Tools

http_request

Outbound HTTP request from the server. Makes an HTTP request FROM the web server (e.g. to test connectivity to a payment gateway, license server or external API, or to inspect a webhook target). Every redirect hop is re-checked: private/internal addresses are blocked unless allow_private=true (needs the "sensitive" scope), cloud metadata addresses always. Methods other than GET/HEAD/OPTIONS need the "settings" scope.

GET requests only read; other methods need Settings & maintenance, and private or internal addresses need Secrets.

page_check

Check a page of the site. Fetches a page of THIS site server-side (bypassing page caches unless use_cache=true) and reports HTTP status, timing, size, cache headers, title, detected PHP errors/warnings/notices printed in the HTML, WordPress critical-error screens and asset counts. Set as_admin=true to load it as the logged-in administrator (e.g. to check wp-admin screens or logged-in views).

Loading a page as the administrator (as_admin) needs Settings & maintenance.

server_info

Server & PHP information. Detailed server environment: PHP configuration (limits, OPcache, extensions), database server variables, disk space, filesystem permissions, loopback/HTTPS status and client-IP headers.

site_health

WordPress Site Health. Runs the WordPress Site Health tests (and optionally the slower network tests: loopback, HTTPS, REST API, background updates, page cache) and returns critical issues and recommendations.

site_overview

Site overview. START HERE. One-call snapshot of the site: environment (production/staging), WordPress/PHP/database versions, theme, active plugins, WooCommerce status, debug constants, caching, limits, pending updates, recent PHP errors, maintenance/rescue state and this token's scopes.

audit_log

PowerWP AI activity log. Queries the PowerWP AI activity log: every MCP request and tool call (who, when, from which IP, result, duration), management actions and security events (failed logins, lockouts, blocked IPs). Useful to review what happened on the site through MCP, including other sessions.

cron_events

List scheduled (cron) events. Lists WP-Cron events with next run, schedule, overdue status and whether any code still handles the hook (orphaned events come from removed plugins). Also reports whether WP-Cron is disabled and the registered schedules.

cron_manage

Run or unschedule cron events. action=run executes a cron hook now (with the args of its next scheduled event, or the given args). action=unschedule removes the next event of a hook (matching args); action=unschedule_all removes every event of the hook. Unscheduling is journaled (cron option snapshot).

debug_mode

WordPress debug mode. Shows or changes WP_DEBUG / WP_DEBUG_LOG / WP_DEBUG_DISPLAY / SCRIPT_DEBUG / SAVEQUERIES in wp-config.php (journaled, syntax-checked, health-checked). Enabling logs to debug.log with display OFF by default, and switches itself back off after auto_disable_minutes (default 60) so production sites never stay in debug mode. action=status is read-only.

error_log_read

Read error logs. Reads the newest entries of a log: WordPress debug.log (source=debug), the PHP error log (source=php), WooCommerce logs (source=wc, optional wc_source like "fatal-errors" or a gateway id) or any log file (source=path). Filter by level, text/regex and time. dedupe=true (default) groups identical messages with counts and first/last seen - ideal for noisy logs.

Reading files that hold secrets needs Secrets.

hooks_inspect

Inspect action/filter callbacks. Lists every callback attached to an action or filter with priority, callable name and source file:line - the fastest way to find which plugin/theme modifies a behaviour. Note: hooks registered only on front-end or admin screens may not be present during this API request.

integrity_check

Verify core/plugin file integrity. Compares WordPress core files (and plugins from wordpress.org) against official checksums to find modified, missing or unexpected files - the first check when a site may be hacked. Premium plugins/themes cannot be verified.

rescue_mode

Rescue mode. Rescue mode makes MCP requests load PowerWP AI WITHOUT other plugins and the theme, so a site broken by a fatal error can still be diagnosed and repaired. It switches on automatically when WordPress crashes while booting an MCP request. action=status|enable|disable|test (test probes the normal site and reports whether it is healthy again).

