WordPress MCP

Editor form schema of one definition kind (fields and their options). Read it before fields_create_definition / fields_update_definition.

Get cvrt-fields settings. The GitHub update token is returned as { set: boolean }, never raw; also the JSON sync path and whether it is writable.

List all definitions of one kind from every source (database, JSON, PHP) with their _source.

List the available field types (text, date_picker, image, relationship, ...) with their settings.

cvrt-fields status: plugin version, definition counts per kind, whether ACF / Elementor / Elementor Pro are active, JSON sync state and JSON read error.

Copy a JSON-sourced definition into the database. Only JSON definitions can be synced.

Replace a definition as a whole: omitted keys fall back to the kind's defaults (it is not a merge, so send the full definition from fields_get_definition with your changes). The key always comes from the path; a key in the body is ignored. 404 when it does not exist, 409 cvrt_fields_defined_in_code for a PHP definition, 409 cvrt_fields_json_shadowed when a read-only JSON file still overrides the database copy. Returns the stored definition.

Update cvrt-fields settings. github_token is write-only and stored encrypted; a blank or omitted token keeps the stored one. clear_github_token: true deletes it. Returns the settings as fields_get_settings does (token as { set }).

Start a backup of the site's whole fort (files + database) on Bearfort now, e.g. before risky changes. Returns { jobId, status }; follow it with fort_job_get. Audit-logged by Bearfort. Needs BEARFORT_API_KEY.

List the fort's backup generations on Bearfort (newest first, as the worker reports them). Restore is not available here: use the Bearfort dashboard. Needs BEARFORT_API_KEY.

Purge the fort's nginx page cache (through Bearfort's cache-purge service, the same request WordPress itself makes on content changes), flush the fort's own object-cache keys and reset OPcache. details says 'Page cache: purged', or 'requested' if the purger had not run yet (it runs every 2 s). Needs BEARFORT_API_KEY and Bearfort fleet 2026-10-08.3+ (before that the page cache was not actually purged).

Status of a Bearfort job on this fort (backup, restore, migration, ...). with_log:true adds the job's log text. Needs BEARFORT_API_KEY.

Read the fort's server logs: access (nginx), error (nginx), php (PHP errors) or wp-cron (its systemd journal). Filters run on the worker: lines = last N matching lines (1-2000, default 200), grep = keep lines containing this text (case-insensitive literal, no regex), since = drop lines older than this ISO time with zone (stack-trace lines stay with their entry). A missing log is an error, not an empty answer. Secret URL parameters (token=, key=, pass=, ...) and credential shapes are masked. Needs BEARFORT_API_KEY (Bearfort fleet 2026-10-08.3+ for the filters).

Manually (force) run fulfillment for an order: renders the packing slip, creates the ClickUp task, notifies Slack. Bypasses the idempotency guard, so it can create a duplicate ClickUp task. Audit-logged.

Get the cvrt-order-fulfillment plugin settings. Secret values are returned as { set: boolean }, never raw.

Print-queue state: status counts (pending/printing/printed/failed) and the 20 most recent jobs (id, order_id, type, status, attempts, error, created_at, printed_at).

Reset a print job to pending so the agent prints it again. Returns { ok: true }; 404 { ok: false, error } for an unknown job.

Pipeline health: which credentials are set, ClickUp list/assignee, when the print agent last polled, and print-queue counts.

Force an immediate plugin-update check (bypassing PUC's throttle) and report { available, current, remote, error } (plus throttled: true when answered from the cached check, about once per 30s). Read-only: it installs nothing. Apply an update from wp-admin or with mcp_update_plugin (cvrt-mcp-endpoints); the plugin deliberately has no self-update route.

Update cvrt-order-fulfillment settings. Only provide the keys you want to change; omitted keys keep their stored value. Secrets are write-only: a blank/omitted secret keeps the stored value (never wipes it), the literal "__clear" deletes it. Returns the settings as fulfillment_get_settings does (secrets as { set }).

Append a section to a legal document (creates the document if it is still empty). On a generated document the section is kept across regenerations. Returns { slug }, the resolved slug, which is what shortcodes address.

Export the raw consent decision log as CSV for a day range (same optional from/to rules as legal_consent_log_stats). Returns { filename, csv }; the csv is the full file text, ready to write out as-is. Requires manage_options. Logging itself stays off until legal_put_consent's log_enabled is set, which should only happen after the Datenschutz document has an 'einwilligungsnachweis' section describing it. Requires cvrt-legal 0.5.0+.

