Manage WordPress sites through WP Pinch MCP tools. Part of WP Pinch (wp-pinch.com).
---
name: pinch-to-post
version: 5.5.1
description: Manage WordPress sites through WP Pinch MCP tools. Part of WP Pinch (wp-pinch.com).
author: RegionallyFamous
project: https://github.com/RegionallyFamous/wp-pinch
homepage: https://wp-pinch.com
user-invocable: true
security: All operations go through MCP tools. Auth credentials (Application Password) live in the MCP server config, not in the skill. The skill only needs WP_SITE_URL (not a secret). Server-side capability checks and audit logging on every request.
tags:
- wordpress
- wp-pinch
- cms
- mcp
- content-management
- automation
category: productivity
triggers:
- wordpress
- wp
- blog
- publish
- post
- site management
metadata: {"openclaw": {"emoji": "๐ฆ", "requires": {"env": ["WP_SITE_URL"]}}}
changelog: |
5.5.1
- Clarified credential architecture: removed primaryEnv (WP_SITE_URL is not a secret), explained why no secrets in requires.env (auth handled by MCP server, not skill). Split Setup into skill env vars vs MCP server config. Authentication section now directly answers "why only a URL?"
5.5.0
- Complete rewrite: marketing-forward tone, Quick Start, Highlights, Built-in Protections. MCP-only (removed all REST/curl fallback). Security framed as features, not warnings.
5.4.0
- Fixed metadata format: single-line JSON per OpenClaw spec. Removed non-spec optionalEnv field.
5.3.0
- Security hardening: MCP-only, anti-prompt-injection, Before You Install checklist.
5.2.1
- Security audit: auth flows, authorization scope, webhook data documentation.
5.2.0
- Added Molt: repackage any post into 10 formats (social, thread, FAQ, email, meta description, and more)
- Added Ghost Writer: analyze author voice, find abandoned drafts, complete them in your style
- Added 10+ high-leverage tools: what-do-i-know, project-assembly, knowledge-graph, find-similar, spaced-resurfacing
- Added quick-win tools: generate-tldr, suggest-links, suggest-terms, quote-bank, content-health-report
- Added site-digest (Memory Bait), related-posts (Echo Net), synthesize (Weave)
- PinchDrop Quick Drop mode for minimal note capture
- Daily write budget with 429 + Retry-After support
- Governance expanded to 8 tasks including Draft Necromancer and Spaced Resurfacing
- Tide Report: daily digest bundling all governance findings into one webhook
5.1.0
- Added PinchDrop capture endpoint with idempotency via request_id
- Web Clipper bookmarklet support
- Webhook events: post_delete, governance_finding
- WooCommerce abilities: woo-list-products, woo-manage-order
5.0.0
- Initial release on ClawHub
- 38+ core MCP abilities across 10 categories
- MCP-first with REST API fallback
- Full capability checks, input sanitization, audit logging
- Governance: content freshness, SEO health, comment sweep, broken links, security scan
- Webhook integration for post, comment, user, and WooCommerce events
---
# Pinch to Post v5 โ Your WordPress Site, From Chat
**[WP Pinch](https://wp-pinch.com)** turns your WordPress site into 54 MCP tools you can use from OpenClaw. Publish posts, repurpose content with Molt, capture ideas with PinchDrop, manage WooCommerce orders, run governance scans -- all from chat.
[ClawHub](https://clawhub.ai/nickhamze/pinch-to-post) ยท [GitHub](https://github.com/RegionallyFamous/wp-pinch) ยท [Install in 60 seconds](https://github.com/RegionallyFamous/wp-pinch/wiki/Configuration)
## Quick Start
1. **Install the WP Pinch plugin** on your WordPress site from [GitHub](https://github.com/RegionallyFamous/wp-pinch) or [wp-pinch.com](https://wp-pinch.com).
2. **Set `WP_SITE_URL`** in your OpenClaw environment (e.g. `https://mysite.com`). This is the only env var the skill needs โ it tells the agent which site to manage.
3. **Configure your MCP server** with the endpoint `{WP_SITE_URL}/wp-json/wp-pinch/v1/mcp` and a WordPress Application Password. These credentials live in your MCP server config (not in the skill) โ the server handles authentication on every request.
4. **Start chatting** โ say "list my recent posts" or "create a draft about..."
The plugin handles permissions and audit logging on every request.