Reading the state is free; switching rescue mode needs Settings & maintenance.

security_scan

Security scan (heuristics). Heuristic malware/security scan: PHP files inside uploads, suspicious code patterns (obfuscated eval, remote shells) in plugins/themes/mu-plugins/uploads, recently modified core files, unexpected administrators, unknown must-use plugins/drop-ins, suspicious .htaccess redirects and risky settings.

content_create

Create a post/page/product. Creates an item of any post type. Status defaults to "draft" - publish explicitly with status="publish". meta sets post meta, terms assigns taxonomy terms ({"product_cat": ["shoes"]}). For WooCommerce products with prices/stock prefer rest_request POST /wc/v3/products (keeps lookup tables in sync). Journaled: rollback deletes it.

content_delete

Delete (trash) an item. Moves an item to the trash (default) or deletes it permanently (force=true). The complete item incl. meta, terms, comments and child posts is journaled, so even permanent deletion can be rolled back.

content_get

Get a post/page/product. Full details of one item: raw content (blocks/shortcodes as stored), excerpt, status, dates, permalink, meta (all or selected keys), terms, featured image, revisions count and - for WooCommerce products - type, SKU, prices, stock and variations.

content_query

Find posts, pages, products.... Searches content of any post type (post, page, product, product_variation, shop_coupon, wp_template, wp_block, custom types like woodmart_layout) with filters for status, text, taxonomy terms, meta, dates and parent. Returns compact rows; use content_get for full details.

content_update

Update a post/page/product. Updates fields, meta and terms of an item. For surgical content changes use content_edits (exact old_string -> new_string replacements in the raw content, like fs_edit) instead of resending the whole content. meta: {"key": value} sets, {"key": null} deletes. A WordPress revision is created and the full previous state (post, meta, terms, product lookup rows) is journaled for rollback. dry_run=true shows the diff.

elementor_edit

Edit an Elementor page. Changes classic Elementor elements by id (from elementor_outline) and saves through Elementor, which rebuilds the page CSS: update settings (texts, links, images or any setting the widget knows; only the keys given change), replace_text (exact text inside the elements' content, on the whole page or in one element), remove, duplicate (placed after the original) and move (to another container at a position). Journaled and undone with changes_rollback. dry_run shows every change first. The live page changes at once: show the exact new texts before applying.

elementor_outline

Elementor page outline. The structure of a page, post or template built with Elementor, like the editor's Navigator: every section, container and widget with its id, type and visible content (texts, links, images, list items), without the style settings. Pass element_id for all settings of one element and the setting names its widget knows, before changing it with elementor_edit. Atomic (v4) elements are marked: Elementor's own abilities edit those (ability_run elementor/manage-elements).

media_import

Import media. Adds a file to the Media Library from a URL or from a file already on the server (e.g. uploaded with fs_transfer_link into wp-content/uploads/wpai-incoming/). Generates thumbnails, sets title/alt text and optionally attaches it / sets it as featured image of a post. Rollback removes the attachment record (files stay in uploads).

term_manage

Create, update or delete a term. Creates, updates or deletes a taxonomy term (with term meta). Journaled; deleting restores term, meta and all object relationships on rollback.

terms_query

List taxonomy terms. Lists terms of a taxonomy (category, post_tag, product_cat, product_tag, pa_color, ...). Without taxonomy, lists the registered taxonomies.

wc_order_inspect

Inspect an order. Everything needed to debug an order: status, totals, payment method and transaction id, items, all order notes in the order they were added (status history, gateway and e-mail messages), refunds, meta keys and the number of related scheduled actions. Personal data stays out unless full_address=true: the customer e-mail is masked, and the IP address, browser, names, street, city and postcode are left out.

wc_overview

WooCommerce store overview. Store health at a glance: orders by status, recent revenue, failed and stuck-pending orders (with the last failure notes), stock problems, enabled payment gateways and shipping zones, HPOS/sync state, database update status, outdated template overrides and Action Scheduler failures.

wc_product_inspect

Inspect a product. Diagnoses a product: type, prices (and whether the stored _price matches), stock settings vs. lookup table, variations summary, attributes, categories, visibility and detected inconsistencies (e.g. "variable product without purchasable variations").

wc_scheduled_action_manage

Run or cancel a scheduled action. Runs a scheduled action now (also to retry a failed one) or cancels a pending action.

wc_scheduled_actions

Scheduled actions (Action Scheduler). Background jobs queued by WooCommerce and plugins (emails, webhooks, subscriptions, imports...). Shows counts per status and lists actions (failed by default) with hook, arguments, schedule and the latest log messages (failure reasons). status=past-due finds pending actions that should already have run (queue stuck).

wc_status

WooCommerce system status. The WooCommerce System Status report (condensed): environment and limits, database tables and versions, active plugins, theme compatibility and template overrides (outdated ones flagged), key settings, security checks and WooCommerce pages.

wc_tools

WooCommerce maintenance tools. action=list shows WooCommerce > Status > Tools (clear transients, regenerate product lookup tables, recount terms, update database, reset capabilities, clear template cache, ...). action=run executes one (needs the "settings" scope).