Get every logged consent decision for one consent_id (the banner's own record of what it asked and what the visitor chose). Requires manage_options. Logging itself stays off until legal_put_consent's log_enabled is set, which should only happen after the Datenschutz document has an 'einwilligungsnachweis' section describing it. Requires cvrt-legal 0.5.0+.

Aggregate consent decision counts by action and banner_version over a day range [from, to) (both optional, default the last 30 days including today; at most 366 days). Returns { from, to, rows: [{ action, banner_version, count }] }. Requires manage_options. Logging itself stays off until legal_put_consent's log_enabled is set, which should only happen after the Datenschutz document has an 'einwilligungsnachweis' section describing it. Requires cvrt-legal 0.5.0+.

Delete a section from a legal document.

Get the self-hosted accessibility tool's settings (enabled, position, colour, tools, statement link) and the tools on offer. Requires cvrt-legal 0.8.0+.

Get the markup repair report: totals per rule (fixed / open) and per page what was repaired and what is still open, i.e. what the site's own markup must fix. Each page is recorded at most once a day, newest 100 pages. Requires cvrt-legal 0.9.0+.

Get the cookie consent banner configuration: enabled, gtm_id, loader_url, ga4_id, ahrefs_key, ads_id, gtm_services { analytics, marketing }, privacy_page, imprint_page, log_enabled, backdrop. Change it with legal_put_consent.

Get one legal document including its ordered sections.

Get the Impressum fields (company, address, register, VAT id, ...) the generator fills into both Impressum and Datenschutz, plus which required ones are missing. Requires cvrt-legal 0.7.0+.

Get a generated document's state: active, library loaded, the selection (ticked modules, options, kept custom sections) and the sections it writes. Requires cvrt-legal 0.7.0+.

Get the imported text library of a generated document (the texts come from websites/bin/legal-v4/privacy, the plugin ships none). Requires cvrt-legal 0.7.0+.

Get which page a legal document is linked to: linked, page_id, the page's post status, and ok (linked AND published). A required document only counts as reachable, and legal_status only turns compliant, when ok is true. Requires cvrt-legal 0.4.2+.

Get cvrt-legal settings. Secret values are returned as { set: boolean }, never raw.

Withdrawal function settings (Widerrufsbutton, § 356a BGB / § 13a FAGG) of cvrt-legal 0.12.1+ on a WooCommerce shop: whether WooCommerce's own withdrawal feature is on, the prescribed labels, single email, item picker, footer link, My Account menu, order actions, which emails carry the link, withdrawal period. 404 when WooCommerce is not active.

Get the social-media section configurator: networks on offer, which are switched on with their profile URLs, and the rendered preview. Requires cvrt-legal 0.6.0+.

Get the imported social-media text modules. Requires cvrt-legal 0.6.0+.

Get the banner theme: preset name, CSS custom property overrides and the rendered CSS.

Link a legal document to its WordPress page (post type page only; posts and products are refused). The rendered document is written into the page's post_content at once (mirrored: true, false while the document is empty) and on every later save, so a deactivated plugin still leaves the text on the page. Linking impressum/datenschutz also fills the consent banner's imprint/privacy link if that is still unset (banner_linked). page_id 0 unlinks. Requires cvrt-legal 0.4.2+.

List all legal document types with their required/filled state and linked page.

Withdrawal requests customers submitted through the shop's withdrawal function, newest first.

Configure the self-hosted accessibility tool (replaces the Ally widget; no third-party request, needs no consent). Merges: omitted keys keep their value. Switching enabled rewrites a generated Datenschutz (section Barrierefreiheits-Werkzeug). Returns the stored settings. Requires cvrt-legal 0.8.0+.

Configure the consent banner and every tracking credential the site uses. Merges: only the keys given change, an omitted key keeps its stored value, an empty string clears an id. Nothing is handed to the browser until the visitor accepts - this plugin owns GTM, GA4, Google Ads and Ahrefs Web Analytics precisely because it owns the gate. Search-engine verification meta tags are NOT here; those belong to cvrt-seo-manager because they fire no request. Returns { saved: true }; read the result back with legal_get_consent.

Replace a whole legal document (every section not listed is gone). Sections are ordered; omit slug to derive it from the heading. The linked page's post_content is rewritten at once. The plugin ships no legal prose - it stores and renders what it is given. Returns { saved: true }.

