Agent Abilities for MCP

What is Agent Abilities for MCP?

Agent Abilities for MCP is a free WordPress plugin that turns your site into a governed Model Context Protocol server. It publishes 153 abilities as MCP tools: 83 for WordPress core, plus 70 that only register when the matching plugin is active (WooCommerce, Advanced Custom Fields, Rank Math, Yoast SEO, All in One SEO). Everything starts off. You choose what the agent can reach, and it connects as a real WordPress user you pick rather than an admin key.

It is built on the WordPress 6.9 Abilities API and the official MCP Adapter, so there is no custom server or transport to trust. Transport is streamable HTTP, at an endpoint on your own site:

https://your-site.com/wp-json/agent-abilities-for-mcp/mcp

How to use it

Install and activate the plugin, then open the Agent Abilities for MCP menu in your admin sidebar. Switch on only the abilities you want. On the Connection tab, copy your site's MCP endpoint.

Hosted clients such as ChatGPT, Claude.ai and Manus connect over OAuth 2.1 with PKCE. You paste the endpoint in as a custom connector and approve it once in the browser. You never touch a config file or copy a password.

Clients that run on your own machine (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI) use either the same OAuth flow or an Application Password on a dedicated low-privilege user. Nine clients connect today.

Governance

• Every ability is off until you switch it on, and plugin updates never widen access on their own.
• The agent authenticates as a WordPress user you choose, never an admin-equivalent key.
• A connection only sees the tools its bound user can call, and each ability re-checks that user's capability again before it runs.
• Every call is written to an audit log in your own database, refusals included, recording the principal and the argument keys but never the values.
• Eight WooCommerce abilities move money or grant authority: refunds, order status, order updates, payment gateway settings, coupon creation and updates, and tax rate creation and updates. Enabling one is not enough on its own. They stay locked until you also switch on a separate high-risk control in Settings, and flipping that control is itself logged.
• The plugin contacts no AI provider and makes no outbound requests of its own. Your client connects in. There is no telemetry.
• Optional limits you can set, all off until you set them: a per-minute rate limit, an IP allowlist, force-to-draft mode, a title-length cap, and block-markup validation.

What people use it for

• Drafting and editing posts, pages and media without giving the agent the right to publish.
• Running a WooCommerce store: products, orders, customers.
• Reading and writing ACF field data, or managing SEO metadata in Yoast, Rank Math or All in One SEO.
• Read-only checks on site health, plugin status and revision history.
• Moderating comments and searching across every post type.

FAQ

Does the agent get admin access?

No. It authenticates as whatever WordPress user you bind it to. Point it at the dedicated low-privilege user the plugin can create and it can only do what that user can do. Every ability re-checks the capability before it runs.

Is it safe to connect an AI agent to my WordPress site?

It is safe to the extent that you scope it, and scoping is what the plugin is built around. The agent is one WordPress user. Every ability is off until you enable it, every call re-checks the capability, and every call is logged whether it ran or was refused.

What can the agent actually do?

Only the abilities you enabled, and only within the bound user's capabilities. The catalog covers reads and guarded writes over posts, pages, terms, comments, media, post meta (allowlisted keys only), site structure, revisions, and site-wide search. It cannot change arbitrary options, fetch a remote URL, or run code. Deletes go to Trash where WordPress supports it, and the last administrator can never be removed.

Is it free?

Yes. Free on WordPress.org under the GPL. There is no paid tier, no API key to buy, and no usage limit added by the plugin.

Requirements

WordPress 6.9 or newer, PHP 8.0 or newer. Current version 1.5.0.

Site: https://agentabilitieswp.com/ WordPress.org: https://wordpress.org/plugins/agent-abilities-for-mcp/ GitHub: https://github.com/unaibamir/agent-abilities-for-mcp