Complete tool reference

Current connected tool contract

What this site's AI assistants actually did over a period, as structured data for a client-facing report. Counts by kind and tool, pages touched, audits run, findings fixed, rollbacks used, and the handful of entries a human would actually mention. Time-saved figures are ESTIMATES built from stated assumptions, never measurements, and every figure carries its own assumption and its estimate flag in the same structure so a renderer cannot show the number without them — the assumptions are overridable per kind and per tool. Also returns not_covered: what the audit log cannot tell you about this period, including read-only work that never reaches the log, edits made by hand in the builder, and anything before the log existed or after retention dropped it. Returns data, never prose, so it can be re-skinned, translated and white-labelled.

Current connected tool contract

Insert Divi 5 markup before, after, or inside an existing node.

Current connected tool contract

Asset cleanup: rules that stop a plugin's scripts and styles loading on pages that do not use it. action=list shows the rules (status active / disabled, when each was last verified) and the recent changes with their journal ids. action=plan reads the key pages as a visitor (checknaut_check_assets' attribution) and proposes one rule per plugin whose files load where nothing on the page uses them — scoped to exactly those pages; pass a candidate's "rule" to add as it is. action=add stores a rule and checks it before any visitor gets it: each page in scope that loads the files is fetched without the rule and with it and compared (status, visible text, structure, PHP errors, inline scripts left calling a removed script's variables or jQuery, classes the removed stylesheet styles); it goes live only if every page comes back whole, otherwise it is saved switched OFF with the reason. action=verify re-checks a rule (apply=true records the result and switches a failing live rule off); action=disable / enable (enable re-checks first) / remove change one; action=undo with journal_id reverses any change. Writes are dry runs until apply=true. Rules apply on the front end only — never in wp-admin, login, REST, AJAX, the Customizer or a builder's editor — never touch WordPress core or theme files unless a handle rule says allow_core_or_theme, never remove Elementor or Divi Builder files from pages built with them, and never apply on pages built with a builder Checknaut does not read. Needs an administrator.

Current connected tool contract

Guardian: audit the whole site in one call. group "qa" checks every page for the client-can-edit-it guarantee — Divi 4 shortcode pages, non-builder content, missing builder meta, unknown modules, broken attribute paths, unresolved presets and tokens. Batched and resumable: a run that reports status "running" is saved — call again to continue it. Results persist per run, and a finished run reports fixed/introduced/persisting against the previous one. group "a11y" checks heading order, alt text, link text, iframe titles and colour contrast across every page. The qa, a11y, perf and taste groups also read Divi 5 canvases (off-canvas menus, popups, mega menus): a finding there is labelled "Canvas: <title>" and carries "canvas" with the page it belongs to. group "perf" checks image weight and dimensions against the media library, hotlinked assets, module counts and nesting depth. group "legal" checks the whole site once for compliance furniture: the expected documents, whether they are published and linked, the third-party tags actually loaded, and whether an accessibility claim matches the accessibility audit. group "site" (2.1.0) audits the INSTALL rather than its pages — versions against support windows, pending updates, inactive and abandoned plugins, security posture (guessable admin logins, open registration, XML-RPC, user enumeration, login protection, backups, salts, security headers, directory listing, mixed content), database bloat, content hygiene (sample content, soft 404s, robots.txt, empty menu locations, comments and spam), mail deliverability (SPF, DMARC, MX, SMTP) and WordPress core's own Site Health tests — on any theme, any builder; single-shot. group "rescue" is the whole-site Divi 5 COMPATIBILITY scan for an existing site: classifies up to 300 pages (clean Divi 5 / Divi 4 shortcodes / Gutenberg-classic / broken builder meta / empty), checks whether header and footer actually live in the Theme Builder, finds shortcodes from removed plugins (rendering as literal bracket text to visitors), modules no installed plugin provides, and raw script/style in classic content — and returns an ORDERED fix_plan for you to execute with the existing write tools, snapshot first; the skill's workflow section describes the method. Single-shot, not batched. Each group reports what it cannot see. Writes nothing to any page. group "all" (3.1.0) runs EVERY audit the site can assess, one after another, one batch per call: keep calling with the same arguments until status is "finished"; each answer names the audit in flight (current), every group's state so far, and on finish the per-group results, the Site Score and the counters: critical and to_fix CAUSES (one finding key however many pages carry it — the work), open occurrences (the reach, and what the score is computed from), fixed and ignored. Groups this site cannot assess are listed as skipped with the reason — never run, never counted as clean. An array of group keys runs just those, the same way.

Current connected tool contract

Bind ONE attribute of ONE module to a dynamic-content field, so it renders per post or per loop item instead of a fixed value — a heading that shows each post's title, a button that links to each post, an image that shows the featured image. Refuses any attribute this module's schema does not declare bindable, and any field name this site does not actually resolve — naming the real ones in both cases, and saying so explicitly when the install exposes no field registry to check against. Dry by default: pass apply=true to write. Use checknaut_list_dynamic_fields first for the paths, and checknaut_set_query to decide WHICH posts a loop-capable module returns.

Current connected tool contract

Ready-made colour-and-type systems for a new or bland site. action="list" (default) returns six kits — each seven colours for the colour roles (surface, surface_alt, surface_dark, ink, ink_muted, accent, accent_contrast) with every text pairing passing WCAG AA, and a heading and body font from open-licensed Google families. action="apply" with kit plans what it would write; apply=true writes it: the seven colours as global colours with fixed ids (applying again updates, never duplicates), two font variables, the colour roles bound to the kit, and the fonts loaded. Existing pages and presets are NOT changed — new work resolves to the kit through the roles; update presets to carry it across the site. Returns a snapshot id and the role bindings it replaced, for undo. Refused when the owner has protected the design system.

Current connected tool contract

Build (or refresh) a Divi page documenting the live design system — every colour with its safe text colour, every variable, every preset. Re-running rewrites the SAME page, identified by a marker this tool stamps on it, instead of creating a second one. It will not overwrite a page it did not write: if a page already has the title you asked for but carries no marker, this refuses with 409 and names the id, and only confirm=true will replace it. Useful as a client handover artifact and as a fast visual check that the tokens are what you think.

Current connected tool contract

Replace WooCommerce's own shop, cart, checkout or account page with a Divi layout, selected by role rather than by id. A PLAN unless apply=true: the plan shows what the page holds now (on most stores the cart is literally the [woocommerce_cart] shortcode — replace that with a layout lacking the cart modules and customers lose their cart) and what would replace it. The write is REFUSED when the new markup carries none of the role's functional modules (divi/shop; the woocommerce-cart-* modules; the woocommerce-checkout-* modules) unless allow_nonfunctional=true is passed deliberately, and myaccount is refused outright on any Divi that registers no My Account module — which is every Divi 5 so far; style that page with the Theme Builder instead. Handles the checkout-module save crash: those modules run WooCommerce code while the page saves and fatal on an empty cart, so a temporary cart is booted for the write and the session restored afterwards. Prior content is kept as a revision.

Current connected tool contract

Withdraw a pending client approval: its link stops working at once. The draft copy this tool made for it moves to the trash (restorable) unless keep_staged=true; a draft you supplied is always kept. The live page is not touched. DRY BY DEFAULT: without apply=true it returns the plan.

Current connected tool contract

The monthly white-label care report emailed to the client: Site Score and how it moved over the period, fixes applied, plugin/theme/core updates, security events (failed sign-ins, new accounts, hardening switches), uptime when a monitor recorded checks, the AI assistant's activity (time saved is an estimate and says so), and the top open findings as next steps. Carries the agency's name, logo and colour. action=preview returns the report data and plain text (include_html=true adds the email HTML) and sends nothing. action=send emails every recipient — DRY BY DEFAULT, apply=true sends. action=settings reads the settings, or with settings {enabled, recipients, client_name, agency_name, agency_url, accent, intro, day (1-28), sections} and apply=true saves them and books the monthly send. Every figure comes from this site's own records; a section nothing recorded says so rather than guessing.

Current connected tool contract

Accessibility audit for ONE page: heading order and H1 count (template-aware since 0.73.0: whether this site's template renders the title as the page's H1 is verified on a real render and cached, so a post correctly starting at H2 under a template title is not flagged, and a stored H1 on top of a template title is flagged as rendering two), missing or meaningless alt text, link text that does not say where it goes, untitled iframes, every colour-contrast failure, plus the Divi-specific defects a generic HTML checker cannot find — module links that render as an unreachable clickable div, and Accordion/Toggle/Tabs that ship with no exposed roles or state. It is module-aware: it knows which modules contribute headings and images, so an accordion title counts toward the heading outline instead of being invisible to it. Run it after building a page, before you call it done — each fix is one edit at that point and a rebuild later. Static: it reads stored content, so it works on drafts and staging, and it states what it cannot see rather than letting a clean result imply WCAG conformance. For the whole site use checknaut_audit_site with group="a11y".

Current connected tool contract

Which plugin, theme or host every script and stylesheet on a served page belongs to. Fetches the page once from the site to itself, as an anonymous visitor (the same loopback checknaut_check_performance live=true uses), and lists each external script and linked stylesheet with its owner (the plugin slug from wp-content/plugins/<slug>, the theme, WordPress core, uploads, or a third-party host), its size (the file on disk, or Content-Length from this site for a generated file; files on other hosts are never requested), whether it blocks the first paint (in <head>, no async/defer, no non-screen media), per-owner totals, and a HEURISTIC probably_unused flag: a plugin's file on a page where no block, shortcode, widget, Elementor widget or element naming that plugin was found. The flag is a lead, not a verdict — cookie banners, analytics and chat legitimately load everywhere — and it is not applied on pages built with a builder Checknaut does not read. Pass id (drafts work, through a preview ticket) or url (this site only) for one page; pass neither for the site-wide sample: the front page, the main menu's top level, then recently changed pages, up to pages (default 10), aggregated per plugin with perf-plugin-assets and perf-third-party-scripts findings. The sample stops inside the call's time budget and continues on the next identical call. Read-only.

Current connected tool contract

WCAG 2.1 contrast checking. With no arguments: audits the palette and reports what text is safe on each colour. With a page id: reports the text/background pairs the page actually uses, inheriting backgrounds down the tree the way they render, and names the module behind every failure. Divi relative colours (hue/saturation/lightness/opacity settings on a colour reference) and global colours defined from other colours are rated at the colour they render as; one that cannot be computed (a loop, a missing base colour) is listed under unresolved, never silently skipped. Run it after building a page with a dark or coloured section.

Current connected tool contract

Divi 5 interaction integrity. With a page id: that page and its local canvases (off-canvas panels, popups); with no id: every page, canvas, library layout and Theme Builder layout on the site that stores an interaction. Checks that every trigger's target exists (a deleted or rebuilt target leaves a button that silently does nothing), that no target, trigger or interaction id is carried twice (a copied section keeps its original's ids, so one button opens both copies), that no target is left with nothing pointing at it (a hidden popup no visitor can ever open), that every trigger and effect is one Divi knows and carries the fields its effect needs, and that a module's trigger id agrees with its interactions. Also reports the keyboard and screen-reader side: click triggers on modules the keyboard cannot reach, hover-only reveals, and popups with no dialog role, close control or aria-expanded. Targets resolve against the page, its canvases, every enabled Theme Builder layout and the global canvases. Returns findings with node ids and the fix, plus the page's interaction map (trigger → effect → resolved target). Read-only; works on drafts. Refuses a page another builder owns — interactions are Divi 5 only. checknaut_check_accessibility carries the same findings inside the page audit.

Current connected tool contract

Compliance completeness check for the whole site, US-oriented. Reports which of the expected documents exist (privacy policy, terms of use, accessibility statement, plus cookie policy and a Do Not Sell or Share page when the site's own trackers oblige them, and a Refund and Returns Policy when the site takes money — WooCommerce active or a Divi Payment Button stored), whether each is PUBLISHED rather than sitting as a draft, and whether anything links to them. It also inventories the third-party tags stored in pages and Theme Builder layouts and cross-checks the claims: advertising tags with no opt-out page, and — the one nothing else can do — an Accessibility Statement claiming conformance on a site whose own accessibility audit is failing. Not legal advice and not a compliance opinion: it does not know the law of any state, and it cannot see trackers injected by a theme, another plugin or a tag-manager rule.

