Skip to content
Documentation

Your EMCP guide

Answers from our docs

YOUR CHAT, YOUR CHOICE

Before we chat

MSR Builds processes your question and up to four recent messages on our server to answer from the EMCP docs. AI is optional and needs your separate permission.

The chat is kept in this page's memory, not saved as a conversation in our database or browser storage. Our hosting and security services process connection information, such as your IP address, to prevent abuse.

Cloudflare Turnstile checks your browser and connection to prevent automated abuse when you send a question. No login is required.

Please leave out personal, sensitive or confidential information, passwords and API keys.

You can withdraw consent and clear this page's chat at any time. This cannot undo a request already sent or erase provider/security records.

Chat privacy, retention & your rights ↗ · Privacy contact

Starting chat consents to this processing. You can browse our docs without using the chat.

WordPress Users

Safe user management over MCP, built on WordPress core user functions (WP_User_Query, wp_insert_user, wp_update_user, wp_generate_password, wp_send_new_user_notifications). The security boundary is the design itself: there is deliberately no delete-user tool and no role-change tool, passwords are auto-generated and emailed (never returned), and a strict privilege guard means agents can only create non-admin accounts and can never edit any user with admin-level capabilities.

list-users and get-user are enabled by default. create-user and update-user ship disabled-by-default.

Privilege guard. A protected-capability set (manage_options, promote_users, edit_users, delete_users, manage_network) is checked against both a role’s capabilities and the target user’s actual capabilities. Any role or user holding one of these caps is off-limits via MCP.

emcp-tools/list-users

Section titled “emcp-tools/list-users”

List WordPress users; filter by role or search text; paginated. Returns id, username, display name, email, roles, registration date, and post count. Never returns passwords or auth data.

Input: role, search, per_page, page (all optional).

Returns: array of user summaries plus pagination info.

Capability: list_users. Read-only.

emcp-tools/get-user

Section titled “emcp-tools/get-user”

Full profile detail for one user: adds first/last name, nickname, URL, description, and an is_admin flag (when true, the user is off-limits to update-user).

Input: user_id.

Returns: the user’s profile fields plus is_admin.

Capability: list_users. Read-only.

emcp-tools/create-user

Section titled “emcp-tools/create-user”

Creates a new non-admin WordPress user. A strong password is auto-generated and emailed to the new user via wp_send_new_user_notifications. The password is never returned in the response. Role defaults to subscriber; administrator and any admin-grade role are refused.

Input: username (required), email (required), role (optional, non-admin), plus optional profile fields (first_name, last_name, display_name, url, description).

Returns: { user_id, username, role }, no password.

Capability: create_users. Disabled-by-default.

emcp-tools/update-user

Section titled “emcp-tools/update-user”

Updates a non-admin user’s profile fields only: email, first/last name, display name, nickname, URL, description. It cannot change roles or passwords, and it refuses any user whose capabilities include an admin-level cap.

Input: user_id plus any editable profile field.

Returns: { user_id, updated: [...] }.

Capability: edit_users. Disabled-by-default.

Enabling the write tools

Section titled “Enabling the write tools”

create-user and update-user are off until you enable them on EMCP Tools → Tools: go to the WordPress tab, find the Users section, switch them on, then choose Save changes in the save bar. See Disabling tools.