WordPress MCP server for ChatGPT and Claude, with limited access and an audit log Agent Abilities for MCP connects ChatGPT, Claude, Cursor and other AI agents to your WordPress site over the Model Context Protocol (MCP), through 179 curated WordPress abilities (tools). The agent acts as a real WordP
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.9 and PHP 7.4.
SourceWordPress plugins · Oct 26, 2026
01 / Source details
Aboutthistool.
WordPress MCP server for ChatGPT and Claude, with limited access and an audit log
Agent Abilities for MCP connects ChatGPT, Claude, Cursor and other AI agents to your WordPress site over the Model Context Protocol (MCP), through 179 curated WordPress abilities (tools). The agent acts as a real WordPress user you choose, never with an admin key, so it can only do what that user’s role allows. Run it on one site or on several, each with its own user, switches and audit log. It is built on the WordPress 6.9 Abilities API and comes with the official MCP Adapter bundled, so there is nothing else to install.
Nothing this plugin serves is exposed until you turn it on. Every call to this plugin’s tools is checked against the chosen user’s permissions and written to the audit log before it runs, denied attempts included. An Editor account can write and publish posts but cannot install plugins or change settings, so you add reach as you build trust. To approve new posts before they go live, switch on Force draft and review what the agent wrote on the Needs review card on the Dashboard. See External Services below for exactly what the plugin can reach on its own.
A WordPress MCP server lets an AI assistant work on your site directly, instead of copying text between a chat window and wp-admin. MCP (Model Context Protocol) is an open standard that tells an AI client which tools a service offers and how to call them, so Claude, ChatGPT, or any other MCP client can list your posts, draft one, or update a WooCommerce order.
Short walkthrough:
What people use it for
Run several sites from one AI chat. Install it on each site and add each one to ChatGPT or Claude as its own connector. Each site keeps its own user, its own switches and its own audit log, so an agency can hand one client’s site to the agent without touching the others.
Let ChatGPT or Claude write and edit posts without admin access. Connect the agent as an Editor, Author or Contributor account. It can only do what that role can do in wp-admin.
Have the agent save drafts for you to approve. Turn on Force draft on create and anything the agent creates or tries to publish is saved as a draft. The Needs review card on the Dashboard lists the drafts and pending posts an agent starts, with Preview, Open in editor, Publish and Discard (Discard moves the post to the Trash). To stop it changing posts that are already live as well, connect it as a Contributor.
Let AI read your site without changing anything. Read-only mode stops every write tool from loading, including write tools you have bridged from your other plugins.
Tell the agent about your site once. Write a few lines in Site Brief on the Settings tab, for example your house style or what to leave alone. This plugin sends it to every agent that connects, when its session starts.
Find out why an agent cannot connect. Connection Doctor on the Connection tab checks the connection from your own server and names the fix, for example a host that strips the Authorization header.
Fix typos and refresh old posts. The agent can search your posts, read one and update it, and every step through this plugin is logged.
Use your other plugins through the agent. Plugins that register WordPress abilities, such as WPForms, show up on the Other plugins screen and stay off until you switch them on.
🛡️ Permission controls and an audit log on every call
Least privilege by design. The AI agent connects as a real, scoped WordPress user through OAuth or an Application Password, never an admin-equivalent key.
Off by default. None of this plugin’s tools are exposed until you enable them, and an update never switches one on. The one thing an update can change is the Adapter’s default server, which other plugins publish to. The FAQ explains it.
Read-only mode. One switch stops every write ability from registering at all, whatever is ticked, abilities bridged from other plugins included, and your selections are untouched when you switch it back off. Tools another plugin publishes straight to the Adapter’s default server are outside it.
Two-layer capability gating. A connection only sees the tools its user can call, and every call re-checks that capability before it runs. One exception: a tool bridged from another plugin whose own check needs an item id is listed to anyone who can edit posts, and that plugin’s check still decides every call.
Per-role and per-connection allowlist. Narrow what one role, or one connection, can reach on top of the global list. The lists only narrow: an ability has to clear the global list, the role’s list, and that connection’s list before an agent can call it. A site that never opens the screen sees no change.
Honest audit log. Every call to this plugin’s tools is recorded, denied attempts included, along with the user or connection that made the call, the argument keys, and a short identifier-only note of what it touched. Free-text argument content is never stored, and the log lives in your own database.
Bounded by construction. No arbitrary option or meta access, no code execution. Uploads are validated by their real bytes against an image allow-list, and a URL upload refuses private, loopback, or link-local targets with no redirects followed. A new user gets the default role, never admin, and the last administrator can never be removed. Anything destructive is off by default, capability-gated, and routed to Trash where supported.
Optional safety controls. Switch on a per-minute rate limit, an IP allowlist, a force-to-draft mode, or a title-length cap. All four stay off until you set them.
No content leaves your site. The plugin contacts no AI provider and has no telemetry; see External Services below for the two outbound requests it can make on its own.
