Catalogue — 80 free, 16 Pro

Every call an agent can make, and what each one costs you.

SiteHelm exposes 80 named operations through 11 MCP tools. There is no other way in — no PHP, no shell, no SQL, no REST passthrough.

Each operation declares a required WordPress capability, a risk level that reflects blast radius rather than difficulty, and whether the change can be undone. Those declarations are not documentation written afterwards; they are what the plugin enforces at the moment of the call.

Cue 2 — first light

Three arguments, 11 tools, one shape.

An agent does not hold 80 tool definitions in its context. It holds 11 dispatchers, and asks one of them for its catalogue when it needs it. Call a dispatcher with no operation and it answers with the operations it carries, their capabilities, and their policies.

The trade is deliberate: the client’s tool list stays small enough to sit comfortably in context, and the catalogue is fetched on demand for the dispatcher actually in use.

tools/call — content-write
"operation": "content-update"
"planToken": omit to receive a preview
"arguments": { "id": 412, "title": "Spring Campaign" }

Illustrative call, not a recording.

tools/list

The 11 dispatchers.

No operation

That dispatcher’s catalogue: ids, summaries, capabilities, policies.

No plan token

On a write: a preview of exactly what would change, and a token to apply it.

Cue 3 — dawn

The catalogue

80 operations in the free plugin, grouped by what they touch. The dispatcher under each name is the tool an agent actually calls.

Content

Posts, pages, custom post types, blocks, terms and redirects — the operations an editor would otherwise perform by hand.

content-get

content-read

Reads one item with its fields, terms, and metadata

needs edit_posts

Read
content-list

content-read

Lists items with filtering and pagination

needs edit_posts

Read
taxonomy-list

content-read

Lists registered taxonomies and their terms

needs edit_posts

Read
content-blocks-get

content-read

Returns the block outline of one item, or one addressed block in full

needs edit_post

Read
content-links-check

content-read

Reports the links in one item, resolving this site's own against its posts and redirects

needs edit_post

Read
redirect-list

content-read

Lists every redirect this site serves, with the table's size and capacity

needs manage_options

Read
content-create

content-write

Creates a post, page, or custom post type item

needs edit_posts

medium risk rollback supported
content-update

content-write

Updates title, content, excerpt, slug

needs edit_post

medium risk rollback supported
content-status-set

content-write

Publishes, drafts, schedules, or privatises

needs edit_post

medium risk rollback supported
content-featured-media-set

content-write

Sets or clears the featured image

needs edit_post

medium risk rollback supported
content-meta-update

content-write

Writes registered post meta

needs edit_post

high risk rollback supported
content-terms-assign

content-write

Assigns categories, tags, or custom terms

needs edit_post

medium risk rollback supported
content-trash

content-write

Moves an item to trash — reversible, never a permanent delete

needs delete_post

medium risk rollback required
content-rollback-apply

content-write

Restores a previous change from its snapshot

needs edit_post

medium risk rollback supported
content-block-update

content-write

Changes the attributes or inner markup of one block

needs edit_post

medium risk rollback supported
redirect-set

content-write

Points one path at a successor URL, or marks it gone

needs manage_options

medium risk rollback supported
redirect-delete

content-write

Removes the redirect stored for one path

needs manage_options

medium risk rollback required

Media

The library: attachment details, uploads, alt text and captions, and import from a URL behind a guarded fetch.

media-get

media-read

Reads one attachment with its metadata and generated sizes

needs upload_files

Read
media-list

media-read

Lists the media library with filtering

needs upload_files

Read
image-size-list

media-read

Lists registered image sizes and their dimensions

needs read

Read
media-upload

media-write

Uploads a file from supplied bytes

needs upload_files

high risk rollback supported
media-import

media-write

Fetches a file from a URL and adds it to the library

needs upload_files

high risk rollback supported
media-meta-update

media-write

Updates alt text, caption, title, description

needs edit_post

medium risk rollback supported
media-attach

media-write

Attaches an existing item to a post

needs edit_post

medium risk rollback supported
media-resize

media-write

Brings an oversized image within a width and height you name, keeping the original file

needs edit_post + upload_files

high risk rollback supported

Menus

Navigation menus, their items, their order, and which theme location each one is assigned to.

