WordPress.com MCP tools reference

This document provides a comprehensive mapping of MCP tools available for WordPress.com developers. This is a living document and will be updated as new tools are added or existing ones are modified.

For exact input and output schemas, call the tool itself — every STRAP facade exposes action: list (operation catalog) and action: describe (full JSON Schema per operation). Schemas evolve, so always treat the live describe response as the source of truth.

The tools a given user sees can differ from this list. Availability depends on the site’s plan and hosting platform, the user’s permissions on that site, and the tool settings on their WordPress.com account. Call tools/list against the server for the definitive set available to a specific connection.

How WordPress.com MCP tools are organized

The WordPress.com MCP server exposes two kinds of tools:

• STRAP facade tools: A single MCP tool that wraps a family of related operations behind one entry point. Facades use a uniform action-based interface (action: list | describe | execute) so AI agents discover what’s available, fetch parameter schemas, and execute operations through one tool. This keeps the tool catalog small and predictable.
• Standalone tools: Single-purpose tools that take parameters directly. Used for operations that don’t fit a larger family (e.g., listing the user’s sites, generating a checkout URL).

The same tool catalog serves WordPress.com-hosted sites and self-hosted sites connected through Jetpack. There is no separate Jetpack namespace: Jetpack features like Backup, Scan, Monitor, Newsletter, and Account Protection are operations on the Site facade rather than tools of their own.

⚠️ Safety protocol: All write, update, and delete operations require user confirmation. The agent must (1) describe exactly what it plans to do, (2) ask the user for explicit confirmation, and (3) include the user’s confirmation as user_confirmed: true in the execute params. Write operations are never auto-executed. Some deletions are permanent — categories, tags, and media items have no trash. These need the same user_confirmed: true; the server applies the permanent-delete flag itself.

Action-based interface (STRAP facades)

Every STRAP facade tool accepts the same three top-level inputs:

• action (enum: list / describe / execute): What the agent wants to do.
• list — Discover available operations on this tool. Returns operation names, short descriptions, and disabled-operation reasons.
• describe — Get the full JSON Schema (parameters, types, required fields) for one operation.
• execute — Run an operation.
• operation: The operation name in resource.action form (e.g., posts.create, theme.presets).
• params: Operation-specific parameters. Write operations must include user_confirmed: true.

Most facades also require wpcom_site (a site ID or URL). The wpcom-mcp-account facade is the exception — it operates on the authenticated user.

All operations support an optional include_fields parameter to limit which fields are returned. Use it to keep responses context-efficient.

---

STRAP facade tools

Content Authoring ( wpcom-mcp-content-authoring )

Create, read, update, and delete content on a WordPress.com site: posts, pages, comments, media, categories, tags, block patterns, and content search. Includes block-level editing, so a single section of a page or post can be changed in place, and AI image generation into the media library.

💡 Recommended sequence: Call wpcom-mcp-site-editor-context first (theme.active, theme.presets) so content uses theme-aligned preset slugs (e.g. "primary", "large") instead of hard-coded colors and sizes.