Two ways to connect. Approve an agent over OAuth (no secret in a config file) or point a dedicated low-privilege user at an Application Password; a guided screen builds the config for you. An Application Password is a whole-site credential scoped only by that user’s role, so this plugin’s own limits (allowlist, high-risk floor, audit log) apply only to calls through its MCP endpoint. OAuth has no such limit, since a token this plugin issues only ever authenticates this one endpoint.
🤖 Built on the WordPress Abilities API and MCP Adapter
WordPress 6.9 ships the Abilities API. The official MCP Adapter (wordpress/mcp-adapter) comes bundled with this plugin, so you do not install it separately. If the standalone Adapter plugin is active too, this plugin works with whichever copy loads first, from 0.6.1 through 0.7.x. Agent Abilities for MCP registers a curated, governed set of abilities on top of them rather than inventing its own protocol or server, so there’s no bespoke transport to trust. A Settings switch (Automatic, Always on, Always off) controls the Adapter’s default server, which other plugins can publish tools to. Automatic, the default, starts it only when another plugin publishes tools there, and this plugin’s own tools never appear on it.
📦 179 governed abilities
The plugin ships 179 governed abilities: 85 across WordPress core and 94 from auto-detected integrations , every one off until you enable it, scoped, capability-gated, and logged. It can also bridge abilities from your other plugins (see below).
WordPress core (85 abilities). Reads plus guarded writes across your whole site:
📝 Posts & Pages: list, read, create, update, and delete, with destructive actions off by default and deletes routed to Trash.
🖼️ Media: list and read the library, and add images from inline data or an HTTPS URL, validated by their real bytes against an allow-list.
🗂️ Post Meta: read and write only administrator-allowlisted meta keys; protected, underscore-prefixed, and authentication keys can never be allowlisted.
👥 Users: read and manage users within capability limits; a new user gets the default role, never admin, and the last administrator can’t be removed.
🧭 Site structure: work with menus and the structural pieces that hold the site together.
🕓 Revision history: read the revision trail for content.
🧱 Blocks & Templates: work with reusable blocks, themes, and templates.
⚙️ Limited settings & site health: a tightly scoped set of settings, plus read-only site health and plugin status.
🔍 Site-wide search: one search that spans every post type at once.
Integrations (94 abilities). Detected automatically per active plugin, off until you turn them on, capability-gated, logged, and only present while that plugin is active:
🛒 WooCommerce MCP (52 abilities): read and write products, orders, and customers to help run your store. These touch personal data (names, emails, addresses), so they sit behind a clear admin notice and stay off until enabled.
🧩 Advanced Custom Fields (7 abilities): read and write ACF field data; like WooCommerce, these can reach personal data and sit behind the same notice.
📈 Rank Math SEO (5 abilities): read and manage Rank Math SEO data.
📈 Yoast SEO (3 abilities): read and manage Yoast SEO data.
📈 All in One SEO (3 abilities): read and manage AIOSEO data.
📅 The Events Calendar (13 abilities): read and manage events, venues, and organizers.
🎫 Event Tickets (3 abilities): read tickets and attendees for an event. No ticket-purchase write is exposed.
📈 Slim SEO (2 abilities): read and manage Slim SEO data.
🎨 Avada / Fusion Builder (2 abilities): read a page’s raw Fusion Builder markup and replace text without disturbing the shortcode layout.
📍 GeoDirectory (4 abilities, off by default): read and manage business and place listings; stays off even when active, turn it on in the Integrations tab.
🔗 Abilities from your other plugins (new in 1.1.0)
WordPress 6.9 lets any plugin register its own abilities, not
See it in action
Screenshots & previews.
The first run walks you through connecting an agent in three steps: turn the connection on, choose what it can touch, then finish and hand the endpoint to your AI client.None of this plugin's 179 abilities is exposed until you switch it on. They are grouped by section, here Menus with its three reads on and its writes off, and each section has buttons to enable all reads or all writes at once.Read-only mode in force. The header badge reads Read-only and the Content section drops its Enable all writes button, because while the mode is on no ability that writes can be switched on.Read-only mode is a single switch under Safety controls on the Settings tab. While it is on, the high-risk unlock beneath it is held as well and says so instead of sitting there looking live.WooCommerce abilities that change orders, issue refunds, or touch payment settings stay padlocked behind a second switch on the Settings tab, sitting among ordinary writes you can turn on one at a time.Each integration has a card that says whether its plugin is active and how many of its abilities are on. WooCommerce and Yoast SEO are active here, Rank Math, All in One SEO, ACF and the rest are marked Not installed, and every ability starts off until you turn it on.Abilities that other plugins register for themselves, grouped by the plugin that declared them and off until you turn them on. A warning reminds you that this plugin does not filter what a bridged ability returns.The Connection tab shows your MCP endpoint, a Check my connection button, and the OAuth route: pick your operating system and client, paste the endpoint into your agent, and approve it in the browser, with no secret to put in a config file.The Activity Log with a 7-day summary, filters for user, connection, tool, plugin, date and text, the connection and IP of each call, the duration of calls that ran, a Live view, and a CSV export that follows the filters.The dashboard opens with a setup checklist that ticks off as you go, then the Needs review card and, further down, enabled abilities, recent agents, audit history, your endpoint and the versions in play.The Site Brief: a few plain rules every connected agent reads when its session starts, such as spelling and what to leave alone.The Connection Doctor checks the connection from your own server and says what to fix. Each finding says whether you or your host can fix it, and some come with a snippet to paste.Needs review: drafts and pending posts your agents wrote wait here, with Preview, Open in editor, Publish and Discard.Notifications, off until you choose how to be told: an admin notice, an email right away or a daily email, for the events you tick.
