Tools
The WordPress tools take site, the site name from list_sites. Images need no site.
| Tool | What it does | Writes |
|---|---|---|
list_sites | Sites connected to your workspace. | |
site_info | Name, plugins, post types and taxonomies of a site. | |
list_content, get_content | Lists and content of pages, posts and custom types. | |
create_content, update_content | New content (always a draft unless you ask to publish) and edits. WordPress revisions are kept. | yes |
list_blocks, get_block_schema, list_patterns | Available blocks, their fields and patterns. | |
list_menus, get_menu, set_menu | Menus and the theme’s menu locations (e.g. the header). | yes |
list_widgets, set_widget | Widget areas (footer, sidebars) and their widgets. | yes |
get_template_parts, set_template_part | Header and footer in block themes. | yes |
list_terms, ensure_terms | Categories, tags and custom taxonomies. | yes |
upload_media | An image from a URL into the media library. | yes |
list_image_templates | Your workspace’s Paqshot image templates: its own, the Reislo brand style (reislo:<brand>), shared and built-in ones (infographics, auto). | |
generate_image | An image from a brand template: featured image, social image, illustration. A short scene description, aspect ratio (16:9, 1:1, 4:5, 9:16 and more), size 1K–4K, optionally a product photo from a URL. With site it goes straight into the media library with alt text. Uses 1 credit per image; without credits nothing is generated. | yes, with site |
get_seo, set_seo | Title, description and canonical URL in Rank Math. | yes |
search_replace | Find and replace in content. Shows the matches only, unless told to apply. | yes |
Rules
- The ProseCaptain AI role. The AI works as a separate user with the Editor role plus menus and widgets. It does not install plugins or themes, change users or site settings. Administrator accounts are refused.
- Production under control. Every write on a production site needs a confirmation with the site name. On a staging site changes go straight in.
- Nothing disappears. New content is a draft. The tools do not delete content or media. A “removed” widget goes to the inactive widgets, where WordPress can bring it back.
- Log. Every write and connection goes to the log in the app (Settings → AI tools): when, which site, which tool, the result. No content, no passwords.
- Your sites only. A token works only on the sites of the workspace that issued it.
Data and passwords
- The application password of the
prosecaptain-aiuser is stored encrypted (AES-256-GCM). It is never shown and never logged. - MCP tokens are stored as a SHA-256 hash only. You see a token once, when you create it.
- The plugin has its own token for each site. Disconnecting one site does not affect the others.
- Acceptance of the AI terms is recorded when a site is connected and when a token is issued: version, time and who accepted.
Disconnecting
- One site: Disconnect from AI in the plugin, or Disconnect next to the site in the app. The application password is deleted in WordPress too.
- One person or tool: Revoke next to the token in the app. Effective immediately.
- In an emergency, without ProseCaptain: in WordPress, Users →
prosecaptain-ai→ Application Passwords → Revoke.