Current connected tool contract

Link check for ONE page: every link and image URL on the page (rendered, so Theme Builder chrome is excluded and loops are reported as opaque) fetched from this server and sorted into ok / broken (4xx, 5xx, href="#") / redirected (works, but through a hop — link the destination) / insecure (http:// internal links on an https site) / unchecked (over the cap, or the host blocks outbound requests — the result says which). Statuses are cached a day. A Divi 5 canvas id (checknaut_list_pages lists them) is checked the same way and the result names the canvas. Run it after building a page and before a hand-off; a broken CTA is the cheapest defect to find and the most expensive to ship.

Current connected tool contract

Performance audit for ONE page. Static by default: heavy and oversized images resolved against the media library, total image payload, hotlinked external assets, module count, nesting depth. Those are the CAUSES, and on a Divi page images are nearly always the largest one. Also resolves the presets a page inherits and reports Theme Builder template images separately, as site-wide. Entirely local by default: no network call, no API key, and it works on drafts and staging; live=true adds ONE request from the site to itself and reports how the page is served (response time, compression, cache headers, render-blocking <head> scripts, third-party hosts). Neither measures a real browser render — for Core Web Vitals use PageSpeed Insights or Search Console directly; this names the page content behind them. site_wide also carries the page builder's own performance switches (Elementor: CSS print method, font-display, local Google Fonts, Font Awesome 4 shim, inline icons, optimized markup, lazy background images, optimized image loading, element cache; Divi: Critical CSS, Dynamic Module Framework, Google Fonts loading, jQuery deferral and the rest of Theme Options → Performance), each naming the setting to change. For the whole site use checknaut_audit_site with group="perf".

Current connected tool contract

SEO audit for ONE page. Title length and whether an SEO plugin overrides it, meta description, readable word count, URL slug quality, internal linking and broken internal links, staleness, noindex, and the Divi-specific fault where a Text module is styled to look like a heading but carries none of a heading's structural meaning. If Yoast, Rank Math or SEOPress recorded a focus keyword, also checks the page is actually built around it. Reads those plugins' meta and never writes it. Heading structure and image alt text are audited by checknaut_check_accessibility, not repeated here. Cannot see search volume, difficulty, rankings or backlinks — no plugin can, those need a paid data provider. For the whole site use checknaut_audit_site with group="seo", which adds the site-level checks (search-engine visibility, permalinks, sitemap, duplicate titles, keyword cannibalisation).

Current connected tool contract

The WordPress install's health and security posture, on any theme with any builder — the audit to run first on a site you did not build. Reads the install rather than its pages: WordPress, PHP and database versions against their support windows; pending core, plugin and theme updates (a same-branch core release is a failure, not a warning); inactive plugins and plugins with no wordpress.org release in two years; guessable administrator logins, open registration, XML-RPC, anonymous user enumeration over REST and ?author=, missing login protection, backups and security plugins, default salts, wp-config permissions, a browsable uploads directory; missing security headers, version disclosure and mixed content on the live home page; autoloaded-option bloat, revision and expired-transient backlogs, orphaned meta, MyISAM tables; sample content still published, soft 404s, a robots.txt that blocks crawlers, empty menu locations, open comments with no spam protection; SPF, DMARC and MX for the site domain and whether mail leaves through PHP mail(); the site's own TLS certificate (days left, issuer, host-name match; fails under 7 days, warns under 21) and the domain registration's expiry from its registry's RDAP record, asked through rdap.org and cached 24 hours (fails under 14 days, warns under 45) — uptime is stated as not measurable from inside the site; plus every WordPress core Site Health direct test not already covered; on an Elementor site also Unfiltered File Uploads (SVG/JSON), maintenance or coming-soon mode left on, a pending Elementor database update and an Elementor/Pro major-version skew. Returns the environment snapshot, findings with the admin screen for each fix, and an explicit list of what could NOT be checked (a host that blocks loopback requests, a disabled resolver). Cached probes: self-fetches for ten minutes, the TLS certificate for an hour and the domain's RDAP record for a day, so a re-run after a fix can show the old answer until then; a probe-cache reset (a hardening change makes one) clears all three. It cannot see passwords, PHP execution inside uploads, host-level firewalls or backups, DKIM, or malware — posture, not a scan.

Current connected tool contract

Clear Divi's compiled CSS and the page caches, then warm one request so the file rebuilds. THIS IS THE RECOVERY when a site renders unstyled: Divi concatenates module CSS and Theme Options Custom CSS into one static file per page, rebuilds it on the first front-end request after any save, and a truncated rebuild is silent — the builder looks right while every page renders as an unstyled list. Returns the unified CSS byte count before and after, and says so explicitly when the rebuild comes back short. Use scope "page" with a post_id after editing one page; "all" after a Theme Options or Theme Builder change. Safe to run on production — it deletes generated files only, never content. On a Hostinger-hosted site with an API token configured in wp-admin it also purges Hostinger's edge cache (hcdn) and reports the real outcome under edge_cache; ordinary writes queue that purge automatically, once per request, and say so.

Current connected tool contract

Copy an element or option-group preset under a new id (never the default), nested presets kept — the starting point for a variant without touching the original. DRY RUN unless apply=true.

Current connected tool contract

Compare a published page of this site with a reference picture — a design mock-up, or an earlier screenshot — and get three pictures back as image content (the reference, the page, and where they differ in red) plus a pixel-difference score from 0 (identical) to 1, the share of pixels that changed and the difference in height. The page is photographed through the owner's screenshot service at the reference's own width unless width is given. Pass id or url, and reference_attachment_id (an image in the Media Library — upload a mock-up with checknaut_upload_media first) or reference_url (an https image address). The score measures pixels, not design: a different photo or a block shifted by a few pixels counts, so look at the pictures before calling the page wrong. Refused when no screenshot service is set up. Read-only on this site.

Current connected tool contract

Create a Divi 5 canvas — an off-canvas menu, popup or mega menu kept off the page until an interaction or a Canvas Portal opens it (or appended above/below the page). scope=local belongs to one Divi page (parent_id); scope=global appears on every page and needs an administrator. content is Divi 5 block markup (a section holding the menu or popup), or from {post_id, node_id} copies an existing section. The markup goes through the same validation and Visibility gate as a page, the canvas is written exactly as the Visual Builder writes it (an et_pb_canvas post with its canvas meta) and appears in the builder's canvas dropdown. Names must be unique among the canvases the page can see. DRY RUN unless apply=true. The result carries the canvas_id, a ready Canvas Portal block and how to open it from a button. Refused on pages built with Elementor or the block editor, where canvases do not render.

Current connected tool contract

Create a Divi 5 OPTION-GROUP preset — a preset for one option group (a border, a font, a button, spacing…) that any module's matching group can use, and that nests inside element presets. group_name is Divi's group preset key (divi/border, divi/font, divi/button, divi/spacing, …); group_id is that group's attribute path on the module it is authored on (module.decoration.border, title.decoration.font, button.decoration.button); module is that module. attrs are the group's values — the full attribute tree, or just {"desktop":{"value":{…}}}, which is placed at group_id. Every value is checked against the sub-fields Divi's own <Group>PresetAttrsMap names for that group on this installed Divi, and group_id against the module's own option groups; anything else is refused by path. Style only: content, Visibility hides and HTML Before/After are refused, and so are interaction presets. nested {groupId: presetId} puts other group presets inside it. set_default makes it the group's default. Snapshot first, verified by re-read. DRY RUN unless apply=true.

Current connected tool contract

Create a plain WordPress (Gutenberg) post or page with no Divi builder. Right for content that does not need layout — policies, changelogs, simple blog posts. Refuses Divi markup: the two authoring modes are exclusive and mixing them renders blank.

Current connected tool contract

Save Divi markup as a reusable library layout. Global by default: reference it from pages with the returned "block" string, and editing it later updates every page at once. Use this for anything repeated across a site — a CTA band, a footer strip, a pricing table.

Current connected tool contract

Create a Divi 5 page from validated block markup. Creates as draft unless status is given. After the write the stored content is rendered in-process and the result carries render_ok (false + render_error when the page would return HTTP 500 to a visitor).

Current connected tool contract

Create a module preset (e.g. a styled divi/heading) that pages then reference by id — the mechanism that keeps generated pages on-brand when the design changes later. Additive-only. Snapshots first, verifies by re-reading the preset store, rolls back automatically on failure. Use design-system tokens inside attrs, not hardcoded values. This makes MODULE presets for any module, divi/group included (a preset for the Group module is the most useful one on most sites); option-group presets (a preset for one option group such as a border or a button slot) are made with checknaut_create_group_preset. A preset carries STYLE only: attrs with innerContent anywhere (an icon glyph, an image src, button text, a link) are refused with checknaut_preset_content, because a preset innerContent silently replaces the module's own on Divi 5. The one thing that must live IN a heading preset is headingLevel — it sits inside title.decoration.font.font.<bp>.value, so an inline headingLevel replaces the whole font object. Pass set_default=true to make this the module's DEFAULT preset: every module of that type that carries no explicit preset picks it up at once, including modules added later. That is how you restyle every button (or every image, or every heading) on a site in ONE call instead of editing each module. Do NOT pass "default" as the id — that is Divi's sentinel meaning "no preset", and a preset stored under it is never applied.

Current connected tool contract

Create a Theme Builder template — site header, footer, and/or body layout — with the pages it applies to. Put header, body and footer for one assignment on a SINGLE template; separate per-slot templates overlap and clobber each other. Requires use_on conditions (or default=true), because a template with none matches nothing and renders nowhere.

Current connected tool contract

Create global design variables (sizes, fonts, strings, links, images) so generated markup can reference tokens instead of hardcoding values. Additive-only: never edits or deletes. Snapshots first, verifies the write by re-reading the store, and rolls back automatically if it did not take. On a fresh site, create the design system here BEFORE building pages. Colors go through checknaut_set_colors instead.

Current connected tool contract

Move a Divi 5 canvas to the WordPress trash (never a permanent delete; restorable with its id and settings). Refused while a Canvas Portal or an interaction on any page still opens it — the refusal names each one, so remove those first. Clears the page's builder index where it named this canvas. DRY RUN unless apply=true.

Current connected tool contract

Forget one recorded site convention. Ask the owner before removing a memory you did not create in this conversation.

Current connected tool contract

Remove a node and everything inside it. The prior content is preserved first. The result says what went (modules, characters of text, images). On Divi, a section, row, column or group that still holds modules is refused until you pass confirm_modules with the module count the refusal reports — read before you delete: a container that looks empty in a screenshot may not be.

Current connected tool contract

Delete a page or post. Default is trash (recoverable from wp-admin); force=true deletes permanently. The configured front page refuses deletion.

Current connected tool contract

Remove a saved pattern.

Current connected tool contract

Delete a module (element) preset or an option-group preset by id. The one gap in preset management: presets could be created and updated forever but never removed, so a test import that brought another site's presets in had no way back out except the Divi builder. Refuses a preset still referenced by page markup unless force=true, since deleting one renders those modules unstyled; an option-group preset nested inside other presets is refused the same way, and force=true also takes it out of them. Snapshots the design system first and verifies by re-read, restoring the store if the delete did not take.

Current connected tool contract

Remove a Theme Builder template. Pages assigned to it fall back to the theme's own header and footer.

Current connected tool contract

Delete a design token — a custom global color (gcid-…) or global variable (gvid-…). Refuses the five default color slots and Divi core entries. Refuses tokens still referenced in page markup or presets unless force=true, because deleting a referenced token makes those spots render as nothing, silently. Verified by re-read; the store is restored on failure.

Current connected tool contract

List the images on ONE page that still need a description — no alt, or an alt that is a file name or says nothing — each with its node ref, src, attachment id, current alt and why it fails, plus a small preview (at most 512px on the long edge, made on this server from the media-library file with WordPress's own image editor; nothing is sent to any other service). The previews come back as image content so you can look at each one and write what it conveys in its place on the page; then call checknaut_fix_alt_text with alts=[{node, alt}]. Up to 6 previews per call; next_offset pages through the rest. A deliberately empty (decorative) alt and builder placeholder images are counted, not listed. An image that is not in the media library has no preview. Works on Divi 5, Elementor and block-editor pages; any other builder is refused by name. Read-only.

