Structure Viewer docs

Getting started

Structure Viewer works entirely inside the WordPress admin. You don't need FTP, cPanel or SSH access, and you don't need to install any other plugin.

1. 1In WordPress, go to Plugins → Add New and search for Structure Viewer.
2. 2Click Install Now, then Activate.
3. 3Open Tools → Structure Viewer. You can also use the AI Context link on the Plugins screen.

To install manually, upload the structure-viewer folder to /wp-content/plugins/ and activate it from the Plugins screen.

• Requires WordPress 5.8 or newer (tested up to 7.1) and PHP 7.4 or newer.
• Requires the manage_options capability, which only administrators have by default.
• Optional: WP-CLI for the command-line tools and the local MCP server.

The interface

The left sidebar links to every screen. On smaller windows it turns into a scrollable bar across the top.

Explorer

The Explorer shows the complete file structure of everything installed on your site.

• Choose what to browse — switch between Plugins, Themes and MU (must-use plugins, shown only when your site has them), then pick one item or “All” from the picker.
• Lazy loading — folders are scanned only when you open them, so even very large plugins load instantly. Use Expand and Collapse for the whole tree.
• Live search — type in Search files… to filter the tree and jump between matches. In “All” mode it filters items by name.
• File type filters — the chips under the toolbar (All, PHP, JS, CSS, images and so on) narrow the tree to one type.
• Item panel — the right column shows version, description, file count, total size, file types, an estimated AI token count and a file-type breakdown.
• Use with AI — shortcuts open the current item in AI Context, Code Search, Hooks Map (Pro) or Integrity Check (Pro).
• Copy and Export — copy the structure to the clipboard or export it as TXT, JSON, XML or PDF.

Viewing & downloading files

Click any file in the Explorer, a Code Search result or a Hooks Map location to open it in the file viewer.

• Syntax highlighting with line numbers for PHP, JavaScript, CSS, JSON, HTML and more. When you open a file from a search result, it jumps to that line.
• Copy for AI copies the file wrapped in a code block with its path, ready to paste into a chat.
• Add to Context Pack (the + button) adds the file to your next AI Context Pack.
• Download saves the file with the correct name and type. Copy copies the raw content.
• Fullscreen for long files — press Esc to close.

The header shows size, last modified date and line count. Image files open in a new tab.

Code Search

New in 2.3. Search inside the contents of every file, not just file names, in one plugin or theme or across all of them at once.

1. 1Choose Plugins, Themes or Must-Use, then pick one item or “All plugins/themes”.
2. 2Type your query and press Search.
3. 3Click any line to open the file at that line.

Quick searches are one-click presets for common audits: add_action, add_filter, do_action / apply_filters, AJAX handlers, REST routes, shortcodes, SQL queries, remote requests, risky functions (such as eval() and base64_decode()) and TODO/FIXME comments.

AI Context Pack

New in 2.3. A context pack is one document that gives an AI model the full picture of a plugin or theme: project facts, a compact file tree and the source of the files that matter, with secrets redacted. Paste it into ChatGPT, Claude, Gemini, Cursor or Copilot, or attach the downloaded file.

1. 1Choose a plugin or theme. The version, file count and size appear next to the picker.
2. 2Select files. Smart pick pre-selects the important files and skips vendor libraries, minified assets, lock files, binaries, data files and very large files — each skipped file shows the reason. Use the filter box, the extension chips, All visible or None to change the selection, and the eye icon to preview a file. Each file shows its estimated tokens.
3. 3Tell the AI what to do (optional). Pick a template — Explain this codebase, Code review & bugs, Security audit, Write documentation, Add a feature, Write tests, Compatibility upgrade — or write your own instructions. They go at the top of the pack.
4. 4Choose the output: Markdown, XML or plain text, and decide whether to include the file tree, project facts and WordPress & PHP versions. Pro adds compression and the Hooks Map.
5. 5Fit your model. Pick a context window: 32K, 128K (GPT-4o / Gemini Flash), 200K (Claude), 400K (GPT-5) or 1M (Gemini Pro / Claude 1M). The meter turns red when your selection is over budget, and files beyond the budget are skipped.
6. 6Click Generate Context Pack, then Copy to clipboard or Download.

Which format? Markdown works everywhere. XML (<documents><document>) is the layout Anthropic recommends for long documents with Claude. Plain text suits tools that don't render Markdown. Set your default in Settings.

AI Agents: the built-in MCP server

New in 2.3. Structure Viewer includes its own Model Context Protocol (MCP) server. MCP clients such as Claude Code, Claude Desktop, Cursor, VS Code (GitHub Copilot agent mode) and Windsurf can connect to your site and use Structure Viewer's tools on their own: listing items, reading files, searching code and building context packs.

