How PowerWP AI works
Your AI app talks directly to PowerWP AI on your own site. Permissions, a change log, health checks and backups guard every tool it uses.
PowerWP AI is a WordPress plugin. It lets an AI app look at your site and, if you allow it, change it, with guard rails around every action. This page explains the pieces in plain words.
MCP in plain words#
MCP, the Model Context Protocol, is a shared standard that lets an AI app use tools offered by another system. The system lists its tools. Each tool has a name, a description and the arguments it needs. The AI app reads the list, picks a tool when your request calls for it, sends the arguments and reads the result.
PowerWP AI is that system for WordPress. Without it, an AI app can only guess about your site. With it, the app can ask the site for facts, such as which plugins need updates, and act on them when you have given permission.
Your AI app talks to your site directly#
The plugin is the MCP server, and it runs on your own site. Your AI app connects to one address:
https://your-store.com/wp-json/wpai/v1/mcpYour AI app --> your-store.com/wp-json/wpai/v1/mcp --> PowerWP AI --> WordPress and WooCommerce
(your own site, over HTTPS) checks the call, (the change is recorded)
runs the toolNothing is relayed through PowerWP's servers. The plugin contacts PowerWP only for plugin updates and the license check. That check never carries your content, orders, customers, connection keys or anything about AI activity. Your AI app is run by its own provider, and what a tool returns reaches that provider, so read its data policy. See Data and privacy for the full list.
The plugin supports the 2026-07-28 version of the protocol and four earlier ones. The details are in the MCP endpoint reference.
Tools#
PowerWP AI offers 85 tools in 14 categories. A tool is one action, such as reading the error log or updating a post.
| Category | Tools | Examples |
|---|---|---|
| Site and server | 5 | site_overview, site_health, page_check, server_info |
| Diagnostics and logs | 9 | error_log_read, audit_log, security_scan, integrity_check |
| Content and Elementor | 10 | content_query, content_update, elementor_outline, media_import |
| WooCommerce | 7 | wc_overview, wc_order_inspect, wc_product_inspect, wc_status |
| Settings and maintenance | 5 | option_get, option_update, cache_flush, maintenance_mode |
| Plugins and themes | 5 | plugins_list, plugin_manage, updates_check, theme_manage |
| Files | 14 | fs_read, fs_edit, fs_search, archive_create |
| Database | 6 | db_query, db_execute, db_search_replace, db_tables |
| REST API | 2 | rest_request, rest_routes |
| Users | 2 | users_list, user_manage |
| Backups and restore | 9 | backup_create, backups_list, restore_prepare, job_status |
| Changes and undo | 4 | changes_list, changes_rollback, checkpoint_create, change_details |
| Memory and recipes | 5 | memory_list, memory_save, recipes_list, recipe_get, recipe_save |
| WordPress abilities | 2 | abilities_list, ability_run |
Each tool needs a permission. Reading is always allowed. Everything else is granted per connection, so a tool that your connection has no permission for refuses to run. See Permissions and presets. Every tool is described in the tools reference.
From your prompt to a result#
- You type a request in your AI app, for example the prompt below.
- The app reads the tools your site offers and picks one, such as
site_overview, with its arguments. - The app sends the call to your site's address, with the connection's key or sign-in.
- PowerWP AI checks the call: the key is valid and not expired, the request comes from an allowed IP address, AI access is on, the rate limit holds and the connection has the permission the tool needs.
- The tool runs. A change is recorded in the change log, with a snapshot where one is possible. Risky changes are health-checked afterwards.
- The result goes back to the app, with secrets masked unless the connection has the Secrets permission. The call is written to the activity log.
- The app explains the result to you and may call the next tool.
Example prompt:
Check my site for errors and tell me what you find. Don't change anything.To answer that, an app might call site_overview, error_log_read and site_health. All three only read.
What PowerWP AI adds on top#
PowerWP AI adds permissions per connection, a change log with rollback, a health check, rescue mode, backups on your computer, switches and a log, and shared memory and recipes. See How PowerWP AI keeps you safe for how they work together, and Connections and keys for the permissions.