Agent Abilities for MCP – MCP Server with Permission Controls and Audit Log

WordPress MCP server for AI agents, governed and off by default

Agent Abilities for MCP is a WordPress plugin that turns your site into a governed Model Context Protocol (MCP) server. It exposes 179 curated WordPress “abilities” (tools) to AI agents like ChatGPT, Claude, Cursor, and VS Code over MCP, so your AI client can read and, when you allow it, write to your site as a real, least-privilege WordPress user you choose. It is built on the WordPress 6.9 Abilities API and the official MCP Adapter, so there is no custom server or transport to trust.

Nothing is exposed until you turn it on. Permission controls are the point: the agent only ever acts as the WordPress user you bind it to, never an admin-equivalent key, and every call is re-checked against that user’s capabilities and written to the audit log before it runs, denied attempts included. You add reach as you build trust, not all at once. See External Services below for exactly what the plugin can reach on its own.

Quick links: Website | Documentation | Getting started | Supported clients | Prompt Library | GitHub

What is a WordPress MCP server?

A WordPress MCP server lets an AI assistant work on your site directly, instead of copying text between a chat window and wp-admin. MCP (Model Context Protocol) is an open standard that tells an AI client which tools a service offers and how to call them, so Claude, ChatGPT, or any other MCP client can list your posts, draft one, or update a WooCommerce order.

An MCP server hands a language model the ability to change your live site, so how far it can reach and whether you can audit it afterwards both matter – exactly what Agent Abilities for MCP governs, off by default and logged.

Prefer to watch first? Here is a short walkthrough of the plugin in action.

🛡️ Permission controls and an audit log on every call

• Least privilege by design. The AI agent connects as a real, scoped WordPress user through OAuth or an Application Password, never an admin-equivalent key.
• Off by default. Nothing is exposed until you enable it, and updates never silently widen access.
• Read-only mode. One switch stops every write ability from registering at all, whatever is ticked, abilities from other plugins included, and your selections are untouched when you switch it back off.
• Two-layer capability gating. A connection only sees the tools its user can call, and every call re-checks that capability before it runs.
• Per-role and per-connection allowlist. Narrow what one role, or one connection, can reach on top of the global list. The lists only narrow: an ability has to clear the global list, the role’s list, and that connection’s list before an agent can call it. A site that never opens the screen sees no change.
• Honest audit log. Every call is recorded, denied attempts included, along with the user or connection that made the call, the argument keys, and a short identifier-only note of what it touched. Free-text argument content is never stored, and the log lives in your own database.
• Bounded by construction. No arbitrary option or meta access, no code execution. Uploads are validated by their real bytes against an image allow-list, and a URL upload refuses private, loopback, or link-local targets with no redirects followed. A new user gets the default role, never admin, and the last administrator can never be removed. Anything destructive is off by default, capability-gated, and routed to Trash where supported.
• Optional safety controls. Switch on a per-minute rate limit, an IP allowlist, a force-to-draft mode, or a title-length cap. All four stay off until you set them.
• No content leaves your site. The plugin contacts no AI provider and has no telemetry; see External Services below for the two outbound requests it can make on its own.
• Two ways to connect. Approve an agent over OAuth (no secret in a config file) or point a dedicated low-privilege user at an Application Password; a guided screen builds the config for you. An Application Password is a whole-site credential scoped only by that user’s role, so this plugin’s own limits (allowlist, high-risk floor, audit log) apply only to calls through its MCP endpoint. OAuth has no such limit, since a token this plugin issues only ever authenticates this one endpoint.

🤖 Built on the WordPress Abilities API and MCP Adapter

WordPress 6.9 ships the Abilities API and the official MCP Adapter (wordpress/mcp-adapter). Agent Abilities for MCP registers a curated, governed set of abilities on top of them, rather than inventing its own protocol or server, so there’s no bespoke transport to trust.

📦 179 governed abilities

The plugin ships 179 governed abilities: 85 across WordPress core and 94 from auto-detected integrations, every one off until you enable it, scoped, capability-gated, and logged. It can also bridge abilities from your other plugins (see below).

WordPress core (85 abilities). Reads plus guarded writes across your whole site:

• 📝 Posts & Pages: list, read, create, update, and delete, with destructive actions off by default and deletes routed to Trash.
• 🏷️ Terms & Taxonomies: manage categories, tags, and custom taxonomy terms.
• 💬 Comments: read and moderate the comment queue.
• 🖼️ Media: list and read the library, and add images from inline data or an HTTPS URL, validated by their real bytes against an allow-list.
• 🗂️ Post Meta: read and write only administrator-allowlisted meta keys; protected, underscore-prefixed, and authentication keys can never be allowlisted.
• 👥 Users: read and manage users within capability limits; a new user gets the default role, never admin, and the last administrator can’t be removed.
• 🧭 Site structure: work with menus and the structural pieces that hold the site together.
• 🕓 Revision history: read the revision trail for content.
• 🧱 Blocks & Templates: work with reusable blocks, themes, and templates.
• ⚙️ Limited settings & site health: a tightly scoped set of settings, plus read-only site health and plugin status.
• 🔍 Site-wide search: one search that spans every post type at once.