• No extra plugin — you don't need the MCP Adapter or anything else, and it works on any WordPress from 5.8.
• Standards-based — MCP Streamable HTTP with JSON-RPC 2.0 (protocol versions 2024-11-05 to 2025-11-25), session IDs, Origin validation and MCP prompts.
• Endpoint: https://yoursite.com/wp-json/structure-viewer/v1/mcp — the AI Agents screen shows your exact URL, including sites without pretty permalinks.
• On WordPress 6.9+ the same tools are also registered with the core Abilities API.

1. 1Open Structure Viewer → AI Agents and make sure Agent access is on.
2. 2Click Create token. Copy it now, because it's shown only once — it's inserted into the configs on the screen automatically.
3. 3Choose your client tab, copy the configuration and follow the hint shown under the tabs.
4. 4Click Run self-test to confirm the server answers (initialize → tools/list → tools/call).

Claude Code — run once in your terminal, then start Claude Code and type /mcp to confirm the server is connected:

claude mcp add --transport http sv-yoursite \
  "https://yoursite.com/wp-json/structure-viewer/v1/mcp" \
  --header "Authorization: Bearer sv_YOUR_TOKEN"

Claude Desktop → Settings → Developer → Edit Config (claude_desktop_config.json). Paste, save and restart Claude. This uses the free mcp-remote bridge, which needs Node.js on your computer. For sites without HTTPS (local development), add "--allow-http" to args.

{
  "mcpServers": {
    "sv-yoursite": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote@latest",
        "https://yoursite.com/wp-json/structure-viewer/v1/mcp",
        "--header", "Authorization:${SV_AUTH}"
      ],
      "env": { "SV_AUTH": "Bearer sv_YOUR_TOKEN" }
    }
  }
}

Cursor → Settings → MCP → Add new global MCP server (~/.cursor/mcp.json). Paste, save and switch the server on.

{
  "mcpServers": {
    "sv-yoursite": {
      "url": "https://yoursite.com/wp-json/structure-viewer/v1/mcp",
      "headers": { "Authorization": "Bearer sv_YOUR_TOKEN" }
    }
  }
}

VS Code — create .vscode/mcp.json in your workspace (VS Code with GitHub Copilot agent mode), paste, then click Start above the server.

{
  "servers": {
    "sv-yoursite": {
      "type": "http",
      "url": "https://yoursite.com/wp-json/structure-viewer/v1/mcp",
      "headers": { "Authorization": "Bearer sv_YOUR_TOKEN" }
    }
  }
}

Windsurf → Settings → Cascade → MCP servers → View raw config (~/.codeium/windsurf/mcp_config.json). Paste and refresh.

{
  "mcpServers": {
    "sv-yoursite": {
      "serverUrl": "https://yoursite.com/wp-json/structure-viewer/v1/mcp",
      "headers": { "Authorization": "Bearer sv_YOUR_TOKEN" }
    }
  }
}

Local (WP-CLI) — for local sites where the AI client runs on the same computer as WordPress. It talks to WP-CLI over stdio, so no token or network is needed.

{
  "mcpServers": {
    "sv-local": {
      "command": "wp",
      "args": ["--path=/path/to/wordpress", "structure-viewer", "mcp", "--user=admin"]
    }
  }
}

cURL — a quick check from a terminal. It should return the list of Structure Viewer tools.

curl -s -X POST "https://yoursite.com/wp-json/structure-viewer/v1/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer sv_YOUR_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

About connection tokens: each administrator has one personal token. It signs the client in as that user and only works on the Structure Viewer MCP endpoint, never the rest of the REST API. Tokens are stored as a salted hash, so they can't be read back. Creating a new token replaces the old one, and Revoke disables it immediately. The status card shows when it was last used.

Tools & prompts

All tools are read-only, admin-only and redact secrets.

Clients that support MCP prompts also get ready-made prompts such as security audit, code review and documentation.

• “List the active plugins on my WordPress site and summarise what each one does.”
• “Find where WooCommerce applies the woocommerce_cart_item_price filter and explain the arguments.”
• “Search my theme for get_option calls and tell me which options it depends on.”
• “Build a context pack of my custom plugin and review it for security issues.”

MCP troubleshooting

Exporting structures

Select an item in the Explorer and click Export, or Copy for the clipboard.

WP-CLI

Every core feature is available from the command line, which is handy for scripts, CI and AI agents working in a terminal. Type wp help structure-viewer <command> for full options.

# List and export
wp structure-viewer list plugins
wp structure-viewer list themes
wp structure-viewer export plugin akismet --format=json
wp structure-viewer export theme twentytwentyfive --output=structure.txt

# AI Context Pack — type: plugin | theme | mu-plugin, format: md | xml | txt
wp structure-viewer pack plugin woocommerce --ext=php --max-tokens=150000 --output=wc.md
wp structure-viewer pack theme twentytwentyfive --format=xml
wp structure-viewer pack plugin my-plugin --paths=my-plugin.php,includes/class-api.php \
  --task="Review this code for security issues"

# Code Search
wp structure-viewer search plugin akismet "add_action"
wp structure-viewer search plugin all "base64_decode\(" --regex
wp structure-viewer search theme my-theme "Get_Option" --case-sensitive

# Local MCP server (stdio)
wp structure-viewer mcp --user=admin
wp --path=/var/www/html structure-viewer mcp --user=admin

# Pro commands
wp structure-viewer hooks plugin my-plugin --format=markdown --output=hooks.md
wp structure-viewer hooks theme my-theme --format=json
wp structure-viewer integrity                     # core + every plugin
wp structure-viewer integrity core akismet --format=json

Settings

Changes save automatically and a “Settings saved” message confirms them.

