# Tune WordPress cache settings with Kimi Code

> Tuning cache settings with Kimi Code means asking Moonshot AI's terminal agent, in the project you are editing, to read an xSpeed module on a WordPress site and write a change through xSpeed Hub after you approve the call.

Page: https://xspeedcache.com/agent/kimi/cache-settings/
Last updated: October 2026

You are in Kimi Code in a theme repository, and you have just shipped a quote request form on its own page. On the live site the form fails for some visitors with a security check error, and you suspect the cached page carries an expired nonce. You describe that and name the site. Kimi Code calls get_settings for the cache module on shop through the xspeedhub server and reads the excluded URLs, so it can say whether the new page is cached at all before it suggests a fix.

What comes back is a finding tied to your code: the form's path is not on the exclusion list, so visitors can receive a stored copy whose nonce has expired. Kimi Code proposes adding the path and keeping the existing entries, and the Hub tells the agent to briefly confirm intent before update_settings, so it states the new list and waits. After your yes it calls update_settings and reads back the stored list. A wrong key or value refuses the whole call and nothing is stored, Pro-only settings are refused without a licence, and credential fields are refused over the Hub. A copy of the page stored earlier stays until it expires or you purge.

What differs in Kimi Code is that every Hub tool has its own name, mcp__xspeedhub__ followed by the tool, and a call that matches no permission rule asks for approval in the default Always Ask mode. Add allow rules in config.toml for the get_ and list_ tools so reads run without a prompt, and leave update_settings and toggle_cache unmatched so they stop for you. Approve for this session allows the same kind of call until the session ends, which is convenient for reads and loose for writes.

## Set up Kimi Code once

### 1. Put your sites in xSpeed Hub

Sign in at app.xspeedcache.com with Google or email; the Hub is free and has no site cap. Then connect each WordPress site from its own dashboard: click Connect Hub in the xSpeed Cache top bar, then Connect via xSpeed Hub. Each site needs the free xSpeed Cache plugin.

### 2. Add xSpeed Hub to mcp.json

Put this in ~/.kimi-code/mcp.json to use the Hub in every project, or in .kimi-code/mcp.json inside one repository, where it overrides a user entry of the same name. You can also run /mcp-config and let Kimi Code add it. A server added while a session is open joins only the next session.

File: `~/.kimi-code/mcp.json`

```json
{
  "mcpServers": {
    "xspeedhub": {
      "url": "https://app.xspeedcache.com/xspeed/mcp"
    }
  }
}
```

### 3. Sign in with /mcp-config login

Start a new session with kimi, run this and approve access on the xSpeed Hub page that opens in your browser. There is no token to paste. Then run /mcp to check that xspeedhub is connected.

```
/mcp-config login xspeedhub
/mcp
```

Full setup: https://xspeedcache.com/agent/kimi/

### Before you send a prompt that changes something

Reads change nothing on your sites, though contact_support emails xSpeed support. Writes run once your connection allows them, so your client's approval prompt and a read-only connection (the token's Read-only everywhere switch, or a Viewer sign-in) are the gates that matter. In Kimi Code's default Always Ask mode, an MCP call that matches no permission rule asks for approval, and Approve for this session allows the same kind of call until the session ends. Permanent rules go in [[permission.rules]] in config.toml: allow mcp__xspeedhub__get_* and mcp__xspeedhub__list_* to let the reads run, and leave the write tools on the prompt. Ask When Needed mode, from /yolo, approves MCP calls automatically, and Never Ask, from /auto, approves everything. xSpeed Hub has no confirmation step of its own, so in either of those modes a purge or a settings change runs as soon as your connection allows writes. To remove writes altogether, list the read tools in the entry's enabledTools, or use a connection token with Read-only everywhere on.

## Prompts

- I added a quote form at /get-a-quote/ on shop. Use xSpeed Hub to check whether that page is cached.
- With xSpeed Hub, add /get-a-quote/ to the cache exclusions on shop and show me the list before and after.
- Ask xSpeed Hub for the minify settings on shop and tell me whether defer could break my new form script.

## Example session

```
You: I added a quote form at /get-a-quote/ on shop and cached copies break its nonce. Use xSpeed Hub to keep that page out of the cache.
  → get_settings(site: shop, module: cache) [read-only]: excluded URLs: /cart/, /checkout/, /my-account/
Agent: The form page is not excluded, so visitors can get a stored copy with an expired nonce. I would add /get-a-quote/ and keep the other three. Apply it to shop?
You: Yes, add it.
  → update_settings(site: shop, module: cache, values: { excluded_urls: [/cart/, /checkout/, /my-account/, /get-a-quote/] }) [changes site]: stored, 4 excluded URLs
Agent: Added. The copy already stored stays until it expires; I can purge shop's page cache so the form works now.
```

