update / menu-items.delete	Add, change, or remove a classic menu item. Deletion is permanent, and child items are not removed with their parent, so clear those first. Writes.
sidebars.list / widgets.list	List a classic theme’s widget areas with the widget IDs in each, or list widgets with their area, id_base, instance, and rendered HTML. Filter widgets.list by sidebar. For classic themes.
widgets.create / widgets.update / widgets.delete	Add a widget to an area, change it, move it to another area, or remove it. For new content, use a block widget: id_base: "block" with instance.raw.content. Other widget types accept only the instance.encoded and instance.hash values that widgets.list returned. Pass sidebar on every widgets.update call. An update without it moves the widget to Inactive Widgets on Atomic and self-hosted Jetpack sites. Writes.
global-styles.get / global-styles.variations	Read the site’s user-level style customizations in theme.json format, or list the style variation presets the active theme provides. This is the user override layer. For theme defaults use wpcom-mcp-site-editor-context theme.presets.
global-styles.update	Update user-level global styles. Colors, fonts, and spacing change across the whole site. Fetch current styles first and send only the keys you want to change. Write.
themes.list	List installed themes with stylesheet slug, name, author, tags, active status, and whether each is a block theme.

💡 Tip: themes.list here reports what is already installed on the site. To browse themes available to install, use theme.list on the Site facade.

Create Site ( wpcom-mcp-create-site )

Provision a new WordPress.com site, either blank or from a template, for the user to build out with the other MCP tools.

The subdomain is derived from the site title automatically, so there is no separate slug or address to ask for. The workflow is: call site.instructions once to get the runbook, ask the user for a title, derive and check the subdomain, show the resulting URL, then provision only after the user confirms.

Available operations

Operation	Description
site.instructions	Returns the runbook for site creation: the field schema, the subdomain derivation rule, the confirmation policy, and the actions available once the site exists. Call once, before anything else.
subdomain.check	Check whether a candidate subdomain is valid and available. Returns the URL the user would actually receive, which may carry a numeric suffix if the base slug is taken. Show that URL verbatim before asking the user to confirm.
site.provision	Create the site. This provisions a real WordPress.com site, so run it only after the user has confirmed the title and URL. Write.

---

Standalone tools

Tool	What it does
wpcom-user-sites	List the user’s accessible sites across WordPress.com and self-hosted Jetpack-connected sites. Use it to find site IDs before calling site-scoped tools. Supports pagination, search (matches the site name, URL, or primary domain; a pasted URL such as https://yourgroovydomain.com/blog matches by its exact host), status and privacy filters, sorting, and optional site metrics.
wpcom-domain-purchase	Search for available domains and generate checkout links for registration. Returns matching domains with prices and pre-built checkout URLs.
wpcom-domain-update-dns-records	Add or remove DNS records (A, AAAA, ALIAS, CAA, CNAME, MX, NS, SRV, TXT) for a single custom domain you manage. Write.
wpcom-domain-restore-default-dns-records	Restore the WordPress.com default A records (apex IPs) or the default www CNAME for a single custom domain. Gated by the “Update DNS records” setting. Write.
wpcom-domain-update-nameservers	Set the nameservers for a single custom domain. Requires the caller to manage the site the domain is connected to. Accepts between 2 and 13 valid nameserver hostnames. Write.
wpcom-domain-set-mail-service	Configure DNS records on a domain for an external mail service: Google Workspace, iCloud Mail, Office 365, or Zoho Mail. Write.
wpcom-checkout-url	Generate a pre-configured checkout URL for one or more products, or for a subscription renewal. The URL takes the user to WordPress.com checkout; payment happens in the browser, not through this tool.
wpcom-plans-list	List WordPress.com plans with prices and per-tier feature lists. Read-only. Useful for surfacing plan options before generating a checkout URL.
wpcom-ai-agent-sites-list	List public WordPress.com sites whose owners have enabled AI Agent Access. Filter by a natural-language topic query or by keywords, matched against site metadata. Discovers opted-in sites; does not search inside one.
wpcom-mcp-jetpack-search-voice	Search a single public, opted-in blog and return the results together with that blog’s voice guidelines. Built for reader-facing questions about a public blog. Short, specific, noun-heavy queries work best.
wpcom-mcp-send-feedback	Send a feature request, bug report, or general feedback about the WordPress.com MCP server to the development team. Takes a type of request, bug, or general, plus plain-text content.

⚠️ The four domain tools change live DNS, and the effects reach past the site. Before any of them, fetch the current records with wpcom-mcp-account → domains.dns_records and describe the diff to the user. Misconfigured records break email and websites. Changing nameservers hands DNS control to another provider, so anything WordPress.com was serving stops unless the new nameservers carry the same records. Setting an external mail service overwrites the domain’s existing MX records, and mail flow stops as soon as the new ones propagate.

---

Safety protocol summary

All write/delete operations enforce a mandatory confirmation flow. The agent must describe the action, get explicit user approval, and pass that approval as user_confirmed: true in the execute params.

Behavior	Read	Create	Update	Delete (trash)	Delete (permanent)
Confirmation required	❌	✅	✅	✅	✅
Reversible	N/A	N/A	Partially (previous values lost)	✅ Within 30 days	❌ Permanent
Default status (content)	N/A	draft	No change	trash	Removed entirely

Permanent deletions cannot be undone: categories, tags, media items, taxonomy terms (content-terms.delete), and items of a post type registered without trash support, which need force=true. They take the same user_confirmed: true as any other write.

Accepted forms of user_confirmed: the boolean true (preferred), or one of the strings "true", "yes", "on", "1". Free-form approval phrases like "yes do it" are rejected — the agent must translate the user’s approval into one of these accepted forms.