Set Impressum fields. Merges: only the keys given change; an empty string clears a field. An unknown key, a value outside a select field's options or an invalid email is refused (400); a checkbox field stores "ja" or empty. Needs an imported Impressum library (409 otherwise). Regenerates every generated document and returns the new state as legal_get_facts does. Requires cvrt-legal 0.7.0+.

Tick or untick modules and options, then regenerate the document (the Datenschutz tab over the API). Merges into the stored selection; unknown module or option keys are refused (400). Needs the library imported (409), and for datenschutz the required Impressum facts filled (409). Returns the new state as legal_get_generator does. Sections tied to a switch (Einwilligungsnachweis, Barrierefreiheits-Werkzeug) follow that switch and are not ticked here. Requires cvrt-legal 0.7.0+.

Import the text library of a generated document and regenerate it if active. Give the library inline or as library_file, a local .json path (e.g. websites/bin/legal-v4/privacy/library-datenschutz.json). A library using the 'accessibility' flag needs cvrt-legal 0.8.0+ on the site first.

Change the withdrawal function settings; only the keys given change, an invalid value is a 400 and nothing is written. core_feature switches WooCommerce's own withdrawal feature (409 below WooCommerce 11.1). The two labels are legally prescribed: change them only to the wording the law requires.

Switch social networks and set their profile URLs (plain https only), then rewrite the Datenschutz social-media section; with nothing on, the section is removed. NOT a merge: every network missing from networks is switched off, so always send the full set you want on. Needs the modules imported and a Datenschutz document (409 otherwise). Returns the new state as legal_get_social does. Requires cvrt-legal 0.6.0+.

Import the social-media text modules, inline or as modules_file (websites/bin/legal-v4/social-media/library.json). Careful: importing while nothing is ticked removes an existing section; call legal_put_social with the current networks right after. Requires cvrt-legal 0.6.0+.

Set the banner theme preset and/or individual CSS custom properties. All or nothing: one invalid name or value rejects the whole request (400, names in data.invalid). Returns { saved: true }.

Render a document to normalized HTML without saving. Useful to preview the heading hierarchy and slug ids before writing.

Clear the markup repair report, e.g. after fixing the source, so new page views record afresh. Requires cvrt-legal 0.9.0+.

Restore a generated document to how it was before the generator first wrote it, and stop generating it. Requires cvrt-legal 0.7.0+.

Legal document status for a site: which documents are required, filled and published, plus a single compliant flag. Impressum and Datenschutz are always required; AGB and Widerruf become required when WooCommerce is active.

Update a section. The slug is never rewritten, so shortcodes already placed on a page keep working when a heading is renamed.

Update cvrt-legal settings. github_token (PUC auto-updates on a private repo) is write-only: a blank value keeps the stored one. required_override forces a document required or not ({agb: false}). Returns the settings as legal_get_settings does (secrets as { set }).

List the WordPress sites this server can manage. Every other tool requires a `site` argument set to one of these ids.

Add an item to a menu. A custom link needs url; a page/post or term item needs object_type post_type/taxonomy plus object and object_id of an existing object. Only the given fields are sent; the plugin defaults the rest (object_type custom, parent 0, appended at the end). target, classes, xfn, attr_title, description and status are set afterwards with mcp_update_menu_item.

Add a widget to a sidebar

Assign a menu to a registered theme location (see mcp_get_menu_locations); menu_id 0 unassigns

Assign taxonomy terms to a post. Terms can be IDs, slugs or names; slugs/names that match no term are skipped silently.

Delete multiple media items at once. Returns the deleted and failed IDs.

Get multiple options at once. A missing option comes back as false. Secret-looking values are returned as "[masked]".

Change a user's role (replaces all current roles)

Check for plugin updates now: runs every Plugin Update Checker instance (GitHub-released plugins such as the cvrt-* and wp-woo-pdf-builder; their own check otherwise runs every 12 h) and a fresh wp.org check. plugin limits the PUC run to one plugin. Returns puc_checked (slugs) and updates [{plugin, name, current, new_version, source: puc|wporg}]. Audit-logged. cvrt-mcp-endpoints 1.16.0+.

Force a check for WordPress core, plugin, and theme updates. Returns { core: new core version or null, plugins: count, themes: count }.

Permanently delete all spam and trashed comments

Delete old post revisions, keeping the newest `keep` per post

Create a post of any post type. Meta keys are run through sanitize_key (lowercase a-z0-9_-).

