Public assessment

mvtandas/wp-cli-mcp (wp-cli-mcp)

wp-cli-mcp · v1.0.0 · scanned Aug 3, 2026

What changed in the harness

Selection accuracy 96→94, token cost up 10%, unconfirmed writes 0%→0%.

Category breakdown

Where the score comes from.

Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.

01Safety

0.0 / 30

0.0 out of 30

02Legibility

19.6 / 30

19.6 out of 30

03Economics

16.2 / 20

16.2 out of 20

04Discoverability

14.9 / 20

14.9 out of 20

Highest-impact fix

Estimated gain +30 points

Add explicit identity and permission preflight tools

Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.

Description evidence

Defects and rewrites.

49 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.

Tool	Defect types	Suggested rewrite
`wp_plugin_install`	no_return_description	Install a WordPress plugin from the official wordpress.org plugin directory. Optionally activate it immediately after installation. Returns the installed plugin's details, including its slug, version, and activation status.
`wp_plugin_activate`	no_return_description	Activate an installed but inactive WordPress plugin. The plugin must already be installed. Returns a confirmation that the plugin was activated successfully.
`wp_plugin_deactivate`	no_return_description	Deactivate an active WordPress plugin without removing it. The plugin files remain on disk and can be reactivated later. Returns a confirmation that the plugin was deactivated.
`wp_plugin_delete`	no_return_description	Permanently delete a WordPress plugin from the filesystem. The plugin must be deactivated first. This cannot be undone. Returns a confirmation that the plugin was deleted.
`wp_theme_install`	no_return_description	Install a WordPress theme from the official wordpress.org theme directory. Optionally activate it immediately. Returns the installed theme's details, including its slug and version.
`wp_theme_activate`	no_return_description	Activate a WordPress theme by slug. The theme must already be installed; activating it sets it as the site's active theme. Returns a confirmation that the theme was activated.
`wp_theme_delete`	no_return_description	Delete a WordPress theme by slug. The theme must not be the active theme. This action cannot be undone. Returns a confirmation that the theme was deleted.
`wp_post_get`	no_return_description	Get a single WordPress post, page, or custom post type entry by its numeric ID. Returns the post's basic fields including title, content, status, date, and type.
`wp_post_update`	no_return_description	Update an existing WordPress post, page, or custom post type entry by ID. Only the fields you supply are changed. Returns a confirmation of the update.
`wp_post_delete`	no_return_description	Delete a WordPress post by ID. By default the post is moved to the trash so it can be restored; set force to true to permanently delete it. Returns a confirmation of the deletion.
`wp_user_list`	no_return_description	List all WordPress users with their user ID, username, email, and assigned role. Useful for inspecting accounts and checking permissions.
`wp_user_create`	params_unexplained no_return_description	Create a new WordPress user account with the given username, email, and role. The role controls the user's permissions (e.g. 'administrator', 'editor', 'subscriber'). Returns the new user's ID and profile details.
`wp_option_get`	no_return_description	Get a WordPress option value from the wp_options table by its key (e.g. 'blogname', 'siteurl'). Returns the stored value, or null if the option does not exist.
`wp_option_update`	no_return_description	Update the value of a stored WordPress option by key, creating it if it does not yet exist. Returns a confirmation that the option was saved.
`wp_menu_list`	no_return_description	List all registered WordPress navigation menus. Returns each menu's name, slug, ID, and assigned locations.
`wp_menu_create`	no_return_description	Create a new WordPress navigation menu with the given name. Returns the new menu's ID and name.
`wp_menu_item_add`	params_unexplained no_return_description	Add a custom link as an item to a WordPress navigation menu. The menu parameter accepts the target menu's name or ID. Returns the new menu item's ID.
`wp_media_import`	no_return_description	Import a media file from a given URL into the WordPress media library, optionally assigning a title. Returns the new attachment's ID and URL.
`wp_db_query`	no_return_description	Execute a raw SQL query against the WordPress database. Intended for read-only SELECT queries. WARNING: Write queries (INSERT, UPDATE, DELETE) can damage the database - use with caution. Returns the query result rows as an array of objects.
`wp_db_export`	no_return_description	Export the entire WordPress database to a SQL dump file. Returns the path to the generated SQL file.
`wp_search_replace`	no_return_description	Search and replace a string across all WordPress database tables. Essential for domain migrations (e.g. staging to production). Handles serialized data correctly. By default only previews changes; set dry_run to false to apply them. Returns the number of replacements made.
`wp_scaffold_theme`	no_return_description	Generate a child theme skeleton with the given slug and optional display name. Returns the path to the created theme directory.
`wp_scaffold_plugin`	no_return_description	Generate a plugin skeleton with the given slug. Returns the path to the created plugin files.
