How Grok Build handles this
You manage a set of WordPress sites from a terminal and Grok Build is the agent in front of you. After a shared change, you ask it to clear all the caches and warm them again. It calls purge_cache and start_preloader with site set to "all" on the xspeedhub server, and the Hub works through the sites one after another with a one-second pause. The fan-out tools are purge_cache, toggle_cache, update_settings, start_preloader, stop_preloader, optimize_site and run_benchmark.
Each call returns one result per site, with ok and either data or an error, so Grok Build can say that eleven sites purged and one failed, and which one. That counts as a partial success and should be reported as such. Tools outside the seven take one site, so a request such as "check the health of every site" turns into a series of calls that the agent makes itself, within the Hub's rate limit of 600 calls per minute.
Grok Build starts in Ask mode, which prompts for anything a rule has not already allowed, so a fleet write prompts until you say otherwise. Always-approve and Auto remove the prompt, Auto by letting a classifier approve what it judges safe. A rule such as MCPTool(xspeedhub__get_*) allows the reads, and deny rules still apply under Always-approve, so add one for any fan-out tool that must never run unprompted. For a purge, toggle, settings change or preloader call across every site, the Hub tells the agent to confirm once, with the site count. That is guidance, not a lock, and it does not name optimize_site. What the Hub does enforce is the scope the sign-in carries. Grok Build signs in with OAuth and gets the scopes it asks for, and the Hub's Read-only everywhere switch applies only to the connection token, so for read-only access sign in as a Viewer member of the workspace.
Set up Grok Build once
Already connected? Skip to the prompts. Alternatives and troubleshooting are on the Grok Build guide.
1Put your sites in xSpeed Hub
Sign in at app.xspeedcache.com with Google or email; the Hub is free and has no site cap. Then connect each WordPress site from its own dashboard: click Connect Hub in the xSpeed Cache top bar, then Connect via xSpeed Hub. Each site needs the free xSpeed Cache plugin.
2Add xSpeed Hub with grok mcp add
Run this once. Add --scope project to write the server to .grok/config.toml in the current directory instead of your user config, which is only sensible if the repo never holds a token. Grok Build handles the OAuth flow for a remote server on its own.
grok mcp add --transport http xspeedhub https://app.xspeedcache.com/xspeed/mcp
3Sign in from the TUI
Start grok and open /mcps. Select xspeedhub and press i to authenticate, or just use a Hub tool and let the browser flow start on first use. Sign in to xSpeed Hub and approve access. There is no token to paste; Grok Build stores the credentials it receives in ~/.grok/mcp_credentials.json. If the connection fails, run grok mcp doctor xspeedhub.
/mcps
Full Grok Build setup, sign-in options and FAQ
Before you send a prompt that changes something
Reads change nothing on your sites, though contact_support emails xSpeed support. Writes run once your connection allows them, so your client's approval prompt and a read-only connection (the token's Read-only everywhere switch, or a Viewer sign-in) are the gates that matter. Grok Build starts in Ask mode, which prompts for anything a rule has not already allowed, so a Hub write tool prompts until you say otherwise. You can allow the reads with a rule such as MCPTool(xspeedhub__get_*) in the permission section of your config, and leave the writes unmatched. Evaluation runs deny, then ask, then allow. Two other modes remove the prompt: Always-approve, from /always-approve, Ctrl+O or --always-approve, approves tool calls unless a deny rule or a hook stops them, and Auto lets a classifier approve tools it judges safe. If a Hub write must never run unprompted, add a deny rule. The Hub itself has no confirmation step.
What do I ask?
Three prompts written for Grok Build. More for this job are below.
Use xSpeed Hub to purge all sites, then start the preloader on all of them and list anything that failed.
With xSpeed Hub, run the benchmark on every site and tell me which one has the slowest cached response.
Ask xSpeed Hub which workspaces this connection can reach, and list them with their site counts.
What happens, step by step
If you run many WordPress sites, repeating one action on each is the slow part. Through xSpeed Hub, seven tools accept every site in a workspace, or a list of handles, in a single call. The Hub runs the sites one after another and returns a result for each, so a site that fails is named instead of hidden. Everything else in the Hub works on one site per call.
01
See what you can reach
list_sites returns each site's handle, URL, status and scopes. When you have more than one workspace, list_workspaces returns each one's handle, id, your role, its site count, which one is the default, and whether this connection can reach it.
02
Choose the scope of the call
The agent passes site: "all" for every site in one workspace, or an array of handles for exactly those sites. For a workspace other than the default it also passes the workspace argument. Omit workspace and the call acts on the default workspace.