Listing the tools is free; running one needs Settings & maintenance.

cache_flush

Flush caches. Flushes caches after changes: object cache, page cache (auto-detects WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround, Breeze, Hummingbird, Autoptimize, Nginx Helper, Varnish HTTP Purge, Cloudflare APO plugin, WP Engine, Kinsta), expired/all transients, WooCommerce transients, PHP OPcache and rewrite rules. Returns what was flushed.

maintenance_mode

Maintenance mode. Shows visitors a "down for maintenance" page (HTTP 503 + Retry-After, SEO-safe) while administrators, allow-listed IPs, wp-admin, the REST API, cron and WooCommerce payment/webhook callbacks keep working. It ALWAYS switches itself off after "minutes" (default 30, max 1440), so a live store is never left closed by accident. action=status is read-only; enable/disable need the "settings" scope.

Reading the state is free; switching maintenance mode needs Settings & maintenance.

option_delete

Delete an option. Deletes an option (journaled, reversible).

option_get

Read options. Reads WordPress options (settings of WordPress, WooCommerce, themes like WoodMart and plugins). mode=get: one option by name (value decoded to JSON; raw=true returns the stored string). mode=search: option names matching a pattern ("woodmart*", "_license") with sizes. mode=autoload_report: total autoloaded size and the largest autoloaded options (a common performance problem). Secret-looking values are masked unless the token has the "sensitive" scope.

option_update

Update an option. Changes an option (journaled, reversible). Give value (any JSON; arrays/objects are stored like update_option does), raw_value (exact stored string), or patch - a list of {op:"set"|"unset", path:"/json/pointer", value} applied to the current array value (ideal for large settings arrays such as theme options: change one key without resending everything). Changes to critical options (siteurl, home, active_plugins, template, stylesheet, permalink_structure) are health-checked and auto-reverted if the site breaks. dry_run=true shows the diff.

Roles, capabilities and user registration need Users; secret-looking options need Secrets.

plugin_manage

Manage a plugin. activate / deactivate / install / update / delete / enable_auto_update / disable_auto_update a plugin. install takes a wordpress.org slug (optionally version), a zip URL or a zip already on the server (path). Before update/delete/reinstall the plugin folder is snapshotted (tar.gz); activation and updates are health-checked and automatically reverted if they break the site. Everything is reversible with changes_rollback. PowerWP AI cannot deactivate or delete itself.

plugins_list

List plugins. Installed plugins with version, active state, available update, auto-update setting and requirements; plus must-use plugins and drop-ins.

theme_manage

Manage a theme. activate / install / update / delete a theme (stylesheet slug). Switching themes on a live store is health-checked and reverted automatically on failure; update/delete snapshot the theme folder first. Premium themes (e.g. WoodMart) update through their own updater or a zip (url/path).

themes_list

List themes. Installed themes with version, parent/child relation, active state and available updates.

updates_check

Check for updates. Available WordPress core, plugin, theme and translation updates (refresh=true asks wordpress.org and premium updaters again).

archive_create

Create archive. Packs a directory into a .tar.gz or .zip file on the server (e.g. to download a theme with fs_transfer_link).

archive_extract

Extract archive. Extracts a .zip or .tar.gz into a directory. The destination directory is snapshotted first (reversible). Unsafe paths (../, absolute) are refused. dry_run=true lists the entries.

Extracting over sensitive files needs Secrets.

fs_copy

Copy file or directory. Copies a file or a directory tree (journaled: rollback removes the copy / restores an overwritten target).

fs_delete

Delete file or directory. Deletes a file, or a directory with recursive=true. A snapshot is taken first (directories as tar.gz, size-limited), so it can be undone with changes_rollback. dry_run=true lists what would be deleted.

fs_edit

Edit file (exact replacements). Applies exact string replacements to a file, atomically: each old_string must occur exactly once (or set replace_all). Keep old_string minimal but unique (include surrounding lines when needed); whitespace and indentation must match exactly (line endings are handled). Journaled, syntax-checked, health-checked like fs_write. dry_run=true returns the diff only.