menu-list

menu-read

Lists menus with their theme location assignments

needs edit_theme_options

Read
menu-get

menu-read

Reads one menu's full item tree

needs edit_theme_options

Read
menu-item-create

menu-write

Adds an item to a menu

needs edit_theme_options

medium risk rollback supported
menu-item-update

menu-write

Updates an item's label, target, or attributes

needs edit_theme_options

medium risk rollback supported
menu-items-reorder

menu-write

Reorders and re-parents a menu tree

needs edit_theme_options

medium risk rollback supported
menu-location-assign

menu-write

Assigns a menu to a theme location

needs edit_theme_options

medium risk rollback supported

Elementor

Documents and elements, widget settings, global colour and typography tokens, and theme-builder display conditions.

elementor-document-list

elementor-read

Lists Elementor-built documents

needs edit_posts

Read
elementor-document-get

elementor-read

Reads a document's element tree

needs edit_post

Read
elementor-composition-get

elementor-read

Summarizes what a document contains, at a size that does not grow with it

needs edit_post

Read
elementor-element-get

elementor-read

Reads one element by its id

needs edit_post

Read
elementor-element-search

elementor-read

Finds elements within a document by type, text, or setting

needs edit_post

Read
elementor-widget-availability

elementor-read

Reports which widget types this site actually has

needs edit_posts

Read
elementor-control-schema

elementor-read

Returns a widget's or container's control schema

needs edit_posts

Read
elementor-global-tokens-get

elementor-read

Reads the global palette and type styles with their write identifiers

needs edit_theme_options

Read
elementor-theme-template-list

elementor-read

Lists theme-builder templates with the display conditions each one stores

needs edit_posts

Read
elementor-element-add

elementor-write

Inserts an element at a position in the tree

needs edit_post

medium risk rollback supported
elementor-element-update

elementor-write

Updates an element's settings

needs edit_post

medium risk rollback supported
elementor-elements-update

elementor-write

Updates several elements' settings as one change; one bad entry refuses all of them

needs edit_post

medium risk rollback supported
elementor-widget-settings-update

elementor-write

Updates a widget's settings against its control schema

needs edit_post

medium risk rollback supported
elementor-element-move

elementor-write

Moves an element within or between containers

needs edit_post

medium risk rollback supported
elementor-element-duplicate

elementor-write

Duplicates an element with fresh ids

needs edit_post

medium risk rollback supported
elementor-element-remove

elementor-write

Removes an element from the tree

needs edit_post

high risk rollback required
elementor-global-colors-update

elementor-write

Updates global colour tokens site-wide

needs edit_theme_options

high risk rollback supported
elementor-global-typography-update

elementor-write

Updates global type styles site-wide

needs edit_theme_options

high risk rollback supported
elementor-theme-conditions-set

elementor-write

Replaces one theme template's display conditions as a whole rule

needs edit_theme_options

high risk rollback supported

Custom fields

ACF and Meta Box field groups, their fields, and their values — read and written through each plugin’s own API.

acf-group-list

fields-read

Lists ACF field groups

needs edit_posts

Read
acf-field-list

fields-read

Lists fields in a group

needs edit_post

Read
acf-field-get

fields-read

Reads a field's value for an object

needs edit_post

Read
metabox-group-list

fields-read

Lists Meta Box field groups

needs edit_posts

Read
metabox-field-list

fields-read

Lists fields in a group

needs edit_post

Read
metabox-field-get

fields-read

Reads a field's value for an object

needs edit_post

Read
acf-field-update

fields-write

Writes an ACF field value

needs edit_post

medium risk rollback required
metabox-field-update

fields-write

Writes a Meta Box field value

needs edit_post

medium risk rollback required

SEO

Titles, descriptions and robots directives, read and written through whichever SEO plugin the site already runs.

