The companion plugin
Optional. It adds the parts of WordPress that have no REST route, with every risky group switched off.
wpreef manages content, media and block-theme design with nothing installed. Some things have
no REST route in WordPress at all, and those need the companion plugin, wpreef-bridge. It is
GPL-2.0-or-later, works with WordPress 6.7 and newer, and the server works without it.
Download it from the install page. The ZIP is rebuilt from source on every deploy, so the version there always matches the connector you are using.
What it adds
- Switching, installing, updating and deleting themes.
- WordPress, plugin and theme updates.
- Customizer values and Additional CSS on classic themes.
- Settings, permalink structure and image sizes.
- Cron, caches and transients.
- Custom fields the REST API does not expose.
- Rebuilding thumbnails and replacing a media file in place.
- Emptying the trash and deleting spam.
What stays under your control
- Anything that changes how your site runs is switched off until you turn it on at Tools → wpreef.
- A switched-off group is not registered at all, so an assistant cannot even see it.
- Settings that could lock you out — your site address, active plugins, security keys — can never be written.
- Every change is recorded with its previous value in a bounded log at Tools → wpreef, behind a stop switch that turns everything off at once.
- An assistant can still only do what the WordPress account it signed in as is allowed to do.
Installing it
Download the ZIP.
Use the button on the install page. Do not unzip it.
Upload it to your site.
Plugins → Add Plugin → Upload Plugin, choose the file, then Install Now and Activate.
Choose what assistants may do.
Go to Tools → wpreef. Three groups are on already: site information, design, and content and media. Turn on anything else you actually want, such as installing and updating plugins.
Refresh your connector.
Open wpreef in ChatGPT and press Refresh, or reconnect it in Claude, so the new capabilities appear.
Check it worked.
Ask your assistant to list the abilities on your site. You should see entries beginning
wpreef/.
With shell access you can skip the upload:
wp plugin install https://wpreef.vercel.app/wpreef-bridge.zip --activateWordPress's own REST API installs plugins only from wordpress.org, so an assistant cannot install this one for you yet.
How the assistant reaches it
Each capability is registered as a WordPress Ability, core since 6.9, with an input schema, an
output schema and a real permission callback. On WordPress 6.7 and 6.8 the same table is served
under wpreef/v1 instead.
The assistant reaches them through two tools, wp_abilities_list and wp_ability_run, not
through one tool per ability. On the hosted connector the ability namespace is forced to
wpreef: the companion plugin and nothing else. Third-party abilities need a per-site control
that does not exist yet.
Why this matters
An ability's own annotations are a claim made by whoever wrote the
plugin. wpreef uses them only to pick the HTTP verb the run must use. They never make a run
safe: every non-GET run needs confirm, and none are offered at all on a read-only site.
On the Free tier
Running an ability counts as an action whenever the run reaches your site, the same as any other write — including a run the ability describes as read-only. Whether an ability changes anything is a claim made by whoever wrote the plugin, and the allowance is not based on a claim. Listing the abilities does not count.