A secure, native MCP server and agent control layer for WordPress.
WP-Nerve exposes 5 tools with mixed quality. Tools 1-2 (tools/list, tools/call) have reasonable descriptions and structured schemas with annotations, but tools 3-5 (server/discover, initialize, ping) are legacy protocol remnants with minimal descriptions. The tools/call schema includes _meta fields for idempotency and confirmation, showing security-aware design. However, parameter descriptions are sparse, and output schemas are not documented. The registry pattern (AbilityToolRegistry) is well-structured and maps WordPress abilities to MCP tools with policy authorization, but the exposed tool definitions lack the depth needed for reliable LLM selection.
Initialize MCP connection with protocol version negotiation (legacy protocol).
Ping the MCP server to verify connectivity (legacy protocol).
Discover MCP server capabilities, supported protocol versions, and available tools.
Execute a WordPress ability as an MCP tool with policy authorization, idempotency protection, and confirmation gating.
List all available MCP tools exposed for the authenticated WordPress user.
Legacy protocol tools (initialize, ping) are deprecated in MCP 2026-07-28 spec and should be removed. These add noise to tool discovery and confuse LLM selection.
Output schemas are not documented for any tool. LLMs cannot plan downstream calls or extract required fields without knowing what tools return. tools/list and tools/call should document their response structures.
Parameter descriptions are minimal or absent. The tools/call 'arguments' parameter lacks guidance on what WordPress abilities accept. The 'name' parameter has no description of valid ability names or how to discover them.
Error handling guidance is missing. When tools/call fails (e.g., authorization denied, ability not found), the response should guide the LLM on recovery steps (e.g., 'Call tools/list to see available abilities').
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 46 | 2025-06-18+ | v2 |
The tools/call schema includes _meta fields (wp-nerve/idempotencyKey, wp-nerve/confirmationToken) but these are not described in the parameter documentation. LLMs cannot know when or how to populate these fields.