content-seo-get

content-read

Reads one item's search-engine metadata from whichever SEO plugin the site runs

needs edit_post

Read
content-seo-score-get

content-read

Reads one item's SEO and readability scores as the SEO plugin stored them, with the findings SiteHelm derives

needs edit_post

Read
content-seo-audit

content-read

Audits a page of items: stored scores, missing or over-long descriptions, missing focus keywords, noindexed published items, in-page duplicate titles and descriptions

needs edit_posts

Read
content-term-seo-get

content-read

Reads one category's or tag's search-engine metadata from whichever SEO plugin the site runs

needs edit_posts + the taxonomy's edit capability

Read
content-seo-set

content-write

Writes one item's search-engine metadata into whichever SEO plugin the site runs

needs edit_post

medium risk rollback supported
content-term-seo-set

content-write

Writes one category's or tag's search-engine metadata into whichever SEO plugin the site runs

needs edit_posts + the taxonomy's edit capability

medium risk rollback supported

Comments

The moderation queue: list by status, approve, hold, spam or trash, and reply beneath a comment.

comment-list

content-read

Lists comments by status, post, or search term, newest first

needs moderate_comments

Read
comment-status-set

content-write

Approves, holds, spams, or trashes one comment

needs moderate_comments

medium risk rollback supported
comment-reply

content-write

Posts an approved reply beneath one comment, authored by the acting user

needs moderate_comments

medium risk rollback supported

Forms

Read only: which forms the site holds, each form’s fields and embed shortcode, and its most recent entries.

form-list

content-read

Lists every form the site's form plugin holds, with each form's embed shortcode

needs edit_posts

Read
form-get

content-read

Reads one form's title, embed shortcode, and the fields it declares — name, type, required

needs edit_posts

Read
form-entries-list

content-read

Reads one form's most recent entries, newest first — or says plainly that the plugin stores none

needs manage_options

Read

Users

The roster, and one write: replacing a user’s roles with a single role the site has actually registered.

user-list

system-read

Lists user accounts by role or search term, newest registration first, with the role slugs this site has registered

needs list_users

Read
user-role-set

content-write

Replaces one user's roles with a single registered role

needs promote_users

high risk rollback supported

Site settings

Thirteen fields, allowlisted: title, tagline, timezone, date and time formats, posts per page, front-page geometry, permalinks, default discussion settings, and search-engine visibility.

site-settings-read

system-read

Reads the whole site-settings allowlist, typed, in one call — the same thirteen fields site-settings-set can change, and nothing else

needs manage_options

Read
site-settings-set

content-write

Changes site settings from a strict thirteen-field allowlist — title, tagline, timezone, date and time formats, posts per page, front page geometry, permalink structure, default comment and ping status, search-engine visibility

needs manage_options

medium risk rollback supported

System

Connection, environment, integration health, one operation’s schema on demand, and the change ledger.

system-connection

system-read

Confirms the gateway is reachable and reports who is authenticated

needs read

Read
system-environment

system-read

WordPress and PHP versions, theme, post types, taxonomies

needs manage_options

Read
system-integrations

system-read

Health of every optional integration: Active, Inactive, VersionBlocked

needs manage_options

Read
system-operation-schema

system-read

Returns one named operation's full input and output schema, so an agent fetches only the schema it is about to use

needs read

Read
audit-list

system-read

Reads the change ledger: what changed, when, by whom, and what can be rolled back

needs manage_options

Read
Cue 4 — blackout

What is not in the rig, and never will be.

These are not gaps waiting on a release. They are the reason the other 80 operations can be trusted: an agent that cannot reach code, the database, or the filesystem cannot surprise you with something the catalogue never mentioned.