Create a new navigation menu

Create a term in any taxonomy

Create a new WordPress user. Returns { id, username, created }; the password is never echoed.

Delete a post of any post type (moves to trash unless force is true)

Delete a media item and its files

Delete a navigation menu

Delete a menu item. Its children move up to its own parent; the response lists them as reparented.

Delete an option (404 if it does not exist)

Delete a term from any taxonomy (permanent; terms have no trash)

Delete an inactive theme (the active theme is refused)

Delete a user. WITHOUT reassign, all of the user's posts and links are deleted too. The current API user cannot delete itself.

Remove a widget from its sidebar

Flush the WordPress object cache and delete all transients and site transients. Does NOT purge a page cache in front of WordPress (Bearfort forts: the nginx page cache is purged by bearfort-cache.php on content changes; a manual purge goes through the Bearfort API, not this tool).

Flush permalink rewrite rules

Action Scheduler queue (WooCommerce emails, webhooks, PDF jobs): counts per status, past_due pending actions and the 10 most recent failures with their last log message (secret-masked). available:false when Action Scheduler is not loaded. cvrt-mcp-endpoints 1.16.0+.

Audit trail of state-changing MCP calls on this site (cron runs, Action Scheduler runs, update checks), newest first: time, action, user, context (secret-masked). The site keeps the newest 200. cvrt-mcp-endpoints 1.16.0+.

Get WordPress cron status: schedules and the next 50 events (total_events counts all)

Get debug information: WordPress settings, server, database (name, prefix, charset), paths and debug constants

Get full Elementor page build (containers, widgets, settings tree) with element and widget counts

Get theme builder display conditions for an Elementor template (Elementor Pro)

Get a single Elementor element with full settings, its parent id and child ids

Get flat list of all Elementor elements on a page (id, elType, widgetType, parent_id, depth, settings); easier to search/filter than the tree

Get Elementor global kit settings (colors, fonts, typography, spacing, button defaults)

Get Elementor page-level settings (hide title, custom CSS, etc.). Fails if the post is not built with Elementor.

Get a quick site health status and score (100 minus 20 per issue: WP_DEBUG on, no HTTPS, pending updates)

Get detailed media item info (caption, description, filename, filesize, image sizes, attached_to)

Get media library statistics (counts by MIME type, total size, upload path/url, max upload size)

Get a menu with all its items. Each item has id, title, url, type, object, object_id, parent, position, target, classes, xfn, attr_title, description, status.

Get registered menu locations and the menu assigned to each

Get a single option value. Secret-looking values are returned as "[masked]". masked: true says the value (or part of it) was hidden.

Get PHP configuration details

Get plugin health status and available updates

Get detailed schema for a post type (supports, taxonomies, counts per status, labels)

Get all widgets in a sidebar

Get comprehensive system information

List the site's database tables (current table prefix only) with data/index size in MB and approximate row count, largest first

Get taxonomy details (labels, description, hierarchical, post_types, term count)

Get user details by ID (profile fields, roles, capabilities, registered, posts_count)

Get all meta data for a user (keys starting with _ are hidden; single values are flattened)

Get WordPress version and update status

Get a widget's details

Install a plugin from WordPress.org by slug. If activation fails the plugin stays installed and activation_error says why.

Install a plugin from a ZIP URL (GitHub releases, custom sources). The URL must end in .zip or be a github.com / api.github.com release asset URL (private repo assets supported with a token).

Install a theme from WordPress.org by slug

Install a theme from a public ZIP URL (must end in .zip). Unlike mcp_install_plugin_zip there is no GitHub token support: private release assets cannot be installed this way.

List posts of any post type (id, title, slug, status, date, modified, author, excerpt, parent) with paging totals

List Elementor library templates (headers, footers, singles, loop items, popups) with theme builder conditions; at most 100, ordered by title

List media library items (id, title, url, mime_type, date; images also alt, width, height) with paging totals

List all navigation menus (id, name, slug, item count, assigned locations)

List WordPress options (name ascending) with an optional name prefix filter. Secret-looking values are returned as "[masked]". Note: autoload is only true for legacy 'yes' rows (WP 6.6+ stores 'on'/'auto', reported as false).

List all public post types (name, labels, hierarchical, has_archive, rest_base, supports, taxonomies, published count)

List all available WordPress user roles (slug, name, capabilities, user count)

List all registered sidebars

List all public taxonomies (name, labels, hierarchical, post_types, rest_base, term count)

List terms for any taxonomy (categories, tags, custom taxonomies): id, name, slug, description, parent, count

List WordPress users (id, username, email, display_name, first_name, last_name, roles, registered) with role/search filters. Returns { users, total, page }.

