MCP workflow guides

Chapter 9 covers connecting a client and the security model. This chapter covers the jobs you actually do once connected, and the habits that keep them safe.

The individual tools are documented in chapters 11 to 21. These pages are about sequences: which tool to call first, what to check between steps, and how to recover when a step fails.

The habits

Read these before the task guides. They apply to everything else in the chapter.

• Inspect content before changing it
• Validate builder or template markup before writing
• Prompt patterns for multi-step MCP work
• Recover from a failed write

Content

• Create and review a post
• Update a page safely
• Build POM builder content
• Upload and assign an image
• Organize taxonomies
• Moderate comments
• Edit navigation menus

Site and theme

• Update a public setting
• Configure POM Theme settings
• Work with POM Theme templates
• Clear the POM Cache

WooCommerce

• Manage the product catalog
• Manage product variations
• Manage coupons

The shape every workflow shares

Whatever the task, the sequence is the same:

1. Read the current state.
2. Check it is what you expected.
3. Validate, where the tools offer a validator or a dry run.
4. Write one bounded change.
5. Read back and confirm.

Skipping step 1 is what produces most bad outcomes. An assistant that has not read the current record is guessing about what it is changing, and a tool call that succeeds tells you the call succeeded — not that the result is right.

Before any of these

• The write gate for the area must be open. All four are closed by default.
• The acting WordPress user must hold the capability.
• The token must carry both the read and write scope for that area.
• A backup must exist. There is no undo.

See Enabling writes.

Start from a published prompt where one exists

The server publishes ready-made prompts for several of the jobs in this chapter — building a landing page, updating a builder page without destroying its structure, creating a content model, changing the header, building a page with generated media, and creating archive, single and feed templates.

They encode the correct order of operations, which is exactly what these guides describe. Where a prompt exists for your task, start from it rather than describing the job from scratch. See Prompt recipes.

Rate limits shape long jobs

Writes are capped at 20 per minute per client. A hundred-record job therefore takes at least five minutes, and that pacing is worth keeping — it leaves time to notice a session going wrong.

If a job genuinely needs to be faster, it wants a script or a WordPress bulk action rather than MCP. See Rate limits.

Where things are deliberately out of reach

Users, roles, plugins, themes, files, the database and network-wide settings are not exposed. If a workflow seems to need one of those, it needs a human with an administrator login. See MCP boundaries.