Current connected tool contract

Copy a page on THIS site, server-side. The markup never passes through you, so this is the right way to clone, template or branch a page — read the source with checknaut_get_page only if you actually need to reason about its contents. Divi page meta comes along; the copy is verified by module count against the source and deleted rather than kept if anything was dropped. Creates a draft unless status is given.

Current connected tool contract

Change one module in place using a node_id from checknaut_get_tree. Attributes are merged into the existing ones, so send only what changes. This is the right tool for revisions — do not rewrite the whole page.

Current connected tool contract

Edit many modules on ONE page in a single write: edits = [ { node_id, attrs, replace? } ] (up to 200), each exactly as checknaut_edit_module would apply it. Every edit is checked against the page first; one bad edit refuses the whole batch and nothing is written. One revision, one validation, one receipt. Find the nodes with checknaut_find_modules. Instead of edits, two Divi attribute operations build the batch for you (DRY RUN unless apply=true): replace_values {find, replace, path_contains?, module?, within?, only_identical_fields? (default true)} replaces attribute VALUES — e.g. "10px" → "20px" only where the path contains "radius", leaving 10px paddings alone; extend {source_node, groups?: styles|content|presets (default styles), within?} copies the source module's styles, content and/or preset references onto every other module of its type in the scope node (default the page). Visibility is never copied; locked modules are skipped and named.

Current connected tool contract

Export in Divi 5's OWN portability JSON — the file the Divi builder's Portability → Import dialog opens, and what Marketplace / Quick Sites packs are. kind: page (context et_builder: the page's block markup plus the presets, global colours and variables it references, and its page custom CSS), layout (context et_builder_layouts: Divi Library items with their scope/type terms), presets, colors, variables or design (the whole store, no content). include_images embeds the site's own media the content uses (base64, capped at 20 MB) so the file survives this site; without it Divi keeps the URLs. The file is proven to read back through checknaut_import_divi_json before it is returned. For Checknaut-to-Checknaut moves prefer checknaut_offer_page; this is for handing files to people and to the Divi builder. Canvases are not exported. Read-only.

Current connected tool contract

Package a page into a portable, compressed blob (gzip+base64, typically ~6x smaller than the raw markup) carrying its own module manifest, SHA-256, and the design-system entries the page references. Use this to move a page to ANOTHER site: export here, then checknaut_import_page there. Preset and token ids are per-site, so the bundled colors, variables and presets are what let the page arrive styled rather than being refused outright. Same-site copies should use checknaut_duplicate_page instead — it moves nothing through you at all. The blob is proven to decode back to the source before it is returned.

Current connected tool contract

Build a client-facing site health report from the latest finished Guardian run of each section, and return a URL to it. Self-contained HTML: opens in any browser, prints to PDF, survives being emailed or archived. It leads with what moved since the last run (fixed / new / unchanged) rather than a finding list, groups findings by cause, and reproduces each section's stated blind spots in the client's copy. Run checknaut_audit_site for a section first — a section never audited is reported as "not run", not as clean.

Current connected tool contract

Turn a duplicate inline style set into an element preset: on one Divi page, modules of one type that carry IDENTICAL inline styles and no preset (the clusters the design-duplicate-styles finding reports, plus two-module ones it does not) get one new preset built from those styles, point at it, and lose the inline values it now supplies — the page looks the same and the style lives in one place. Call with just id to list the clusters (a key the finding names is the same key here); then cluster (or nodes) + name. Locked modules are skipped and named. DRY RUN unless apply=true.

Current connected tool contract

Find modules by what they are and what they hold — on one page (post_id) or across every Divi page, layout and Theme Builder part. Filters, AND-ed: module ("divi/button" or "button"), attr_path (a dot path that must exist, e.g. "button.decoration.background.desktop.value.color"), value (substring of that value, or of the attributes), has_preset (true/false). E.g. every button without a preset, every hardcoded #hex, every heading with an inline size. Returns node ids for checknaut_edit_modules.

Current connected tool contract

Find a page or post by title — exact match first, then a search that also reads page bodies. Each row carries id, status, module count, which builder owns the page, whether Checknaut can write to it, and matched_on ("title" or "content", so a body-only hit is never mistaken for a title match). Use this instead of guessing an id from a URL.

Current connected tool contract

Give a name to the links and buttons on ONE page that a screen reader can only announce as "link" or read out as a URL: an icon link, an empty anchor, a button or link element with no text. Call it WITHOUT labels first: it lists each unnamed control with its node ref and destination. Decide the words (where it goes or what it does, e.g. "Follow us on Instagram"; ask the owner when unsure), then send labels=[{node, label, href?}]. It writes an aria-label through the builder's own attribute settings and never touches the destination or styling: on Divi 5 the element's Advanced → Attributes list (on the link of an icon, on the root of a button or link element, or on the <a> inside a text element's HTML); on Elementor the link control's own custom attributes; in the block editor the <a> in the block's markup. A label that would still fail (empty, "click here", a URL, or led by the role word: "Link to…", "Button: …") is rejected with the reason. Refused by name: a block-editor Button block (markup its save() does not produce breaks the block; give it visible words with checknaut_fix_link_text), Elementor atomic elements, and any builder other than Divi 5, Elementor and the block editor. Buttons the theme or a plugin renders (a11y-button-name) are not page content and are labelled in that theme or plugin. Dry by default; apply=true writes, journaled, and checknaut_undo_fix reverses it alone.

Current connected tool contract

Fill missing image alt text on ONE page from the WordPress Media Library, WRITING IT INTO THE PAGE's stored attributes. This is not a render-time patch: the Visual Builder shows the result, a step back records it, checknaut_undo_fix can undo it, and the fix survives this plugin being deactivated — which is the difference between a repair and an overlay. Dry by default; pass apply=true to write. It never overwrites an alt that is already set, and it leaves a deliberately-empty alt (a decorative image) alone. Images it cannot resolve are returned in "skipped" with the reason rather than filled with a guess. use_filename derives text from the file name and is OFF by default because "hero-image-2.jpg" satisfies a scanner while telling a blind reader nothing — anything written that way is still reported as a failure. With alts=[{node|src, alt}] it writes descriptions YOU supply instead (look at the images first with checknaut_describe_images): each alt is checked before anything is written (5 to 150 characters, not a file name, not "image of…", not empty) and a rejected one comes back with the reason; an image whose alt is missing or meaningless is written, a real description is never overwritten; the call is journaled, so checknaut_undo_fix reverses it alone. Divi 5, Elementor (where alt lives on the media-library item, so every use of that image changes and the result says where) and the block editor; any other builder is refused by name.

Current connected tool contract

Apply checknaut_fix_finding's fix for ONE check on EVERY page it touches, in one call: pass ids (checknaut_audit_site's causes[] carries them as page_ids) or all=true for every page the active builder can write (self-test fixtures excluded, capped at 100, oldest first). Runs sequentially under a 20s budget; a non-empty "remaining" means call again with those ids. Everything done is saved and journaled per page, each page's fix individually undoable with checknaut_undo_fix. Site-level checks (no id) are refused — call checknaut_fix_finding for those. Dry by default: pass apply=true to write.

Current connected tool contract

Apply the automated fix for ONE audit finding, by its check slug — the closing half of the audit loop. Fixable checks: perf-image-weight / perf-image-oversized / perf-page-weight (compress the page's offending images with WordPress's own image editor — WebP where the host supports it, resized to 2400px max, no third-party service, no API key; the optimised file is written ALONGSIDE the original and every stored reference is rewritten, so the original file never moves and nothing can 404), perf-template-image-weight (same, for Theme Builder template images — pass no id), a11y-alt-missing and a11y-heading-h1 / a11y-heading-order (the existing alt-text and heading repairers, journaled), seo-meta-missing (derive a description from the page's own opening text into the active SEO plugin's field — read it after, it is mechanical not editorial), seo-noindex (clear the per-page noindex flag — only when the page is MEANT to be found), the site-level seo-site-noindex / seo-site-permalinks switches (pass no id), and (2.1.0) the Site Health posture findings a hardening switch answers — health-xmlrpc, health-version-disclosure, health-user-enumeration, health-author-enumeration, health-security-headers, health-file-edit, health-robots-sitemap (each flips one reversible hardening switch) — plus health-default-content (trashes WordPress's sample post and page) and health-comments (closes comments by default and on published pages), and (3.2.5) a11y-doc-viewport (pass no id) — while it is on, the plugin rewrites the viewport meta the site serves so pinch-zoom works, which is the only way to answer this finding on a theme that prints that tag itself, Divi included; it REMOVES user-scalable=no and a maximum-scale below 2 and never adds a viewport meta where there is none, so the warn half of this check (no viewport tag at all) is refused by name, and the fix re-reads the home page after writing and turns itself back off rather than report an unverified success, and (3.2.6) a11y-doc-skip-link (pass no id) — prints a skip link on wp_body_open and prepends its target to the page content, because on a theme like Divi there is no content wrapper with an id to point a hand-written link at; it verifies the same way, checking the served page carries the link, the target, and enough header text between them to be worth jumping, and refuses with the reason when it does not. Dry by default: pass apply=true to write. Every applied fix returns a fix_id and is INDIVIDUALLY undoable with checknaut_undo_fix — not a page rollback, an undo of exactly that fix. Checks not on this list have no automated fix on purpose (titles, slugs, copy need judgment; converting a fake heading changes how the page renders) — fix those in the page builder.

Current connected tool contract

Repair the heading OUTLINE on ONE page, writing into the page's stored attributes. Fixes two things deterministically: more than one H1 (keeps the first in document order, demotes the rest to H2) and skipped levels — closed with EVIDENCE, not just arithmetic (0.72.0): each heading's explicit px size is matched against this site's resolved type scale (checknaut_resolve_design_values — token, then mined convention, then shipped default), so an H5 that is sized like this site's H2s is relabelled H2 as the mislabelled peer it is, rather than becoming the H3 arithmetic would guess; a heading with no unambiguous size evidence falls back to closing the skip to the previous level plus one, and a size intent is never allowed to widen a skip or mint an H1. A heading sized at the site's BODY scale whose text reads as prose comes back in paragraph_verdicts — reported with its evidence, never rewritten, because headingLevel has no paragraph value and converting the module would change how it renders. Only headingLevel changes — the heading text and its font styling are separate attributes and are never touched, so the page looks pixel-identical afterwards. That is the property that makes this safe to run unattended. Dry by default; pass apply=true to write. On a page with NO H1 it promotes the FIRST heading to H1 — but only when that heading sits at the page's top heading level, has text, and is a real rewritable Divi heading module (slide captions, accordion titles and preset-driven levels are structurally refused); anything ambiguous is a stated refusal, never a guess, because promoting the wrong heading mislabels the page while turning the audit green. It also refuses headings whose level comes from a preset (the real fix is one edit to the preset, not N inline overrides) and headings written as raw HTML inside a text or code module (the node id identifies the module, not the individual tag). Everything refused comes back in "skipped" with the reason.

Current connected tool contract

Rewrite the WORDS of specific links on ONE page — the closing half of the a11y-link-text finding, which until 2.0.0 had no fixer at all and told you to hand-edit each one. It does not invent the new text: "See our pricing" is a fact about where the link goes, not a transformation of "Read more", so YOU pass the replacement for each link and this resolves it, verifies it is unambiguous, writes it into stored content, journals it and makes it undoable. Each entry names its link by `node` (the ref checknaut_check_accessibility's a11y-link-text finding carries under links[]) or by `href` plus `match` (its current text). If a spec matches more than one link the whole entry is REFUSED and every match is listed with its ref — it will not pick one for you, because rewriting the wrong card's label is a silent content edit. A replacement that would still fail the check (another "click here", a bare URL) is refused too. Dry by default; apply=true writes, preserves the prior content as a revision and returns its revision_id. Only the words change — href, target and styling are untouched. NOT for Divi content: a Divi link's words live in a different attribute per module, so on a Divi page this refuses by name.

