The full catalog

179 governed abilities, each off until you say otherwise.

Every WordPress action an agent can perform through MCP, one card at a time. 85 come from core, 94 arrive with optional plugin integrations. Read only or guarded write, capability-gated on every call, and switched off on install.

The catalog, grouped and governed.

Every ability is a real tool in the plugin. Jump to a category, filter by badge, or search by name, then open one to see how it is governed.

Read only

Reads content only. Nothing is changed on your site.

Guarded write

Reads plus conservative writes. Deletes go to Trash where WordPress supports it.

Off until enabled

Every ability starts off. You switch on one at a time, and updates never widen access.

Showing all 179 governed abilities, 85 across WordPress core and 94 from optional integrations.

Content 27

Get post meta

Read only

Read a single allowlisted meta value from a post the agent can edit (scalar only).

View ability

Get all post meta

Read only

Read every allowlisted scalar meta value from a post the agent can edit, returned as a key/value map. Protected, underscore, and non-scalar values are excluded.

View ability

Update post meta

Guarded write

Write a single allowlisted scalar meta value to a post the agent can edit.

View ability

Delete post meta

Guarded write

Delete an allowlisted meta key from a post the agent can edit. Removes all values of that key.

View ability

Get pages

Read only

List pages filtered by status and search term. Each item returns id, title, status, type, slug, link, author {id, display_name}, dates, excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, and allowlisted meta. Set include_content=true to also return full content per item. Response includes total.

View ability

Get page

Read only

Retrieve a single page by ID. Returns id, title, status, type, slug, link, author {id, display_name}, dates, full content (rendered HTML by default, or raw markup via content_format; omitted for password-protected pages), excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, meta (allowlisted scalar values only), and content_length (1.7.4: always present, the real byte length even when include_content is false). Set include_content=false (1.7.4, default true) to skip the content field while still getting content_length.

View ability

Create page

Guarded write

Create and publish a page (requires publish_pages). Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only).

View ability

Update page

Guarded write

Update an existing page by ID (publishing is a separate gate). Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only). (1.7.4) Refuses when the page is owned by a foreign page builder, for the same reason as update-post.

View ability

Trash page

Guarded write

Move a page to trash (recoverable, never permanently deleted).

View ability

Delete page

Guarded write

Permanently delete a page, bypassing the Trash. This cannot be undone - use trash-page to remove a page recoverably instead.

View ability

Get posts

Read only

List posts filtered by type, status, and search term. Each item returns id, title, status, type, slug, link, author {id, display_name}, dates, excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, and allowlisted meta. Set include_content=true to also return full content per item; content_format (rendered or raw) only takes effect when include_content is true. Response includes total.

View ability

Count posts

Read only

Count posts of an allowlisted post type: a total of active (non-trashed) items, plus a breakdown by status (publish, draft, pending, private, future, trash). Trash and auto-draft are shown in the breakdown but excluded from total.

View ability

Get post

Read only

Retrieve a single post by ID. Returns id, title, status, type, slug, link, author {id, display_name}, dates, full content (rendered HTML by default, or raw markup via content_format; omitted for password-protected posts), excerpt, terms grouped by taxonomy, featured_image {id, url, alt} or null, meta (allowlisted scalar values only), and content_length (1.7.4: always present, the real byte length even when include_content is false). Set include_content=false (1.7.4, default true) to skip the content field while still getting content_length, letting an agent judge a large post before fetching it in full.

View ability

Create draft

Guarded write

Create a new draft post. The agent drafts; a human publishes. Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only).

View ability

Create post

Guarded write

Create and publish a post (requires publish capability). Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only).

View ability

Update post

Guarded write

Update an existing post by ID (publishing is a separate gate). Optional: slug, featured_media (attachment id), terms ({taxonomy: [termId]}, replaces existing terms per taxonomy), and meta ({key: value}, allowlisted keys only). (1.7.4) Refuses when the post is owned by a foreign page builder (Elementor, Divi, Beaver Builder, or Avada), since a write here would appear to succeed but have no visible effect.

