Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add yojahny55/claude-wp-builder/plugin install claude-wp-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/yojahny55/claude-wp-builder/wp-finalize)<a href="https://agentmods.dev/commands/yojahny55/claude-wp-builder/wp-finalize"><img src="https://agentmods.dev/badge/commands/yojahny55/claude-wp-builder/wp-finalize.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.05989 |
| Opus 5 | $0.00010 | $0.02995 |
| Sonnet 5 | $0.00004 | $0.01198 |
| Haiku 4.5 | $0.00002 | $0.00599 |
Grade A, and why
wp-finalize scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "$SITE/<a-cpt-archive-slug>/" | grep -o 'rel="canonical"' | wc -l # must be 1 How it starts
The opening of the file, as written. The whole thing — 458 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WP Finalize — Pre-Delivery Checklist
Run a comprehensive validation checklist on the theme before delivery. This command does NOT fix issues — it reports them so you can address them.
Step 1: Read Project Context
Read .claude/CLAUDE.md to extract:
- Function prefix (e.g.,
kairo_) - Theme slug
- Languages (all configured languages)
- Theme directory path
If .claude/CLAUDE.md does not exist, tell the user to run /wp-init first and stop.
Step 2: Determine Theme Directory
Use the theme directory from .claude/CLAUDE.md. Verify it exists. If not, search for it under wp-content/themes/.
Step 3: Run All Validation Checks
Run each check category using Grep and Glob. Track pass/fail status and collect issues.
Check 1: Escaping Validation
Search all .php files in the theme directory for unescaped output:
-
Find
echostatements that are NOT followed byesc_html,esc_url,esc_attr,wp_kses_post,wp_kses, orwp_kses_allowed_html:- Search pattern:
echo\s+\$(echo followed directly by a variable) - Search pattern:
echo\s+[^e][^s][^c]and exclude safe functions - Exclude:
echo esc_html,echo esc_url,echo esc_attr,echo wp_kses
- Search pattern:
-
Allowlist: These are safe and should NOT be flagged:
echo get_template_part(no output)echo wp_nav_menu(self-escaping)echo get_search_form(self-escaping)the_content(),the_title(),the_excerpt()(WordPress auto-escapes)
PASS if no unescaped echo statements found. FAIL with file:line list if any found.
Check 2: Bilingual Coverage
Branch on the project's i18n strategy (read it from .claude/CLAUDE.md):
- Field files check —
suffixonly. Undersuffix, globfields/*.php, and for each file search for field names ending in_en. Verify corresponding_es(or other language) variants exist. Underpolylang, skip this item: field files carry ONE set of fields with no_<lang>duplicates (one post per language carries its own values), so there are no_esvariants to verify — running it would fail every correct Polylang project.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +10 lines c65499b4c677
- 2d ago Changed · +43 lines 64046e7f1f2c
- 6d ago First seen · 405 lines · 19 tokens per session scan A 0e39d785143d
wp-finalize is a command published in the GitHub repository yojahny55/claude-wp-builder (6 stars, last pushed yesterday), licensed MIT. It adds 19 tokens to every session and 5,989 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
anti-slop-designer
Use when a UI looks machine-made rather than decided. Violet gradients, glassmorphism everywhere, identical cards in a grid, untouched shadcn or Material defaults, emoji bullets, or copy stuffed with seamless and unlock.
design-enforce
Use when code has drifted off the design system. Raw hex values and pixel numbers written where a token already exists, one-off components, library defaults left untouched. Finds every bypass and fixes it.
design-grill
Use when a design keeps getting reinvented every session. Interviews you until you share one understanding, then writes the vocabulary and the binding decisions into the repo so they survive the next context window.
design-triage
Use when a dwic audit report is full of findings and there is no plan. Ranks them into an order someone can work through, then works through it.
audit
Run a full UI/UX design audit on the current project. Scores 12 dimensions and produces a markdown report with prioritized findings.
debug-helper
Use when something is broken and you need it diagnosed. A build failure, a runtime crash, a blank page, an unreadable error message, or behaviour that is simply wrong. Gives one exact fix, not a list of things to try.