Novamira gives an AI agent PHP, WP-CLI and the database on a WordPress site. That is a lot of rope. I wanted it to diagnose a slow site without inventing SQL and without running cleanup on a guess.
WP Multitool 1.9.6 ships six read-only WordPress Abilities for that job. They sit behind the Site Doctor Agent access toggle. Default is off. They report findings. They change nothing.
Why Abilities, not another MCP server
Novamira is an MCP server. I am not going to ship a second one. WordPress 6.9 already has an Abilities API. I marked these public the way the official Adapter docs ask. I installed Novamira Free 1.11.6 on a local copy of this site. Abilities Hub listed all six under a WP Multitool group, status Enabled, MCP type tool. I have not installed Novamira on production.
The CLI I already had for this: wp multitool quickstart, health, autoload, slow-queries, redis. The abilities wrap those reads. They are the same family of JSON, not byte-identical: I dropped CLI extras that carry host names, and slow-queries is stats, not the query list. They do not wrap clean, autoload optimize, or frontend enable-all. An application password or OAuth token with manage_options is already an administrator. A typed tool that deletes revisions is an accident.
If you want the CLI playbook instead, I wrote that earlier: How to make your AI agent use WP Multitool. This post is the Novamira path.
What 1.9.6 actually ships
One toggle: WP Admin → WP Multitool → Site Doctor (or Tools → Site Doctor if you moved the menu). Agent access is a checkbox on that page. Off until you turn it on. WordPress 6.9 or newer. Below 6.9 the checkbox is not shown. I did not bump the plugin's WordPress minimum. It stays 5.0. The scan ability already existed in 1.9.x. 1.9.6 is the public flag plus five more reads behind that same toggle.
Six names:
| Ability | What it returns |
|---|---|
wp-multitool/quickstart | Worst-first findings across config, autoload, database bloat and captured slow queries |
wp-multitool/site-rescue-scan | Cache, OPcache, stacked optimizers, WooCommerce gateway checks |
wp-multitool/health | PHP, memory, object cache, autoload size, revisions, transients |
wp-multitool/autoload | Oversized option names and sizes. Not values. |
wp-multitool/slow-queries | Log totals only: how many, how many unfixed, worst milliseconds. Not the SQL. |
wp-multitool/redis | Whether Redis is actually in play, and the 21-check probe I described in Redis "connected" is not the same as working |
Start with quickstart. Drill with the others. A source marked unavailable was skipped - treat that as "not checked", not as "healthy".
The JSON is the same family as the CLI. quickstart returns findings (each with severity, source, title, why), a per-severity summary, and a sources map. I dropped the CLI extras that carry host names. slow-queries is stats, not the query list, because I do not want SQL on a public MCP tool. autoload lists option names and kilobytes, never the option value.
Same termination condition as the CLI loop: read summary, stop when critical and warn are zero. Scan, tell the human, scan again after they act. The agent does not get to declare victory on its own write.
Permission is manage_options. Treat the payload as for that conversation. Never print DB_PASSWORD, auth keys or salts.
How to turn it on
- Install WP Multitool 1.9.6 or newer. The changelog is here.
- WordPress 6.9 or newer.
- Enable the Site Doctor module if it is off.
- Open the Site Doctor page. Turn Agent access on. Save.
- Connect your AI client through Novamira the way their docs say (OAuth or an application password).
If the tools are missing after that, check the toggle, the plugin version, and WordPress 6.9. On Novamira 1.11.6 they showed up in Hub once Agent access was on. A different Novamira build might differ. Do not fall back to wp eval or a handmade SELECT. That is the whole point of this surface.
The Novamira skill
Novamira skills are one Markdown file. YAML frontmatter, then instructions. Their docs say the agent skims description and loads the body when it matches. I have not uploaded this file to a live Novamira Skills screen. I flattened the ClawHub skill into that shape: under 800 words, abilities instead of raw SQL, no write commands.
It is not in the plugin zip. docs/ is stripped from the release. It is not on ClawHub either - that package is the WP-CLI skill, and mixing the two would teach the agent both playbooks at once.
v1 is: save the file below as wp-multitool.md and upload it under Novamira → Skills.