View ability

Replace in post

Guarded write

Literal find-and-replace inside a post's content. Sanitizes the replacement text and edits only the replaced spans of the body; untouched content is left byte-for-byte as it was, and status is never touched. Reversible via revisions. (1.7.4) Refuses when the post is owned by a foreign page builder, for the same reason as update-post.

View ability

Replace sitewide

Guarded write

Literal find-and-replace across multiple posts, scoped by post type and status. Dry-run by default (previews the match count and which posts would change, writes nothing); pass dry_run:false to apply. Each candidate post is guarded by the same structure-preserving check as replace-in-post, so a match landing inside markup is skipped and reported, not applied. A candidate owned by a foreign page builder is likewise skipped and counted in skipped_builder_owned, not applied. Bounded to 50 posts per call; a larger match set reports truncated:true with the real total. New in 1.7.4.

View ability

Trash post

Guarded write

Move a post to trash (recoverable, never permanently deleted).

View ability

Create content item

Guarded write

Create an item of an allowlisted custom content type (post_type). Drafts unless the type's publish capability is held.

View ability

Update content item

Guarded write

Update an item of an allowlisted custom content type by ID (publishing requires that type's publish capability). (1.7.4) Refuses when the item is owned by a foreign page builder, for the same reason as update-post.

View ability

Delete post

Guarded write

Permanently delete a post, bypassing the Trash. This cannot be undone - use trash-post to remove a post recoverably instead.

View ability

List revisions

Read only

List the revisions of a post the agent can edit (metadata only - no body content).

View ability

Get revision

Read only

Get a single revision of a post the agent can edit, including its body content (rendered or raw) and an optional diff against the post's current content.

View ability

Restore revision

Guarded write

Restore a post to one of its revisions. The current state is first saved as a fresh revision, so the restore is reversible. Refused when revisions are disabled for the post, since the current state could not be preserved and the restore would be irreversible. Since 1.7.4 it also refuses when the post is owned by a foreign page builder, for the same reason as update-post.

View ability

Delete revision

Guarded write

Permanently delete a single revision from a post's history. This cannot be undone (unlike trashing a post, there is no Trash for revisions). The live post is not changed. Requires edit access to the parent post.

View ability

Add post terms

Guarded write

Append terms to a post (does not replace existing terms). Requires edit access to the post and the taxonomy's assign_terms capability.

View ability

Site settings 6

Get activity log

Read only

Reads this plugin's own audit log: each row's ability name, status (started, success, error, denied), acting user id and login, whether the caller is flagged as an agent identity (1.7.4: new is_agent_identity boolean, reflecting either the existing per-user app-password marker or a new per-OAuth-client flag), the argument keys passed, the timestamp, and a short identifier-only detail (an object id or slug, a WP_Error code, or a crashed call's exception class and throw site), or null when none was recorded. Most recent first. Response includes total (the count for the status filter). Keeps identifier-only values (ids, slugs, key names, statuses); never free-text content, argument values, file paths, or network addresses. Requires the manage-options capability.

View ability

Get site settings

Read only

Read a small allowlist of site settings: name, tagline, timezone, date and time formats, week start, and posts per page. Requires the manage-options capability. Never the site URL or admin email.

View ability

Update site settings

Guarded write

Write a small allowlist of site settings, passed as a settings object whose keys are the setting names and values the new values. Accepted keys: blogname (site name), blogdescription (tagline), timezone_string, date_format, time_format, start_of_week (0-6), posts_per_page (1-100). String values are sanitized; the two integer settings are clamped into their legal ranges. Any unrecognized key rejects the entire call with nothing written. It can never change the site URL, admin email, default role, or open registration. Requires manage-options. Off by default.

View ability

Get taxonomies

Read only

List public taxonomies registered on the site.

View ability

Get post types

Read only

List public post types registered on the site. Each type includes a writable flag indicating whether agents may create/update items of that type.

View ability

Get site info

Read only

Retrieve the site name, tagline, URL, and language.

View ability

WooCommerce 52

Appears only while WooCommerce is active, off until you enable it.

