Qwen Code WordPress MCP. httpUrl, not url.

Fixing the images Qwen Code found

The read-only media review returns attachment IDs for oversized images and images with no alt text. Both have a GoBuildWP ability, and both are safe to try on a staging site set to Production Safe because neither throws the original away. For alt text, have Qwen look at each image with wppilot/get-media-image before writing anything, then save a small batch with wppilot/update-image-alt and run wppilot/audit-media-alt again to confirm.

For an image that is far larger than the layout ever shows, wppilot/edit-image can resize it with WordPress's own image editor. Its default mode saves the result as a new attachment and leaves the original untouched; replace mode writes a new file for the same attachment the way the Edit Image screen does and keeps the old file as a backup. Start with the default so nothing already on a page changes, and compare the two before deciding which one the page should use. Swapping the image on the page is then a separate, visible edit you can check in the ledger, rather than a side effect hidden inside the resize.

• "For the three largest images, show each with wppilot/get-media-image and propose a maximum width based on where they appear."
• "Resize image ID 123 to 1600 px wide with wppilot/edit-image in copy mode and give me the new attachment ID."

Why trust stays false on the WordPress entry

Qwen Code's trust setting on a server skips its confirmation prompts for every tool that server offers. On a coding tool that only reads files that might be tolerable; on a WordPress server it means every write the site's profile allows runs without you seeing the arguments. Keep trust false and use includeTools to decide which abilities Qwen can see at all.

Remember that the site has the final word either way. A write Qwen runs without asking is still checked against the WordPress user's capabilities, the safety profile and any confirmation the ability requires (by default the agent supplies that confirmation itself, unless A person approves is on), and it lands in the change ledger. Those are the checks to rely on; Qwen's prompts are the ones that let you catch a mistake before it reaches them.

A Qwen Code setup that cannot write by accident

Qwen Code's tool filters have one property worth using deliberately: an exclusion always wins over an inclusion. Put the WordPress write abilities you never want Qwen to call in mcp.excluded, or in excludeTools on the server, and no includeTools entry in a project file can bring them back by mistake. Reads stay available everywhere, and a session that needs a particular write gets it from an explicit change to the exclusion, not from a forgotten setting.

Pair that with the site's own controls. Production Safe blocks the critical class outright (code execution, filesystem, WP-CLI, database and admin-access abilities) but still lets destructive writes such as deletions run once they are confirmed; Read Only refuses every write. Qwen's filters decide what the model is shown, GoBuildWP decides what runs.

Carrying a Gemini CLI entry, and the Cloud option

Because Qwen Code kept Gemini CLI's httpUrl convention, a WordPress entry from an old Gemini setup usually works as it is, while the same entry in Antigravity would need renaming. Re-authenticate with /mcp auth rather than copying token files between tools; each client should hold its own grant so revoking one does not cut off the other.

GoBuildWP Cloud names Gemini CLI, not Qwen Code, among its tested OAuth apps. Given the shared convention, an httpUrl entry for the Cloud link with oauth enabled is the obvious thing to try, but treat it as unverified until a sign-in completes and a read returns. Without Cloud, Qwen talks to the site directly with no account and no relay.