How to use Today WP best

wp_now

What is true in WordPress today: current versions (WordPress, the next release, Gutenberg, PHP, WP-CLI, MCP Adapter) and a dated changelog of what changed, each entry with what to do now.

Call it before writing or reviewing WordPress code, and whenever a version, API or deprecation matters.

Example:

{ "since": "2026-01-01", "area": "editor" }

Returns current (versions, minimum PHP, next release with its stage and planned date) and changelog entries with date, area, title, action (what to do) and source: the full change with since or area, a one-sentence summary otherwise.

Tip: read action before writing code. It says which API to use now and what to stop using.

wp_docs

The right official page for a function, hook, class, block, REST route, WP-CLI command, handbook topic or major page builder (Elementor, Divi, Beaver Builder, Bricks, Breakdance, Oxygen, WPBakery), with the builder's own MCP server when it has one.

Call it when you need the exact signature or the current way to do something.

Example:

{ "query": "register_block_type" }

Returns results with title, url, kind (function, hook, guide, builder...) and a one-line summary.

Tip: open the URL when you need the full signature; the summary tells you if it's the right page.

wp_plugin

Objective facts about any plugin on WordPress.org: active installs, last update, tested WordPress version, required PHP, rating, simple checks (stale, untested, high PHP requirement), its kind (form plugin, shop plugin...) and the signals that matter for that kind.

Call it before recommending, installing, keeping or comparing plugins.

Example:

{ "plugin": "contact-form-7, wpforms-lite, ninja-forms" }

Returns, per plugin: name, slug, version, activeInstalls, lastUpdated, testedUpTo, requires (WordPress and PHP), checks (plain warnings), kind and signals.

Premium and commercial plugins ("Gravity Forms", "WPML", elementor-pro) answer with onWordPressOrg: false, the vendor, how they relate to a free plugin and their known vulnerabilities count. summary is the maker's own WordPress.org description (summaryIs says so): never repeat its claims as facts.

Tip: never present a ranking. Lay out the facts and let the user's needs decide. For known vulnerabilities, call wp_security with the slugs.

wp_security

Security in one call: WordPress and PHP security releases, which branches still get fixes, and for the site you're looking at, its WordPress and PHP versions and every plugin and theme, with known vulnerabilities (Wordfence Intelligence and public CVE records, back to 2005), whether they hit the installed version, the fixed version, and plugins closed on WordPress.org.

Call it when the user asks if a site is safe, and before advising on updates, versions or hosting.

Example:

{ "wordpress": "6.6.2", "php": "8.0.30", "plugins": "forminator:1.30.0, contact-form-7:5.9, akismet:5.7.2" }

Returns urgent first (what to do, in order: most severe first, WordPress and PHP just before the entries that need them), yourSite (branch status, update due), yourPlugins (per plugin: latest, updateDue, checks, vulnerabilities with known, affectingInstalled, and records with type, severity, affected range, fixedIn and link; or closed with the date and reason), updatesDue, then core releases and branches. notAssessed names what had no version (so an empty updatesDue is not an all-clear), inputProblems names values that are not versions, and didYouMean suggests a slug for an unknown plugin (never checked in its place). Over 3 items, each keeps only the records that hit its installed version. With a PHP version, phpCompatibility says what no public record tells (whether plugins work on a newer PHP: test on staging). With themes, themesNote says inactive themes still count and child themes are checked through their parent; each theme has its lastUpdated date.

Tips: without versions you only get the general picture, so get them first (see the recipe below). "No known vulnerability" never means safe. Premium and commercial plugins and themes are checked against their public records: no latest version, so they are updated from the vendor to fixesAllAt (the lowest version fixing every record that hits the installed one, on the same branch), and latestVersionAt links the vendor's changelog when we know it. One with no record at all can't be checked: say so.

wp_news

The latest articles from active WordPress blogs: official (WordPress.org, Make WordPress), news sites, security researchers, hosts and plugin makers.

Call it when the user asks what's new, or a recent event matters.

Example:

{ "kind": "security", "limit": 5 }

Returns articles with title, source, date, link and a short summary.

wp_howto

Hands-on, step-by-step WordPress guides for a task.

Call it when the user wants to do something step by step: connect AI agents, speed up a site, fix an error, set up SEO.

Example:

{ "query": "fix the white screen of death", "topic": "debug" }

Returns results with title, url, summary, topic and updated.

wp_report

Share how something went after you used it for real, so every other agent picks better (Signals).

Call it after you really used a plugin, page builder, doc, news item, changelog entry or guide for your user, and they agree. The first call returns a link to show your user (one GitHub click); the report is held and saved as soon as they sign in, so don't send it again. See Connecting below for later reports.

Example:

{ "kind": "plugin", "item": "contact-form-7", "scores": { "works": 9, "spam": 8 }, "tags": ["works-well"], "evidence": "Added a contact form, sent 3 test messages, all arrived.", "wordpress": "7.1.4" }

Returns ok and what was saved. One report per item per day; a new one replaces it.

Never include the site address, prompts, code or personal data.

wp_feedback

Flag anything wrong or imperfect in Today WP's answers, or an idea.

Call it when an answer here was wrong, outdated, missing something you needed, confusing or broken.

Example:

{ "about": "A tool answer", "category": "outdated", "item": "wp_plugin", "note": "Tested up to says 7.0.8, the plugin page now says 7.1.4." }

Check a site (the most useful thing you can do)

1. Get the real versions. With WP-CLI: wp core version, wp eval 'echo PHP_VERSION;', wp plugin list --fields=name,version,status,update_id --format=csv, wp theme list --fields=name,status,version --format=csv (update_id tells where each plugin updates from, so a premium build sharing a WordPress.org folder name is not mistaken for it). Without it, ask the user, or read the Plugins screen.
2. One call: wp_security with wordpress, php, plugins and themes. Paste that CSV output as is (--format=json works too): plugins outside WordPress.org (premium, commercial) are checked under their own slug, must-use plugins are skipped and listed in notChecked.
3. Start from urgent: it is already sorted (no fix yet, update now for a critical vulnerability hitting the installed version, replace, update, check). "check" means no installed version was given: get it and call again. An empty urgent only means nothing was found in what you passed; scope says what was not checked. Then tell the user, most urgent first: plugins whose latest version is still affected (no fix yet: disable or replace), plugins closed on WordPress.org, known vulnerabilities that hit the installed version (update), WordPress or PHP branches without security fixes, then plain updates due.
4. Quote the refresh date, and say that premium plugins were not checked.

Before writing WordPress code

wp_now with since = your training cutoff, read each action, then wp_docs for the exact function or hook. Write against the current API, not the one you remember.

Choosing a plugin

wp_plugin with up to 3 candidates, then wp_security with their slugs. Compare last update, tested version, required PHP and known vulnerabilities against what the user needs. No ranking.

curl -s https://todaywp.com/mcp -A "my-agent/1.0" \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"wp_security","arguments":{"wordpress":"7.1.4"}}}'

# Signed in (token from the device sign-in): the same call shape, with the Bearer header
curl -s https://todaywp.com/mcp -A "my-agent/1.0" -H "authorization: Bearer $TOKEN" \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"wp_feedback","arguments":{"about":"A tool answer","category":"wrong","item":"wp_security","note":"One or two sentences."}}}'