All Available Tools

All Available Tools

Complete reference of every tool in the MCP server.

Site Management

Tool	Parameters	Description
wp_add_site	name, host, username, wp_path, auth_type, port, key_path, site_url	Add a new WordPress site
wp_update_site	name, + any field to change	Update site configuration
wp_get_site	name	Get detailed site information
wp_list_sites	-	List all sites with status
wp_remove_site	name	Remove a site from configuration
wp_test_connection	name, password?	Test SSH and WP-CLI connectivity
wp_export_sites	-	Export all site configurations

Scanning Tools

Tool	Parameters	Description
wp_full_scan	name, password?	Run all scans comprehensively
wp_full_scan_verbose	name, password?	Full scan with detailed command output
wp_verify_core	name, password?	Verify WordPress core file integrity
wp_verify_plugins	name, password?	Check plugins against WordPress.org checksums
wp_scan_mu_plugins	name, password?	Scan must-use plugins for malware + user-hiding
wp_scan_suspicious_plugins	name, password?	Detect plugins with random/malware-like names
wp_scan_hidden_plugins	name, password?	Detect self-hiding plugins (disk vs WP list mismatch)
wp_scan_themes	name, password?	Scan for malware themes, timestamp dirs, webshells
wp_scan_uploads	name, password?	Find dangerous files in uploads directory
wp_scan_malware_patterns	name, password?	Deep scan for malware signatures
wp_scan_recently_modified	name, days?, password?	Find files changed in last N days
wp_scan_webshells	name, password?	Detect file manager backdoors and web shells
wp_check_db_injections	name, password?	Scan database for malicious content

User Audit Tools

Tool	Parameters	Description
wp_list_admins	name, password?	List all administrator users
wp_scan_hidden_admins	name, password?	Find suspicious admin accounts
wp_scan_app_passwords	name, password?	Detect suspicious application passwords
wp_audit_user	name, username, password?	Detailed audit of user activity
wp_find_recent_users	name, days?, password?	Find users created recently
wp_delete_user	name, username, reassign_to, confirm, password?	Delete user with content reassignment

Cleanup Tools

Tool	Parameters	Description
wp_complete_cleanup	name, password?	Full 16-step cleanup + hardening
wp_quarantine_file	name, file_path, password?	Move file to quarantine (auto-learns hash)
wp_read_file	name, file_path, lines?, password?	Read file contents for analysis
wp_remove_mu_plugin	name, filename, password?	Quarantine an MU-plugin
wp_reinstall_core	name, password?	Reinstall WordPress core from official source
wp_reinstall_plugin	name, plugin_slug, password?	Reinstall a plugin from WordPress.org
wp_clean_uploads_php	name, confirm?, password?	Remove all PHP from uploads directory
wp_clean_core_injections	name, dry_run?, password?	Delete injected core files
wp_delete_malware_options	name, dry_run?, password?	Delete malware campaign DB markers
wp_revoke_app_passwords	name, password?	Revoke all application passwords
wp_clean_db_spam	name, password?	Remove spam comments
wp_fix_permissions	name, password?	Set secure file/directory permissions

Security Hardening

Tool	Parameters	Description
wp_reset_passwords	name, password?	Reset all admin passwords
wp_regenerate_salts	name, password?	Regenerate security salts (invalidates sessions)
wp_disable_file_editing	name, password?	Disable theme/plugin editor
wp_harden_wpconfig	name, password?	Apply DISALLOW_FILE_EDIT, FORCE_SSL_ADMIN, etc.
wp_install_security_mu_plugin	name, password?	Install persistent security MU-plugin
wp_full_harden	name, password?	Complete hardening in one command
wp_add_security_htaccess	name, password?	Add security rules to .htaccess
wp_update_all	name, password?	Update core, plugins, and themes

Database Tools

Tool	Parameters	Description
wp_backup_database	name, password?	Create database backup before cleanup

Batch Operations

Tool	Parameters	Description
wp_batch_scan	status_filter?	Scan all (or filtered) sites
wp_batch_update	-	Update all clean sites

Reporting

Tool	Parameters	Description
wp_generate_report	name, anonymize?	Generate detailed cleanup report
wp_generate_case_study	name	Generate anonymized case study for sharing
wp_version	-	Show version information

Threat Intelligence

Tool	Parameters	Description
wp_threat_db_stats	-	Database statistics (signatures, cleanups, hashes)
wp_threat_db_sync	-	Sync community signatures from GitHub
wp_threat_sync_patchstack	-	Sync Patchstack vulnerability feed
wp_threat_sync_wpscan	-	Sync WPScan vulnerability feed
wp_threat_add_signature	name, pattern, type, severity, category, desc	Add custom signature
wp_threat_learn_from_cleanup	file_path, hash, family, description	Learn from a confirmed malware file
wp_threat_check_file	name, file_path, password?	Check file against threat database
wp_threat_export	-	Export signatures for community contribution
wp_threat_top_signatures	limit?	Show most frequently detected signatures
wp_threat_report	-	Generate threat intelligence report

Parameter Notes

• name - The site name you used when calling wp_add_site()
• password? - Required only for password-auth sites. Omit for SSH key auth.
• dry_run? - When True, reports findings without making changes
• confirm? - Safety flag for destructive operations
• anonymize? - When True, removes identifying info from reports