List all available widget types

Move a widget to a different sidebar

Run OPTIMIZE TABLE on every table with the site's table prefix

Regenerate image thumbnails for a media item (images only)

Set the widget order of a sidebar. Pass the COMPLETE list: widgets of the sidebar left out are removed from it (their settings stay, but they end up in no sidebar, not even Inactive Widgets).

Run due (past-due pending) Action Scheduler actions now through Action Scheduler's own runner, oldest first. Optional hook/group filters. Returns processed, failed, remaining. 501 when Action Scheduler is not active. Audit-logged. cvrt-mcp-endpoints 1.16.0+.

Run the earliest scheduled event of a cron hook now, like `wp cron event run`: a recurring event moves to its next slot, a single event is unscheduled, then the hook fires (404 if not scheduled). Returns next_run_timestamp (null for a single event). Audit-logged. cvrt-mcp-endpoints 1.16.0+; older versions leave the event due.

Scan the uploads directory for executable files (.php, .phtml, .phar, .pht, .phps, .shtml, .cgi, also double extensions like x.php.jpg). Read-only; symlinks are not followed. Each finding has path, size, modified, sha256, benign and reason (a code-free 'Silence is golden' index.php, or a known plugin file such as a Borlabs Cookie compatibility patch, checked by active plugin + path + the file's own guard; cvrt-mcp-endpoints 1.16.1+). Caps: 500 findings, 200000 files (truncated says so). cvrt-mcp-endpoints 1.16.0+.

Search published Elementor-built posts for widgets, settings, or text in string setting values (case-insensitive)

Search the WordPress.org plugin repository. Returns { total, plugins: [{ name, slug, version, author, rating, active_installs, description }] }.

Search and replace a string in every text column of the site's tables (current table prefix only). Plain SQL REPLACE: it is NOT serialization-safe, so a replacement of different length corrupts serialized PHP values (options, postmeta, widgets). Both strings pass through sanitize_text_field on the server (tags and line breaks are stripped). total_changes and tables count matching rows per column, not occurrences.

Search the WordPress.org theme repository. Returns { total, themes: [{ name, slug, version, author, rating, description }] }.

Create or update an option (any option, no allow-list: be careful with siteurl, home, active_plugins etc.). A value containing "[masked]" is refused, since writing back a masked read would destroy the stored secret. The echoed value is masked like reads. Note: created is always false (cvrt-mcp-endpoints 1.14.2 checks it after writing).

Upload media to WordPress from a public external URL (private/internal hosts are refused)

Update all plugins with available updates. cvrt-mcp-endpoints itself is never bulk-updated and is listed under skipped.

Update all themes with available updates

Update WordPress to the latest version. Returns { updated: false, message } when already up to date.

Update a post of any post type. Only the given fields change; meta keys are merged (update_post_meta per key).

Update settings on a single Elementor element (merge by default). With widget_type, replaces the widget in place (same id, position and parent), e.g. turn a V4 placeholder into a V3 html widget; the type must be registered with Elementor. Give settings, widget_type, or both.

Update Elementor global kit settings (colors, fonts, typography). Top-level keys are merged; a nested value such as system_colors replaces the old one whole, so send the complete list. Returns the merged settings.

Update Elementor page-level settings. Top-level keys are merged into the stored settings (a nested value replaces the old one whole); returns the merged settings.

Update media item metadata (title, alt text, caption, description). Only the given fields change.

Rename a navigation menu (the menu's description and parent are kept)

Partially update a menu item: only the given fields are sent and changed, every other stored field (type, linked object, url, ...) is kept (cvrt-mcp-endpoints 1.14.2+). The linked object (type/object/object_id) cannot be changed here: delete the item and add a new one. The response lists the changed fields.

Update a single plugin to the latest version. refresh:true first runs a fresh update check for it (wp.org and Plugin Update Checker / GitHub releases), so a just-released update is seen without waiting 12 h. A plugin that was active before is reactivated after the file swap (reactivated / reactivate_error report it). updated:false means already up to date; a failed download or unpack is an error (502, cvrt-mcp-endpoints 1.16.0+). cvrt-mcp-endpoints itself is refused (409): update it via mcp_install_plugin_zip or wp-admin.