Available operations

Operation	Description
posts.list	List posts with optional filters (status, author, search, taxonomy, date range, ordering, pagination).
posts.get	Get a single post by ID or slug. Falls back to searching pages if a slug doesn’t match a post.
posts.create	Create a new post — creates as draft by default. Write.
posts.update	Update an existing post. Only provided fields change. If status is publish, changes go live immediately. Write.
posts.delete	Move a post to trash. Restorable from WordPress admin within 30 days. Write.
post-sections.list	List a post’s top-level blocks, each with its index, block name, attributes, and a content preview. Returns locking tokens that the replace, insert, and remove operations require.
post-sections.replace	Replace one top-level block of a post, leaving the rest untouched. Target the block by index from post-sections.list and supply the replacement as serialized block markup. Write.
post-sections.insert	Insert one new top-level block into a post at a given index. Supply the block as serialized block markup. Write.
post-sections.remove	Remove one top-level block from a post, leaving the rest untouched. Target the block by index from post-sections.list. Write.
pages.list	List pages with optional filters (parent, status, search, ordering, pagination).
pages.get	Get a single page by ID or slug.
pages.create	Create a new page — creates as draft by default. Supports hierarchical structures and page templates. Write.
pages.update	Update an existing page. Only provided fields change. If status is publish, changes go live immediately. Write.
pages.delete	Move a page to trash. Restorable from WordPress admin within 30 days. Write.
page-sections.list	List a page’s top-level blocks, each with its index, block name, attributes, and a content preview. Returns locking tokens that the replace, insert, and remove operations require.
page-sections.replace	Replace one top-level block of a page, leaving the rest untouched. Target the block by index from page-sections.list and supply the replacement as serialized block markup. Write.
page-sections.insert	Insert one new top-level block into a page at a given index. Supply the block as serialized block markup. Write.
page-sections.remove	Remove one top-level block from a page, leaving the rest untouched. Target the block by index from page-sections.list. Write.
comments.list	List comments with optional filters (status, post, author, search, date range, pagination).
comments.get	Get a single comment by ID.
comments.create	Create a comment on a post. Comments from authenticated users auto-populate author fields. Write.
comments.update	Update an existing comment. If status is approved, changes are visible immediately. Write.
comments.delete	Move a comment to trash. Write.
media.list	List media items with optional filters (mime type, post, author, search, date range, pagination).
media.get	Get a single media item by ID.
media.create	Upload a new media item (image, video, audio, document). Write.
media.generate	Generate an image from a text prompt and save it to the media library. Returns the new media item ID and URL, ready to use as a featured image or in an Image block. Write.
media.update	Update media item metadata (not the file). Changes to alt_text and caption update immediately wherever the media is used. Write.
media.delete	Permanently delete a media item. WordPress.com does not trash attachments, so the file cannot be recovered and any content using it loses the image. Write.
categories.list	List categories with optional filters.
categories.get	Get a single category by ID.
categories.create	Create a new category. Supports hierarchical parent-child relationships. Write.
categories.update	Update an existing category. Changing the slug affects archive URLs immediately and may break links. Write.
categories.delete	Permanently delete a category — taxonomy terms have no trash. Assigned posts move to Uncategorized; child categories are reassigned to the deleted category’s parent. Write.
tags.list	List tags with optional filters. Tag search is case-insensitive.
tags.get	Get a single tag by ID.
tags.create	Create a new tag. Write.
tags.update	Update an existing tag. Changing the slug affects archive URLs immediately. Write.
tags.delete	Permanently delete a tag — removed from all associated posts. Write.
patterns.list	List block patterns available on the site (theme, core, pattern directory).
patterns.get	Get a single block pattern by name, including its block markup.
synced-patterns.list	List the site’s synced (reusable) patterns.
synced-patterns.get	Get a single synced pattern by ID, including its block markup.
content.search	Free-text search across the site’s public content. Searches published content only — for drafts, private, or pending content, use posts.list or pages.list with a status filter.

⚠️ Destructive operations (posts.delete, pages.delete, comments.delete, media.delete, categories.delete, tags.delete) require the agent to fetch and present the item being deleted (title, author, count of affected posts) before requesting confirmation.

💡 Tip: When creating pages, use patterns.list → patterns.get to fetch block patterns and compose full pages from multiple patterns. After every create or update, check the response’s _content_warnings field — WordPress may strip blocks or HTML during save.

💡 Tip: To change one part of an existing page or post, use the section operations rather than pages.update or posts.update. Call page-sections.list or post-sections.list to find the block by index, then replace, insert, or remove that single block. Full-page updates are better suited to new content and complete rewrites.

---

Site Editor Context ( wpcom-mcp-site-editor-context )

Query site design context — theme presets, applied styles, and registered block types. Read-only companion to Content Authoring. Use it before creating or updating content so the markup uses theme-aligned tokens rather than hard-coded values.

