Tools Reference
Forge Pro ships 39 tools in 9 groups. Each group is a toggle on Settings → Windcodex Forge Pro → Tools. Each group's tools share the same default, so a toggle never misrepresents part of its group.
| Group | Tools | Risk | Default |
|---|---|---|---|
| Site introspection | 11 | Low | On |
| Database read | 3 | Low | On |
| Content blocks | 3 | Medium | On |
| Memory | 3 | Low | On |
| Sandbox file writes | 5 | Low | On |
| Execute PHP | 1 | High | On (needs backup acknowledgement) |
| Run WP-CLI | 3 | High | On |
| Direct file writes | 8 | High | Off |
| Database write | 2 | High | Off |
"On" only means the group is enabled. Every power tool is still subject to the live-site block, an Administrator check, and confirm: true on destructive calls.
Site Introspection
Always safe: none of these can change anything. Same as Forge, plus wp_list_snapshots.
wp_get_site_info, wp_list_plugins, wp_get_active_theme, wp_list_hooks, wp_get_design_authority, wp_take_screenshot, wp_inspect_page, wp_list_files, wp_read_file, wp_list_snapshots, wp_list_recent_activity
wp_take_screenshot uses a public WordPress.com screenshot service, so the page URL is sent to it. Switch it off on the Tools tab if that is not acceptable.
Database Read
wp_db_read (one SELECT), wp_list_tables, wp_describe_table.
Content Blocks
| Tool | Description |
|---|---|
wp_get_content_block | Read one block by position |
wp_list_reusable_blocks | List reusable blocks |
wp_update_content_block | Edit one block's attributes or HTML in place. Protected by WordPress post revisions |
Memory
wp_remember, wp_list_memories, wp_forget. Plaintext, capped at 200 entries, not for secrets.
Sandbox File Writes
Write new code to a holding area first. See Sandbox & Drafts.
| Tool | Description |
|---|---|
wp_write_draft | Save a file to the sandbox (never live) |
wp_list_drafts | List sandbox files |
wp_promote_draft | Copy a draft to a live path in wp-content (needs confirm) |
wp_discard_draft | Delete a draft |
wp_create_upload_link | Create a one-time upload URL that drops a file into the sandbox |
Execute PHP
| Tool | Description |
|---|---|
wp_execute_php | Run PHP inside the WordPress environment and return the output |
Requires an Administrator, a non-production site (or the override), and I have a backup in place ticked under General, because raw PHP has no "before" state to snapshot. Limited to 10 calls per minute.
Run WP-CLI
wp_run_wp_cli, wp_run_wp_cli_background, wp_check_wp_cli_job. See WP-CLI & Background Jobs.
Direct File Writes
Off by default. The group toggle and Allow direct live writes are separate switches. wp_write_file is hidden until that second switch is on.
| Tool | Description |
|---|---|
wp_write_file | Write straight to a live file in wp-content, no draft step |
wp_delete_file | Permanently delete a file |
wp_move_file | Move or rename a file within wp-content |
wp_make_directory | Create a folder within wp-content |
wp_disable_file | Reversibly deactivate a file by renaming it with a .disabled suffix |
wp_enable_file | Restore a disabled file |
wp_restore_file | Revert a file to a prior automatic snapshot |
wp_create_admin_access_link | One-time login link that signs in as a target account |
wp_create_admin_access_link can sign in as any account, including other administrators, so it needs the same backup acknowledgement as wp_execute_php plus confirm: true. The link expires after 15 minutes.
Database Write
| Tool | Description |
|---|---|
wp_db_write | Run one write statement. The whole target table is snapshotted first. Needs confirm: true |
wp_restore_snapshot | Revert a table to a prior snapshot |
See Snapshots & Restore for limits.
Safeguards That Apply to Every Power Tool
| Safeguard | Behavior |
|---|---|
| Live-site block | Blocked on production unless overridden |
| Administrator | manage_options required at call time |
| Path scope | File tools cannot leave wp-content; traversal and symlink escapes are refused |
| Confirmation | Destructive tools need confirm: true |
| Rate limit | wp_execute_php, wp_db_write, wp_run_wp_cli, and wp_run_wp_cli_background are limited to 10 per minute, separately from the general limit |
| Audit log | Everything is logged in full, including the PHP code or command |
| Read-only mode | Strips every tool not marked read-only |