NiranzWP CLI

A CLI for WordPress.

Works on any WordPress site through core Application Passwords — no plugin required. Where a site also exposes the WordPress Abilities API (core, 6.9+), niranzwp unlocks those abilities too.

niranzwp probe example.com          # what does this site support? (no auth)
niranzwp auth login example.com     # browser consent -> credential in Keychain
niranzwp post list --status draft
niranzwp discover                   # abilities, if the site exposes any

Why

wp-cli is the standard WordPress CLI, and it needs SSH access to the server. On shared hosting, on managed platforms, or across a portfolio of client sites, you usually do not have that.

niranzwp needs a URL and one browser click.

Two tiers

| | Requires | Gives you | |---|---|---| | Tier 1 | nothing — core WordPress 5.6+ | posts, pages, media, users, taxonomies, comments, settings | | Tier 2 | an abilities provider on the site | whatever that site registers — PHP execution, filesystem, WP-CLI, … |

niranzwp probe reports which tiers a site offers before you connect.

$ niranzwp probe mysite.com
My Site -- a WordPress magazine
  https://mysite.com
  Tier 1 (app passwords): yes
  Tier 2 (abilities):     yes
  MCP endpoint:           yes
  OAuth server:           yes
  namespaces: 38

$ niranzwp probe yoursite.com
Your Site -- just another WordPress site
  https://yoursite.com
  Tier 1 (app passwords): yes
  Tier 2 (abilities):     no
  MCP endpoint:           no
  OAuth server:           no
  namespaces: 12

A site with Tier 1 only still gives you posts, pages, media, users and settings. Tier 2 is what an abilities provider adds on top.

Tier 2 is deliberately not tied to one plugin. Any provider that registers abilities through the core API works — Novamira, your own plugin, anything else.

Install

curl -fsSL https://niranz.dev/install.sh | sh

or, if you would rather not pipe a script to a shell:

npm install -g niranzwp

Requires Node 22+. No runtime dependencies.

Authentication

niranzwp auth login opens WordPress's own /wp-admin/authorize-application.php consent screen. You approve there, and WordPress redirects back to a temporary loopback listener with the credential. Nothing is typed or pasted, and no password crosses a third party.

Where a site runs an OAuth server, niranzwp uses it instead — dynamic client registration, PKCE, the device grant, and rotating refresh tokens.

Credentials go to the strongest store the machine offers:

| | | |---|---| | macOS | Keychain | | Linux | libsecret — GNOME Keyring or KWallet, via secret-tool | | Windows | DPAPI, scoped to your Windows account | | otherwise | a 0600 file, and niranzwp sites tells you so |

No secret is ever passed as a command-line argument, because process arguments are visible to ps.

Profile metadata (site URL, username) lives in ~/.config/niranzwp/profiles.json; secrets never do.

niranzwp auth logout <profile> revokes the credential on the site and removes the local copy. Pass --local to keep it on the site.

Commands

auth login|status|logout      connect, inspect, disconnect
probe <url>                   what a site supports, before connecting
doctor                        check every connected site

post|page  list|get|create|update|delete
media      list [--missing-alt] | set-alt <id> "<text>"
user       list
settings   get|set <key> <value>

seo   audit | missing <field>
geo   check | llms-txt [--write]

discover | describe <ability> | run <ability> [--input '<json>']
mcp   servers|tools|call

Anything that writes needs --yes. Anything that reads does not.

--json on any command gives machine-readable output — including on failure, so a pipeline can branch on the error rather than parse a message.

Tests

NIRANZWP_TEST_SITE=<profile> npm test

51 tests. They run the real binary as a subprocess against a real WordPress site and assert on exit codes and printed output, because that is where the bugs were. Point them at a throwaway install: the write tests create and delete their own content and restore any setting they touch.

Status

Usable. Everything in the command list above works and is covered by tests.

Not done yet: no OAuth server — that lives in a companion plugin and is not written, so MCP clients still authenticate with an application password.

License

MIT