Developer tools · 2 modules
WordPress Developer Tools MCP that starts on staging.
A WordPress developer tools MCP covers the calls that put new behaviour on a site: snippets that run on every matching request, and add-on tools that switch builder features on and off. They are the calls to try on staging before anywhere else.
What goes wrong without a plugin-aware module
- Generated code enabled before review and validation
- Privileged access used in production for convenience
- No recovery path if a snippet or tool breaks the site
Worked example
Add a small PHP snippet that changes the login logo link, on staging, with a way back if it fails.
Code Snippets, since a snippet is new code running on every matching request and the sequence exists to keep that step deliberate.
wppilot/code-snippets-check-setupProReports whether Code Snippets or Code Snippets Pro is active, the snippet types this install allows (PHP and HTML in free; CSS, JS and conditions in Pro), and how many snippets are active now.
wppilot/code-snippets-get-types-schemaProReturns which scope values each type accepts and when each scope runs, so the snippet is created with a valid type and scope pair first time.
wppilot/code-snippets-validate-snippetProParses the PHP without saving or running it, catching syntax and compile errors. Non-PHP types are skipped rather than falsely failed.
wppilot/code-snippets-create-snippetProSaves the snippet inactive. It exists in the database but does not run until someone enables it.
wppilot/code-snippets-enable-snippetProActivates it after a person has read the code. From this call on, the snippet runs on every request its scope matches.
wppilot/code-snippets-disable-snippetProThe way back: stops the snippet on the next request and leaves its code untouched, so it can be fixed and enabled again.
What to check yourself. After enabling, load the login page and the front end in a private window so a cached page cannot hide a fatal error. Validation proves the code parses; it cannot prove the code does what was intended, and it does not run it.
Why it matters
What plugin-aware changes for developer tools
These are the abilities that let a site execute new code, which puts them among the abilities where a mistake can take the whole site down rather than one page with it, alongside plugin, theme and update work. They exist because the alternative, doing this work over FTP with no record, is worse, not because they are safe to hand out.
A first safe workflow
Do the first several sessions on staging, with the snippet saved inactive, read by a person, then enabled while you watch the site in a private window. Once that rhythm is habit, decide deliberately whether it should ever apply to production, and write the answer down for whoever joins the team next.
How to tell it worked
Use staging. Save a snippet inactive, read it yourself, then enable it and load the site in a fresh session so a fatal error cannot hide behind a cached page. Know how you would disable it again before you enable it the first time.
Modules
2 modules compared
Each module loads only when its plugin is active and needs GoBuildWP Pro. Open a module for its full ability list, requirements and safety notes.
| Module | Edition | Abilities | Inspect / change / destructive | Covers |
|---|---|---|---|---|
 Code Snippets | Pro | 11 | 6 / 1 / 4 | snippet list and detail, snippet validation, snippet types, condition schemas |
 Bricksforge | Pro | 21 | 9 / 9 / 3 | custom elements, tool activation, element activation, email templates |
Code on a live site, with a record
Two modules with opposite risk profiles
The developer tools category holds two modules that look alike in a table and behave nothing alike. Code Snippets puts new code into execution. Its writes are recorded in the change ledger but cannot be restored from it, because the snippets live in the plugin's own table, and a delete is permanent with no trash. Read a snippet before editing it so its previous body is on record somewhere you control.
Bricksforge switches features of a Bricks site on and off: tools such as popups and the email designer, and its custom elements. Everything it stores is an option row, so every Bricksforge write here can be rolled back. Its risk is different: disabling a custom element drops the settings on that element's row, such as captcha or Stripe keys on Pro Forms, exactly as Bricksforge's own screen does, and disabling an email template changes which emails actually go out.
Where new code should live: snippet, theme file or one-off PHP
When an agent proposes code, the first decision is where to put it, and GoBuildWP offers three routes with different trade-offs.
- A Code Snippets snippet survives a theme switch, can be scoped to admin, front end or a single run, and can be switched off without touching its code. It is the right home for small site behaviour such as a filter or a login tweak.