This facade uses action: list | describe | get (not execute, since it never writes).

💡 Recommended sequence: theme.active → theme.presets → (optionally) blocks.allowed → then create content via wpcom-mcp-content-authoring.

Available operations

Operation	Description
theme.active	Get the active theme’s stylesheet slug and name. Use the stylesheet value when fetching theme.presets or theme.styles.
theme.presets	Get the site’s design tokens — color palette, font sizes, font families, gradients, spacing scale. Auto-resolves stylesheet from the active theme if omitted.
theme.styles	Get the site’s applied styles from theme.json — block-level overrides and element-level typography/colors. Complements theme.presets: presets are what tokens exist; styles are how they’re applied.
blocks.allowed	List block types registered on the site with name, title, description, category, and style variations. Apply a style variation as is-style-{name}.

💡 Tip: Reference preset slugs in block markup — e.g., has-primary-color or has-large-font-size — rather than inline styles with raw hex or pixel values, so content adapts when the site’s design tokens change.

⚠️ Important: A block being registered does not guarantee its markup survives the REST API save pipeline unchanged. After every create or update via wpcom-mcp-content-authoring, check the _content_warnings field. If markup was stripped, use simpler block alternatives or ask the user how to proceed.

---

Account ( wpcom-mcp-account )

Manage the authenticated user’s WordPress.com account: profile, notifications, achievements, domains, subscriptions and billing, connections, security, and currency. Operates on the calling user; no wpcom_site parameter required.

Available operations

Operation	Description
profile.get	Basic profile (username, email, display name, avatar, locale, timezone), optionally with preferences, stats, account info, social/activity data.
profile.update	Update profile fields (display name, bio, locale, etc.). Write.
notifications.get	Notification preferences across email, push, timeline, and other channels. Includes device list and delivery test.
notifications.update	Update notification settings. Write.
inbox.get	The user’s notification inbox (messages, alerts, mentions, likes, follows). Filter by type, unread, time range.
achievements.get	Earned badges, feats, gamification progress, and trophy case.
domains.list	List the authenticated user’s domains across all sites.
domains.get	Domain details: management capabilities, DNS configuration, DNSSEC, SSL status, maintenance state.
domains.attach	Attach a standalone domain to a site, or move a domain you already own from another WordPress.com site to this one. Optionally sets it as the primary domain. Write.
domains.dns_records	DNS records (A, AAAA, ALIAS, CAA, CNAME, MX, NS, SRV, TXT) for a single domain.
domains.set_primary	Set a custom domain as the primary domain for a site. Write.
connections.get	Social and third-party service connections (list, get details, test health).
security.get	Security status: 2FA, application passwords, active sessions, login history, account age.
subscriptions.get	The user’s WordPress.com subscriptions, with billing history, payment methods, and usage.
subscriptions.renewals.list	Upcoming renewals for the user’s subscriptions.
subscriptions.invoice.get	Retrieve a single invoice.
subscriptions.manage_plan.get_url	Get the URL where the user can manage a plan directly.
subscriptions.stop_renewal	Turn off auto-renewal on a subscription. The subscription stays active until the end of the current term. Write.
subscriptions.resume_renewal	Turn auto-renewal back on for a subscription. Write.
subscriptions.cancel	Cancel a subscription. Write.
subscriptions.reactivate	Reactivate a cancelled subscription. Write.
subscriptions.payment_method.remove	Remove a stored payment method from the account. Write.
currency.preview	Preview the impact of changing account currency (does not commit).
currency.change	Change the account’s billing currency. Applies to new purchases only. Existing subscriptions keep renewing in the currency they were bought in. Write.

---

Site ( wpcom-mcp-site )

Manage a WordPress.com site: settings, statistics, plugins, collaborators, activity log, themes, backups, security scans, and Jetpack module configuration. Requires wpcom_site (site ID or URL).