## How it works

1. **List the modules**: list_modules returns every Free and Pro module available on one site, with its settings schema and status. It tells the agent which module slugs exist, such as minify or gzip, and what each setting accepts.
2. **Read the current settings**: get_settings takes a module slug and returns its settings. Credential fields come back masked, so an agent cannot read a stored API token or password back in plain text.
3. **Change them**: update_settings takes the module and a values object of setting keys. The site checks the whole object first. If any key is unknown, any value is outside the schema, or a field is pinned by a constant in wp-config.php, it refuses the write, writes nothing and says which keys and why, sometimes with a "did you mean" hint.
4. **Turn page caching on or off**: Page caching has its own tool, toggle_cache, because it installs or removes the cache drop-in and the WP_CACHE constant. Asking update_settings to set cache_enabled does not work and is refused. If another caching plugin owns the drop-in, the site declines to enable xSpeed and returns blocked: true with the reason.
5. **Check the effect**: The result of a settings write is the stored settings. A module can add a warning when a setting is saved but has no effect on this server, for example Brotli on a server without the module for it, and the agent should pass that on. run_benchmark then times cached against uncached to see whether the change helped.
6. **Apply to many sites only after reading one**: update_settings and toggle_cache accept site: "all" or a list of handles. Each site validates against its own schema and answers in its own row, so a module missing on one site fails that row and the others still apply. Read one site first, then apply.

## Reference

| | |
| --- | --- |
| Discover | list_modules (read): Free and Pro modules, settings schema, status, per site |
| Read settings | get_settings (read): argument module; credential fields masked |
| Change settings | update_settings (write): arguments module and values; validated by the site |
| Bad input | The whole write is refused and nothing is written; the error names the keys and reasons |
| Page cache on or off | toggle_cache (write): argument enabled; cache_enabled in update_settings is refused |
| Blocked by another plugin | toggle_cache returns blocked: true with blocked_reason when another plugin owns the cache drop-in |
| Every site at once | update_settings and toggle_cache accept site: "all" or a list of handles, one result per site |
| Pro modules | A Pro module on a site without an active licence cannot be read or written; the site refuses |
| Credential fields | Refused by default over MCP; set them in the xSpeed dashboard, not through the agent |
| Read-only connection | The connection token with Read-only everywhere on, or a Viewer member's sign-in: update_settings and toggle_cache are refused; list_modules and get_settings still work. An OAuth sign-in gets the scopes the client asks for, read and write by default, clamped to the member's role |
| Confirmation | None on the Hub; the Hub tells the agent to briefly confirm intent for these two, and your client's prompt is the gate |

## Rules

- Read before you write. Ask for list_modules and get_settings first, so the agent changes real keys with valid values instead of guessing.
- update_settings and toggle_cache change how a live site behaves. They run as soon as your connection allows writes. The Hub tells the agent to briefly confirm intent first, which is guidance to the agent, so your client's approval prompt and a read-only connection (the connection token with Read-only everywhere on, or a Viewer sign-in) are the gates. The switch does not limit an OAuth sign-in.
- For site: "all", the Hub tells the agent to confirm once with "this will touch all N sites", then make one call. The result is per site, and some sites failing is a partial result to report, not a blanket success or failure.
- Do not ask an agent to set credentials such as a Cloudflare token or Redis password. The site refuses those writes by default, and they belong in the xSpeed dashboard.
- If a settings result says a value is saved but inactive on this server, relay that. Do not tell the user the feature is enabled.

## Good to know with Kimi Code

Ask When Needed mode, which /yolo selects, approves MCP calls automatically, and Never Ask, from /auto, approves everything, so in either mode a settings write reaches the live site with only the Hub's request to confirm in the way. Stay in Always Ask for this job. A .kimi-code/mcp.json in the repository overrides your user entry of the same name, so check which xspeedhub entry the session loaded. For a look-only session, list only the read tools in enabledTools, or use a connection token with Read-only everywhere on.

## More prompts for this job

They work in any client connected to xSpeed Hub.

- Use xSpeed Hub to list the modules on shop and tell me which ones are off.
- Ask xSpeed Hub for the current minify settings on blog.
- With xSpeed Hub, turn on HTML minification on blog, then benchmark the cache and tell me if it helped.
- Use xSpeed Hub to turn page caching off on staging while I debug, and tell me when it is off.
- Using xSpeed Hub, read the gzip settings on shop first, then enable the same options on every site.
- Use xSpeed Hub to set the page cache lifespan on docs to 30 days, and if the site refuses it, tell me why.

## Frequently asked questions

### Which Kimi Code permission rules suit settings work?

Allow rules for the Hub's read tools, the ones Kimi Code names mcp__xspeedhub__get_ and mcp__xspeedhub__list_ followed by the tool name, and nothing for update_settings or toggle_cache, so those ask in Always Ask mode. Avoid a wildcard rule for the whole server, which would let the write tools run too.