Update a term in any taxonomy. Only the given fields change.

Update a single theme to latest version

Update an existing user. Only the given fields change. Use mcp_change_user_role for the role.

Set meta data for a user (merged per key; keys are run through sanitize_key, so lowercase a-z0-9_-)

Update a widget's settings. The given keys are merged into the stored settings; keys not given are kept.

Bulk update SEO meta of up to 100 posts. Each item is { id, ...fields } with the same fields as seo_update_post_seo (null deletes a field, omitted fields are kept). Returns { updated, errors: [{ index, id?, message }] }.

Delete 404 monitor log entries: one entry by id, or every entry last seen within from..to (inclusive dates, either bound optional). With no argument the WHOLE log is cleared. Returns { deleted, success }.

Create a redirect. Rejects invalid regex, unknown status codes and redirect loops/chains deeper than 5. Returns the redirect.

Create a 301 redirect from a 404 monitor log entry's URL to to_url. Fails with 409 when a redirect from that URL already exists.

Delete (reset) every SEO meta field of a post. Returns { deleted: true }.

Delete a redirect by id. Returns { deleted: true }.

Delete (reset) every SEO meta field of a taxonomy term. Returns { deleted: true }.

Export post SEO meta as a CSV string (post_id, post_title, url, seo_title, seo_description, focus_keywords, seo_score).

Export every redirect as a CSV string (source, target, type, is_regex, enabled).

Export every csm_* option as a flat { csm_name: value } map. Secrets are masked as { set: boolean }.

Run the SEO content analysis for a post: { score, checks }.

Get the SEO meta for a post (every field, null when unset; plus language and translations when Polylang is active).

Get a redirect by id.

Get cvrt-seo-manager settings grouped by section (titles, robots, social, knowledge_graph, schema, verification, indexnow, search_console, advanced, sitemap, breadcrumbs, images, links, local_seo, monitor_404, woocommerce). Secret values are returned as { set: boolean }, never raw.

Get the SEO meta for a taxonomy term: { title, description, robots, og_image, schema } (null when unset).

Import post SEO meta from CSV in the seo_export_csv format (header row, then one row per post with at least 7 columns; export first and edit that). Give the CSV inline (csv) or as a local .csv path (csv_file). It is sent as the raw text/csv request body. Returns { success, errors } row counts.

Migrate from RankMath or Yoast. Default: per-post/term meta and redirects are migrated (WRITES immediately, dry_run is not honoured here) and { posts_migrated, terms_migrated, redirects_migrated, errors } is returned. With settings=true (RankMath only) ONLY the global titles/meta/sitemap/robots settings are ported instead, and dry_run=true reports { written, skipped, dry_run } without writing.

Import redirects from CSV in the seo_export_redirects format (header row source,target,type[,is_regex],enabled; the is_regex column is detected from the header). Give the CSV inline (csv) or as a local .csv path (csv_file). It is sent as the raw text/csv request body.

Import settings from a flat { csm_name: value } map (the seo_export_settings shape). Only csm_* keys are written; secrets (csm_indexnow_key, csm_gsc_service_account, csm_github_token) are never imported. Returns the number of options written.

Submit URLs to IndexNow (one request per URL). Returns [{ url, ok, error? }]; ok means the site dispatched the ping (non-blocking), a failing URL does not stop the others.

Check whether a focus keyword is already used by another post (case-insensitive). Returns { unique, posts: [{ id, title }] }.

List the 404 monitor log: { items: [{ id, url, hits, first_seen, last_seen, ... }], total, pages }.

List SEO meta of published posts, newest ID first: [{ id, title, url, seo, language?, translations? }].

List redirects, newest first: { items: [{ id, from_url, to_url, type, is_regex, hits, enabled, created_at, updated_at }], total, pages }.

Submit the sitemap to Google Search Console (needs the search_console settings) and return the status Search Console reports. The old Google/Bing ping URLs are switched off.

Get sitemap status: { sitemap_url, post_types, taxonomies, total_urls, search_console? }.

Get cvrt-seo-manager status: { version, configured, dependencies: { php, wordpress } }.

Update the SEO meta for a post (partial: only the fields you give change; null deletes a field). Purges the post's page cache. Returns the post's full SEO meta.

Update a redirect (partial: omitted fields keep their stored value). Returns the redirect.