List WooCommerce product attributes

Read only

Lists all global WooCommerce product attribute taxonomies with their id, name (label), slug, type, sort order, and archive flag. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce product attribute

Guarded write

Creates a new global WooCommerce product attribute taxonomy from a name (required) plus optional slug, type, sort order, and archive flag. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce product attribute

Guarded write

Updates a global WooCommerce product attribute taxonomy by id, changing only the fields you send. Requires the manage-WooCommerce capability.

View ability

List WooCommerce coupons

Read only

Lists WooCommerce coupons with their id, code, amount, discount type, expiry date, and usage count, plus a total. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce coupon

Read only

Reads one WooCommerce coupon by id: code, amount, discount type, expiry, usage limits, spend limits, product and email restrictions, and other config. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce coupon

Guarded write

Creates a WooCommerce coupon from a code and discount type, with optional amount, usage limits, spend limits, product restrictions, and email restrictions. Returns the full coupon shape. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce coupon

Guarded write

Updates a WooCommerce coupon by id, changing only the fields you send. An empty request body is a no-op success. Returns the full coupon shape. Requires the manage-WooCommerce capability.

View ability

List WooCommerce customers

Read only

Lists WooCommerce customers with their id, email, name, username, order count, and total spent. Customer email is returned in full under the Integrations security disclaimer. Requires the manage-WooCommerce capability, and the list_users capability as of 1.5.0 (a stock WooCommerce Shop Manager does not hold it, so is now denied).

View ability

Get WooCommerce customer

Read only

Reads one WooCommerce customer by id, including email, name, username, order count, total spent, date created, and the full billing address (including phone) and shipping address. Customer PII is returned in full under the Integrations security disclaimer. Requires the manage-WooCommerce capability, and the list_users capability as of 1.5.0 (a stock WooCommerce Shop Manager does not hold it, so is now denied).

View ability

Create WooCommerce customer

Guarded write

Creates a WooCommerce customer from an email and username, with optional first name, last name, and billing/shipping address. Returns the full customer shape including PII under the Integrations security disclaimer. Requires the manage-WooCommerce capability, and the create_users capability as of 1.5.0 (this ability creates a real WordPress user account).

View ability

Update WooCommerce customer

Guarded write

Updates a WooCommerce customer by id, changing only the fields you send. An empty request body is a no-op success. Returns the full customer shape. Requires the manage-WooCommerce capability, and as of 1.6.2 a real user-editing capability too: the object-independent `edit_users` floor plus a per-object `edit_user` check against the specific target account (mirroring `update-user`). As of 1.6.2 it also joins the high-risk locked set, so it stays unreachable until the operator deliberately unlocks the high-risk category.

View ability

List WooCommerce payment gateways

Read only

Lists all registered WooCommerce payment gateways with their id, title, and enabled state. Secret or credential settings are never returned. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce payment gateway

Read only

Reads one WooCommerce payment gateway by id, including its title, description, enabled state, order, and non-secret settings. Credential and key fields are always redacted. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce payment gateway

Guarded write

Updates a WooCommerce payment gateway by id, changing only the fields you send: enabled state, title, description, or display order. Returns the updated gateway shape with secrets redacted. Requires the manage-WooCommerce capability.

View ability

List WooCommerce orders

Read only

Lists WooCommerce orders with their id, number, status, total, currency, date, and customer id, plus a total count. List rows are lean - no billing or shipping details. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce order

Read only

Reads one WooCommerce order by id: line items, totals, status, dates, customer note, and the full customer billing address (including email and phone) and shipping address. Customer PII is returned in full under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce order

Guarded write

Creates a WooCommerce order from optional status, customer id, billing, shipping, and line items. Returns the full order shape including PII under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce order

Guarded write

Updates a WooCommerce order by id, changing only the fields you send. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce order status

Guarded write

Sets the status of a WooCommerce order by id. Accepts both the short form (e.g. "completed") and the wc-prefixed form (e.g. "wc-completed"). Requires the manage-WooCommerce capability.