Structure Viewer Pro

Pro adds deeper tools for audits, security reviews and upgrades. To upgrade, go to Structure Viewer → Pro Tools (or any Pro screen) and click Upgrade to Pro. After purchase, activate your licence in Settings → Licence or from the activation prompt. The Pro tools unlock immediately.

• Hooks Map — everything a plugin plugs into WordPress, with file and line.
• Integrity Check — find modified, missing and suspicious files.
• Presets & compression — reusable context packs that use 20–40% fewer tokens.
• Comparator & FlatPack — diff versions and extract files from any ZIP.

Hooks Map runs static analysis of every PHP file in a plugin or theme — nothing is executed. Choose an item and Structure Viewer lists the actions and filters hooked (with callback and priority) and fired (do_action / apply_filters, with argument count; dynamic hook names are tagged); AJAX handlers (logged-in or public nopriv), REST routes with methods, shortcodes, post types, taxonomies, blocks, cron events, admin pages and WP-CLI commands; and classes, interfaces, traits and global functions. Filter by text or click a group chip, click any location to open the file at that line, and use Copy for AI, Markdown or JSON to export. Vendor libraries are skipped and results are cached — use Rescan after you change files.

Integrity Check compares WordPress core and every plugin hosted on WordPress.org with the official checksums for the installed version. Click Scan everything, or Check on a single row. Each row shows Clean, Issues found or Not on WordPress.org (premium or custom plugins and development builds can't be verified). Open a row with issues to see suspicious files (executable files that aren't part of the release), modified files, missing files and extra non-executable files. Click View to read a file, or Diff vs original to compare it line by line with the official release. The Dashboard shows the latest result and raises an alert when modified files are found. Requests go to wordpress.org only when you start a scan.

Context Pack presets save your file selection, task, format and options — use the Presets menu on the AI Context screen, optionally limited to one item. Compress strips comments and blank lines, which typically saves 20–40% of tokens, and Include Hooks Map adds the item's hooks summary to the pack.

Comparator gives a colour-coded, line-by-line diff in four modes: ZIP vs ZIP, Installed plugin vs ZIP, Installed theme vs ZIP and File vs file. The summary shows added, removed, modified and unchanged files, and clicking a file expands its diff. Large and minified files are tokenised first, so diffs stay readable.

FlatPack takes any plugin or theme ZIP and extracts only the files you need (PHP, CSS & JS, images or custom extensions) into one flat download. The preview updates as you filter, and smart naming prevents collisions: unique files keep their names, and duplicate names get a folder prefix (for example assets/style.css becomes assets-style.css).

Security & performance

• Read-only — Structure Viewer never edits, uploads or deletes files on your site.
• Administrator-only — every screen, AJAX request, MCP call and CLI command requires manage_options, and every AJAX request is protected by a nonce.
• Path safety — realpath() checks prevent path traversal, so tools can only read inside the selected plugin or theme.
• Secret redaction — covers AWS, Stripe, GitHub, Google, Slack, OpenAI, Anthropic, SendGrid and Mailchimp keys, JWTs, PEM private keys, wp-config salts and credential constants, .env values and passwords in connection strings.
• MCP hardening — per-user hashed tokens scoped to one endpoint, Origin validation against browser-based attacks, and a master switch for agent access.
• Sanitised and escaped — input is sanitised with wp_unslash() and sanitize_text_field(), and all output is escaped.
• No frontend impact — assets load only on Structure Viewer's own screen. Trees load lazily, dashboard stats are cached and searches have time and size limits.
• No external requests except the WordPress.org downloads you start in Integrity Check.
• Clean uninstall — deleting the plugin removes its options, tokens, user meta and cached data.

What's new in 2.3

• New: AI Context Pack with smart file selection, token budgets, task templates and Markdown/XML/text output.
• New: Built-in MCP server with per-user tokens, ready-made configs for Claude Code, Claude Desktop, Cursor, VS Code and Windsurf, a live self-test and the local wp structure-viewer mcp command.
• New: Code Search with regex, filters, context lines, quick searches and click-to-line.
• New: Syntax highlighting, “Copy for AI” and “Add to Context Pack” in the file viewer.
• New: Must-use plugin support and the WP-CLI pack, search and mcp commands.
• New (Pro): Hooks Map, Integrity Check, Context Pack presets and compression.
• Improved: A completely redesigned light interface with sidebar navigation and a new dashboard, broader secret redaction, faster scans and WordPress 7.1 compatibility.