`wp_scaffold_block`	no_return_description	Generate a Gutenberg block skeleton with the given slug, optionally registering it in a named plugin. Returns the path to the created block files.
`wp_rewrite_flush`	no_return_description	Flush and regenerate WordPress rewrite rules. Use this to fix permalink issues, such as 404s after changing permalink structure or registering new post types. Returns a confirmation that rules were flushed.
`wp_cache_flush`	no_return_description	Flush the WordPress object cache to clear all cached values. Useful when cached data is stale after changes. Returns a confirmation that the cache was flushed.
`wp_cli_raw`	no_return_description	Execute any WP-CLI command directly by passing the full command without the 'wp' prefix. Use for operations not covered by other tools. Returns the command's standard output.
`wp_theme_file_read`	no_return_description	Read the contents of a file in a WordPress theme. Use this to inspect template files, functions.php, style.css, or any theme file. Returns the file's full contents as a string.
`wp_theme_file_write`	no_return_description	Create or overwrite a file in a WordPress theme. Use this to edit templates, add new PHP files, modify CSS/JS, or create entirely new theme files. Directories are created automatically. Returns a confirmation that the file was written.
`wp_theme_file_delete`	name_restates_behavior no_return_description	Delete a file from a WordPress theme by its path relative to the theme root (defaults to the active theme). This action cannot be undone. Returns a confirmation that the file was deleted.
`wp_eval`	no_return_description	Execute arbitrary PHP code in the WordPress environment. Has access to all WordPress functions, hooks, and the database. Use for custom queries, data manipulation, or anything not covered by other tools. Returns any output produced via 'echo' in the code.
`wp_sidebar_list`	no_return_description	List all registered widget areas (sidebars) in the active theme. Returns each sidebar's name and ID.
`wp_widget_list`	no_return_description	List all widgets in a specified sidebar, or in all sidebars if no sidebar is given. Returns each widget's ID, name, and the sidebar it belongs to.
`wp_term_create`	no_return_description	Create a new term in a taxonomy (category, tag, or custom taxonomy). The slug is auto-generated from the name if not provided. Returns the new term's ID.
`wp_post_meta_get`	params_unexplained no_return_description	Get a specific meta value for a post by its numeric post ID. Used for custom fields, ACF fields, WooCommerce product data, etc. Returns the stored meta value, or null if the key is not set.
`wp_post_meta_update`	params_unexplained no_return_description	Set or update a meta value for a post by its numeric post ID. Used for custom fields, featured images, WooCommerce data, etc. Creates the meta key if it doesn't exist. Returns a confirmation of the saved value.
`wp_post_meta_list`	no_return_description	List all meta key-value pairs for a post by its numeric ID. Shows custom fields, ACF data, WooCommerce product meta, SEO meta, etc. Returns an array of meta entries.
`wp_site_info`	no_return_description	Get a comprehensive overview of the WordPress installation including version, site URL, site name, active theme, and active plugin count. Great starting point for understanding a site. Returns the overview as a structured object.
`wc_product_list`	no_return_description	List WooCommerce products with ID, title, status, and date. Requires WooCommerce to be installed and active. Returns a JSON array of products.
`wc_product_create`	no_return_description	Create a new WooCommerce product with name, price, and type. Sets up all required product meta automatically. Returns the new product's ID.
`wc_product_get`	no_return_description	Get detailed WooCommerce product info including price, sale price, SKU, and stock status. Returns the product's full details as a structured object.
`wc_product_update_price`	no_return_description	Update WooCommerce product pricing. Set a new regular price and an optional sale price (leave sale_price empty to remove an existing sale). Returns a confirmation of the updated prices.
`wc_order_list`	no_return_description	List WooCommerce orders with ID, status, and date, optionally filtered by order status. Returns a JSON array of orders.
`wc_order_get`	no_return_description	Get detailed WooCommerce order info including total, currency, billing email, and payment method. Returns the order's full details as a structured object.
`wc_coupon_create`	no_return_description	Create a WooCommerce discount coupon with a code, discount type, and amount. Returns the new coupon's ID.
`wp_cron_list`	no_return_description	List all scheduled WordPress cron events with hook name, next run time, and recurrence. Returns an array of scheduled events.
`wp_cron_run`	no_return_description	Manually trigger a specific WordPress cron event by its hook name. Useful for testing scheduled jobs without waiting for the next scheduled run. Returns a confirmation that the event was executed.
`wp_maintenance_mode`	no_return_description	Enable or disable WordPress maintenance mode. When enabled, visitors see a 'Briefly unavailable for maintenance' message. Returns a confirmation of the new maintenance mode state.
`wp_transient_delete_all`	name_restates_behavior no_return_description	Delete all WordPress transients (cached temporary data). Use this to clear stale caches. Returns the number of transients deleted.