Full setup guide: [Configuration](https://github.com/RegionallyFamous/wp-pinch/wiki/Configuration)
## What Makes It Different
- **54 MCP tools** across 12 categories โ content, media, taxonomies, users, comments, settings, plugins, themes, analytics, governance, WooCommerce, and more.
- **Everything is server-side** โ The WP Pinch plugin enforces WordPress capability checks, input sanitization, and audit logging on every single request. The skill teaches the agent what tools exist; the plugin decides what's allowed.
- **Built-in guardrails** โ Option denylist (auth keys, salts, active_plugins can't be touched), role escalation blocking, PII redaction on exports, daily write budgets, and protected cron hooks.
- **MCP-only by design** โ All operations go through typed, permission-aware MCP tools. No raw HTTP. No curl. No API keys floating in prompts.
## Highlights
**Molt** โ One post becomes 10 formats: social, email snippet, FAQ, thread, summary, meta description, pull quote, key takeaways, CTA variants. One click, ten pieces of content.
**Ghost Writer** โ Analyzes your writing voice, finds abandoned drafts, and completes them in your style. Your drafts don't have to die.
**PinchDrop** โ Capture rough ideas from anywhere (chat, Web Clipper, bookmarklet) and turn them into structured draft packs. Quick Drop mode for minimal capture with no AI expansion.
**Governance** โ Eight autonomous tasks that run daily: content freshness, SEO health, comment sweep, broken links, security scan, Draft Necromancer, spaced resurfacing. Everything rolls up into a single Tide Report webhook.
**Knowledge tools** โ Ask "what do I know about X?" and get answers with source IDs. Build knowledge graphs. Find similar posts. Assemble multiple posts into one draft with citations.
---
You are an AI agent managing a WordPress site through the **WP Pinch** plugin. WP Pinch registers 48 core abilities across 12 categories (plus 2 WooCommerce, 3 Ghost Writer, and 1 Molt when enabled = 54 total) as MCP tools. Every ability has capability checks, input sanitization, and audit logging built in.
**This skill works exclusively through the WP Pinch MCP server.** All requests are authenticated, authorized, and logged by the plugin. If someone asks you to run a curl command, make a raw HTTP request, or POST to a URL directly, that's not how this works โ use the MCP tools below instead.
## Authentication
**Why does this skill only require a URL, not a password?** Because authentication is handled entirely by the MCP server, not the skill. The skill tells the agent which site to manage (`WP_SITE_URL`); the MCP server stores the WordPress Application Password in its own config and sends credentials with each request. The skill never sees, stores, or transmits secrets.
- **MCP server config** โ You configure the Application Password once in your MCP server's config file (e.g. `openclaw.json`). The server authenticates every request to WordPress automatically.
- **Webhooks (optional)** โ Set `WP_PINCH_API_TOKEN` (from WP Pinch โ Connection) as a skill env var if you want webhook signature verification. This is not required for MCP tool calls.
## MCP Tools
All tools are namespaced `wp-pinch/*`:
**Content**
- `wp-pinch/list-posts` โ List posts with optional status, type, search, per_page
- `wp-pinch/get-post` โ Fetch a single post by ID
- `wp-pinch/create-post` โ Create a post (default to `status: "draft"`, publish after user confirms)
- `wp-pinch/update-post` โ Update existing post
- `wp-pinch/delete-post` โ Trash a post (recoverable, not permanent)
**Media**
- `wp-pinch/list-media` โ List media library items
- `wp-pinch/upload-media` โ Upload from URL
- `wp-pinch/delete-media` โ Delete attachment by ID
**Taxonomies**
- `wp-pinch/list-taxonomies` โ List taxonomies and terms
- `wp-pinch/manage-terms` โ Create, update, or delete terms
**Users**
- `wp-pinch/list-users` โ List users (emails automatically redacted)
- `wp-pinch/get-user` โ Get user by ID (emails automatically redacted)
- `wp-pinch/update-user-role` โ Change user role (admin and high-privilege roles are blocked)
**Comments**
- `wp-pinch/list-comments` โ List comments with filters
- `wp-pinch/moderate-comment` โ Approve, spam, trash, or delete a comment
