WP Agent Bridge

How it works

How it works

WP Agent Bridge exposes 53 abilities via the MCP protocol. Each call follows a precise journey, from the MCP client to confirmation, with a safety net at every step.

A call’s journey

Journey of an MCP call to WordPress Animated diagram: a light dot travels through seven steps – MCP Client, Bearer route, Mode/window check, Snapshot, Write, Loopback check, Confirmation. MCP Client Bearer route Mode / window Snapshot Write Loopback Confirmation

The seven steps in detail

1. MCP Client

The AI agent (Claude, GPT, Devin, or any MCP client) sends a JSON-RPC request to the server. The request contains the ability name (e.g. wpab/update-post) and its arguments.

2. Bearer route

The request arrives on the dedicated endpoint /wp-json/wp-agent-bridge/mcp. The server verifies the bearer token (e.g. wpab_****). Without a valid token, the request is rejected with a 401 error.

3. Mode and window check

The plugin checks the current mode (READONLY or APPLY) and the write window state. In READONLY, any write ability is refused. In APPLY, the window must be open (15 to 240 minutes).

4. Snapshot

Before any write, a snapshot of the affected row is captured across six tables: posts, postmeta, options, terms, term_taxonomy, term_relationships. This is the safety net.

5. Write

The write is executed on the database. If the write fails, the snapshot enables automatic rollback. If it succeeds, an operation_id is generated.

6. Loopback verification

After the write, the plugin verifies the site responds with HTTP 200. If the site is broken (500 error, blank page, PHP fatal), the operation is rolled back and the site restored from the snapshot.

7. Confirmation

The response returns ok: true, the operation_id, and the verification result. The agent can then chain the next operation or request a rollback if the result is unsatisfactory.

Two modes, one switch

READONLY / APPLY switch and ability families In READONLY mode (default), write families are greyed out with a lock. On hover or focus, the switch toggles to APPLY and write families regain the accent color. READONLY APPLY Read Write Taxonomies Media Options SEO Diagnostics Snapshots [LOCK] [LOCK] [LOCK]

Text equivalent: In READONLY mode, Read, Options, SEO and Diagnostics families are available. Write, Media and Snapshots families are locked. When switching to APPLY, all families become active. The APPLY window lasts 15 to 240 minutes, then the site reverts to READONLY.

Typical workflow

  1. The agent opens the APPLY window (wpab/open-apply-window).
  2. For each write: dry-run (dry_run=true) then apply (dry_run=false + confirmation_token).
  3. Each write generates an operation_id and a snapshot.
  4. If a problem occurs: wpab/rollback-operation with the operation_id.
  5. At the end: wpab/close-apply-window to return to READONLY.