WordPress.com funnels 60-plus operations through one MCP tool guarded by a confirmation parameter

The two designs the comparison singles out put their safety check in different places. On WordPress.com, every operation that writes or deletes has to arrive carrying a `user_confirmed` parameter, and permanently deleting a category or a tag needs a second confirmation on top ^[8]. On Storyblok, deletion has its own entry point, and the user's role is embedded in the URL of the connection ^[11][13]. The two guarantees hold in different places. A parameter is set by the caller, so an unattended agent can send `user_confirmed` as true and carry on; the check binds only where the client stops and asks a person. A role fixed in the connection string stays fixed whatever the agent sends ^[13].

The distinction the comparison runs on is between a tool and an endpoint, which are commonly read as the same thing. A program calls an API repeatedly against a fixed spec. A model reads a tool's name, description and return value, then decides for itself which one to call, when, and with which parameters ^[17]. Designed badly, the article says, the model picks the wrong tool, calls it wrong, or stalls and does nothing ^[18].

Both vendors replaced a wide tool list with a dispatcher. Between them, about 220 operations reach the model behind eight tool names, roughly 28 operations per name ^[23]. Discovery moves to runtime: before the first write, the model spends two calls finding out what exists and what shape the arguments take ^[24]. What it buys is a short tool list, which the criteria ask for directly. Each name also carries a service prefix, so a model holding hundreds of tools from several vendors still picks the right one ^[25].

WordPress.com also ships a read-only companion tool that lets the agent inspect the theme and blocks already in use, and its guide says to call that before creating content ^[9]. Wix came at the same problem from the documentation side: six of its twelve tools exist to search Wix's own material, including the REST and SDK guides ^[14].

The eight criteria reward one workload in particular. A confirmation on every write, plus consent scoped to a single site or environment, scores well when a person is in the session approving changes to one property ^[19]. Point the same server at a nightly job and the confirmation becomes a field the job fills in for itself.

The comparison opens on a scenario. It asks the reader to picture an agent that opens its toolbox and finds 54 options in one list, from creating a product to deleting every staff account, with nothing marking which are dangerous or which to reach for first ^[15]. It states that this is what happens now when AI is connected to website builders ^[16]. The article does not attribute that list to any of the 13 systems. The per-criterion results are presented as a chart ^[4], and the scoring drew on official documentation and publicly available source code ^[3].