### Why exclude a form page from the page cache?

A cached page is the same for every visitor, including the security token a form embeds. When that token expires, visitors who get the stored copy see the form fail. Excluding the page means it is built fresh for each request, while other pages stay cached.

### How does an agent know which settings exist?

It calls list_modules for the site, which returns every available module with its settings schema and status, then get_settings for the one module it wants to change. The schema says which keys exist and what values each accepts.

### What happens if the agent sends a wrong setting key?

The site refuses the whole update and writes nothing. The error names the keys it rejected and why, such as an unknown key, a value outside the allowed range, or a field fixed by a constant in wp-config.php, and it can suggest the nearest valid key.

### How do I turn page caching on or off with an agent?

Use toggle_cache with enabled set to true or false. It installs or removes the cache drop-in and the WP_CACHE constant. Setting cache_enabled through update_settings does not work. If another caching plugin already owns the drop-in, the site will not enable xSpeed and says why.

### Can one prompt change settings on all of my sites?

Yes. update_settings and toggle_cache accept site: "all", and the Hub runs the sites one after another with a one-second pause and returns a result per site. Each site checks the values against its own schema, so a site that lacks the module fails its own row while the others apply.

### Can the agent change my Cloudflare or Redis credentials?

Not by default. Writing credential fields over MCP is off unless the site owner allows it, and the site refuses the write and names the fields. Set credentials in the xSpeed dashboard. Credential values also come back masked when an agent reads settings.

## Tune cache settings with other agents

[Claude Code](https://xspeedcache.com/agent/claude-code/cache-settings/) · [Claude](https://xspeedcache.com/agent/claude/cache-settings/) · [Claude Cowork](https://xspeedcache.com/agent/claude-cowork/cache-settings/) · [ChatGPT](https://xspeedcache.com/agent/chatgpt/cache-settings/) · [Codex](https://xspeedcache.com/agent/codex/cache-settings/) · [Cursor](https://xspeedcache.com/agent/cursor/cache-settings/) · [GitHub Copilot in VS Code](https://xspeedcache.com/agent/github-copilot/cache-settings/) · [Windsurf](https://xspeedcache.com/agent/windsurf/cache-settings/) · [Gemini CLI](https://xspeedcache.com/agent/gemini-cli/cache-settings/) · [Antigravity](https://xspeedcache.com/agent/antigravity/cache-settings/) · [Zed](https://xspeedcache.com/agent/zed/cache-settings/) · [Kiro](https://xspeedcache.com/agent/kiro/cache-settings/) · [OpenCode](https://xspeedcache.com/agent/opencode/cache-settings/) · [OpenClaw](https://xspeedcache.com/agent/openclaw/cache-settings/) · [Hermes Agent](https://xspeedcache.com/agent/hermes-agent/cache-settings/) · [Grok Build](https://xspeedcache.com/agent/grok-build/cache-settings/) · [ChatGPT dots](https://xspeedcache.com/agent/chatgpt-dots/cache-settings/) · [Grok](https://xspeedcache.com/agent/grok/cache-settings/) · [Grok Bot](https://xspeedcache.com/agent/grok-bot/cache-settings/) · [Muse](https://xspeedcache.com/agent/muse/cache-settings/) · [Manus](https://xspeedcache.com/agent/manus/cache-settings/) · [Paperclip](https://xspeedcache.com/agent/paperclip/cache-settings/) · [NanoClaw](https://xspeedcache.com/agent/nanoclaw/cache-settings/)

## More with Kimi Code

- [Purge the WordPress cache with Kimi Code](https://xspeedcache.com/agent/kimi/purge-cache/)
- [Find out why WordPress pages are not cached with Kimi Code](https://xspeedcache.com/agent/kimi/troubleshoot-cache/)
- [Scan a website for speed problems with Kimi Code](https://xspeedcache.com/agent/kimi/speed-scan/)
- [Run and track PageSpeed tests with Kimi Code](https://xspeedcache.com/agent/kimi/pagespeed-tests/)
- [Raise a WordPress site's PageSpeed score with Kimi Code](https://xspeedcache.com/agent/kimi/optimize-site/)
- [Warm the WordPress cache with Kimi Code](https://xspeedcache.com/agent/kimi/preload-cache/)
- [Set up the Redis object cache with Kimi Code](https://xspeedcache.com/agent/kimi/object-cache/)
- [Manage Cloudflare caching with Kimi Code](https://xspeedcache.com/agent/kimi/cloudflare/)
- [Manage every WordPress site at once with Kimi Code](https://xspeedcache.com/agent/kimi/fleet/)

## Documentation

- How to enable Page Cache: https://xspeedcache.com/docs/page-cache/
- How to minify CSS and JavaScript: https://xspeedcache.com/docs/minify/
- How to add cache rules and bypasses: https://xspeedcache.com/docs/rules-and-bypass/
- Site MCP tool reference: https://xspeedcache.com/docs/mcp-tool-reference/