Current connected tool contract

The fleet hub: this site stores its client sites' Checknaut connectors and reads them over their own MCP endpoints. action=list shows the sites (tokens masked, never returned) with their cached numbers; add stores a site from its connector URL (the one Checknaut → AI assistant shows on that site, ending in ?key=) — https only, checked first with one read-only call, token stored encrypted; remove takes one off (kept 30 days) and restore puts it back; status refreshes each site's Site Score, pending updates, security posture and Site Health with read-only calls, stalest first within about 45 seconds, and returns every site's row including uptime (hourly ping) and certificate/domain days read by this hub; run calls ONE tool on ONE site — a tool this hub lists as read-only runs as asked, a write runs only if it is one of checknaut_snapshot, checknaut_restore_snapshot, checknaut_clear_css_cache, checknaut_fix_finding, checknaut_undo_fix, checknaut_manage_plugins, checknaut_update_settings AND confirm=true (without it you get the plan). The client site's own switches, token scope and read-only mode still apply there. add, remove and restore are dry runs unless apply=true. Needs an administrator's connector here.

Current connected tool contract

Generate tints and shades of one global colour as Divi 5 relative colours: each step is a global colour DEFINED FROM the base (a nested $variable with an HSL lightness shift), so the whole ramp follows when the brand colour changes. base = a gcid-… id; tints / shades = lightness points (default 10,20,30,40 and 10,20,30). The plan shows what each step renders as and its contrast on white and black; steps that clip to the same colour are dropped and named. Written through checknaut_set_colors (snapshot, verify). DRY RUN unless apply=true.

Current connected tool contract

Divi 5's breakpoints on this site: all seven (phone, phoneWide, tablet, tabletWide, desktop, widescreen, ultraWide), which are switched on, their widths, the media-query range each one styles, and the restore points checknaut_set_breakpoints took. Write a per-breakpoint value as <attr>.<breakpoint>.value only for an ENABLED breakpoint — a value stored for a disabled one is kept but renders nowhere. Read-only.

Current connected tool contract

Global colors, variables, fonts and breakpoints, each with the exact Divi variable token token string to emit. A colour that is relative or defined from another colour carries `resolved` — the hex it renders as. ALWAYS call before generating markup.

Current connected tool contract

The ACF or Meta Box custom field values on one post, with each field's label and type. Divi loop and dynamic-content pages usually read these.

Current connected tool contract

What has been done to this site: the tool-call activity log (newest first), design-system snapshots, and optionally one page's revisions. Call this before asking the owner "what changed?" and after any surprising result.

Current connected tool contract

Full attribute tree for ONE module. Request modules individually — never in bulk. Read known_paths for real storage paths, roots for where sizing/spacing/shadow/border live on THIS module (not the same root everywhere), inner_content_shapes for whether each innerContent is a string or an object, renders_from for paths Divi stores but does not render from, option_shapes for the VALUE shape inside each option group (interactions, attributes, html/semantic element, lock, sticky, scroll, transform, filters, animation, position, text effects, spam protection, loop: where to write it, each sub-field's enum, required-when rules), and module_enums for this module's own closed sets.

Current connected tool contract

The markup of ONE node from a page, by node_id. Use it to inspect a single section instead of reading a whole page. To COPY a section somewhere (Theme Builder, a global layout, a pattern) prefer the from:{post_id,node_id} argument on those tools — that copies it server-side and cannot mangle it.

Current connected tool contract

Stored content for one page or post, through the builder that OWNS it: always returns adapter and builder, plus source ("divi" | "blocks" | "rendered") and writable. Where the owning builder keeps the body in its own data (Elementor, Bricks, Breakdance), content is null with a content_note and an edit_url for that builder's editor — an empty post_content there is normal and is NOT evidence the page is empty. Divi meta (_et_pb_*) is returned only for Divi pages.

Current connected tool contract

Full attribute set for ONE preset. Read it to understand what a preset already handles — then reference the preset by id rather than copying these values into markup.

Current connected tool contract

The Checknaut Site Score out of 100, with the arithmetic that produced it — one number for how healthy this site is, and exactly which audit is costing what. A suite scores the share of the site that came back clean, counting a failure as six warnings; site-level checks cost a fixed price per finding; accessibility and legal count half again because they carry real liability, design taste counts half because its findings are opinions about craft. An audit that has never run is EXCLUDED and reported as missing coverage — never counted as a pass, which would flatter, and never as zero, which would lie. Also returns the movement since the last recorded day, and says when Divi itself changed between the two runs so a drop is not blamed on the owner. Use it to answer "how is this site doing" in one call, to rank several sites, or to show the owner what fixing a thing would be worth before doing it. The counters block says what the owner has to do — critical and to_fix count CAUSES, one per finding key however many pages carry it — beside the occurrence counts the score is computed from; tell the owner "19 critical causes", never "1167 issues".

Current connected tool contract

Read this site's operator safety switches and what each means for what you are allowed to do. Also returned inside checknaut_get_site_context as "operator" — read it there once at the start rather than discovering restrictions through refusals.

Current connected tool contract

WP version, breakpoints, design-token counts, active plugins (page builders included) and the operator safety switches, plus an "adapter" block naming the builder that owns this site, what it can do, and — on a MIXED site — which page ids belong to a builder nothing here can write. Divi-only telemetry appears only where Divi is the active builder. Call this first on any new site.

Current connected tool contract

The WordPress side of a build, in one read: site title and tagline, what "/" shows (latest posts or which page — with that page's status, because a draft front page is a 404), the posts page, permalink structure, timezone, whether search engines are discouraged, every menu with its theme locations, and every form the installed form plugins already have (with the shortcode / module to embed each). Call it at the start of a site build and again before you say the job is done. checknaut_get_site_context describes the builder; this describes the site.

Current connected tool contract

The Divi 5 authoring rules for THIS site, served by the plugin so they always match the installed builder — a downloaded copy goes stale, this cannot. Read it before your first build in a session; fetch one section when a specific rule is in doubt. Sections: attributes, tokens, escaping, layout, presets, dynamic, design, code, images, workflow.

Current connected tool contract

Divi Theme Options (Divi → Theme Options): logo, fixed navigation, social icons and URLs, blog and archive settings, SEO defaults and the rest — read from the installed Divi's own option list, with each option's type, allowed values and whether it can be changed here. Secrets read back only as "set"/"empty". Pass ids to read just those.

Current connected tool contract

Page as a node tree with stable node_ids. Use this before editing so you can change one module instead of rewriting the page. Depth-limited by default: on a large page, read the top level first, then pass node_id to zoom into the one section you care about. Nodes marked has_children have more below the depth you asked for.

WooCommerce integration — withheld here; exact schema must be read on an applicable install

Reads WooCommerce context when that plugin is active. It is not exposed on the connected site because WooCommerce is inactive.

Current connected tool contract

Import a Divi 5 portability JSON file (a page export, Divi Library layouts, or a presets/colours/variables export — from the Divi builder, a Marketplace pack or checknaut_export_divi_json). DRY BY DEFAULT: validates the file and returns the plan — what is created, reused or REMAPPED. A colour, variable or preset whose id already exists here with a different value gets a new id and every reference to it in the content and the presets is rewritten, so this site's brand is never overwritten (Divi's own import overwrites it); on_conflict:"use_site" uses this site's value instead. A pack's default preset becomes the site default only where the site has none. Divi 4 packs are converted by Divi's own converter when it is available, otherwise refused by name. Refuses presets carrying HTML/code fields or Visibility hides, Theme Builder exports (import those in Divi → Theme Builder), and files over 8 MB. apply=true (with the plan_hash from the dry run) snapshots the design system, writes colours → variables → presets → images (image types only) → the page (a new draft, or page_id with confirm for a published page) or the Library items, verifies each, and returns the snapshot id and created post ids to undo with.

Current connected tool contract

Write a page. For a CROSS-SITE move prefer pull_url + pull_token from checknaut_offer_page on the source site: the two installs transfer the payload directly over HTTPS, so nothing large passes through you and nothing can be truncated in transport. Also accepts a checknaut_export_page blob in data, raw Divi 5 markup, or a completed checknaut_stage_chunk upload (stage_id). Creates a new page, or replaces page_id if given. Design entries carried by the blob (colors, variables, presets) that this site is missing are created first — additive only, so ids already here keep their existing values. When the payload is an export blob the result is verified against the manifest it carries, so a payload truncated in transport fails loudly instead of writing a partial page.

Current connected tool contract

Turn a saved pattern into ready-to-write markup: binds its colour roles to THIS site's palette and substitutes your copy. Refuses on any unfilled placeholder or unbindable role rather than shipping "{{headline}}" to a live page. Pass post_id and node_id to place it directly.

Current connected tool contract

Install a custom font into Divi (Divi → font picker → Uploaded), stored exactly as Divi's own upload stores it: through Divi's FontsUtility into uploads/et-fonts and the et_uploaded_fonts option, so the builder shows it and pages load it from this site — the self-hosted alternative to a Google Fonts request. One source: url (public http(s), fetched with the SSRF-safe HTTP API), data (base64) + filename, or attachment_id. The format must be one this site's Divi accepts (et_pb_supported_font_formats: ttf and otf by default) and the file's REAL type is checked against Divi's font mime list; 10 MB cap; the name follows Divi's rule (letters, digits, spaces, _ -, 100 max) and may not clash with an uploaded or Google family. create_variable:true also creates a font variable for it. action:"remove" uninstalls an uploaded font and its files (refused while it is in use unless force:true) — that is the undo. Dry by default.

Current connected tool contract

Create whichever expected compliance pages are missing, as DRAFTS. Always drafts, with no option to publish: these are starting documents assembled from what the site appears to do, and publishing an unreviewed legal statement under a client's name is exactly what standardising a compliance package is supposed to prevent. Bodies are plain Divi modules with no preset or token references, so the same call works on a site with no design system. Anything needing a human decision is marked [REVIEW]. Existing pages are never overwritten.

Current connected tool contract

Push design library items from this hub to fleet sites through each site's own tools: preset (a module preset id → checknaut_create_preset), colors (a gcid- id, or "*" for all → checknaut_set_colors), variables (a gvid- id, or "*" → checknaut_create_variables), pattern (a pattern saved on this hub → checknaut_save_pattern), layout (a Divi Library item id → checknaut_create_layout), brand_kit (a kit id → checknaut_brand_kits apply). Every item is Divi 5 design data: each target's builder is read first and a site that does not run Divi 5 with Checknaut Pro on is refused by name, never written to; items other than brand_kit also need this hub to run Divi. A preset's or layout's colour and variable references travel ahead of it (include_tokens, default true). Each target is read first: a preset it already has (same id and module) is updated with checknaut_update_preset instead, and variables it already has are kept, not re-created. DRY RUN unless apply=true: the plan lists, per site, the calls in order. Applied results are per site and per item, with the client-side snapshot id where the tool took one (undo there with checknaut_restore_snapshot via checknaut_fleet run).

Current connected tool contract

Client approvals on this site, newest first: which page, the staged draft, status (pending, approved, approved_unapplied — approved but not swapped in, with the reason — changes_requested with the client's comment, cancelled, expired), and when. Links are stored hashed and are never returned here; a lost link is replaced from wp-admin (History → Client approvals) or by cancelling and requesting again.

Elementor integration — withheld here; exact schema must be read on an applicable install

Lists supported Elementor components. Not exposed on the connected Divi site.

Current connected tool contract

Which attributes of a module accept DYNAMIC CONTENT, and which QUERY fields it exposes — read from this install's own module schema, not from a list we maintain, so it stays true across Divi updates. Call this BEFORE binding anything or setting a query: it returns the exact attribute paths Divi will resolve, each with its value type (text, url, image, color) and, for query fields, the accepted options. It also returns fields{} — the dynamic-content field NAMES this site resolves, including any a plugin or custom post type registered — which is what you bind INTO those attributes. A $variable written to an attribute that is not on the bindable list, or naming a field this site does not have, renders as raw text or nothing on the front end while looking fine in the builder, which is why this check exists.

