A clear target makes file work manageable
Give the assistant a file, a directory, and a defined result
File maintenance becomes difficult when an assistant has no clear target or the person responsible for the site cannot see what happened. MCP Abilities – Filesystem exposes focused operations through MCP for a known WordPress file or directory, while the site owner keeps control of the intended result.
That covers inspection, content changes, preservation, relocation, and removal as separate filesystem outcomes. The separation helps the maintainer choose the operation that matches the job and review the recorded activity afterward.
Recommended maintainer sequence
Make one approved file task checkable
The maintainer owns the decision. The assistant carries out the selected filesystem operation, and the sequence keeps the result clear.
01
Name the target and result
Identify the known file or directory and state the result you approve: a new container, replaced content, added content, a preserved copy, a new location, or removal.
02
Inspect before acting
List the intended directory, inspect file information, or read the current contents of a known file when its state determines the right operation.
03
Apply the matching operation
Create a directory, write or append content, copy or move a file, or delete a known file or directory according to the result you approved.
04
Review the recorded activity
Inspect the changelog afterward. It returns recent filesystem activity so you can review what the operation recorded.
Complete capability set
Choose the filesystem outcome that matches the job
The eleven registered operations cover six practical jobs. Each group keeps a different filesystem outcome clear without turning implementation names into the reader’s task list.
01
Locate and inspect
List a directory, inspect file information, or read the current text or binary contents of a known file before deciding what should happen next.
02
Create a directory
Create a directory when the approved maintenance plan needs a new container or destination inside the WordPress root.
03
Replace or add content
Writing replaces the contents of a target with the approved payload. Appending adds approved content without replacing what is already there.
04
Preserve or relocate a file
Copy a known file to its intended destination while preserving the original, or move that known file to its intended destination.
05
Remove an approved target
Delete a known file when removal is approved, or delete a known directory when its removal is approved.
06
Review recorded activity
Inspect recent filesystem activity in the changelog after the work so the recorded operation and its context remain visible.
Security boundaries
Know what the operations will and will not accept
These safeguards define who can use the operations, where they can work, what they can read or write, and what is recorded afterward.
01
Authorization, path, and read limits
Every operation requires a signed-in WordPress user with the manage_options capability. Each supplied path is resolved inside the current WordPress root. File reads block the root wp-config.php, environment files, SSH key names, authorized key files, and common private key or certificate extensions. A read defaults to 256 KB and accepts an explicit limit up to 1 MB.
02
Write and destination guards
Writes, appends, copies, and moves honor DISALLOW_FILE_MODS; a PHP target also honors DISALLOW_FILE_EDIT. The write guard rejects PHP-like target extensions, dangerous executable or script extensions, suspicious filenames, PHP double extensions, disallowed file types, PHP signatures hidden in other file types, and unsafe directives in the root .htaccess. Write and append payloads are limited to 10 MB.
Writes and appends reject WordPress core files under wp-admin and wp-includes. Moves reject sources under those locations. File and directory deletion reject those core locations, and file deletion also rejects the root wp-config.php, .htaccess, and index.php.
03
Backup and deletion rules
Writing or appending over existing content creates a backup by default, but the caller can explicitly disable it. File deletion also creates a backup by default and can explicitly disable it, so the operation has no separate confirmation stage. Copying over an existing destination requires an explicit overwrite choice and backs up that destination. Moving always backs up the source and backs up an existing destination before an explicitly allowed overwrite.
Directory deletion creates no backup. Recursive deletion is off by default and must be explicitly selected. Backup folders older than seven days are eligible for periodic cleanup.
04
Recorded activity
Successful writes, appends, file deletions, directory deletions, copies, and moves append an audit record with the time, operation, path, WordPress user, client address, and supplied context. When applicable, the record also includes the backup, destination, or size change. The changelog returns recent entries for inspection.
Dependencies
What MCP Abilities – Filesystem requires
Five named components make the filesystem operations available. Each has a distinct role.
WordPress 6.9+
WordPress 6.9+Provides the WordPress runtime and native Abilities API required by the filesystem operations.
PHP 8.0+
PHP 8.0+Provides the minimum PHP runtime required by the plugin.
Required
WordPress Abilities APIRegisters the eleven filesystem operations as typed WordPress abilities.
Required
WordPress MCP AdapterTransports registered WordPress abilities to authenticated MCP clients.
Required
MCP Expose AbilitiesExposes the registered abilities through the controlled Devenia MCP surface.
Stable package
Download MCP Abilities – Filesystem for one approved WordPress file change
Download the stable self-hosted ZIP to give an AI assistant a focused route for one approved, reviewable change to a known WordPress file or directory. It is useful when the target and intended result are already clear.
After the download, select the matching filesystem operation and inspect the changelog to review the recorded activity.