Update cvrt-seo-manager settings (partial: only the keys you send change; unknown keys are ignored). Send keys flat ({ title_separator: '|' }) or grouped ({ titles: { title_separator: '|' } }); keys are the option names without the csm_ prefix. Returns the full settings (GET shape, secrets masked). Groups and keys: titles: title_separator, title_home, desc_home, title_post, desc_post, title_page, desc_page, title_product, desc_product, title_category, title_tag, title_author, title_search, title_404 (templates, tokens like %title% %sep% %sitename%). robots: default_robots (text); booleans noin…

Update the SEO meta for a taxonomy term (partial; null deletes a field). Returns the term's full SEO meta.

The Stripe account behind the gateway: country, default currency, charges/payouts enabled, details submitted, requirements (currently_due, past_due, disabled_reason).

WooCommerce Stripe Gateway settings, secrets masked, plus the active mode (live/test).

Recent Stripe charges: id, amount, currency, status, created, paid/refunded, payment method type, outcome, failure code/message, WooCommerce order_id. No customer personal data or card details.

Stripe payment method configurations: per configuration every payment method with available, preference (what was chosen) and value (what is in effect).

Recent Stripe refunds: id, amount, currency, status, created, charge, reason, WooCommerce order_id. Read-only; refunds are not created here.

Webhook endpoints of the Stripe account: id, url, status, api_version, number of events; configured:true marks the endpoint that delivers to this site's gateway URL.

Recreate this site's Stripe webhook with the gateway's own routine: a new endpoint is created first, then older endpoints for this site's URL are deleted, and the new signing secret is stored on the site (never returned). Use when stripe_list_webhooks shows no enabled configured endpoint. Needs confirm:true; audit-logged.

Turn one payment method of a Stripe payment method configuration on or off (display preference). The method must exist in that configuration (see stripe_list_payment_method_configs). Needs confirm:true; audit-logged.

Add a note to an order

Bulk update product stock; per product only the given fields change

Create a global product attribute (taxonomy pa_{slug})

Create a term for a global attribute

Create a product category

Create a coupon

Create a customer

Create a WooCommerce product

Create a variation of a variable product. Note: wp-pilot-pro 1.1.0 declares `attributes` as a list and rejects this map with 400 until the plugin declares it as an object

Delete a product category

Delete a coupon permanently

Delete a WooCommerce product (to trash unless force)

Delete a product variation permanently

WooCommerce payment gateways for a customer country: id, title, enabled, available (offered at checkout, WooCommerce's own check for an empty cart, so minimum-total gateways show unavailable), plus cvrt-woo-helper's Stripe status (express checkout, where Stripe.js loads) when that plugin is active. cvrt-mcp-endpoints 1.17.0+.

Get coupon details

Get customer details (incl. billing and shipping address)

Get a customer's latest 20 orders plus total spent and order count

Get WooCommerce order details (payment, billing, shipping, line items, totals)

Get order notes

Get WooCommerce product details (descriptions, stock, tags, images, attributes, dates)

Get all product meta data plus _regular_price, _sale_price, _price, _stock, _stock_status, _sku

DESTRUCTIVE, IRREVERSIBLE: creates a REAL invoice for this order in the live sevDesk/Lexware ledger. An invoice there cannot be deleted, only cancelled with a cancellation invoice. Refused with 409 while dry-run is on. Check woo_helper_get_invoice_order (preview) first. Requires confirm:true.

WooCommerce email look managed by cvrt-woo-helper 0.2.0+: logo (id, url, warning for unsafe formats), logo width, colours, footer text, product images, certificate link once, plus the environment (WooCommerce version, email template improved/classic/block_editor, PDF builder).

Invoice state of one order: status, invoice number, error, attempts, has_pdf, the dry-run request preview, and credit notes.

Invoice settings of cvrt-woo-helper 0.4.0+ (sevDesk / Lexware Office): settings, API keys per provider as { set, constant } (never the key), the cached provider lists (contact persons, templates, layouts, ...), whether invoicing is active, and order counts per invoice status.

cvrt-woo-helper settings (secrets as { set }, never raw).

The Stripe express-checkout settings cvrt-woo-helper manages: express checkout on/off, button locations per type and what they mean per page, and whether Stripe.js loads only on the checkout (scripts_checkout_only, so it does not load before consent on product pages).

Reload the provider's lists (contact persons, templates, letter papers, payment methods, units, print layouts, payment conditions) into the settings cache. Read-only at the provider.

Test the invoice provider connection (read-only GETs: company, tax type, small-business status).

Orders by invoice status: done, dry_run, queued, retry or failed.