Available operations

Operation	Description
settings.get	General, writing, reading, discussion, media, permalink, and privacy settings.
settings.update	Update site settings. Write.
statistics.get	Site totals — published posts, pages, subscribers — plus optional views, visitors, posts published, and pages published for a date range. Does NOT include top-posts, referrers, geo, or per-URL breakdowns.
plugin.list	Installed plugins with status, version, update availability, and permissions.
activity.get	Activity log entries (posts, comments, plugin updates, backups, user actions). Reverse-chronological. Defaults to the last 6 months. Filter by activity_group and activity_action.
backup.rewind_status	Jetpack Backup readiness for the site: the backup system state, a non-sensitive summary of stored server credentials, and backup facts including when the last successful backup ran and how the most recent attempt ended.
backup.storage_status	Backup storage used against quota, the size of the most recent backup, the retention window, and whether backups have stopped because storage is full. Covers backup storage only, not the site’s media storage.
scan.status	Jetpack Scan state, last-scan metadata, the live threat list with autofix eligibility, ignored threats, and recently fixed threats.
scan.run	Queue a fresh Jetpack Scan. The scan runs in the background and results appear in scan.status. Write.
theme.list	Search and browse block themes available for the site. Filter by subject category or keyword. Returns screenshots, preview links, and style tags for comparing themes before switching.
theme.set	Switch the active theme. Write.
users.list	List the site’s collaborators with user ID, login, display name, roles, capabilities, and registration date. Supports role filtering, search, sorting, and pagination.
monitor.status / monitor.activate / monitor.deactivate	Jetpack Monitor uptime checks. Activate/deactivate are writes.
newsletter.status / newsletter.get_settings / newsletter.update_settings	Newsletter diagnostics and settings. status returns subscriber counts, recent sends with delivery counts, and whether the site can currently send. get_settings returns the public-facing Newsletter settings. update_settings applies a partial update: pass any subset of fields and the rest are left unchanged. update_settings is a write.
account-protection.status / account-protection.activate / account-protection.deactivate	Jetpack Account Protection. Activate/deactivate are writes.
manage-site.status / manage-site.launch / manage-site.set-visibility	Site lifecycle — coming-soon status, launch, visibility. Writes.

💡 Tip for activity.get: combine activity_group (e.g. ["plugin"]) and activity_action (e.g. ["activated", "deactivated"]) to narrow investigations. Call without filters first to discover what’s available for a given site.

User Management ( wpcom-mcp-user-management )

Manage collaborators on a WordPress.com site: list them, invite new ones, change roles, and remove access. Requires wpcom_site (site ID or URL).

⚠️ Invites reach a real inbox. user.invite and user.resend-invite send email as soon as they execute, so they should never be run to explore or test the tool. user.change-role and user.remove-access return a preview first, and apply only when the call is repeated with user_confirmed: true. Removing access removes the person from that site and does not delete their WordPress.com account.

Available operations

Operation	Description
user.list	List current collaborators with their site-local user ID, login, display name, roles, and capabilities. The user ID returned here is the one user.change-role and user.remove-access expect.
user.pending-invites	List invitations that have been sent but not yet accepted.
user.invite	Invite someone to the site by email address or WordPress.com username, at a chosen role. Sends email. Write.
user.cancel-invite	Cancel a pending invitation. Write.
user.resend-invite	Resend a pending invitation. Sends email. Write.
user.change-role	Change a collaborator’s role. Returns a preview unless user_confirmed: true is passed. Accepts the five standard WordPress roles only. Write.
user.remove-access	Remove a collaborator from the site. Returns a preview unless user_confirmed: true is passed. Irreversible for that site. Write.

Plugin Management ( wpcom-mcp-plugin-management )

Manage plugins on a WordPress.com site across their full lifecycle: search the catalog, install, activate, deactivate, update, and uninstall. plugin.search works at account level and needs no site. Every other operation requires wpcom_site.

Plugin operations need a plan that includes plugin installation. On other sites these operations return an unsupported response rather than an error.