- A theme or child-theme file edited with edit-file belongs to that theme and goes with it. Use it when the code is genuinely presentation for that theme, and keep the edit in your own version control too.
- execute-php runs code once and leaves nothing installed. It suits a one-off migration or an inspection no ability covers, and it needs the Developer Full Access profile plus its own confirmation.
The three calls that start code running
Code Snippets has exactly three ways to put code into execution, and each one needs confirm: enabling a snippet, creating one with activate set, and editing the code, type, scope or condition of a snippet that is already active. Everything else, from listing and reading to validating and saving inactive, leaves the site's behaviour unchanged. That boundary is what to give a reviewer: approve those three calls, and let the agent draft freely before them.
Two snippet settings deserve a second look in review. A single-use PHP snippet runs once and switches itself off, so it is wrong for a hook that must register on every request. On Code Snippets Pro, CSS, JS and condition snippets save and read back on an unlicensed install but are not output on the site, which reads like a bug in the snippet when it is a licence state.
Plan the way back before the first enable
code-snippets-disable-snippet stops a snippet on the next request and keeps its code, and that is the normal recovery. It assumes the site still answers. If a fatal error takes down wp-admin and the MCP endpoint with it, recovery has to come from outside: Code Snippets documents a safe mode, a CODE_SNIPPETS_SAFE_MODE constant added to wp-config.php, that pauses every snippet so you can get back in and disable the faulty one. Check the vendor's current instructions, and make sure you can actually edit wp-config.php through your host's file manager or SFTP before you need to.
Keep a backup or a staging copy for the same reason, and never enable a snippet on production that has not run on staging first.
Admin and Site Enhancements and other toolkit plugins
People searching for AI help with Admin and Site Enhancements usually want its custom content features driven from a prompt. GoBuildWP's ASE module covers exactly that, field groups, post types, taxonomies and their values, and it is compared with the other field frameworks under custom data. ASE's many other admin tweaks have no abilities of their own, so change those in ASE's settings screen.
Giving developer abilities to the right connection
Treat these as the abilities you grant last. The restrictive safety profiles withhold code abilities, and a token issued for content or store work never needs them. A sensible split is one connection for a developer on staging with code abilities and a person watching, and every other connection without them. On production, ask the agent to list active snippets and Bricksforge tools as a read before any change, so you have a record of the starting state the ledger itself cannot restore.
FAQ
Developer tools and AI, answered
Does this let an agent run arbitrary code on my site?
It lets an agent create and manage snippets where you have enabled those abilities, which is why the restrictive safety profiles withhold them and why staging is the right place to start. The alternative people actually use, pasting code in with no record, is less controlled, not more.
Can a snippet be created without being activated?
Yes, and that is the recommended sequence: save inactive, read the code yourself, then enable it and reload the site in a fresh session so a fatal error cannot hide behind a cached page.
What if a snippet takes the site down?
Know the recovery route before enabling anything: a way to disable the snippet from outside the site's own admin, and a backup or staging copy. The change ledger records that a snippet was created, edited or enabled, but it cannot restore Code Snippets writes, so the way back is disabling the snippet, or Code Snippets' safe mode when wp-admin is down, and putting back code you kept a copy of.
Does validating a snippet guarantee it will not break the site?
No. wppilot/code-snippets-validate-snippet runs PHP's parser over the code, so it catches syntax and compile errors, but it never executes anything. A call to a function that does not exist, or a hook that misbehaves at runtime, only shows up once the snippet runs, which is why enabling happens on staging with the site open in another window.
Can an agent manage network-wide snippets on multisite?
No. The Code Snippets abilities work on each site's own snippets table only; snippets shared across a network are out of scope. On a network, connect to the site whose snippets you want to change.
Start in Read Only, then add what the site runs
Connect your AI client to the free MCP foundation and check what it can see. Add Pro when you want the Code Snippets and Bricksforge modules.