The safety model covers what happens when an agent asks for one of these anyway.

Never
Arbitrary PHP

No eval, no snippet store, no theme-file editor. There is no path from an agent to executing code.

Never
Unrestricted SQL

No query passthrough. Every read and write goes through a typed operation with a schema.

Never
Unrestricted filesystem

No arbitrary file writes, and no WP-CLI passthrough.

Never
Irreversible deletion

Nothing is destroyed without a snapshot that can put it back.

Cue 5 — day

Pro adds 16 more, on the same rails.

Nothing above moves behind the licence. Pro operations register into the same dispatchers, take the same previews, and write the same audit ledger — they simply check the licence before they look at anything else.

SEO (Pro)

Site-wide SEO settings, schema, the 404 log and redirections, and bulk fixes across up to fifty posts at once.

seo-settings-get

system-read

Reads the SEO plugin's settings at site scope (separator, knowledge-graph name and logo, default social image, breadcrumbs) or for one public post type (postType: title and description templates, noindex, sitemap inclusion)

needs manage_options

Read
seo-settings-set

content-write

Writes the same allowlisted settings, one scope per change — site scope or postType, never both

needs manage_options

write risk rollback supported
content-seo-bulk-set

content-write

Sets the per-post fields of content-seo-set on up to fifty posts as one previewed, reversible change; one post the caller may not edit, or one that does not exist, refuses the whole set

needs edit_post on every post

write risk rollback supported
seo-404-log-list

system-read

Pages Rank Math's 404 monitor newest first (URI, hits, last seen, referer), at most 200 per page

needs manage_options

Read
seo-redirection-list

system-read

Pages Rank Math's redirections newest first (sources, destination, status code, hits, status)

needs manage_options

Read
content-seo-schema-get

content-read

Reads one post's primary schema type (Schema.org spelling, null when the plugin's default applies), the plugin's stored fields for it, and the type names the plugin accepts on write

needs edit_post

Read
content-seo-schema-set

content-write

Sets one post's schema type and optional fields as a previewed, reversible change; null clears it back to the plugin's default and drops the stored fields; an unknown type is refused naming content-seo-schema-get for the list

needs edit_post

write risk rollback supported
content-seo-audit-fix

content-write

Takes the same page content-seo-audit would (type, status, limit ≤ 50, offset, minScore) and fixes the chosen findings on every post that carries one as one previewed, reversible change — missing-description from the post's excerpt or text (a post whose text yields fewer than 70 characters is reported under unfixable), description-too-long and title-too-long trimmed at a word boundary, noindex set to false

needs edit_post on every post

write risk rollback supported

WooCommerce (Pro)

Products read and edited; orders and customers read only, and always will be.

product-list

content-read

Pages products newest first with name, SKU, status, type, price, sale price, stock status and quantity, and categories; filtered by search term, status, category or stock state

needs edit_products

Read
product-get

content-read

Reads one product in full — name, description, short description, SKU, regular and sale price, stock, categories, tags, images, type — and says when the price lives on the product's variations rather than on the product

needs edit_products

Read
product-category-list

content-read

Lists the product categories with parent, slug and product count

needs edit_products

Read
order-list

content-read

Pages orders newest first with status, total, currency, item count and date, filtered by status, customer or date range

needs manage_woocommerce

Read
order-get

content-read

Reads one order — line items, totals, tax, shipping, payment method and status history

needs manage_woocommerce

Read
customer-list

content-read

Pages shop customers with order count, lifetime spend and last order date

needs manage_woocommerce

Read
product-create

content-write

Creates one simple product from name, description, SKU, prices, stock and categories

needs edit_products

write risk rollback n/a
product-update

content-write

Changes one product's name, description, SKU, regular price, sale price, stock status, stock quantity or categories

needs edit_products, re-checked as edit_product against the resolved product

write risk rollback supported

See what Pro costs