Change cvrt-woo-helper invoice settings; only the keys given change, an invalid value is a 400 and nothing is written. api_keys is WRITE-ONLY (a blank key keeps the stored one) and is never returned; clear_api_keys deletes keys. dry_run stays on until explicitly switched off: with it off, paid orders create REAL invoices in the live ledger.

SENDS A REAL EMAIL: a WooCommerce order-email preview to `to`. settings (same keys as woo_helper_update_emails) are applied to this one email only and NOT saved, to try a look before saving it. Rate limited (30 s per user, 10 per hour per site; 429). Needs WooCommerce 9.6+ (409) and cvrt-woo-helper 0.2.0+.

cvrt-woo-helper status: plugin version, WooCommerce and Stripe Gateway active/version, whether the CVRT hub is on, GitHub token { set }.

Read-only WooCommerce Stripe Gateway status from cvrt-woo-helper (recursively masked): mode, enabled methods, express checkout and Stripe.js loading per page.

Change the WooCommerce email look through cvrt-woo-helper 0.2.0+. Only the keys given change; an invalid value is a 400 naming the field and nothing is written. Returns the settings as woo_helper_get_emails does.

Update cvrt-woo-helper settings. github_token is write-only (blank or omitted keeps the stored one); clear_github_token:true deletes it.

Change Stripe express checkout through cvrt-woo-helper. Only the keys given change. locations maps a button type (apple_google_pay, link, amazon_pay) to the pages it shows on (product, cart, checkout). 409 when the Stripe Gateway plugin is inactive.

List terms of a global attribute (including empty ones)

List global product attributes

List product categories

List published WooCommerce coupons

List WooCommerce customers (users with the given role)

List WooCommerce orders (slim)

List WooCommerce products (slim: id, name, slug, type, status, sku, prices, stock, category ids)

List product tags (including empty ones)

List the available (purchasable, visible) variations of a variable product

Get sales report (completed + processing orders)

Get stock status report (stock-managed products, lowest stock first)

Get top selling products by quantity (completed + processing orders)

Update a product category; only the given fields change

Update a coupon; only the given fields change

Update a customer; only the given fields (and address keys) change

Update order status (triggers the usual WooCommerce status emails)

Update a WooCommerce product; only the given fields change (type, images and attributes cannot be changed here)

Update product meta data (merged; _regular_price, _sale_price, _stock, _stock_status, _sku go through the product setters)

Update a product variation; only the given fields change

Activate an installed plugin (via cvrt-mcp-endpoints, avoids the often-blocked core route)

Activate a theme (switch themes)

Create a new category

Create a comment on a post (or a block note with type=note)

Create a new WordPress page

Create a new WordPress post

Create a new tag

Create a new WordPress user

Deactivate an installed plugin (via cvrt-mcp-endpoints)

Delete a category permanently (its posts fall back to the default category)

Delete a comment (moves to trash, or permanently if force=true)

Delete a media item and its files

Delete a page (moves to trash, or permanently if force=true)

Delete an installed plugin (via cvrt-mcp-endpoints; deactivates first)

Delete a post (moves to trash, or permanently if force=true)

Delete a tag permanently

Delete a user permanently, reassigning their content to another user

Get the currently active theme

Get a comment by ID

Get a media item by ID

List available REST API namespaces (plugins may add custom endpoints)

Get a single page by ID (content, when requested, is the raw stored markup)

Get plugin details by slug

Get a single post by ID (content, when requested, is the raw stored markup)

Get the WordPress settings exposed by wp/v2/settings (title, tagline, url, email, timezone, date/time format, language, reading and discussion settings, site logo/icon, plus plugin-registered ones)

Get theme details by stylesheet name

Get a user by ID

List categories

List comments

List media library items

List WordPress pages

List all installed plugins

List WordPress posts with optional filters

List tags

List all installed themes

List WordPress users

Get the currently authenticated user

Batch moderate comments by status

Search posts by keyword (shortcut; wp_list_posts has every filter)

Get WordPress site information (name, description, URL, timezone)

Update a category (only the given fields change)

Update a comment (approve, edit content, move, ...); only the given fields change

Update media item metadata (title, alt text, caption, description, attachment, ...); only the given fields change

Update an existing page (only the given fields change)

Update an existing post (only the given fields change)

Update WordPress site settings (only the given fields change); returns all settings afterwards

Update a tag (only the given fields change)

Update an existing user (only the given fields change)