Plugins & Themes

Discover and manage WordPress plugins and themes over MCP, built on WordPress core upgrader APIs (get_plugins, activate_plugin, Plugin_Upgrader, plugins_api, Theme_Upgrader, switch_theme, …). Installs come from the wordpress.org directory by slug, or, since v3.16.0, from an uploaded zip attachment. No arbitrary URLs are accepted either way.

The 4 read/search tools are enabled by default. The 9 mutation tools ship disabled-by-default. An admin opts in per-tool on EMCP Tools → Tools in wp-admin.

Guardrails (shared EMCP_Tools_Package_Guard):

• EMCP Tools, Elementor, and Elementor Pro can never be deactivated or deleted via MCP.
• The active plugin/theme is protected from deletion.
• Each operation checks its own capability (activate_plugins, install_plugins/install_themes, update_plugins/update_themes, delete_plugins/delete_themes, switch_themes).
• Install / update / delete require a directly-writable filesystem. If WordPress would prompt for FTP credentials, the tool returns a clean error instead of hanging.

Plugins

emcp-tools/list-plugins

List installed plugins with active/inactive status, version, update-available flag, and a protected marker. Read-only (activate_plugins).

emcp-tools/search-plugins

Search the wordpress.org plugin directory by keyword. Returns slug, name, version, rating, and requirements. Read-only (install_plugins).

emcp-tools/install-plugin

Install a plugin from wordpress.org by slug, or from an uploaded zip via zip_attachment_id (see below); optionally activate after install (install_plugins).

emcp-tools/activate-plugin

Activate an installed plugin by file path or folder slug (activate_plugins).

emcp-tools/deactivate-plugin

Deactivate a plugin. Refuses EMCP Tools and Elementor (activate_plugins).

emcp-tools/update-plugin

Update an installed plugin to the latest wordpress.org version; reports up-to-date when no update is pending (update_plugins).

emcp-tools/delete-plugin

Permanently delete an inactive, unprotected plugin. Requires a direct filesystem (delete_plugins).

Themes

emcp-tools/list-themes

List installed themes with active status, version, update-available flag, and a protected marker. Read-only (switch_themes).

emcp-tools/search-themes

Search the wordpress.org theme directory by keyword. Read-only (install_themes).

emcp-tools/install-theme

Install a theme from wordpress.org by slug, or from an uploaded zip via zip_attachment_id (see below). Requires a direct filesystem (install_themes).

emcp-tools/switch-theme

Switch the active theme by stylesheet slug (switch_themes).

emcp-tools/update-theme

Update an installed theme to the latest wordpress.org version. Requires a direct filesystem (update_themes).

emcp-tools/delete-theme

Permanently delete an inactive, unprotected theme. Requires a direct filesystem (delete_themes).

Installing from an uploaded zip

New in v3.16.0. When you don’t want a wordpress.org install, upload-media (see Media Library) can stage a plugin or theme zip first, then install-plugin/install-theme installs from it:

// 1. Upload the zip (returns an attachment ID and its SHA-256).
upload-media({ /* … */ })

// 2. Install from it, confirm + the exact hash are both required.
install-plugin({
  zip_attachment_id: 4821,
  expected_sha256: "<hash from upload-media>",
  confirm: true
})

Pass exactly one of slug or zip_attachment_id, never both. An uploaded zip additionally requires expected_sha256 (the exact hash, checked before install) and confirm: true; without either, the call is refused rather than installing something unverified.

The same EMCP_Tools_Package_Guard that checks slug installs also validates the uploaded archive before it’s ever extracted: the path must be inside the uploads directory, the archive must have a single root folder (no malformed or multi-root zips), no path traversal or symlinks, no unsafe expansion, a valid plugin/theme header, a compatible WordPress/PHP requirement, no overwriting an existing install, and never a protected destination (EMCP Tools, Elementor, Elementor Pro). A package that installs from a zip stays inactive unless you also pass the activation flag, same as a wordpress.org install.

Enabling the mutation tools

install-*, activate-plugin, deactivate-plugin, update-*, delete-*, and switch-theme are off until you enable them. Open EMCP Tools → Tools in wp-admin, go to the WordPress tab, find the Plugins & Themes section, switch on the ones you want, then choose Save changes in the save bar at the bottom of the screen. (The separate Plugins and Themes tabs hold the plugin and theme integrations, not these tools.) See Disabling tools.