View ability

List WooCommerce order notes

Read only

Lists all notes on a WooCommerce order by order id. Returns each note's id, text, date, and whether it is customer-facing. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce order note

Guarded write

Adds a note to a WooCommerce order by order id. Optionally marks the note as customer-facing so it appears in the customer's account. Requires the manage-WooCommerce capability.

View ability

List WooCommerce order refunds

Read only

Lists all refunds on a WooCommerce order by order id. Returns each refund's id, amount, reason, and date. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce order refund

Read only

Reads a single refund by refund id. Returns the refund amount, reason, and date. Reason text is returned verbatim under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce order refund

Guarded write

Creates a refund on a WooCommerce order by order id. Accepts an amount, optional reason, and optional line-item breakdown. Reason text is returned verbatim under the Integrations security disclaimer. Requires the manage-WooCommerce capability.

View ability

List WooCommerce products

Read only

Lists WooCommerce products with their id, name, SKU, price, stock status, status, categories, and featured flag, plus a total. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce product

Read only

Reads one WooCommerce product by id, including its description, prices, stock, images, attributes, variation ids, and categories. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce product

Guarded write

Creates a WooCommerce product from a name (required) plus optional type, status, description, prices, SKU, stock, categories, tags, images, and attributes. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce product

Guarded write

Updates a WooCommerce product by id, changing only the fields you send. Requires the manage-WooCommerce capability.

View ability

Delete WooCommerce product

Guarded write

Permanently deletes a WooCommerce product by id. This bypasses the Trash and cannot be undone. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce sales report

Read only

Returns a sales summary for a date range: total sales, order count, net sales, and average order value. Defaults to the current calendar month. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce top sellers report

Read only

Returns the best-selling products for a period (week, month, or year) ordered by quantity sold. Requires the manage-WooCommerce capability.

View ability

Count WooCommerce orders

Read only

Returns order counts broken down by WooCommerce status (pending, processing, on-hold, completed, cancelled, refunded, failed) plus a total of active (non-trashed) orders. HPOS-aware. Requires the manage-WooCommerce capability.

View ability

Count WooCommerce products

Read only

Returns product counts broken down by post status (publish, draft, private, pending, trash) plus a total of active (non-trash) products. Requires the manage-WooCommerce capability.

View ability

List WooCommerce shipping zones

Read only

Lists WooCommerce shipping zones with their id, name, and order. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce shipping zone

Read only

Reads one WooCommerce shipping zone by id, including its name, order, and zone locations. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce shipping zone

Guarded write

Creates a WooCommerce shipping zone from a name and optional order. Returns the full zone shape. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce shipping zone

Guarded write

Updates a WooCommerce shipping zone by id, changing only the fields you send. An empty request body is a no-op success. Returns the full zone shape. Requires the manage-WooCommerce capability.

View ability

List WooCommerce shipping methods

Read only

Lists the shipping methods configured in a WooCommerce shipping zone. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce shipping method

Read only

Reads one shipping method from a WooCommerce shipping zone by zone id and instance id. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce shipping method

Guarded write

Adds a shipping method to a WooCommerce shipping zone. Provide the zone id and method type (e.g. flat_rate, free_shipping, local_pickup). Returns the new method shape. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce shipping method

Guarded write

Updates a shipping method in a WooCommerce shipping zone by zone id and instance id, changing only the fields you send. Returns the updated method shape. Requires the manage-WooCommerce capability.

View ability

List WooCommerce tax rates

Read only

Lists all WooCommerce tax rates across every tax class, returning id, country, state, rate, name, priority, compound flag, shipping flag, order, and class slug for each. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce tax rate

Read only

Reads one WooCommerce tax rate by id, returning id, country, state, rate, name, priority, compound flag, shipping flag, order, and class slug. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce tax rate

Guarded write

Creates a WooCommerce tax rate. Required fields: rate (decimal string). Optional: country, state, name, priority, compound, shipping, order, class slug. Returns the full rate shape. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce tax rate

Guarded write

Updates a WooCommerce tax rate by id, changing only the fields you send. An empty body (only id) is a no-op success. Returns the updated rate shape. Requires the manage-WooCommerce capability.