Changing wp-config.php or .htaccess needs Secrets.

fs_find

Find files. Finds files/directories by name glob, size and modification time (e.g. PHP files modified in the last day: name="*.php", modified_after="1d").

fs_list

List directory. Lists a directory (relative to the WordPress root unless absolute) with sizes, modification times and permissions. depth > 1 lists recursively (max 5).

fs_mkdir

Create directory. Creates a directory including missing parent directories (journaled: rollback removes it again if it is still empty/unchanged).

fs_move

Move / rename. Moves or renames a file or directory (journaled, reversible). overwrite=true replaces an existing target file (snapshotted).

fs_read

Read file. Reads a text file with line numbers (like cat -n). Use offset/limit for large files. Returns sha256 for use as expected_sha256 in fs_write/fs_edit. Binary files: encoding="base64" (byte range) or as_image=true to view an image. Secrets in wp-config.php/.env are redacted unless the token has the "sensitive" scope and reveal_secrets=true.

Reading a file with secrets unredacted needs Secrets.

fs_search

Search file contents (grep). Searches text files for a literal string or regex (PCRE) and returns matching lines with optional context. Defaults to wp-content and skips node_modules/.git/cache folders. Time-boxed; narrow with path/include if results are truncated.

fs_stat

File information. Metadata of a file or directory: size, permissions, owner, modification time, sha256/md5, MIME type, line count; for directories the recursive size and file count (bounded).

fs_transfer_link

Create a file transfer link. Creates a short-lived signed URL to move a file between this site and your machine with curl - use it for large or binary files (images, zips, logs, database exports) instead of passing contents through MCP. direction=download: GET the URL (Range/resume supported). direction=upload (needs the "files" scope): PUT the raw bytes; uploads are journaled (reversible), PHP is syntax-checked and code in plugins/themes is health-checked. Links are single-purpose and expire (default 1 hour).

Upload links need Files; downloading a file with secrets needs Secrets.

fs_write

Write file. Creates or overwrites a file (content or content_base64). Journaled: the previous version is snapshotted (undo with changes_rollback). PHP is syntax-checked before writing; code changes are health-checked and auto-reverted if the site breaks. Pass expected_sha256 (from fs_read) to avoid overwriting concurrent edits. For surgical changes prefer fs_edit. dry_run=true shows the diff without writing.

Changing wp-config.php or .htaccess needs Secrets.

db_cleanup

Database cleanup. Common database clean-ups for performance. dry_run=true (DEFAULT) only counts. Tasks: expired_transients, revisions, auto_drafts, trashed_posts, spam_comments, trashed_comments, orphaned_postmeta, orphaned_commentmeta, orphaned_termmeta, orphaned_usermeta, wc_expired_sessions, action_scheduler_history (completed/canceled/failed actions and their logs), optimize_tables. Content deletions are snapshotted (reversible) when under 50,000 rows; cache-like data (transients, sessions, scheduler history) is deleted without snapshot.

db_describe

Describe a table. Columns (type, null, default, key, extra), indexes and the CREATE TABLE statement of a table.

db_execute

Run a write SQL statement (journaled). Runs ONE write statement (INSERT, UPDATE, DELETE, REPLACE, CREATE/ALTER/DROP/TRUNCATE/RENAME TABLE, CREATE/DROP INDEX, OPTIMIZE/ANALYZE/REPAIR). Before executing, the affected rows are snapshotted (single-table UPDATE/DELETE/INSERT) or the whole table is dumped (DDL and complex statements), so it can be undone with changes_rollback. ALWAYS run with dry_run=true first to see the row count and plan. UPDATE/DELETE without WHERE require confirm_all_rows=true. Statements affecting more than max_affected rows are refused. For content/products/orders prefer the dedicated tools or rest_request (they keep WordPress caches and hooks consistent).

db_query

Run a read-only SQL query. Runs ONE read-only statement (SELECT, SHOW, DESCRIBE, EXPLAIN, WITH ... SELECT) inside a READ ONLY transaction with a server-side timeout. Returns at most max_rows rows (default 200).

