Governed ability
Replace block
aafm/replace-blockGuarded write
Replace block is a governed ability in Agent Abilities for MCP, a free WordPress plugin that runs an MCP server on your site.
Replace one whole block in a post or page with new block markup, without resending the rest of the content. The block is addressed by path: its index among the top-level blocks, then among that block's inner blocks, counting only real blocks (the blank lines between blocks are not counted), so [2, 0] is the first block inside the third top-level block. Read the post with content_format raw to count them; classic HTML between blocks is not counted. Pass expect_block (for example core/group) to refuse the write if the block at that path is a different one. The plugin leaves other blocks' parsed attributes and HTML unchanged; WordPress may sanitize the whole page on save for users who cannot post unfiltered HTML. Content warnings and strict-mode refusals cover the whole resulting page, not only the new block. Refuses when the post's existing block markup does not survive being re-serialized (for example a block with invalid attribute JSON); use aafm-update-post for those. When WordPress revisions are enabled, the change can be restored from revision history. Refuses when the post is owned by a foreign page builder (Elementor, Divi, Beaver Builder, Avada), since a write here would either have no visible effect or corrupt its own stored markup.
How it is governed
The same model as every ability in the plugin, stated for this one.
- Off until you enable it
Like every ability, Replace block ships switched off. You turn it on one at a time, and an update never switches on a tool it serves.
- Guarded write
Writes stay conservative, and the plugin re-checks the capability before the call runs.
- Capability gated
A connection only sees Replace block if the user you connected can run it, and the plugin checks that capability again before it executes.
- Every call audited
The call is written to the log in your own database, denials included, with the argument keys and the identifiers it touched, never free-text content.
Replace block is one of the 28 governed Content abilities. Browse the other Content abilities in the catalog.
See it in action
An illustrative run. Your real calls and data stay on your own site.
Try it with a prompt
Example requests you could paste to your agent.
In page 54, replace the third block with a new call to action group.
Swap the first block inside the hero group on post 142 for an updated heading, and check it is a core/heading first.
Replace the pricing table block on the plans page without touching the rest of the page.
These are illustrative example prompts. The agent runs them as the user you connected, checked against that user's capabilities and written to your audit log.
Frequently asked
Short answers for Replace block.
Does the agent have to resend the whole page?
No. Replace block names one block by its position and sends only the new markup for that block. The other blocks keep their parsed attributes and HTML.
What stops it from replacing the wrong block?
The agent can pass the block name it expects, such as core/group, and the write is refused if the block at that position is a different one.
Can I undo it?
Yes, when WordPress revisions are on, the change can be restored from revision history. It is off by default, requires edit access to the post, and every call is logged.
Governed by default, from the first call.
Replace block is off until you enable it, scoped to the user you connect, and logged like everything else. Turn on only what you need.
Every ability off until you enable it, capability-gated on every call.