Available operations

Operation	Description
plugin.list	Installed plugins with status, version, update availability, and per-plugin permissions. Includes summary statistics.
plugin.search	Search the WordPress.org and WordPress.com commercial catalogs. Results arrive pre-ranked, so keep that order when presenting them. Account level, no site required.
plugin.install	Install a plugin by WordPress.org slug or plugin file identifier. Write.
plugin.activate	Activate an installed plugin. Write.
plugin.deactivate	Deactivate a single plugin, or every active plugin at once with deactivate_all. Jetpack and Akismet are pinned by WordPress.com and cannot be deactivated. Write.
plugin.update	Update one installed plugin to its latest version. One plugin per call. Write.
plugin.uninstall	Uninstall a plugin. Called without user_confirmed: true it returns a preview of what will be removed, so use that preview to confirm with the user before repeating the call. Write.

Site Editing ( wpcom-mcp-site-editing )

Read and change site structure: templates, template parts, navigation, global styles, and installed themes. Requires wpcom_site (site ID or URL).

Read the current state before any write. The sequence is {entity}.list, then {entity}.get, then {entity}.update. All writes need user_confirmed: true.

Block themes use navigation.* for their menus. Classic themes use menus.* and menu-items.*. Template and template part IDs take the form {theme}//{slug}, for example twentytwentyfive//header.

⚠️ Two deletion behaviours differ here. Deleting a template or template part removes a user customization and restores the theme default, so nothing is lost. Deleting a classic menu or menu item is permanent and has no trash.

Available operations

Operation	Description
templates.list / templates.get / templates.lookup	List block templates, fetch one by ID, or find which template WordPress would use to render a given URL or post type. templates.lookup avoids listing everything when you only need the template behind one page type.
templates.create / templates.update / templates.delete	Create a custom template override, update an existing one, or delete an override to return to the theme default. Changes to index, singular, archive, or 404 templates affect every page using them. Writes.
template-parts.list / template-parts.get	List template parts by area (header, footer, sidebar, uncategorized) and fetch one by ID, including its block markup.
template-parts.create / template-parts.update / template-parts.delete	Create, update, or remove a template part override. Header and footer parts appear on every page of the site, so these carry the widest impact of any operation here. Writes.
navigation.list / navigation.get	List block navigation menus and fetch one, including its block markup. For block themes.
navigation.create / navigation.update	Create a block navigation menu, or update an existing one’s title or content. A navigation referenced by a header template part goes live for all visitors immediately. Writes.
menus.list / menus.get	List classic navigation menus and fetch one, with its location assignments. For classic themes.
menus.create / menus.update / menus.delete	Create a classic menu, update its name or theme location assignments, or delete it. Deleting a menu removes it and all of its items permanently. Writes.
menu-items.list / menu-items.get	List the items in a classic menu, or fetch one item with its title, URL, type, parent, and order.
menu-items.create / menu-items.update / menu-items.delete	Add, change, or remove a classic menu item. Deletion is permanent, and child items are not removed with their parent, so clear those first. Writes.
global-styles.get / global-styles.variations	Read the site’s user-level style customizations in theme.json format, or list the style variation presets the active theme provides. This is the user override layer. For theme defaults use wpcom-mcp-site-editor-context theme.presets.
global-styles.update	Update user-level global styles. Colors, fonts, and spacing change across the whole site. Fetch current styles first and send only the keys you want to change. Write.
themes.list	List installed themes with stylesheet slug, name, author, tags, active status, and whether each is a block theme.

💡 Tip: themes.list here reports what is already installed on the site. To browse themes available to install, use theme.list on the Site facade.

Create Site ( wpcom-mcp-create-site )

Provision a new WordPress.com site, either blank or from a template, for the user to build out with the other MCP tools.

The subdomain is derived from the site title automatically, so there is no separate slug or address to ask for. The workflow is: call site.instructions once to get the runbook, ask the user for a title, derive and check the subdomain, show the resulting URL, then provision only after the user confirms.

