toolkit

PageSpeed fix pipeline · Playbook

WP Rocket MCP — setup and safe optimization loop

Read this reference only when a task involves WP Rocket 3.23+, Rocket Insights, WP Rocket MCP, or portfolio-wide WordPress performance management. Ordinary PageSpeed work stays on reuniclus’s existing rapidash + WordPress REST path.

What this adds

WP Rocket 3.23+ includes the WordPress MCP Adapter and registers WP Rocket abilities. A local MCP proxy (@automattic/mcp-wordpress-remote) lets Codex read Rocket Insights and WP Rocket settings and, where the exposed tools allow it, propose settings changes.

This is an agent-side backend. scripts/reuniclus.mjs does not call MCP and remains fully usable without it.

Per-site setup

One MCP server entry represents one WordPress site. Never put a client hostname, username, or application password in this repository. Never ask a teammate to paste an application password into chat. The teammate creates and enters it on their own machine.

Prerequisites:

  • WP Rocket 3.23+ installed and active;
  • Node 20+ with npx available;
  • the site’s canonical HTTPS URL;
  • a dedicated WordPress user with only the capabilities the intended workflow needs;
  • a fresh WordPress Application Password created under Users → Profile → Application Passwords.

Print the maintained setup block:

node skills/meta/noctowl/scripts/noctowl.mjs mcp wp-rocket --codex

The Codex entry uses STDIO with:

command: npx
args: -y @automattic/mcp-wordpress-remote@latest
WP_API_URL: https://SITE/wp-json/mcp/mcp-adapter-default-server
WP_API_USERNAME: WORDPRESS_USERNAME
WP_API_PASSWORD: WORDPRESS_APPLICATION_PASSWORD
OAUTH_ENABLED: false

Enter the real values in Codex Settings → MCP servers, save, and restart the server. The application password is a live credential with the connected WordPress user’s permissions: keep it local, site-specific, and revocable. For multiple sites, duplicate the entry, name each server after its domain, and use a different application password for each site.

Codex should use default_tools_approval_mode = "writes" for this server. Tool annotations are part of the server contract, so still inspect the actual tool list and do not assume every operation is correctly classified.

Connection test

Start read-only:

  1. List the WordPress/WP Rocket tools exposed by this site.
  2. Read the WP Rocket version, current settings, tracked Rocket Insights pages, and latest report.
  3. Confirm no write tool was invoked.
  4. Run rapidash against the same canonical URL and save the baseline artifacts.

A successful MCP handshake without WP Rocket abilities is not a successful WP Rocket setup. Confirm the plugin version and that the expected Rocket Insights/settings abilities are actually present.

Optimization loop

For each change:

  1. Capture the exact current setting and the independent rapidash baseline.
  2. Explain the proposed setting, expected benefit, compatibility risk, and rollback value.
  3. Obtain explicit approval for that one change. Do not treat approval for one setting as approval for a batch or another site.
  4. Apply the setting through the connected site’s WP Rocket MCP tool.
  5. Re-read the setting, let caches warm as the site requires, then rerun rapidash on the same URL, device, and PSI/local mode.
  6. Keep the change only when the result and page behavior are acceptable. Otherwise restore the captured value through MCP and verify the restore.

Do not use Rocket Insights alone to grade a WP Rocket change: it is useful operational context, but rapidash provides the independent comparison and preserves the normal toolkit evidence artifacts.

Boundaries

  • MCP is for WP Rocket settings and WP Rocket/Rocket Insights data. Post content, media replacement, and builder source stay in reuniclus, shrinkita, or sigilyph and their rollback-backed seams.
  • A portfolio action is a series of site-scoped changes. Approve, record, and verify each site; never copy settings blindly across different themes, builders, ecommerce stacks, or consent systems.
  • If MCP is unavailable or incomplete, report that limitation and continue with reuniclus’s normal audit/fix plan. Do not block ordinary PageSpeed work on this optional backend.

Authoritative references