db_search_replace

Search & replace in the database. Replaces text across tables safely: PHP-serialized values are unserialized, changed and re-serialized with correct lengths (objects of unloaded classes included); JSON-escaped variants ("https:\/\/...") are handled. Skips the guid column by default. dry_run=true (DEFAULT) reports matches per table/column with samples - review it, then run with dry_run=false. Large jobs continue with continue_token. Every modified cell is journaled for rollback. Typical use: domain or http->https migration.

db_tables

List database tables. Lists the site's database tables with engine, approximate rows, data/index size, reclaimable space (overhead), collation and auto-increment. Sorted by size.

rest_request

Call the site REST API. Performs a REST API request internally as the token's administrator - the most complete way to work with WordPress and WooCommerce data (e.g. GET /wc/v3/orders?status=failed, PUT /wc/v3/products/123 {"regular_price":"19.90"}, POST /wp/v2/pages). Use fields (=_fields) to keep responses small. GET needs only read access (secret-looking values are masked without the "sensitive" scope); writes to content (posts of any type, terms, media, comments, menus, templates, WooCommerce products/orders/coupons) need "content"; users/customers: "users"; plugins/themes: "extensions"; everything else (settings, payment gateways, shipping, taxes, webhooks, plugin routes): "settings". Writes to single items (posts, pages, products, variations, coupons, orders incl. notes/refunds, users/customers, terms, comments, block templates/template parts, settings) are snapshotted and reversible, and so are WooCommerce batch requests (POST /wc/v3/products/batch, …/variations/batch, orders, coupons, customers, product categories/tags/shipping classes/attribute terms/reviews and settings/<group>/batch, up to 100 items): their answer names the batch, undone in one step with changes_rollback {"batch": …}. Other writes are logged as irreversible.

GET requests only read. Other methods need the permission of the route (for example Content & store data for posts, products and orders); application passwords need Secrets.

rest_routes

List REST API routes. Lists the REST API routes available on this site (WordPress core /wp/v2, WooCommerce /wc/v3 and /wc/store, plugin/theme routes) with methods, optionally filtered by namespace or text, and with argument names (include_args).

user_manage

Create / update / delete a user. create, update (email, display name, first/last name, role), delete (content reassigned to reassign_to) or send_reset (password reset e-mail). Passwords are never returned: new users get a set-password e-mail when send_notification=true. Creating or promoting administrators requires confirm_admin=true. The user behind this token cannot be deleted or demoted. Journaled (users + usermeta rows).

users_list

List users. Lists users with roles, registration date, last activity (WooCommerce), post count and, for administrators, a flag if created recently. Filter by role or search (login, email, name).

backup_confirm_downloaded

Confirm a backup was downloaded. Reports the SHA-256 checksums computed locally. When all match, the backup is marked downloaded and (by default) the server copy is deleted.

backup_create

Create a backup. Starts a backup job on the server: type "database" (SQL dump), "files" (wp-content + root files, optionally uploads and WordPress core) or "full" (both). It runs in resumable steps: poll job_status (which also advances the job) until status=ready, then download it to the local machine with backup_download_links and confirm with backup_confirm_downloaded (or let the user download it in wp-admin > PowerWP AI > Backups). Take a database backup before risky database work.

backup_delete

Delete a server backup. Deletes the server copy of a backup (or a finished/failed restore job).

backup_download_links

Get backup download links. Creates signed download URLs for every file of a ready backup and returns a bash script (curl + sha256sum) that downloads them into a local folder and verifies checksums. After a successful download call backup_confirm_downloaded with the checksums so the server copy is deleted.

backups_list

List backups and restores. Lists recent backup and restore jobs with status, size and parts.

job_cancel

Cancel a job. Cancels a queued/running backup or a restore that has not started yet.

job_status

Backup/restore job status. Returns a backup or restore job and (advance=true, default) performs up to ~20 seconds of work first, so polling this drives the job forward. Poll every few seconds until status is ready / completed / failed.

restore_prepare

Prepare a restore. Step 1 of a restore: pass the contents of the backup's manifest.json. Returns a restore job and one upload URL per backup file (PUT raw bytes; chunk with &offset=N and finish with &final=1). The user can also do this in the browser: wp-admin > PowerWP AI > Backups > Restore from your computer.

