README

Boost your WordPress development with AI-powered introspection, security auditing, and intelligent code generation.

Inspired by Laravel Boost.

Overview

WordPress Boost accelerates AI-assisted development by providing deep context about your WordPress codebase, comprehensive security auditing, test data generation, and curated AI guidelines. Works with any AI agent (Claude Code, Cursor, Windsurf, etc.).

• Hooks (actions & filters) and their callbacks
• Database schema and queries
• Post types, taxonomies, and REST endpoints
• Security vulnerabilities and site hardening status
• ACF field groups and WooCommerce configuration
• Test data generation
• And much more...

Key Features

🔍 Deep WordPress Introspection

30+ specialized tools to scan hooks, post types, taxonomies, REST endpoints, database schema, and more - giving AI agents the context they need for accurate code generation.

🛡️ Security Auditing

Comprehensive security analysis with code vulnerability scanning (SQL injection, XSS, etc.) and site-level audits that check configuration, updates, permissions, and headers - complete with A-F grading.

📝 AI Guidelines & Skills

Pre-built guidelines and skills installed to your project's .ai/ directory, teaching AI assistants WordPress best practices for themes, plugins, REST API, Gutenberg, ACF, and WooCommerce.

🧪 Test Data Generation

Generate realistic test posts, pages, users, taxonomy terms, WooCommerce products, and ACF field data using Faker - perfect for development and testing.

⚡ Development Tools

Execute PHP code in WordPress context (wp_shell), run database queries, search documentation, and read error logs - all accessible to your AI assistant.

Installation

With Composer (Recommended)

cd /path/to/wordpress
composer require thanoseleftherakos/wordpress-boost --dev
php vendor/bin/wp-boost --init

That's it! The --init flag creates a .mcp.json file and installs AI guidelines and skills to .ai/ directory.

CLI Options

php vendor/bin/wp-boost --init                # Full setup: .mcp.json + AI files
php vendor/bin/wp-boost --init --no-ai-files  # Only create .mcp.json config
php vendor/bin/wp-boost --guidelines-only     # Install only AI guidelines to .ai/guidelines/
php vendor/bin/wp-boost --skills-only         # Install only AI skills to .ai/skills/
php vendor/bin/wp-boost --version             # Display version
php vendor/bin/wp-boost --help                # Show help

Without Composer

For WordPress projects that don't use Composer:

# Clone to a location outside your WordPress project
git clone https://github.com/thanoseleftherakos/wordpress-boost.git ~/wordpress-boost
cd ~/wordpress-boost
composer install

# Initialize in your WordPress project
cd /path/to/wordpress
php ~/wordpress-boost/bin/wp-boost --init

Then edit .mcp.json to use the absolute path:

{
    "servers": {
        "wordpress-boost": {
            "command": "php",
            "args": ["/Users/YOUR_USERNAME/wordpress-boost/bin/wp-boost"]
        }
    }
}

Quick Start

For Cursor / VS Code / Windsurf

These editors auto-detect .mcp.json files. After running --init, just open your WordPress project and the MCP server will be available automatically.

For Claude Code

cd /path/to/wordpress
claude mcp add wordpress-boost -- php vendor/bin/wp-boost

No --path needed - WordPress Boost auto-discovers your WordPress installation from the current directory.

AI Guidelines & Skills

WordPress Boost includes curated AI guidelines and skills that help AI assistants write better WordPress code. These are installed to your project's .ai/ directory.

Guidelines (.ai/guidelines/)

• wordpress-core.md - Core WordPress patterns and best practices
• theme-development.md - Theme development standards
• plugin-development.md - Plugin development patterns
• rest-api.md - REST API development
• gutenberg-blocks.md - Block editor development
• security.md - WordPress security practices
• acf.md - Advanced Custom Fields patterns
• woocommerce.md - WooCommerce development

Skills (.ai/skills/)

• theme-development - Theme creation and customization
• plugin-development - Plugin architecture and hooks
• rest-api-development - Custom REST endpoints
• gutenberg-blocks - Custom block development
• acf-development - ACF field groups and usage
• woocommerce-development - WooCommerce extensions
• wp-cli-commands - WP-CLI command creation

Available Tools

Site Information

Hooks Introspection

WordPress Structure

Database Tools

Development Context

URLs & Environment

Security Tools

WordPress Abilities API (WordPress 6.9+)

ACF Integration (when ACF is active)

WooCommerce Integration (when WooCommerce is active)

Gutenberg Blocks

Data Generation (requires fakerphp/faker)

Security

wp_shell Safety

The wp_shell tool only works when WP_DEBUG is enabled. It also prevents dangerous operations:

• No exec, shell_exec, system, or similar functions
• No file writing operations
• No eval or create_function

Database Security

• Only SELECT queries are allowed via database_query
• All queries use $wpdb->prepare() internally
• Results are limited to prevent memory issues

Requirements

• PHP 7.4 or higher
• WordPress 5.0 or higher
• Composer (for installation)

Optional Dependencies

• fakerphp/faker - For data generation tools

Development

Running Tests

composer test

Code Style

composer cs-fix

How It Works

1. AI Agent (Claude Code, Cursor, etc.)
         ↓
2. MCP Protocol (JSON-RPC over stdio)
         ↓
3. WordPress Boost Server
         ↓
4. WordPress Bootstrap (wp-load.php)
         ↓
5. WordPress Functions & Data

WordPress Boost loads WordPress in CLI mode, giving full access to all WordPress functions, hooks, and data while communicating with AI agents via the MCP protocol.

License

MIT License - see LICENSE file for details.

Credits

• Built for the Model Context Protocol