View ability

List WooCommerce tax classes

Read only

Lists all WooCommerce tax classes including the Standard class, returning name and slug for each. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce tax class

Guarded write

Creates a WooCommerce tax class from a name, with an optional slug. Returns the new class shape. Requires the manage-WooCommerce capability.

View ability

List WooCommerce product variations

Read only

Lists a variable product's variations by parent product id, each with its id, parent id, SKU, price, stock status, and status, plus a total. Requires the manage-WooCommerce capability.

View ability

Get WooCommerce product variation

Read only

Reads one product variation by id, including its parent id, prices, stock, description, image, and its chosen attribute values. A variation that inherits its parent's stock reports manage_stock false and stock_quantity null, not the parent's number. Requires the manage-WooCommerce capability.

View ability

Create WooCommerce product variation

Guarded write

Creates a variation under a variable product (parent product id required) from optional status, description, prices, SKU, stock, image, and attribute values. Requires the manage-WooCommerce capability.

View ability

Update WooCommerce product variation

Guarded write

Updates a product variation by id, changing only the fields you send. Requires the manage-WooCommerce capability.

View ability

Delete WooCommerce product variation

Guarded write

Permanently deletes a product variation by id. This bypasses the Trash and cannot be undone. Requires the manage-WooCommerce capability.

View ability

The Events Calendar 13

Appears only while The Events Calendar is active, off until you enable it.

Get events

Read only

List events via the Events Calendar ORM (tribe_events()), filtered by an optional free-text search term and an optional `status` input. Defaults to publish; draft/pending/future require edit access to events (scoped to the caller's own unless they can edit others' events); private requires read-private access.

View ability

Get event

Read only

Read a single event by ID, including its start/end dates, venue, and organizers.

View ability

Create event

Guarded write

Create an event via the Events Calendar ORM. Requires the edit_tribe_events capability; a publicly-visible status additionally requires publish_tribe_events.

View ability

Update event

Guarded write

Update an event by ID via the Events Calendar ORM. Requires edit access to that event. Status changes route through the same shared status-authority chokepoint as update-post; organizer_ids and all_day map onto the real ORM repository behavior (clearing with an empty array, and un-setting the all-day meta key rather than writing a falsy value).

View ability

Delete event

Guarded write

Trash an event by ID (goes to Trash, matching this plugin's trash-post convention, never a permanent delete). Requires delete access to that event.

View ability

Get venues

Read only

List venues via the Events Calendar ORM (tribe_venues()). Defaults to whatever the caller can already see (publish, plus private with read-private access); draft/pending/future require edit access to venues (scoped to the caller's own unless they can edit others' venues).

View ability

Get venue

Read only

Read a single venue by ID.

View ability

Create venue

Guarded write

Create a venue via the Events Calendar ORM. Requires the edit_tribe_venues capability. Defaults to draft; publish requires the publish_tribe_venues capability.

View ability

Update venue

Guarded write

Update a venue by ID via the Events Calendar ORM. Requires edit access to that venue. Setting status to publish requires the publish_tribe_venues capability.

View ability

Get organizers

Read only

List organizers via the Events Calendar ORM (tribe_organizers()). Defaults to whatever the caller can already see (publish, plus private with read-private access); draft/pending/future require edit access to organizers (scoped to the caller's own unless they can edit others' organizers).

View ability

Get organizer

Read only

Read a single organizer by ID.

View ability

Create organizer

Guarded write

Create an organizer via the Events Calendar ORM. Requires the edit_tribe_organizers capability. Defaults to draft; publish requires the publish_tribe_organizers capability.

View ability

Update organizer

Guarded write

Update an organizer by ID via the Events Calendar ORM. Requires edit access to that organizer. Setting status to publish requires the publish_tribe_organizers capability.

View ability

More abilities and integrations are on the way. The catalog grows; the governance model stays the same.

Enable one ability, or a hundred.

Nothing is exposed until you turn it on, and updates never silently widen access. Start with a single read and grow from there.

Every ability off until you enable it, capability-gated on every call.