Available operations

Operation	Description
site.instructions	Returns the runbook for site creation: the field schema, the subdomain derivation rule, the confirmation policy, and the actions available once the site exists. Call once, before anything else.
subdomain.check	Check whether a candidate subdomain is valid and available. Returns the URL the user would actually receive, which may carry a numeric suffix if the base slug is taken. Show that URL verbatim before asking the user to confirm.
site.provision	Create the site. This provisions a real WordPress.com site, so run it only after the user has confirmed the title and URL. Write.

---

Standalone tools

Tool	What it does
wpcom-user-sites	List the user’s accessible sites across WordPress.com and self-hosted Jetpack-connected sites. Use it to find site IDs before calling site-scoped tools. Supports pagination, search, status and privacy filters, sorting, and optional site metrics.
wpcom-domain-purchase	Search for available domains and generate checkout links for registration. Returns matching domains with prices and pre-built checkout URLs.
wpcom-domain-update-dns-records	Add or remove DNS records (A, AAAA, ALIAS, CAA, CNAME, MX, NS, SRV, TXT) for a single custom domain you manage. Write.
wpcom-domain-restore-default-dns-records	Restore the WordPress.com default A records (apex IPs) or the default www CNAME for a single custom domain. Gated by the “Update DNS records” setting. Write.
wpcom-domain-update-nameservers	Set the nameservers for a single custom domain. Requires the caller to manage the site the domain is connected to. Accepts between 2 and 13 valid nameserver hostnames. Write.
wpcom-domain-set-mail-service	Configure DNS records on a domain for an external mail service: Google Workspace, iCloud Mail, Office 365, or Zoho Mail. Write.
wpcom-checkout-url	Generate a pre-configured checkout URL for one or more products, or for a subscription renewal. The URL takes the user to WordPress.com checkout; payment happens in the browser, not through this tool.
wpcom-plans-list	List WordPress.com plans with prices and per-tier feature lists. Read-only. Useful for surfacing plan options before generating a checkout URL.
wpcom-ai-agent-sites-list	List public WordPress.com sites whose owners have enabled AI Agent Access. Filter by a natural-language topic query or by keywords, matched against site metadata. Discovers opted-in sites; does not search inside one.
wpcom-mcp-jetpack-search-voice	Search a single public, opted-in blog and return the results together with that blog’s voice guidelines. Built for reader-facing questions about a public blog. Short, specific, noun-heavy queries work best.
wpcom-mcp-send-feedback	Send a feature request, bug report, or general feedback about the WordPress.com MCP server to the development team. Takes a type of request, bug, or general, plus plain-text content.

⚠️ The four domain tools change live DNS, and the effects reach past the site. Before any of them, fetch the current records with wpcom-mcp-account → domains.dns_records and describe the diff to the user. Misconfigured records break email and websites. Changing nameservers hands DNS control to another provider, so anything WordPress.com was serving stops unless the new nameservers carry the same records. Setting an external mail service overwrites the domain’s existing MX records, and mail flow stops as soon as the new ones propagate.

---

Safety protocol summary

All write/delete operations enforce a mandatory confirmation flow. The agent must describe the action, get explicit user approval, and pass that approval as user_confirmed: true in the execute params.

Behavior	Read	Create	Update	Delete (trash)	Delete (permanent)
Confirmation required	❌	✅	✅	✅	✅
Reversible	N/A	N/A	Partially (previous values lost)	✅ Within 30 days	❌ Permanent
Default status (content)	N/A	draft	No change	trash	Removed entirely

Permanent deletions — categories, tags, and media items — cannot be undone. They take the same user_confirmed: true as any other write.

Accepted forms of user_confirmed: the boolean true (preferred), or one of the strings "true", "yes", "on", "1". Free-form approval phrases like "yes do it" are rejected — the agent must translate the user’s approval into one of these accepted forms.