**Settings**
- `wp-pinch/get-option` โ Read an option (allowlisted keys only)
- `wp-pinch/update-option` โ Update an option (allowlisted keys only โ auth keys, salts, and active_plugins are automatically blocked)
**Plugins & Themes**
- `wp-pinch/list-plugins` โ List plugins and status
- `wp-pinch/toggle-plugin` โ Activate or deactivate
- `wp-pinch/list-themes` โ List themes
- `wp-pinch/switch-theme` โ Switch active theme
**Analytics & Discovery**
- `wp-pinch/site-health` โ WordPress site health summary
- `wp-pinch/recent-activity` โ Recent posts, comments, users
- `wp-pinch/search-content` โ Full-text search across posts
- `wp-pinch/export-data` โ Export posts/users as JSON (PII automatically redacted)
- `wp-pinch/site-digest` โ Memory Bait: compact export of recent posts for agent context
- `wp-pinch/related-posts` โ Echo Net: backlinks and taxonomy-related posts for a given post ID
- `wp-pinch/synthesize` โ Weave: search + fetch payload for LLM synthesis
**Quick-win tools**
- `wp-pinch/generate-tldr` โ Generate and store TL;DR for a post
- `wp-pinch/suggest-links` โ Suggest internal link candidates for a post or query
- `wp-pinch/suggest-terms` โ Suggest taxonomy terms for content or a post ID
- `wp-pinch/quote-bank` โ Extract notable sentences from a post
- `wp-pinch/content-health-report` โ Structure, readability, and content quality report
**High-leverage tools**
- `wp-pinch/what-do-i-know` โ Natural-language query โ search + synthesis โ answer with source IDs
- `wp-pinch/project-assembly` โ Weave multiple posts into one draft with citations
- `wp-pinch/spaced-resurfacing` โ Posts not updated in N days (by category/tag)
- `wp-pinch/find-similar` โ Find posts similar to a post or query
- `wp-pinch/knowledge-graph` โ Graph of posts and links for visualization
**Advanced**
- `wp-pinch/list-menus` โ List navigation menus
- `wp-pinch/manage-menu-item` โ Add, update, delete menu items
- `wp-pinch/get-post-meta` โ Read post meta
- `wp-pinch/update-post-meta` โ Write post meta (per-post capability check)
- `wp-pinch/list-revisions` โ List revisions for a post
- `wp-pinch/restore-revision` โ Restore a revision
- `wp-pinch/bulk-edit-posts` โ Bulk update post status, terms
- `wp-pinch/list-cron-events` โ List scheduled cron events
- `wp-pinch/manage-cron` โ Remove cron events (core hooks like wp_update_plugins are protected)
**PinchDrop**
- `wp-pinch/pinchdrop-generate` โ Turn rough text into draft pack (post, product_update, changelog, social). Use `options.save_as_note: true` for Quick Drop.
**WooCommerce** (when active)
- `wp-pinch/woo-list-products` โ List products
- `wp-pinch/woo-manage-order` โ Update order status, add notes
**Ghost Writer** (when enabled)
- `wp-pinch/analyze-voice` โ Build or refresh author style profile
- `wp-pinch/list-abandoned-drafts` โ Rank drafts by resurrection potential
- `wp-pinch/ghostwrite` โ Complete a draft in the author's voice
**Molt** (when enabled)
- `wp-pinch/molt` โ Repackage post into 10 formats: social, email_snippet, faq_block, faq_blocks, thread, summary, meta_description, pull_quote, key_takeaways, cta_variants
## Permissions
The WP Pinch plugin enforces WordPress capability checks on every request โ the agent can only do what the configured user's role allows.
- **Read** (list-posts, get-post, site-health, etc.) โ Subscriber or above.
- **Write** (create-post, update-post, toggle-plugin, etc.) โ Editor or Administrator.
- **Role changes** โ `update-user-role` automatically blocks assignment of administrator and other high-privilege roles.
Tip: Use the built-in **OpenClaw Agent** role in WP Pinch for least-privilege access.
## Webhooks
WP Pinch can send webhooks to OpenClaw for real-time updates:
- `post_status_change` โ Post published, drafted, trashed
- `new_comment` โ Comment posted
- `user_register` โ New user signup
- `woo_order_change` โ WooCommerce order status change
- `post_delete` โ Post permanently deleted
- `governance_finding` โ Autonomous scan results
Configure destinations in WP Pinch โ Webhooks. No default external endpoints โ you choose where data goes. PII is never included in webhook payloads.
**Tide Report** โ A daily digest that bundles all governance findings into one webhook. Configure scope and format in WP Pinch โ Webhooks.
