A defined job is easier to review
Name the target and intended result
Give the AI client one known WordPress file or directory and the result it is meant to produce. The maintainer can judge a specific filesystem change instead of approving an open-ended maintenance brief.
MCP Abilities – Filesystem matches that target to a focused operation, while its access, path, content, backup, and audit rules keep the job inspectable.
Recommended maintainer sequence
Define the job before the client acts
The person responsible for the site defines the target, result, and review standard. This sequence keeps one AI client request concrete without making the software responsible for the editorial decision.
01
Name the target and result
Describe the WordPress file or directory, the intended end state, and what stays outside the request. That boundary gives the maintainer one concrete filesystem change to approve.
02
Inspect what changes the choice
Check the current directory listing, file information, or contents needed to choose responsibly. Stop when those facts settle the target and result.
03
Keep one outcome in scope
Choose whether the request will read, create, write, append, copy, move, or delete the selected target. State any preservation, destination, or removal choice explicitly.
04
Check the result and record
Compare the filesystem state with the intended result, then inspect recent changelog entries for successful work. Retain the context that explains why the change was made.
Filesystem outcomes
Choose the result the client should produce
The eleven registered operations resolve into six practical outcomes. Start with the result, then set its target and the safeguards that apply.
01
Inspect a target
List a directory, inspect a file’s information, or read the current text or binary contents of a file.
02
Create a directory
Create a directory inside the WordPress root for a new destination or working area.
03
Write or append content
Replace existing contents with an approved payload, or add content while leaving what is already there in place.
04
Copy or move a file
Copy a file when the original must remain available, or move it when the intended location changes.
05
Delete a file or directory
Delete a file or directory when the approved result is removal.
06
Inspect the changelog
Read recent entries in the changelog to inspect successful filesystem activity after the job.
Safety before execution
Keep access, paths, and changes inside clear limits
These source rules decide who may act, which paths are reachable, what content is accepted, how overwrites are handled, and what a successful change records.
01
Permission and reach
All eleven operations require a signed-in WordPress user with the manage_options capability. Every supplied path is resolved inside the current WordPress root. Reads reject the root wp-config.php, environment files, SSH key names, authorized key files, and common private key or certificate extensions. A file read defaults to 256 KB and accepts an explicit limit no larger than 1 MB.
02
Content and location filters
File writes, appends, copies, and moves honor DISALLOW_FILE_MODS; a PHP destination also honors DISALLOW_FILE_EDIT. The write guard rejects PHP-like and dangerous executable or script extensions, suspicious filenames, disallowed MIME types and file types, PHP signatures hidden in other file types, PHP double extensions, and unsafe directives in the root .htaccess. Write and append payloads stop at 10 MB.
Writes and appends cannot target WordPress core files under wp-admin or wp-includes. Moves cannot start in those locations. File and directory deletion also reject those core locations; file deletion additionally protects root wp-config.php, .htaccess, and index.php.
03
Overwrite choices have consequences
Writing or appending over existing content creates a backup by default, but the caller can explicitly disable it. File deletion follows the same default and option, so it takes effect without a separate confirmation stage. Copying over an existing destination requires an explicit overwrite choice and backs up that destination. Moving always backs up the source and backs up an existing destination before an explicitly allowed overwrite.
Directory deletion creates no backup. Recursive deletion is off by default and must be explicitly selected. Backup folders older than seven days are eligible for periodic cleanup.
04
A completed job leaves evidence
Successful writes, appends, file deletions, directory deletions, copies, and moves append an audit record with the time, operation, path, WordPress user, client address, and supplied context. When applicable, the record also includes the backup, destination, or size change. Recent entries are available through the changelog.
Dependencies
Know what the MCP connection requires
These named requirements provide the WordPress runtime, typed filesystem operations, and transport used by an AI client.
WordPress 6.9+
WordPress 6.9+Hosts the WordPress execution environment in which the extension is loaded.
PHP 8.0+
PHP 8.0+Sets the minimum PHP environment in which the plugin runs.
Required
WordPress Abilities APIRegisters the package’s typed abilities with the native API.
Required
WordPress MCP AdapterConnects a WordPress ability call to an authenticated MCP client.
Required
MCP Expose AbilitiesPlaces the package’s callable surface behind Devenia’s controlled MCP endpoint.
Download for a defined WordPress job
Get the plugin when the target and result are clear
Download the stable ZIP when a WordPress file or directory and its intended result are already clear. The next job stays focused on that target: an AI client performs the selected filesystem operation through MCP, and successful activity is available for review in the changelog.