restore_start

Start a restore. Step 2 (after all uploads are complete): restores the selected components. DESTRUCTIVE - replaces the database and/or files with the backup. Requires confirm = the site host (e.g. "store.com"). The site is in maintenance mode meanwhile; PowerWP AI's own data, the running plugin and wp-config.php (unless restore_wp_config) are preserved. Poll job_status until completed. Only do this when the user explicitly asked for a restore.

change_details

Change details & diff. Shows one change with a preview of what it did: unified diff for files and options, row differences for database/content changes, and whether the target was modified again afterwards.

changes_list

List recorded changes. Lists the change journal (newest first): every change made through PowerWP AI with its target, status and whether it can be rolled back. sessions=true lists work sessions (groups of changes with < 30 min gaps) instead. Use it to review what was done and to find ids for changes_rollback.

changes_rollback

Roll back changes. Undoes recorded changes: one change (change_id), everything after a checkpoint (checkpoint_id), a whole work session (work_session) or one REST batch request (batch, as rest_request returned it), newest first. If the target was modified again after the change, the rollback stops with a conflict - inspect with change_details and retry with force=true. dry_run=true previews. A rollback is itself journaled, so it can be undone too. Requires the scope that the original change needed.

Needs the permission of the change it undoes.

checkpoint_create

Create a checkpoint. Marks the current point in the change journal. Everything this token changes afterwards, and that is recorded, can be rolled back in one step with changes_rollback {"checkpoint_id": N}. Create one before any multi-step modification.

memory_list

Site memory. The site memory: the owner's rules, facts about the business and notes from earlier sessions that apply to every AI session on this site, the setup questions (and which are answered), proposals waiting for the owner, and the detected site profile. The connection instructions already carry the active entries; use this for all of them, their ids and the questions.

memory_save

Propose a memory entry. Proposes an entry for the site memory, or a change or removal of one (id from memory_list). The owner approves proposals in wp-admin > PowerWP AI > Memory; until then they are not in effect (the result says "saved" when the owner lets this connection save directly). Save only what matters in future sessions, one point per entry (max 600 characters): kind "rule" for how AI apps must work here ("Ask before changing prices"), "fact" for the business (brand voice, markets, shipping or refund terms; topic = the question id when it answers a setup question), "note" for a technical observation ("Product images are 1200x1200"). Save only what the user said or what you verified. Never save passwords, keys, tokens or customer data.

recipe_get

Run a recipe. Returns the instructions of one recipe (from recipes_list) with its arguments filled in. Follow them step by step, as if the user had given them.

recipe_save

Propose a recipe. Proposes a recipe for this site, e.g. when the user says "save what we just did as a recipe": a named, step-by-step procedure that later sessions (and other AI apps) can run. Saving one with the name of a built-in recipe makes this site's own version of it. The owner approves it in wp-admin > PowerWP AI > Recipes. Write numbered steps that name the tools and arguments to use, with the checks that made the work safe; no site secrets or customer data.

recipes_list

List recipes. Ready-made recipes for this site: step-by-step procedures for diagnosis, audits, safe changes and site-type tasks (built-in packs for the site type plus the site's own recipes). The same recipes are this connection's prompts (slash commands); in apps without prompts, run one with recipe_get. Suggest a recipe when it fits what the user asks for.

abilities_list

List WordPress abilities. Lists abilities registered through the WordPress Abilities API by core, WooCommerce, the theme (e.g. WoodMart) and plugins, with their annotations (readonly/destructive). Pass name to get one ability's full input/output schema before running it with ability_run.

ability_run

Run a WordPress ability. Executes an ability (from abilities_list) with the given input, as this token's administrator, after the ability's own permission check. Read-only abilities need only read access; others need the "settings" scope, except Elementor's page abilities (manage-elements, build-composition, update-page-settings, publish-document, create-preview-link, create-page), which need "content". Elementor's abilities are snapshotted and undone with changes_rollback (the answer names the batch), and the page CSS and caches are refreshed; on a published page Elementor stages edits in an autosave until elementor/publish-document. Other plugins' abilities are logged but cannot be rolled back automatically: create a checkpoint or backup first for big changes. Secret-looking values in results are masked unless the token has the "sensitive" scope.

Abilities that only read need nothing more. Elementor's page abilities need Content & store data; every other ability that makes changes needs Settings & maintenance.