Current connected tool contract

Divi's fonts on this site: the custom fonts uploaded to Divi (served from this site), the Google Fonts list Divi ships (search-filtered, capped by limit — reading it makes no request to Google), the web-safe families, and the global heading/body font slots. usage:true adds where every family is used — Divi pages and posts, Library and Theme Builder layouts (up to 1,000), presets, font variables and theme options — and names families that are used but not available here (the browser falls back) and uploaded fonts nothing uses. Read-only.

Current connected tool contract

Every form the site already has — Gravity Forms, Contact Form 7, WPForms, Ninja Forms, Fluent Forms, Formidable — with id, title and the exact shortcode or Divi module to embed it. Read this before building a divi/contact-form: the owner's notifications, spam protection and CRM hooks already live on their existing form. Says plainly when no form plugin is active (Divi's own divi/contact-form then needs none). Also lists builder_forms: every divi/contact-form and divi/signup already on a page (node path, receiver, spam protection, success message, field titles) and every Elementor Form widget (element id, fields, actions after submit, email recipients, honeypot/reCAPTCHA, stored submissions), each with its issues — a missing or invalid recipient, no spam protection, no success message, unlabelled fields. Read-only; up to 200 pages per builder.

Elementor integration — withheld here; exact schema must be read on an applicable install

Lists the global classes available in the Elementor integration. Not exposed on the connected Divi site.

Current connected tool contract

Saved Divi Library layouts. Global ones can be referenced from any page with divi/global-layout so one edit updates every use — the returned "block" string is the exact markup to paste.

Current connected tool contract

Durable conventions the owner has recorded for this site. You do NOT need this during a build — every memory is already injected into the connection instructions at session start. Call it to audit, correct or clean up the list.

Current connected tool contract

WordPress navigation menus: every menu with its item count and theme locations, plus the theme's registered locations. Pass menu_id for one menu's items as a tree (title, url, target page and ITS status — a menu link to a draft page 404s). On a Divi Theme Builder header the visible menu is whatever menu id the divi/menu module points at (menu.advanced.menuId), not a theme location.

Current connected tool contract

Every registered Divi module: name, title, category. One line each.

Current connected tool contract

Pages on this site with the builder that owns each one. On a Divi site the default lists Divi-built pages (pass builder:"all" for everything); on any other site the default is every page. On Divi 5 the result also lists "canvases": the off-canvas menus, popups and mega menus Divi stores as et_pb_canvas posts, each with its canvas_id, scope (local to one page, archive context, or global), the page it belongs to and how it is shown. A canvas id works with checknaut_check_accessibility, checknaut_check_links and the fixers like any page id. Self-test fixtures are never listed.

Current connected tool contract

Browse saved section patterns — hero, pricing, testimonial bands and so on — with their categories, copy placeholders and the colour roles each needs. Metadata only; markup comes from checknaut_insert_pattern. Check here before hand-building a common section.

Current connected tool contract

Global presets on this site: id, name, module, and the exact "apply" JSON to put in a block. Call this alongside checknaut_get_design_system before generating — referencing a preset keeps the page on-brand when the design later changes. Attribute values are omitted; use checknaut_get_preset for one.

Current connected tool contract

Version history for one page, newest first, with module counts so you can see what each entry would cost or restore. Every Checknaut write to a page preserves the outgoing content, title and excerpt first: a WordPress revision where the site keeps them, and on a site with revisions disabled (WP_POST_REVISIONS) a single Checknaut undo slot, listed here as revision_id 0 — the slot holds content only. The featured image is post meta and is in neither; checknaut_set_post_fields returns the id it replaced under "before".

Current connected tool contract

Rollback sessions on this site, newest first. Every WRITE tool call is recorded as it happens — reads never are — into the session of the connector (or MCP session) that made it: one session per connector per hour, measured from its first write, so the whole stretch can be undone together rather than one page at a time. Page writes made from Checknaut's own wp-admin screens (Fix, review, undo fix, fix all, History restore and its other dashboard actions) are recorded too, in a session of that user (user:N); design and settings changes made there are not. Each session lists the objects it touched by type (page, page_created, design_snapshot, and the kinds it cannot put back: page_fields, site_write). Pre-restore sessions (kind pre_restore) are the state captured before a rollback, so a rollback can itself be undone. Self-test writes are not recorded. An administrator sees every session; anyone else sees only their own. A connector is shown as "connector", never by its key. At most 50 sessions and 256 KB are kept, none older than 30 days.

Current connected tool contract

Every Theme Builder template on this site — its display conditions and the header/body/footer layout attached to each. Read this BEFORE creating one: a second template matching the same pages will clobber the first, because Divi applies exactly one template per request. Also returns the exact condition strings this install accepts.

Current connected tool contract

Divi modules registered by plugins other than Divi itself. These have no schema in checknaut_get_module_schema, so their attribute names are listed here instead. Check this on any site before assuming the module list from checknaut_list_modules is everything available.

Current connected tool contract

Client hand-off lockdown for chosen pages. action=lock locks every section of each page (Divi: the builder's own module lock; block editor: the core block lock, no move and no remove, on every top-level block; Elementor has no element lock, so its pages get the page guard only and need roles) and, with roles, keeps users of those roles out of the pages entirely — no edit, delete or publish in any editor, Checknaut included. Administrators are never locked out, and a role that can manage the site is refused. action=unlock reverses exactly what lockdown did: only the sections it locked (locks the owner set by hand stay) and the page guard. A page with nothing the lockdown can lock (an Elementor or classic page, an empty or Divi 4 page) is refused unless roles are given, and a page someone has open in the WordPress editor is refused. Needs an administrator. The same lockdown is managed in wp-admin: Checknaut → Settings → Safety switches → Client lockdown. Dry run by default: pass apply=true to write.

Current connected tool contract

Lock modules in the Divi builder, as the lock icon in the Visual Builder does: items = [{id, node_id}] across one or more pages. A locked module cannot be edited, moved, deleted or cloned by anyone without Divi's "Lock Module" permission, and Checknaut's own writes and fixers skip or refuse it. A lock covers everything inside it, so locking a section locks its rows and modules. Columns are refused (lock the row or section). Needs edit rights on each page and the Lock Module permission. Every item is checked before anything is written, and a page someone has open in the WordPress editor is refused. The write changes the lock attribute and nothing else on the page. Dry run by default: pass apply=true to write. Reverse it with checknaut_unlock_modules (checknaut_undo_change does not undo a lock change).

Current connected tool contract

Generate tablet and phone overrides for a Divi page from its desktop values, deterministically. This closes the failure where a page looks right on a laptop and unreadable on a phone because nothing below desktop was ever set — the single most common defect in a page an assistant built. Font sizes, padding, margins and gaps are scaled through measured bands rather than one blanket percentage, because a 120px display heading and a 26px sub-head need very different treatment; a phone floor stops padding collapsing to nothing; and values below the floor are left alone because scaling them makes them worse, not better. A value in em, rem, %, vw or auto is NEVER touched — the pass only moves what it can reason about in pixels. DRY BY DEFAULT: without confirm=true it returns exactly what would move and writes nothing. Running it again after applying is a no-op: every property that already carries a responsive override is skipped, so a value you hand-tuned in the builder is never overwritten. Divi ignores overrides that lack their own last-edited marker, so this writes that too. Follow an applied run with checknaut_clear_css_cache scope=page.

Elementor integration — withheld here; exact schema must be read on an applicable install

Manages supported Elementor default styles. Shared effects should be reviewed and verified across representative pages.

Elementor integration — withheld here; exact schema must be read on an applicable install

Manages supported Elementor variables. Availability and value types come from the active Elementor integration.

Elementor integration — withheld here; exact schema must be read on an applicable install

Manages supported Elementor global classes. This affects shared styling; discover the installed schema and read the plan before writing.

Current connected tool contract

Plugins and themes. action=list shows versions, what is active and which updates WordPress knows about. update / install (WordPress.org slug) / activate / deactivate for plugins (kind=plugin), update / activate for themes (kind=theme): each backs up first, checks the home page and REST API before and after from a separate request, and rolls back automatically if the site got worse. Only WordPress.org packages; vendor-licensed updates (Divi, premium plugins) stay in wp-admin. Locked until the owner unlocks "plugins and themes" in wp-admin. Never deletes anything.

Current connected tool contract

Monitoring for this site and the fleet. action=status returns this site's TLS certificate and domain registration days left (read through the free Site Health engine; the domain from its registry's RDAP record via rdap.org, cached a day), each fleet site's 30-day uptime from the hub's hourly ping (down after two failed pings in a row) and its certificate and domain days read from this hub, the alert settings and the recent alerts; refresh=true re-reads everything now within a time budget (about a minute at most). action=settings reads the alert settings, or changes enabled, recipients, ssl_days (alert under, default 14) and domain_days (default 30) — a dry run unless apply=true. action=test_alert sends a test email to the saved recipients only (apply=true). Alerts mail only on a change of state: down or back up, under a threshold or renewed. Uptime of THIS site is not measurable from inside it; add it to another hub's fleet.

Current connected tool contract

Move a node to sit before, after, or inside another node on the same page.

Current connected tool contract

Mint a single-use ticket that lets ANOTHER site pull this page directly over HTTPS. This is the preferred way to move a page between installs: you carry a 48-character token instead of a ~19KB base64 blob, so there is nothing to truncate and no large payload in your context. Returns pull_url and pull_token — hand both to checknaut_import_page on the TARGET site. The ticket is stored hashed, dies on first use, and expires in 15 minutes. The export is proven to build before a ticket is issued. Requires Checknaut 0.19.0+ on both sites; fall back to checknaut_export_page + checknaut_import_page against older targets.

Current connected tool contract

Turn hardcoded values repeated across Divi pages into design tokens: colour literals (#hex, rgb/rgba), lengths (px/em/rem/%/vw/vh; kinds number) and font families (kinds font) that appear min_count times or more become global colours / variables — reusing a token that already holds the value — and every whole-value occurrence is rebound to the token. Scope: id, ids, or site=true (the 50 most recently changed Divi pages). The plan lists each literal, its count per page and the token. Modules locked in the Divi builder are left alone and named; each page keeps its prior content for checknaut_undo_change. Pages built with Elementor or the block editor are skipped by name. DRY RUN unless apply=true; only=[literals] narrows it.

Current connected tool contract

Redirects: action=list shows every rule with its hit count, the SUGGESTIONS (old URLs left behind when a published page was renamed or trashed) and any other redirect plugin running; action=add creates from → to (a path on this site, or a full URL with allow_external=true), refusing loops of any length and warning about chains; action=remove deletes one. Rules keep working even if Pro lapses.

Current connected tool contract

Render a page as a visitor sees it and return the text, HTML or heading outline. Use this to CHECK YOUR OWN WORK after building — it catches empty modules, duplicated sections and wrong copy without a browser. It reflects content and structure, not spacing or colour.

Current connected tool contract

Fetches this page over HTTP the way a visitor would and reports any block that asked for styling but produced NO CSS at all — modules AND sections, rows, columns and inner rows/columns, which is where background, spacing and sticky live. This is the only check that sees what the browser is actually handed — checknaut_validate_markup checks shape, checknaut_check_contrast reads stored attributes, and checknaut_render_page deliberately strips styles. Use it after building or restyling a page, and whenever something looks unstyled but the markup reads correctly. The classic hit is a path one level too shallow: decoration.font.<bp> stores, validates and round-trips perfectly and renders nothing, because the FONT and TEXT option groups repeat their own name (decoration.font.font.<bp>). Only those two do — background, spacing, layout and sizing take the breakpoint directly. Works on drafts where the host serves the probe the draft’s render; when the document it gets back is not the page (or carries none of its CSS) it answers status "unprobeable" with the reason instead of calling every node silent. It reports absence, never wrongness — it cannot tell you a colour is ugly, only that Divi emitted nothing. Sticky and scroll are JS-driven rather than CSS-driven, so they are verified separately: the js_driven section of the result confirms each such module's selector appears in the emitted config.

Current connected tool contract

Repair presets: scope=tokens fixes tokens that declare the wrong type (a font as "font", a size as "content" — they resolve to nothing with no front-end symptom); scope=module_names back-fills the type/moduleName CSS-identity fields on items written by pre-0.12.2 versions (without them Divi emits dead selectors); scope=all runs both. DRY RUN unless apply=true. Snapshots first, verifies by re-read, rolls back automatically if the write did not take.

