Use Royal MCP with Code Snippets and WPCode
Snippet plugins put PHP, JavaScript, CSS and HTML straight into your site, which makes them one of the first places to look when something breaks. Royal MCP lets an AI agent such as Claude or ChatGPT read your snippets in Code Snippets and WPCode, explain what each one does, find the snippet behind an error, and, in Code Snippets, switch a broken snippet off. The free plugin never creates, edits, activates or runs snippet code. This guide explains what each tool does, how secrets in snippet code are kept out of the AI’s view, and how to use the tools when a site goes wrong.
Why these tools mostly read
A snippet runs on every page load, often with full access to your site. Writing or activating snippet code through an AI client would mean code that nobody has reviewed could run on your live site the moment it is saved. For that reason the free Royal MCP plugin keeps snippet code read-only in both plugins. You review code and switch snippets on in the Code Snippets or WPCode screens, where you can see exactly what will run.
Royal MCP also keeps the general post tools away from snippets. Tools such as wp_update_post refuse to change the posts where WPCode and similar plugins store snippet code, so snippet code can only be read through the dedicated tools on this page.
Royal MCP Pro adds tools that create, edit and activate snippets in Code Snippets and WPCode, with their own safeguards. This page covers the tools in the free plugin.
How secrets in snippet code are protected
Snippets often contain API keys, passwords or tokens. Whenever a tool returns snippet code, or an error message that may quote it, values that look like passwords, API keys, tokens or connection secrets are replaced with [REDACTED] before the AI client sees them. Code larger than 256 KB, or code that cannot be checked this way, is not returned at all; the reply says code_withheld: true instead. The snippet itself is never changed.
Royal MCP refuses any write that contains the text [REDACTED], so a hidden value can never be overwritten with the placeholder by mistake.
Code Snippets: five tools
These tools appear when the Code Snippets plugin is active, from Royal MCP 1.5.10. They use the permission Code Snippets itself requires to manage snippets, which is usually administrator access. They cover this site’s snippets only, not snippets shared across a multisite network.
| Tool | What it does | Changes the site? |
|---|---|---|
snippets_list | Lists snippets with their ID, name, type (PHP, HTML, CSS or JavaScript), where they run, whether they are active, priority, tags, last change and whether they are locked. It can filter by status (active, inactive or trashed), type or a search term, and never includes code. | No |
snippets_get | Reads one snippet, including its code with secrets hidden. | No |
snippets_recently_active | Lists snippets that were deactivated recently, newest first, with when and whether they are active now. Use it to see what changed before a site broke. | No |
snippets_deactivate | Switches one snippet off, for example the one breaking your site. Locked snippets are refused. | Yes, no undo |
snippets_update_metadata | Changes a snippet’s name (up to 255 characters), description or tags (up to 50). It never changes the code, the type or where the snippet runs. Locked snippets are refused. | Yes, with undo |
Why deactivating has no undo: turning a snippet back on runs its code again. If the snippet broke the site once, an automatic undo could break it again. After you have fixed the snippet, switch it back on yourself on the Snippets screen.
WPCode: three read-only tools
These tools appear when WPCode (Lite or Pro) is active, from Royal MCP 1.5.10. The account needs WPCode’s own permission to edit snippets, and the code of a snippet is shown only if the account may edit that type of snippet in WPCode.
| Tool | What it does |
|---|---|
wpcode_list_snippets | Lists snippets with their ID, title, code type, where WPCode inserts them, whether they are active, tags, priority, whether WPCode recorded an error, whether conditional logic or a schedule applies, and the last change. It can filter by status, code type, tag or title. |
wpcode_get_snippet | Reads one snippet: its location, priority, tags, note, shortcode, schedule dates, conditional logic and code, with secrets hidden. |
wpcode_get_snippet_status | Says whether a snippet is active and shows the last error WPCode recorded for it: when it happened, the line in the snippet, whether WPCode deactivated the snippet because of it, and the error message (only for accounts that may see the snippet’s code). |
The free plugin does not switch WPCode snippets on or off. WPCode can deactivate a snippet itself when it throws an error, and the status tool tells you whether and when that happened.
When the site breaks after a snippet change
This is the situation these tools are built for. As long as the site still answers requests to its REST API, an AI client can help you find and stop the cause.
Ask what changed
For example: “My site started showing errors an hour ago. Check my snippets and the PHP error log and tell me what changed.” The client lists snippets with their last change, checks which were recently deactivated, and from Royal MCP 1.5.15 can also read the recent PHP fatal errors Royal MCP keeps, with wp_get_php_errors.
Read the suspect snippet
The client reads the snippet’s code (secrets hidden) and, for WPCode, the last recorded error and line number, then explains what went wrong.
Switch it off (Code Snippets)
If the snippet is in Code Snippets, ask the client to deactivate it. For WPCode, check whether WPCode already deactivated it; if not, deactivate it on the WPCode screen.
Fix and re-enable yourself
Ask the client to suggest a corrected version, review it, paste it into the snippet editor and activate the snippet there.
Deactivating a snippet changes the site, so it is refused while Read-only mode or Drafts only is on, or when the AI client’s own access level is Read-only or Drafts only. If you rely on these settings, use Code Snippets’ own safe mode or the Snippets screen to switch a broken snippet off.
Undo and review
Renaming or retagging a Code Snippets snippet returns an undo token that works once and lasts 72 hours by default. Ask the AI client to undo the change and it restores the earlier name, description and tags, unless they were changed again since, in which case undo refuses. Tracked changes are listed under Royal MCP > Recent Changes.
Troubleshooting
“You do not have permission to use Code Snippets tools.” or “…WPCode tools.”
The account the AI client signed in with lacks the snippet plugin’s own permission. Sign the client in with an administrator account, or one that can open the snippet plugin’s screens.
“Code Snippets is not active” or “WPCode is not active”
The plugin is deactivated or not installed. Activate it under Plugins.
The code comes back as code_withheld: true
The snippet is larger than 256 KB, its code could not be checked for secrets, or, in WPCode, your account may not edit that type of snippet. Open the snippet in its own plugin screen instead.
“Snippet 12 is locked; unlock it in the Snippets screen first.”
Code Snippets lets you lock a snippet against changes. Royal MCP respects the lock for both deactivating and renaming. Unlock it on the Snippets screen if the change is intended.
A snippet on my multisite network is missing
The Code Snippets tools cover the current site’s snippets, not network-wide snippets. Manage those in the network admin.
Frequently asked questions
Can the free Royal MCP plugin write or activate snippet code?
No. In the free plugin, snippet code is read-only in both Code Snippets and WPCode. The only changes it makes are deactivating a Code Snippets snippet and changing a snippet’s name, description or tags. Royal MCP Pro adds tools that create, edit and activate snippets.
Will the AI see the API keys in my snippets?
No. Values that look like passwords, API keys, tokens or connection secrets are replaced with [REDACTED] before the code reaches the AI client, and code that cannot be checked is withheld.
Why can I not undo a deactivation?
Turning a snippet back on runs its code again, so an automatic undo could break the site a second time. Fix the snippet first, then activate it yourself on the Snippets screen.
Can the AI change snippets through wp_update_post instead?
No. The general post tools refuse to change the posts that hold snippet code, so snippets are only reached through the dedicated tools.
Which version do I need?
Royal MCP 1.5.10 or later, with Code Snippets or WPCode (Lite or Pro) active.