Integrations (94 abilities). Detected automatically per active plugin, off until you turn them on, capability-gated, logged, and only present while that plugin is active:

• 🛒 WooCommerce MCP (52 abilities): read and write products, orders, and customers to help run your store. These touch personal data (names, emails, addresses), so they sit behind a clear admin notice and stay off until enabled.
• 🧩 Advanced Custom Fields (7 abilities): read and write ACF field data; like WooCommerce, these can reach personal data and sit behind the same notice.
• 📈 Rank Math SEO (5 abilities): read and manage Rank Math SEO data.
• 📈 Yoast SEO (3 abilities): read and manage Yoast SEO data.
• 📈 All in One SEO (3 abilities): read and manage AIOSEO data.
• 📅 The Events Calendar (13 abilities): read and manage events, venues, and organizers.
• 🎫 Event Tickets (3 abilities): read tickets and attendees for an event. No ticket-purchase write is exposed.
• 📈 Slim SEO (2 abilities): read and manage Slim SEO data.
• 🎨 Avada / Fusion Builder (2 abilities): read a page’s raw Fusion Builder markup and replace text without disturbing the shortcode layout.
• 📍 GeoDirectory (4 abilities, off by default): read and manage business and place listings; stays off even when active, turn it on in the Integrations tab.

More integrations are planned.

🔗 Abilities from your other plugins (new in 1.1.0)

WordPress 6.9 lets any plugin register its own abilities, not just this one, and Agent Abilities for MCP can bring those in too. Abilities from other active plugins appear on a dedicated Other plugins screen, grouped by plugin, every one off until you enable it – then it becomes a governed MCP tool under the same rules as the built-in catalog: scoped, capability-checked, rate-limited, and logged with identifiers only.

One limit worth knowing: since it’s the other plugin’s code doing the work, WordPress can only check a bridged ability’s answer against a description if that plugin publishes one. The governance above (permissions, scoping, rate limiting, the audit log) applies in full either way.

So you are not limited to the integrations shipped here: any plugin that speaks the Abilities API can be handed to your agent, with a whole plugin’s set toggled at once. The bundled WP-CLI command wp aafm catalog export prints a site’s discoverable abilities as JSON.

Page builder pages: refused, not silently broken

Elementor, Divi, Beaver Builder, and Avada keep their layout outside the normal post content, so a write that reports success can leave the front end exactly as it was. Since 1.7.4 the plugin checks before it writes and refuses the call with an error naming the builder that owns the page. This is a guard, not an integration with any of them, and OptimizePress is not covered yet.

Connect Claude to WordPress

Install the plugin, switch on the abilities you want Claude to have, add your site’s MCP endpoint as a custom connector in Claude, and approve the OAuth sign-in once. No API key or config file. The claude.ai app, Claude Desktop, and Claude Code share this flow, and Claude only ever acts as the WordPress user who approved it.

Connect ChatGPT to WordPress

Turn on Developer Mode in ChatGPT (Settings, then Connectors, then Advanced), add your site’s MCP endpoint as a custom connector, and approve it once over OAuth – a beta feature on ChatGPT’s paid plans, not the plugin’s limit. ChatGPT then reaches only the abilities you switched on, acting as the WordPress user that approved the connection.

🔌 Supported AI platforms

Your AI client connects in over MCP; the plugin never calls out to an AI provider, so there’s no model API key to add. Anthropic Claude, OpenAI ChatGPT, Manus, and Google Gemini (via its CLI) all work today; the hosted Gemini app does not yet.

🧩 Compatible clients and frameworks

Connect any MCP client that can reach your endpoint: over OAuth (paste the endpoint URL, approve once) or with an Application Password (point a dedicated low-privilege user at it).

• Hosted apps: ChatGPT, Claude, and Manus, by URL over OAuth.
• Editors and IDEs: Claude Code, Cursor, VS Code, and Windsurf.
• Command line: Gemini CLI.
• Frameworks: any MCP-compatible framework can call your enabled abilities as tools.
• Bridged clients: the open-source mcp-remote or @automattic/mcp-wordpress-remote bridge runs on your machine for clients that cannot connect directly.

⚖️ Disclaimer

Model Context Protocol (MCP) is an open specification originally developed by Anthropic. Claude, ChatGPT, Cursor, VS Code, Gemini, and other product names are trademarks of their respective owners. Agent Abilities for MCP is a third-party plugin and is not affiliated with, endorsed by, or sponsored by any of them.

External Services

This plugin contacts no AI provider and includes no analytics or telemetry.

It makes two kinds of outbound HTTP request on its own: the Connection tab’s reachability check (a same-origin call confirming your MCP endpoint answers), and, only when you enable the off-by-default upload-media-from-url ability, a fetch of the exact HTTPS URL your AI client supplies so that file can be added to your media library. That fetch is SSRF-hardened against private, reserved, and redirect-based targets, and carries none of your content, credentials, or site data – it only reads what’s already public at that URL.

Connecting a client is done by the client, not this plugin. Some reach your endpoint directly; others use a bridge such as the open-source mcp-remote or @automattic/mcp-wordpress-remote, run on your own machine and not bundled with this plugin:

• mcp-remote: https://www.npmjs.com/package/mcp-remote
• @automattic/mcp-wordpress-remote: https://www.npmjs.com/package/@automattic/mcp-wordpress-remote