Current connected tool contract

Send a proposed change to a LIVE page to the client for approval before it goes live. The proposal is staged on a draft copy of the page (never on the live page): pass changes {title?, content?} to have a new draft copy made with them applied, or staged_post_id for a draft copy you already edited (on Divi, checknaut_duplicate_page makes one). content is the whole page body in the page's own format — Divi 5 markup, core-block markup, or an Elementor element tree as JSON — and is validated by the same write path and write guardrails an edit takes. The live title changes only when a title is proposed: changes.title, or use_staged_title=true with staged_post_id. Returns review_url: a private, single-use link (stored hashed, expiring after expires_hours, revocable) that shows the client the proposal on the real site with Approve and Request changes. Approve swaps the proposal into the live page as a normal write with a revision and the undo slot, so checknaut_restore_revision reverses it; the swap is refused if the live page changed after staging. client_email emails the link; the owner is emailed the decision. DRY BY DEFAULT: without apply=true it returns the plan and stages nothing. Divi 5, Elementor and block-editor pages only; any other builder is refused by name.

Current connected tool contract

Answer "what value should I use" before building or fixing something, instead of guessing or hardcoding. For each requested role, resolves in order: (1) a token/binding already on this site for that exact role, (2) failing that, this site's own organic consistency — mined from live page content or its real colour palette, and reported with a sample size so you can judge it, not a silent guess, (3) failing that, a real shipped default (typography only) sourced from converged industry defaults, never an invented number. domain="typography" covers roles h1, h2, h3, h4, h5, h6, body, caption (mining only covers h1-h6). domain="color" covers roles surface, surface_alt, surface_dark, ink, ink_muted, accent, accent_contrast — colour has no honest default tier, so a site with no colours yet resolves every role to source "none" rather than inventing a hue, and the surface/ink and accent/accent_contrast pairings are checked for real AA contrast and reported honestly, not assumed; a role binding set in the design system locks a role in. VISUAL DOMAINS: domain="elevation" (roles rest, raised, floating), "radius" (sm, md, lg, full), "spacing" (xs, sm, md, lg, xl), "sizing" (container). These resolve adopted -> token -> mined and have NO default tier — there is no universal right shadow or corner radius, so a site with no convention returns source "none" instead of this plugin's taste. Pass module= with a visual domain and you get back the exact attribute path AND a paste-ready fragment: a shadow on divi/image belongs at image.decoration.boxShadow, NOT module.decoration.boxShadow, and spacing on divi/image lives under module.ADVANCED rather than decoration. Write to the wrong root and Divi renders nothing while the call reports success. Tier 0 in every domain is the site's ADOPTED design system (checknaut_sniff_design_system) — when one is in force it outranks tokens and mining, and it is changed by the owner in wp-admin, not here. Read-only — mining scans content, nothing is written. Call this before writing or fixing a value whenever the right value is not obvious from checknaut_get_design_system alone.

Current connected tool contract

Turn a plain-language reference to part of ONE page ("the second blurb", "the hero heading", "the Contact button", "the footer email link") into the node ref(s) the other tools take, each with a confidence and the evidence behind it: the element type, its position in document order, the text or destination that matched, and which section it sits in. When two candidates are equally good both come back and none is chosen; ask which, or add an ordinal or a quoted word from its text. best is set only when exactly one candidate matches everything the reference said; a lone leftover that does not (its unmatched[] says what) is listed and not chosen. A link typed inside a text element counts as a link of its own. Reads the stored page: on Divi 5 each match carries node (the ref the fixers take) and node_id (the checknaut_get_tree id); on Elementor the element id; in the block editor the block ref. Any other builder is refused by name. Read-only.

Current connected tool contract

Which Theme Builder template — and which header, body and footer layout — a given page or kind of page actually gets, answered by Divi's own resolver. Pass post_id, or kind: homepage | search | 404 | date | author (user_id) | archive (post_type) | term (taxonomy, term_id). Use it after creating or retargeting a template, and whenever chrome "does not appear" on a page (it also names the Blank Page template, which suppresses Theme Builder output).

Current connected tool contract

Roll a page back to one of its revisions, or to the Checknaut undo slot (revision_id 0). Restores every field the revision holds — content, title and excerpt — the way WordPress's own revision restore does; the dry run names the title change explicitly when there is one. The undo slot holds content only, so restoring from id 0 leaves the title alone. Defaults to a DRY RUN that reports exactly what would change and writes nothing — pass confirm=true to apply. What is being replaced is preserved first, as a revision or in the undo slot, so a restore is itself undoable and the result says which of the two it made.

Current connected tool contract

Put every object a session touched back to its state at FIRST touch — not its most recent one, because restoring each object to its last-recorded state would leave the site in a combination it was never actually in. DRY BY DEFAULT: without confirm=true you get the plan, listing every object in the order it would be written (last-touched first), what it would go back to, anything that CANNOT be restored with the reason, and anything BLOCKED right now with the reason. A page goes back byte for byte (its content hash is checked) from the revision or undo slot Checknaut took before the session's first write to it — an Elementor page from its whole first-touch state (post_content and Elementor's own data, stored beside the page), written back through Elementor's save with its CSS regenerated; a page whose pre-session state is no longer there is named, not guessed at. A page the session created goes to the Trash. The design system goes back to the snapshot taken before the session's first design write, and is checked to read back as it did. Named and left alone: a page somebody else changed BETWEEN the session's writes to it (rolling it back would throw that edit away), title/excerpt/status-only edits (page_fields) and settings, menus, media or options (site_write). BLOCKED, and a confirmed rollback then writes NOTHING: a page or the design system changed after the session's last write to it (a person saved it, another assistant wrote), a page open in the editor, a module locked in the Divi builder, or protect_design. If any write by this connector could not be recorded while the session was open (the store was busy or did not keep the write) — the first write of a stretch included, and every such miss, not only the latest — the plan says records may be missing and never claims to be complete. A design snapshot that is no longer in the snapshot store is named as not restorable. The whole cascade is one undo step per page, the pre-restore state is captured first as a session of its own (undo_session_id) so a mistaken rollback is itself reversible; if that capture cannot be stored in full, the rollback is refused (outcome refused_undo_unavailable) before anything is changed, with no undo_session_id. The rollback is written to the site history. Outcomes are per object, never flattened to a single true/false.

Current connected tool contract

Roll the design system back to a snapshot id.

Current connected tool contract

Put back a design token deleted with checknaut_delete_token, with its original id and value, so every page that still references it renders again. The last 50 deletions are kept. Refused if the id exists again.

Current connected tool contract

Run the plugin's self-test against this install and return failures. Use it after installing or upgrading Checknaut, after a builder update, or when an assistant cannot connect, to confirm the deployment works instead of assuming it. The result names its engine: "suite" where the plugin's full integration suite is installed, otherwise "runtime" — diagnostics of the connector route, OAuth discovery, REST access, a loopback fetch, the audit table, the active builder, the write switches and the PHP and WordPress versions. scope=read touches nothing and is safe on production; scope=all also exercises the write path using a temporary draft it deletes afterwards. A run may be PARTIAL: the full suite works for ~20 seconds per call and then pauses cleanly, returning status=running with progress; call again with the SAME scope to continue (progress is saved). Only a status=finished result is a verdict. The runtime diagnostics finish in one call. The group parameter runs one slice by name (matched case-insensitively, substring allowed) for targeted debugging; an unknown value returns the list of valid groups. Omit group and pass no scope for the safe read-only pass.

Current connected tool contract

Update plugins, themes or WordPress with a before/after test of the site's key pages, rolling back automatically when an update breaks something. Without apply it only returns the plan: what is pending (as of WordPress's last update check), which pages will be tested (default: the front page, the main menu, then recently changed pages; up to 5), and what counts as a regression. With apply=true each item is processed ALONE: the pages are read as an anonymous visitor (HTTP status, visible text, element structure, scripts and stylesheets, PHP errors printed into the page, WordPress's critical-error screen, and on Divi pages how many styled modules emit CSS), the item is updated through checknaut_manage_plugins' own path (zip backup, home/REST health check, its own automatic rollback), the pages are read again, and a regression — a page that stops answering, a new fatal or PHP error, more than 30% of a page's text or elements gone, the styled elements of a Divi page gone silent — is checked twice and then rolled back from the backup; the result says whether the pages match again. With a screenshot provider set up (wp-admin: Checknaut → Settings → Screenshots) the first page is also photographed before and after, and the pictures and a difference score come back as image content; a visual difference alone is a warning, never a rollback. Every step is journaled and each item gets a verdict: passed, passed_with_warnings, rolled_back, regressed (WordPress core: there is no automatic core rollback, so core is only updated when named or with include_core=true, runs last, and a regression stops the batch), skipped (vendor-delivered updates such as Divi, which update from wp-admin), up_to_date, or failed. A batch stops at the first rollback unless continue=true, and at the call's time budget with the rest in remaining — call again with the same arguments to carry on. Refused while the owner keeps plugins and themes locked. The history is on Site Health → Updates in wp-admin.

Current connected tool contract

Record a durable convention for this site so it never has to be explained again — palette rules, tone, "always do X here". Only save what the OWNER has stated as a standing rule; a one-off instruction for the current task is not a memory. Memories are injected into every future session, so keep each one short and specific. Pass id to revise an existing one. Only the memories that fit the injection cap reach a session: a save that would push the store over is REFUSED and names which existing memories would go dark, so the owner chooses what matters rather than losing one silently.

Current connected tool contract

Save a section you have built as a reusable pattern. Colours that match this site's tokens are generalised into roles so the pattern adopts the palette of whatever site it is used on; anything left as a literal value is reported so you can fix it before it travels.

Current connected tool contract

Create or update content of ANY public post type — blog posts, custom types like team or services — with categories and tags (terms: { taxonomy: [slug|id] }), a publish date (future dates schedule it), excerpt, slug, parent, menu order and plain custom fields (meta; protected _keys are refused). Content is block markup or HTML; Divi markup and Divi-built posts are refused (they have their own tools). New content is a draft unless status says otherwise.

Current connected tool contract

Site-wide dead-link scan of published pages, posts, Theme Builder / Library layouts and Divi 5 canvases (off-canvas menus, popups, mega menus — a hit there carries "canvas" with the page it belongs to): every internal link that leads to a trashed, draft or private page, or to a path nothing answers. Resolved inside WordPress (no HTTP requests), so it covers the whole site in one call. checknaut_check_links checks one page over HTTP, external links included.

Current connected tool contract

A picture of one published page of this site, returned as image content you can look at, through the screenshot service the owner set up (wp-admin: Checknaut → Settings → Screenshots; WordPress has no browser of its own). Pass id or url, and width (320-1920, default 1280). The service loads the page as an anonymous visitor, so drafts, private and password-protected pages are refused; tall pages are cut to the first 3000px. Refused with the screen to visit when no service is set up. Each call uses one request of the owner's screenshot plan. Read-only on this site.

Current connected tool contract

Search the media library by title, file name or alt text — returns id, URL, dimensions, size, alt and available sizes. Use it before adding anything new: the logo, team photos and hero images a site already has should be referenced, not uploaded a second time. type defaults to image (mime prefix; "any" for everything).

Current connected tool contract

Find a literal string across stored page/post content and titles — a phone number, an address, a product name — and, with apply=true, replace it everywhere at once through each page's owning builder (Divi pages re-validate; a revision is kept). DRY BY DEFAULT: the plan lists every post with occurrence counts and, on Divi pages, the node_ids. Refuses needles under 3 characters and anything carrying quotes, backslashes, block-comment markers or $variable( — those live inside block attribute JSON, where a blind replace silently drops a module's attributes; use checknaut_edit_module for those. Menus are not content: checknaut_set_menu edits them. Elementor pages are found and replaced in their stored element tree (string settings only), not in the text mirror WordPress search sees.

Current connected tool contract

Before building a section, search what this site already has that fits: shipped and saved patterns, Divi Library layouts, Theme Builder parts and labelled sections on existing pages — ranked, each with how to reuse it. query: a few words, e.g. "pricing table", "testimonial", "cta".

