WordPress AXI

An AXI-compliant CLI for managing WordPress through the core REST API. Token-efficient TOON output, pre-computed totals, truncation with --full, structured errors, and --confirm gates on every publication, deletion, role change, and site-wide switch.

npx -y wordpress-axi

Install

npm install -g wordpress-axi
# or run on demand
npx -y wordpress-axi@latest --help

Configure

Create a dedicated WordPress user with only the capabilities the integration needs, then generate an Application Password from that user's profile (Users > Profile). Export these values in the agent's runtime environment:

export WORDPRESS_URL="https://example.com"
export WORDPRESS_USERNAME="api-user"
export WORDPRESS_APPLICATION_PASSWORD="xxxx xxxx xxxx xxxx xxxx xxxx"

Do not commit .env files or credentials. Application Passwords should be sent only over HTTPS (enforced - loopback HTTP is allowed for local development) and can be revoked independently in WordPress.

Commands

Command	What it does
(no args)	Home view: site health, content counts, command cheatsheet
post list|get|create|update|publish|delete|revisions	Posts (drafts by default; publish/delete need --confirm)
page ...	Pages, with --parent hierarchy support
category ..., tag ...	Terms; creates are idempotent on duplicates
media list|get|upload|update|delete	Media library with alt-text management
comment list|get|create|reply|approve|unapprove|spam|trash|delete	Comment moderation (all moderation needs --confirm)
user me|list|get|create|update|delete	Users; role changes and creation need --confirm
search <query>	Cross-type search over exposed content
settings get|set	Site settings (title, timezone, formats)
plugin list|get|activate|deactivate|delete	Plugin management
theme list|get|activate	Theme inspection and switching
discover	Map the site's namespaces, post types, taxonomies, statuses
request <METHOD> <route>	Escape hatch for plugin namespaces and custom routes
setup hooks|status|remove	Ambient session-start context

Each command supports --help. Every list reports count plus the server-reported total; large text is truncated with a size hint and a --full escape hatch; --json gives machine-readable output.

Safety model

• New content is created as status=draft; publication, deletion, moderation, user creation, role changes, and plugin/theme activation all require an explicit --confirm on the same invocation.
• Deletes go to trash by default; --force (and all media/term deletes) are permanent and say so before running.
• The request escape hatch is not double-gated - the API user's own WordPress capabilities remain the authorization boundary.
• HTTPS is enforced for all non-loopback sites; credentials are read only from the environment and are redacted from all error output.

The AXI design principles

This CLI follows the 10 AXI principles: TOON output (~40% token savings over JSON), minimal default schemas with a --fields override, content truncation with size hints, pre-computed aggregates (count/total on every list), definitive empty states, structured errors on stdout with clean exit codes, an ambient-context installer, a live no-argument home view, contextual help[] next steps, and consistent per-command --help.

Contributing

Contributions should remain generic and reusable: never add site URLs, project identifiers, usernames, access tokens, Application Passwords, or customer content. Add tests for behavior changes and run the gates before opening a focused pull request:

npm ci
npm run typecheck
npm test
npm run build

License

MIT