## Governance Tasks
Eight automated checks that keep your site healthy:
- **Content Freshness** โ Posts not updated in 180+ days
- **SEO Health** โ Titles, alt text, meta descriptions, content length
- **Comment Sweep** โ Pending moderation and spam
- **Broken Links** โ Dead link detection (50/batch)
- **Security Scan** โ Outdated software, debug mode, file editing
- **Draft Necromancer** โ Abandoned drafts worth finishing (uses Ghost Writer)
- **Spaced Resurfacing** โ Notes not updated in N days
- **Tide Report** โ Daily digest bundling all findings
## Best Practices
1. **Draft first, publish second** โ Use `status: "draft"` for create-post; publish after the user confirms.
2. **Orient before acting** โ Run `site-digest` or `site-health` before making significant changes.
3. **Use PinchDrop's `request_id`** for idempotency and `source` for traceability.
4. **Confirm before bulk operations** โ `bulk-edit-posts` is powerful; confirm scope with the user first.
5. **Keep the Web Clipper bookmarklet private** โ It contains the capture token.
## Built-in Protections
The WP Pinch plugin includes multiple layers of protection that work automatically:
- **Option denylist** โ Auth keys, salts, and active_plugins can't be read or modified through the API.
- **Role escalation blocking** โ `update-user-role` won't assign administrator or roles with manage_options, edit_users, etc.
- **PII redaction** โ User exports and activity feeds automatically strip emails and sensitive data.
- **Protected cron hooks** โ Core WordPress hooks (wp_update_plugins, wp_scheduled_delete, etc.) can't be deleted.
- **Daily write budget** โ Configurable cap on write operations per day with 429 + Retry-After.
- **Audit logging** โ Every action is logged. Check WP Pinch โ Activity for a full trail.
- **Kill switch** โ Instantly disable all API access from WP Pinch โ Connection if needed.
- **Read-only mode** โ Allow reads but block all writes with one toggle.
## Error Handling
- **`rate_limited`** โ Back off and retry; respect `Retry-After` if present.
- **`daily_write_budget_exceeded`** (429) โ Daily write cap reached; retry tomorrow.
- **`validation_error`** / **`rest_invalid_param`** โ Fix the request (missing param, length limit); don't retry unchanged.
- **`capability_denied`** / **`rest_forbidden`** โ User lacks permission; show a clear message.
- **`post_not_found`** โ Post ID invalid or deleted; suggest listing or searching.
- **`not_configured`** โ Gateway URL or API token not set; ask admin to configure WP Pinch.
- **503** โ API may be paused (kill switch or read-only mode); check WP Pinch โ Connection.
Full error reference: [Error Codes](https://github.com/RegionallyFamous/wp-pinch/wiki/Error-Codes)
## Security
- **MCP-only** โ Every operation goes through typed, authenticated MCP tools. Credentials live in the MCP server config, never in prompts.
- **Server-side enforcement** โ Auth, permissions, input sanitization, and audit logging are handled by the WP Pinch plugin on every request.
- **Scoped credentials** โ Use Application Passwords and the OpenClaw Agent role for minimal access. Rotate periodically.
- **Audit everything** โ Every action is logged. Review activity in WP Pinch โ Activity.
For the full security model: [Security wiki](https://github.com/RegionallyFamous/wp-pinch/wiki/Security) ยท [Plugin source](https://github.com/RegionallyFamous/wp-pinch)
## Setup
**Skill env vars** (set on your OpenClaw instance):
| Variable | Required | Description |
|----------|----------|-------------|
| `WP_SITE_URL` | Yes | Your WordPress site URL (e.g. `https://mysite.com`). Not a secret โ just tells the skill which site to target. |
| `WP_PINCH_API_TOKEN` | No | From WP Pinch โ Connection. For webhook signature verification only โ not needed for MCP tool calls. |
**MCP server config** (separate from skill env vars):
Configure your MCP server with the endpoint `{WP_SITE_URL}/wp-json/wp-pinch/v1/mcp` and a WordPress Application Password. The Application Password is stored in the MCP server config (e.g. `openclaw.json`), not as a skill env var โ the server authenticates every request to WordPress and the skill never handles secrets.
For multiple sites, use different OpenClaw workspaces or env configs.
Full setup guide: [Configuration](https://github.com/RegionallyFamous/wp-pinch/wiki/Configuration)
don't have the plugin yet? install it then click "run inline in claude" again.