Current connected tool contract

Find free stock photos on Pexels or Pixabay and import the chosen one into the media library, credited. action="search" (default) takes query (describe the photo), optional orientation (landscape|portrait|square) and provider (pexels|pixabay; default: whichever the owner set up), and returns previews with the photographer and source page — nothing is downloaded. action="import" takes provider and id from a result, plus alt (always set it) and optional post_id; the photo is looked up again by id, downloaded from the provider's own image host, and stored with "Photo by … on …" in its caption and the source recorded. Importing the same photo twice returns the existing copy. Needs the owner's free API key for the provider (Checknaut → Settings → Tools & profile); without one this says so. Check checknaut_search_media first: a photo the site already has beats a stock one.

Current connected tool contract

Create a real default spacing scale as number variables — 9 tokens, 4px to 96px, on an 8px base unit with a 4px half-step. This is not an invented scale: it is the converged default across IBM Carbon, Atlassian, USWDS, and Material Design's 8dp grid. Use it on a fresh site with no spacing tokens yet, before building pages, instead of hand-picking padding numbers. Idempotent — ids already on the site are skipped, not fought over, so calling it again just fills in whatever is missing. preview=true returns the plan without writing. Delegates to checknaut_create_variables, so it is additive-only with the same snapshot/verify/rollback guarantee.

Current connected tool contract

Create a real default type scale as number variables — 16 tokens (h1-h6, body, caption; a size and a line-height each). Sizes are the converged subset of Tailwind CSS's own scale that also lands on Material Design 3's and IBM Carbon's type-scale values (16px body, 24px shared breakpoint, and so on); not an invented scale. Before seeding, check checknaut_resolve_design_values first — if this site already has its own consistent heading sizes, seeding the plugin's generic default over that would be the wrong fix; tokenize what the site already does instead (checknaut_create_variables) rather than seeding here. Use this tool specifically when a site has no established type scale at all. Idempotent — ids already on the site are skipped, not fought over. preview=true returns the plan without writing. Delegates to checknaut_create_variables, so it is additive-only with the same snapshot/verify/rollback guarantee.

Current connected tool contract

Set or remove HTML ATTRIBUTES on one module or element — aria-label, aria-expanded, aria-controls, role, tabindex, id, rel, title, lang, data-* — and optionally the tag its wrapper renders as (element_type: nav, section, header, footer, main, aside, article, button, a, ul, li and the rest of the builder's allowlist; "default" clears it). On Divi 5 the attributes go into the module's own Attributes list, on its wrapper ("main") or one of its own elements (target_element: title, content, button, image… — checked against the module's real element list and its show toggles). On Elementor they go into the element's Custom Attributes (Elementor Pro required; wrapper only), and element_type sets a container's HTML tag. Values are data, never code: event handlers (on*), style, srcdoc and javascript: URLs are refused by name, an aria-* name must be real ARIA, an HTML id must be unique on the page, and a result the accessibility check would fail (an invalid ARIA value, a <button> wrapped around links, a second <main>) is refused. The block editor, atomic Elementor elements and other builders are refused by name. A module locked in the Divi builder is refused, and so is a page someone has open in the WordPress editor. Dry run by default: pass apply=true to write. Undo with checknaut_undo_change (Divi and Elementor).

Current connected tool contract

Switch Divi 5 breakpoints on or off and change their widths, site-wide. breakpoints: {name: {enable?, width?}}. Divi's rules are checked BEFORE writing, because Divi silently drops a width that breaks them and reports success: desktop is the base and cannot be disabled or sized; every width must sit strictly between its neighbours' widths, enabled or not (phone < phoneWide < tablet < tabletWide < widescreen < ultraWide) — send both widths in one call to move past a neighbour. Values pages already store for a breakpoint you disable are kept and return when it is re-enabled. DRY BY DEFAULT. apply=true snapshots the setting, writes through Divi's own Breakpoint::update(), re-reads and rolls back if any value did not land, then clears Divi's CSS cache so pages carry the new media queries. restore:<snapshot id> puts a snapshot back (also dry by default). After enabling a breakpoint, fill values for it in the builder or with checknaut_make_responsive.

Current connected tool contract

Explicitly bind one or more colour roles (surface, surface_alt, surface_dark, ink, ink_muted, accent, accent_contrast — see checknaut_resolve_design_values domain="color") to a real colour id on this site. This is the deliberate, persisted "token" tier of colour-role resolution: once set, a binding outranks the automatic luminance guess from then on, for both checknaut_resolve_design_values and pattern insertion. Pass an empty string for a role to clear its binding back to automatic inference. This does not create colours or change contrast on its own — call checknaut_set_colors first if the colour you want to bind does not exist yet, and checknaut_resolve_design_values (domain="color") or checknaut_check_contrast after to confirm the resulting pairing is accessible. Returns "before" — the binding each role held, null where it had none — plus a snapshot_id, so a call is reversible either by naming the previous values or by checknaut_restore_snapshot.

Current connected tool contract

Create or update global colors — additive merge, other colors are never touched. Each item: {id?, label?, value} (value = any CSS color; omit id to generate one). Snapshots first, verifies the write by re-reading the store, and restores the pre-write palette automatically if it did not take.

Current connected tool contract

Show or hide a module based on who is looking or where they are — logged-in status, user role, post type, category, referrer, date, URL parameter. Divi stores these as a LIST of conditions, each with its own id and a joining operator, and this writes exactly that shape (verified against real markup rather than inferred). conditionName is checked against the 22 Divi 5.13.1 evaluates (postType, categories, tags, author, customField, tagPage, categoryPage, dateArchive, searchResults, loggedInStatus, userRole, dateTime, pageVisit, postVisit, numberOfViews, urlParameter, browser, operatingSystem, cookie, productPurchase, cartContents, productStock): names_checked=true when every name is one of them, and any other is named in unknown_names — a wrong name stores cleanly and never fires. The settings inside a condition are not checked; load the page in the state it describes. NOT a way to vary a layout per device: operatingSystem / browser conditions are not a substitute for breakpoint values — viewport differences are breakpoint values on the field that differs. Dry by default.

Elementor integration — withheld here; exact schema must be read on an applicable install

Sets supported Elementor element styling through the builder integration. Use the live schema rather than a Divi attribute path.

Current connected tool contract

Write ACF or Meta Box field values on one post: values = { field_name: value }. Every field is checked first (exists on that post, a simple type, email/number shaped right) and nothing is written if any fails. Repeaters, groups and flexible content are refused — edit those in wp-admin. Returns the previous values.

Current connected tool contract

Flip the hardening switches Site Health's posture findings point at — the fixes this plugin can apply from inside WordPress without touching wp-config.php or the server, all reversible but one (hsts, flagged below): xmlrpc_off, hide_versions, block_user_enumeration (anonymous /wp/v2/users → 401, /?author=N → home), security_headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy — each sent only when the server has not), hsts (HTTPS only, 180 days, no preload — the ONE switch here that is not reversible, so turning it on requires accept_hsts_is_one_way=true), disable_file_edit (defines DISALLOW_FILE_EDIT), robots_sitemap (Sitemap: line in the virtual robots.txt). Pass only the switches you are changing; unknown names are refused rather than ignored. Returns before/after and warns when a switch would break something present (Jetpack needs XML-RPC). checknaut_check_site_health lists every switch with its current state under "hardening". checknaut_fix_finding on the corresponding health-* check flips the same switch and journals it for checknaut_undo_fix.

Current connected tool contract

Add, update or remove Divi 5 INTERACTIONS on one trigger module — a click that shows a hidden popup section, a hover that adds a preset, a scroll into view that sets an attribute. Writes exactly the shape the Visual Builder saves: fresh 10-character ids, the trigger class shared by every interaction on the module, and the target module's own interaction id (reused when it already has a unique one, so two buttons can open the same popup). Target a module on this page by node_id, one in this page's canvas, a global canvas or a Theme Builder layout by {post_id, node_id}, a theme-added class by {class}, or a relative element by {type: parentContainer|rootContainer|children}. Every field is checked against Divi 5.13.1 before anything is written: the trigger and effect names, each field the effect or trigger needs (named when missing), an enabled breakpoint, an existing preset, sensitivity 0-100, and attribute effects follow the same data-only rules as checknaut_set_attributes (no on* handlers, no style, no javascript:). The free interaction checker runs on the planned result and again after the write; a change that would leave a target missing, an id duplicated or a trigger class out of step is refused, and a write that leaves one is rolled back. remove takes interaction ids off (removing the last clears the trigger; a target nothing aims at any more loses its id). A module locked in the Divi builder is refused, and so is a page someone has open in the WordPress editor. enabled:false is refused: Divi 5.13.1 runs every stored interaction on the front end whatever its enabled switch says, so remove the interaction instead. Dry run by default: pass apply=true to write. Undo with checknaut_undo_change on each page listed in writes (the trigger's page, and any canvas or layout a target sits in).

Current connected tool contract

Turn ANY module into a query loop — a heading, an image, a whole row — so it repeats once per post, term or user instead of showing one fixed value. This is Divi 5's Loop Builder, and it is separate from checknaut_set_query: that one configures the built-in post-type modules (divi/blog and friends), this one loops a module that has no query of its own. The storage shape here was read back out of a page authored by hand in the Visual Builder, not inferred from documentation, because almost every detail of it defeats a reasonable guess. Post types are checked against the list Divi itself will offer on this site, and orderBy against the values Divi accepts for that query type; a value we cannot verify is reported as unchecked rather than silently trusted. After looping a module, bind its fields to the loop_* dynamic fields (checknaut_bind_dynamic_field) or every iteration renders the same content. Dry by default.

Current connected tool contract

Create a menu or replace its items, and optionally assign it to theme locations. items is a tree: [{title, page_id | url, target?, children?}] — a page item takes its title from the page unless given; a url must be absolute, site-relative, an anchor, mailto: or tel:. Every item is validated before anything is written (a link to a draft page is refused unless allow_unpublished:true on that item), the whole item list is replaced by default (mode:"append" adds to the end), and the result is the menu re-read. Unknown locations are refused with the registered list. To show the menu in a Divi Theme Builder header, point the header's divi/menu module at the returned menu_id.

Current connected tool contract

Set a post or page's featured image, excerpt, page template, SEO title, meta description, social sharing image (og:image), noindex and/or canonical URL. seo_title, meta_description and social_image and meta_description are written into the active SEO plugin's own fields (Yoast, Rank Math, SEOPress — AIOSEO is refused, it uses its own tables); with no SEO plugin, Checknaut stores and prints them itself. Lengths are checked against what search results show (title ~60, description 70–160). The featured image must already be in this site's media library — checknaut_search_media finds it; add it to the media library first if it is not there. An external URL is refused rather than silently ignored.

Current connected tool contract

Set which content a loop-capable module returns — post type, count, categories, offset and the rest. Every key is validated against the module's real query fields and its accepted values — including post type and categories, which Divi leaves unenumerated because they are registered at runtime, and which are therefore checked against this site's own post types and terms. An unknown key or value is refused with the real list rather than written and ignored, because a query that silently returns nothing still renders a page. Post-type modules (divi/blog, divi/portfolio, divi/shop, the post sliders) are the ones that query — to make a plain module dynamic, bind its fields with checknaut_bind_dynamic_field instead. Dry by default.

Current connected tool contract

Add, replace or remove ONE labelled snippet (label: "ga4", "gtm", "meta-pixel"…) in a Divi Integration slot — head, body, single_top or single_bottom — leaving everything else in that field untouched, and switch the slot on. Locked by default: the site owner unlocks it in wp-admin ("Keep site-wide code locked"). Needs an administrator with unfiltered_html. A tracker carries consent duties for the owner; run checknaut_check_legal afterwards. Undo with checknaut_update_theme_options undo=<change_id>.

Current connected tool contract

JSON-LD for one page (id) or the whole site (no id): pass schema as an object with @type (LocalBusiness, Organization, Service, FAQPage, Article, …) or a list of them; @context is added. Printed in wp_head as <script type="application/ld+json"> by this plugin. Refuses aggregateRating/review nodes — invented ratings are a manual-action risk; the owner adds those with the reviews visible on the page. Call with no schema to read the current value; remove:true clears it. Names any SEO plugin already printing schema so you do not duplicate its Organization/WebPage nodes.