Selection evidence

Confusable tool pairs.

10 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.

Tool A	Tool B	Confidence	Why they collide
`wp_post_get`	`wp_post_meta_get`	medium	A task like 'get the price/custom field of product 5' is ambiguous: both names are 'get a post'-flavored, and wp_post_get accepts only an id, so an agent could fetch the whole post (which lacks the meta) instead of the meta value.
`wp_post_update`	`wp_post_meta_update`	medium	Tasks like 'update the price/featured image/SKU of product 5' target post meta, but the near-identical names and shared 'update post' phrasing make wp_post_update a plausible wrong pick since it takes an id and generic post fields.
`wp_theme_delete`	`wp_theme_file_delete`	medium	'Delete the theme's functions.php/style.css' could route to wp_theme_delete (delete the whole theme) because both names match 'delete + theme' and differ only on 'file', with no obvious priority signaling in the definitions.
`wp_theme_list`	`wp_theme_file_list`	medium	A task like 'show me what's in the theme' or 'list my theme's templates' could select wp_theme_list (lists installed themes) instead of wp_theme_file_list (lists files inside a theme); only the word 'file' separates them.
`wp_post_meta_get`	`wp_post_meta_list`	medium	Tasks such as 'get/show the meta for post 5' or 'what custom fields does post 5 have' are ambiguous: get requires a specific key while list returns all pairs, and both names are 'post meta' + get/list with very similar wording.
`wp_plugin_install`	`wp_theme_install`	medium	For 'install <slug> from wordpress.org' where the entity type isn't explicit (e.g. a slug that could be a plugin or theme), the two installers are indistinguishable except for the plugin/theme token, so the wrong one can be chosen.
`wp_plugin_list`	`wp_theme_list`	medium	Generic tasks like 'list what's installed / show me my add-ons or installed components' are ambiguous since both tools list installed items with identical status/version/update fields; an agent may pick plugin_list when themes were meant or vice versa.
`wp_post_list`	`wp_post_meta_list`	low	'List the fields/metadata/data for post 5' could plausibly pull wp_post_list (list posts) instead of wp_post_meta_list, though the meta tool's description about key-value pairs usually disambiguates.
`wp_plugin_deactivate`	`wp_plugin_delete`	low	Vague removal phrasing like 'get rid of / remove the plugin' is ambiguous between deactivating (files remain) and permanently deleting, since both names match 'plugin' and the distinction is only in the descriptions.
`wc_order_list`	`wc_order_get`	low	A task like 'show me the order details/info' without a clear id or plurality could select the single-order getter (which requires an id) instead of the list tool, though the definitions' count/id requirements usually steer correctly.

Compare the field

One score is useful.
The evidence makes it actionable.

Back to the leaderboard