---
name: wp-multitool
description: Diagnose WordPress performance and health with WP Multitool read-only abilities (wp-multitool/quickstart, wp-multitool/health, wp-multitool/autoload, wp-multitool/slow-queries, wp-multitool/redis, wp-multitool/site-rescue-scan). Use when the site is slow, autoload is heavy, Redis looks wrong, or the user asks for a health audit.
enable_prompt: true
enable_agentic: true
---
# WP Multitool (read-only)
[WP Multitool](https://wpmultitool.com) is a paid WordPress plugin. This skill is diagnostics through WordPress Abilities. Call the named abilities. Do not run shell WP-CLI, do not execute PHP, do not query the database yourself, and do not change the site.
## Before you start
Abilities exist only when:
- WP Multitool is installed and active
- WordPress 6.9 or newer (below that they are a silent no-op)
- An administrator has turned **on** Site Doctor → Agent access (default is off)
If the tools are missing, stop and tell the user to enable Agent access. Do not invent a fallback.
Permission is `manage_options`. Treat returned data as for this conversation only. Never print `DB_PASSWORD`, `AUTH_KEY`, `SECURE_AUTH_KEY`, or any secret or salt. Never use `wp eval`.
## Start here
Call **`wp-multitool/quickstart`** first when the question is "why is this site slow?". It returns ranked `findings` (each with `severity`, `source`, `title`, `why`, `data`), a per-severity `summary`, and a `sources` map. A source marked `unavailable` was skipped — treat that as "not checked", not as "healthy".
Optional input: `{ "force": true }` to bypass the cache.
## Then drill
Use one ability per area. Do not skip quickstart unless the user already named a single area.
| Ability | When | Returns |
|---------|------|---------|
| `wp-multitool/site-rescue-scan` | Cache, OPcache, page cache, LiteSpeed, stacked optimizers, WooCommerce gateways | Per-check severity, why, and a fix hint. Overall status. `{ "force": true }` optional. |
| `wp-multitool/health` | PHP, WordPress, memory, object cache, autoload size, revisions, transients, database size | Flat string metrics. No input. |
| `wp-multitool/autoload` | Autoload burden and oversized option **names** | `{ summary, threshold, oversized }`. Optional `{ "limit": 20 }` (1–100). Names and sizes only — never option values. |
| `wp-multitool/slow-queries` | Captured slow-query log | Totals only: `total_logged`, `unfixed`, `worst_ms`. Not the SQL. No input. |
| `wp-multitool/redis` | Object cache that is "connected" but maybe worse than none | `{ in_play, server, findings }`. `{ "force": true }` optional. Hosts that block `CONFIG GET` report "cannot verify", not "ok". |
`wp-multitool/slow-queries` is stats, not a query dump. `wp-multitool/autoload` lists option names and kilobytes, not contents.
## How to report
1. Lead with the worst finding from quickstart.
2. Quote severity and why, not raw dumps.
3. If a source is unavailable, say it was not checked.
4. Recommend next human steps. This skill does not apply them. Do not toggle modules, do not rewrite config, do not delete rows, do not run repairs.
## What this is not
- Not a license to execute PHP or WP-CLI on the host.
- Not a write surface. Writes are out of this skill.
- Not a substitute for the plugin. Without Agent access the abilities do not exist.
Website: https://wpmultitool.com
What I did not do
I did not bundle Novamira. Their license is AGPL. Mine is proprietary. Mixing those in one zip is a legal mess, and I do not want PHP-exec sitting next to a paid optimizer by default.
I did not install Novamira on wpmultitool.com. Their own docs say staging, with backups.
On Novamira Free 1.11.6 locally, Hub listed the six abilities as Enabled MCP tools. I have not installed Novamira on production. A later Novamira version might change that screen.
novamira.ai/mcp is their Pro catalog - specializations they write. I sent Giovanni the ability names and offered the skill file. A listing there would be theirs.
The loop I want the agent to run
- Call
wp-multitool/quickstart. - Read
summary. If everything is ok, stop. - Drill the hot source with the matching ability.
- Tell the human what is wrong and what to do. Do not delete rows. Do not rewrite wp-config. Do not enable frontend tricks from this skill.
That last line is the one people skip. The CLI still has cleanup, with confirmation and a backup. The Abilities surface does not. I want the agent to be loud about a 2 MB autoload and quiet about "I already optimized it".
Site Doctor itself still has the human scan: WordPress Site Doctor. Use that when you are the one looking. Use the abilities when the agent is.