Current connected tool contract

SEO title, meta description and noindex for a category, tag or other term archive — written into Yoast, Rank Math or SEOPress's own term fields. WordPress has no such fields itself, so without one of those plugins this is refused with the reason.

Current connected tool contract

Snapshot the design system (colors, variables, presets — global styles on a block site) and return a snapshot id. Roll back with checknaut_restore_snapshot.

Current connected tool contract

Read the design system this site ALREADY has, and propose it. Scans real stored content — pages, posts, Theme Builder headers and footers, and the Library — newest first, up to 300 items, resolving presets so a site that keeps its design in presets is not read as having none. Reports what it found per domain (radius, elevation, spacing, typography, colour, sizing) consolidated onto a real scale rather than as an inventory of every value: "adopting this standardises 11 radii down to 3". It never invents — a site with no drop shadows is told that is a design decision, not a gap, and a domain with no convention resolves to source "none". Read-only, and PROPOSING IS NOT ADOPTING: no tool adopts a proposal, deliberately, because an agent that can adopt a design system can redefine what on-brand means and then satisfy every check it was failing. Where the site owner has adopted a system, it is tier 0 of checknaut_resolve_design_values.

Current connected tool contract

Upload one ordered slice of a large payload, to be assembled server-side and written by checknaut_import_page. Use this when a single write is refused by the host (a 403 from a WAF, or a gateway size limit) — split the payload into slices of roughly 4-8KB, send them with seq 0,1,2… and final=true on the last, then call checknaut_import_page with the returned stage_id. Re-sending a seq overwrites it, so a failed chunk can simply be retried. Staged payloads expire after 6 hours and are consumed on import.

Current connected tool contract

Which pages use each design token (gcid-/gvid-) and preset, which ones nothing uses, and — most important — MISSING references: pages pointing at a token or preset this site no longer has, which render as nothing. Pass id for one token or preset. Read before deleting or retargeting anything in the design system.

Current connected tool contract

Undo the assistant's LAST write to one page, putting back exactly what was there before it (found by hash among the page's revisions and undo slot). Refused if anyone changed the page after that write — undoing would discard their edit too — unless force=true.

Current connected tool contract

Roll back ONE fix applied by checknaut_fix_finding (or the Fix buttons in wp-admin), by its fix_id, leaving everything else untouched. Image fixes restore byte-identically — the original files were never moved, so undo repoints the attachment, reverses the recorded URL rewrites and deletes the optimised copies. Content fixes restore the revision the fix created, but ONLY while the page still matches the fix's own after-state: if the page was edited since, this refuses with the reason rather than eating the edit (use checknaut_restore_revision to pick a state deliberately). SEO meta and option fixes restore the exact prior values under the same edited-since guard. The journal keeps the last 100 fixes; each fix's result carries its fix_id.

Current connected tool contract

Unlock modules locked in the Divi builder: items = [{id, node_id}]. A module locked through a locked ancestor stays locked until that ancestor is unlocked too, so the call is refused unless the ancestor is in the same items list; modules locked on their own inside an unlocked one stay locked and are listed. Needs edit rights on each page and Divi's "Lock Module" permission; a page someone has open in the WordPress editor is refused. Dry run by default: pass apply=true to write. Reverse it with checknaut_lock_modules (checknaut_undo_change does not undo a lock change).

Current connected tool contract

Change a Divi 5 canvas: its name, its content (replaced through the same write path as a page — lock guard, Visibility gate, undo slot, render check), local ↔ global scope (moving it to one page is refused while other pages still open it), append above/below/none and z_index. id is the canvas post id from checknaut_list_pages → canvases[] (or canvas_id). The page's builder index (_divi_off_canvas_data) is kept consistent. DRY RUN unless apply=true; returns the previous values.

Elementor integration — withheld here; exact schema must be read on an applicable install

Updates supported Elementor kit values. These are shared design settings, so inspect their reach before applying.

Current connected tool contract

Change where a form's notification goes and what it says, and the message a visitor sees after sending: Contact Form 7, Gravity Forms or WPForms (plugin + form_id from checknaut_list_forms). notification = { to, subject, from_name, reply_to } — form tags like [your-email] or {Email:2} are allowed in to/reply_to. Returns the previous values. Send a test afterwards. An Elementor Pro Form widget is plugin:"elementor" with id + node_id instead of form_id: fields, notification/notification_2, actions, redirect_to, webhook_url, spam, confirmation_message — dry by default, apply:true writes.

Current connected tool contract

Edit an existing option-group preset in place — every module using it (directly, as the group default, or nested in an element preset) picks the change up. attrs merge (default) or replace, checked against Divi's own map for the group like checknaut_create_group_preset; name; set_default true/false (false only clears it when this preset holds it); nested {groupId: presetId | null} adds or removes group presets inside it (a preset that would contain itself is refused). Snapshot first, verified by re-read, prior store restored on failure. DRY RUN unless apply=true.

Current connected tool contract

Replace the content and/or title of an existing block-editor (Gutenberg) page or post — the whole-page write for a site that is not built with Divi. Content is core-block markup or plain HTML; Divi markup is refused, because the two authoring modes are exclusive and mixing them renders blank. The write goes through the block adapter's own path: the markup must survive a parse → serialize → parse round trip, the outgoing content is preserved first (a revision, or the Checknaut undo slot on a site with revisions disabled) so checknaut_restore_revision can put it back, and the saved result is re-read and verified block-for-block so a save filter that strips content is an error rather than a silent loss. Replacing the content of a PUBLISHED page may require confirm=true on this site. A page owned by a builder Checknaut cannot write (Elementor, Bricks) is refused by name — fix those in that builder.

Current connected tool contract

Edit a saved global layout. This changes every page that references it — the response lists which. The prior content is preserved first, and the result says how.

Current connected tool contract

Edit a media library item's alt text, title, caption and description — in the LIBRARY, so every future use starts right (checknaut_fix_alt_text writes alt into pages).

Current connected tool contract

Replace a page title, status, template or FULL markup. When content is replaced the result carries render_ok (false + render_error when the stored page would return HTTP 500 to a visitor). Preserves the outgoing content first — a revision, or the Checknaut undo slot on a site with revisions disabled — so it is recoverable via checknaut_list_revisions. Replacing the content of a published page may require confirm=true on this site. To change part of a page use checknaut_edit_module or checknaut_add_module instead — surgical edits are cheaper and never need confirmation.

Current connected tool contract

Edit an existing module preset in place — every page referencing it picks the change up immediately, which is the point of presets. mode=merge (default) deep-merges attrs into the existing tree (maps merge, lists/scalars replace); mode=replace swaps the whole attrs tree. Can also rename via name, and promote or demote the preset as the module's DEFAULT via set_default. Snapshots first, verifies by re-read, restores the prior item verbatim on failure. Use design-system tokens in attrs, not hardcoded values.

Current connected tool contract

Change the operator safety switches. These belong to the SITE OWNER: only call this when the owner has explicitly asked in this conversation. Never relax a switch to get around a refusal or a finding — report it instead. Switches can only be TIGHTENED from here; loosening one is done by the owner in wp-admin. Turning a safety switch ON is irreversible from here — only a human in wp-admin can turn it back off.

Current connected tool contract

Set the site title, tagline, front page and/or posts page, and core settings (timezone, permalinks, comments, reading, image sizes). front_page takes a PAGE id, or "posts" for the latest-posts front. A draft page is refused as the front page unless publish:true is passed (visitors would get a 404 at "/"). Verifies by re-read, flushes the caches it can reach, touch-saves the new front page so hosts that purge on save purge "/", and returns the previous values for undo. An option change fires no save hook, so the result tells you to check "/" as a logged-out visitor.

Current connected tool contract

Replace the markup in one slot (header, body or footer) of an existing Theme Builder template, in place. The prior content is preserved first, and the Theme Builder caches are cleared. One header or footer layout is often SHARED by several templates (the global header): the result lists every template it reaches (shared_with), and a layout shared by more than one enabled template is refused until you pass confirm_shared with that count — tell the owner which pages change first.

Current connected tool contract

Change Divi Theme Options: values = { option_id: value } (checkboxes true/false, selects one of the listed values, uploads a URL). All-or-nothing — every value is checked before any is saved. Secrets, Custom CSS and the Integration code fields are refused here (code has checknaut_set_site_code). Every change returns a change_id; undo=<change_id> puts the previous values back, refused if they were changed again since unless force=true.

Current connected tool contract

Change an existing Theme Builder template in place: where it applies (use_on / exclude_from — same condition strings as checknaut_create_theme_template), whether it is on (enabled), its title, and which of its header/body/footer slots are switched on (slots_enabled). The attached layouts stay as they are; use checknaut_update_theme_layout for their markup. Pass expected_hash = template_hash from checknaut_list_theme_templates so a concurrent Theme Builder save is not overwritten. Verified by re-read.

Current connected tool contract

Change existing Divi global variables (gvid-…): value, label, or archive (true hides it from the picker, false restores it). items = [ { id, value?, label?, archive? } ]. Numbers, strings, fonts, links, images and gradients (a settings object); colours go through checknaut_set_colors. A changed value changes every page that uses it, so this needs "Protect the design system" off, snapshots first, verifies by re-read, restores the store if it did not take, and clears the CSS cache. Returns each variable's previous values. DRY RUN unless apply=true.

Current connected tool contract

Sideload an image into the media library from a public URL or base64 bytes, and get back the attachment URL to reference in divi/image modules. Use this instead of hotlinking external URLs — those die when the source does. Images only (jpeg/png/gif/webp/avif, 15MB); an SVG source is rasterized to PNG at width px (default 1024) — never stored raw. Returned URLs are pinned to the scheme this request arrived on. Private/internal URLs are refused; send base64 data for anything not publicly reachable.

Current connected tool contract

User accounts: action=list (with the roles an assistant may assign); action=create adds an account with a non-administrator role — WordPress emails them a link to set their own password, and no password is ever returned; action=update changes name, bio or role of a NON-administrator (never the email: that is how a password is reset). Administrator-grade roles (and roles that may post unfiltered HTML, like Editor) and accounts are never created, edited or promoted from here. create/update are locked until the owner unlocks "user accounts" in wp-admin.

Current connected tool contract

Dry run. Checks markup and reports token-discipline warnings without writing anything. Also checks value SHAPES against the module schema: an object on a string field (e.g. contact-field fieldItem.innerContent) is a hard error (checknaut_bad_attr_type) because it returns HTTP 500 on the front end; a bare string on a link-carrying innerContent (blurb title, button, image) is coerced to {"text":…} on write and warned about here. Pass page_id instead of content to run the same checks over a page already on the site — that is how an existing page gets checked for unbalanced code-module HTML, and how you get the full warning list for that page.

Current connected tool contract

Add a Divi Post Filter (divi/post-filter with divi/post-filter-item controls) that filters ONE loop on the same page, or retarget an existing Post Filter. The filter points at the loop through its loopId (module.advanced.targetLoop) — checknaut_set_loop returns it, or pass the looped module's node_id. Each control is validated against that loop: select/radio/checkbox list a taxonomy of the loop's post type, "author", "role" (user loops) or custom_field:<meta_key>; text searches the loop's own search targets; sort controls (orderby/order/multiple-order) and submit/reset buttons need no option; WooCommerce controls need WooCommerce and a product loop. apply_mode "submit" (Divi's default) needs a submit button, so one is added when missing — without it the filter never applies. The filter is placed before the looped module unless node_id/position say otherwise, and never inside it (it would repeat per result). Validated from PHP; the page write is revisioned and undoable. Dry by default.

Current connected tool contract

Add Divi Pagination (divi/post-nav) that pages ONE loop on the same page, or retarget an existing one — module.advanced.targetLoop set to the loop's loopId, so page 2 is ?<loopId>=2. Placed after the looped module unless node_id/position say otherwise, never inside it. Refuses a second pager for the same loop unless allow_second=true (e.g. above and below), and a loop that is switched off. Notes the page size Divi will use (postPerPage, default 10) and how an offset is counted. Validated from PHP; the page write is revisioned and undoable. Dry by default.