03
Confirm once
Before a purge, toggle, settings change or preloader call that touches every site, the Hub tells the agent to say "this will touch all N sites" and wait for you, then make one call. That instruction does not name optimize_site, so for it your client's prompt is the gate. It is guidance to the agent, not a lock. It is one tool call, so one approval in your client covers every site in it.
04
Run it as one call
The Hub runs the sites one after another with a one-second pause between live calls, so a fleet purge is not a burst of traffic at your servers. Revoked sites are skipped from "all". Each site's action lands in the activity log as its own row.
05
Read the result per site
The reply is a summary of targets, succeeded and failed, plus one row per site with ok and either its data or its error. Some sites failing is a partial success. Only a run where every site failed comes back as an error.
06
Follow up on the failures
The agent reports which sites failed and why, then retries just those handles with an array. Tools that read one site, such as get_cache_status and get_health, do not fan out, so a fleet-wide check means one call per site.
Reference
| Fan-out tools | purge_cache, toggle_cache, update_settings, start_preloader, stop_preloader, optimize_site, run_benchmark |
|---|---|
| Selector | site: "all", or an array of handles |
| What all covers | Every site this connection can see in one workspace, minus revoked ones |
| Pacing | One after another, with a 1 second pause between live calls |
| Result | summary (targets, succeeded, failed) and a row per site: ok, then data or error |
| Partial failure | Reported per site; the call counts as an error only when every site failed |
| Workspace argument | Optional. Omit it for the default workspace; name one by its handle or id from list_workspaces |
| Reach | Fixed when you approve the connection; list_workspaces shows reachable: false for the rest |
| Not fan-out | get_health, get_cache_status and every other tool take one site per call |
| Slow tools | optimize_site takes up to 2 minutes per site; a target_score run is capped at 12 rounds per call |
| Read-only | The connection token with Read-only everywhere on, or a Viewer sign-in, refuses every fan-out write; run_benchmark works. An OAuth sign-in gets the scopes the client asks for |
| Hub daily pass | Re-verifies sites, snapshots cache status and hit ratio, reads stored reports, alerts by Slack webhook or email |
Rules worth keeping
- Confirm once, then call once. The Hub has no confirmation step of its own, so your client's approval prompt and a read-only connection (the connection token with Read-only everywhere on, or a Viewer sign-in) are the gates that matter. The Hub's "this will touch all N sites" is an instruction to the agent for purge, toggle, settings and preloader calls, and it does not name optimize_site.
- "all" is one workspace, never every workspace. To act in another workspace, name it. A write to a non-default workspace must name it, and an array of handles is looked up only in the workspace the call names.
- Read every result per site. Treat some sites failing as a partial result, and never accept a blanket "done" from the agent.
- Try a behaviour change on one site before you send it to the fleet. toggle_cache and update_settings on every site are one call, and each site checks values against its own settings, so a Pro setting can fail on a Free site.
- optimize_site on many sites is slow, because each site can take up to two minutes inside one call. Use dry_run first, or name a short list of handles.
- The Hub has no scheduler for agent prompts. Its own daily pass and alerts run without an agent, and an agent can only act when you send a prompt or your AI client runs one on a timer.
Good to know with Grok Build
Which workspaces the agent can reach is decided when you sign in, not by anything you type later. If you added a client workspace after you connected Grok Build, the agent will not see it, and list_workspaces shows it as not reachable. No tool call can widen that. Sign in again and tick the workspace at the consent step. Also, all covers one workspace, so a fleet run for a second client needs its own request that names the workspace.
More prompts for this job
They work in any client connected to xSpeed Hub.
Use xSpeed Hub to list every site I can reach, and every workspace, and say which workspace you act in by default.
With xSpeed Hub, purge the cache on every site in my workspace and tell me which ones failed.
Use xSpeed Hub to run a benchmark on all my sites and rank them by cached response time.
Use xSpeed Hub to start the preloader on blog, shop and docs only.
With xSpeed Hub, turn page caching on for every site where it is off. Check each site first.
Use xSpeed Hub to stop the preloader everywhere. The servers are busy.
Ask xSpeed Hub to preview a safe optimize_site pass on every site with dry_run and summarize what it would change.
Use xSpeed Hub to purge every site in the client-acme workspace, not my default one.
Frequently asked questions
Keep going
Manage every site at once with other agents
More with Grok Build
Documentation
- Managing your fleet with xSpeed Hub
- Teams, roles and workspaces in xSpeed Hub
- Scoped AI connections in xSpeed Hub
- Connecting to xSpeed Hub
- How to write prompts for xSpeed Hub
- Grok Build + xSpeed
- Every AI agent that works with xSpeed
From the blog