02 / Source details
Gettingstarted.
01Upload the plugin to the /wp-content/plugins/agent-abilities-for-mcp directory, or install it from the WordPress plugins screen.
02Activate it from the Plugins screen.
03Open the Agent Abilities for MCP menu in your admin sidebar. On the Abilities tab, turn on only the abilities you want the agent to have. Everything starts off.
04On the Connection tab, copy your site’s MCP endpoint. The simplest path is OAuth: paste the endpoint into your MCP client and approve the connection once in the browser, where the agent acts as your own account.
05Prefer not to use OAuth, or on a client that can’t? Create the dedicated low-privilege agent user the Connection tab offers, generate an Application Password for it, and connect with that instead.
06Run Check my connection on the Connection tab to confirm the endpoint is reachable from your server.
For a full walkthrough, see the getting started guide and connecting a client .
03 / Source details
Frequently asked questions.
More help: Documentation | Connecting a client | Security and disclosure | Support forum
How do I connect an AI agent to my WordPress site?
Install and activate the plugin, then open the Agent Abilities for MCP screen and turn on the abilities you want, since everything starts off. Copy your site’s MCP endpoint from the Connection tab and add it to your AI client. The simplest path is OAuth: paste the endpoint and approve the connection once in the browser. If your client cannot use OAuth, point a dedicated low-privilege user at an Application Password instead. Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Gemini CLI all connect today, some directly and some through the mcp-remote bridge that runs on your own machine.
How do I connect Claude to WordPress?
Install the plugin, enable the abilities you want on the Abilities tab, then copy your MCP endpoint from the Connection tab and add it to Claude as a custom connector. Approve the sign-in once in the browser. The claude.ai web app and Claude Desktop use that same flow; Claude Code connects from the command line.
Does the agent get admin access?
No. The agent authenticates as whatever WordPress user you bind it to. Point it at the dedicated low-privilege user the plugin can create for you, and it can only do what that user can do. Each of this plugin’s abilities also re-checks the user’s capability before it runs, so a connection can never call one of them if its user is not allowed to use it.
What permission controls do I get over the AI agent?
Agent Abilities for MCP gives you three layers for its own tools. Every ability is off until you enable it. The agent connects as a real WordPress user you choose, so it can only do what that user’s role already allows. Every call re-checks that user’s capability before it runs, and a call that fails the check is denied and recorded.
Can I give one connection less access than another?
Yes. Beyond the site-wide list of enabled abilities, you can add a per-role allowlist, a per-connection allowlist, or both, on the Connections screen. Either one only narrows what was already enabled: an ability still has to clear the global list, then the matching role’s list, then the matching connection’s list, before an agent can call it. There is no finer-grained scoping below role and OAuth connection – an Application Password inherits its user’s whole role, with no separate per-password limit. Leave the screen alone and nothing changes; every existing connection keeps working exactly as it did before.
How do I find what an agent did?
Open the Activity Log tab. You can filter by user, connection, tool, plugin, date and text. Each row shows the connection name, the source IP address and how long the tool ran. A summary at the top covers the last 7 days, and a Live view keeps the first page current while you watch (it needs a date range when a text search or a user filter is applied). Export CSV downloads exactly the rows the filters show.
The IP is the address the request came from, so behind a proxy or CDN it is the proxy’s address. Duration is the time spent inside the tool, not what the agent experienced. A denied call never runs, so it has no duration.
Is there an audit log of what the agent did?
Yes. Agent Abilities for MCP writes every call to one of its abilities to an audit log in your own database, denied attempts included. Each entry records the acting user, the ability name, the argument keys, and a short note of what the call touched: small identifying values only, such as ids, meta key names, slugs, and status values. For a failed call to another plugin’s bridged ability, it also records that plugin’s error code, never its message. Free-text argument content, a post body or an email address, is never stored. Each entry also records the source IP address and the time the tool took, and a denied call records why it was refused. That reason is in the log, not in the message the agent sees. You can clear the log from the admin screen.
Is it safe to connect an AI agent to my WordPress site?
Yes, when the connection is scoped, which is what this plugin is built around. The agent connects as a real, least-privilege WordPress user you choose, never an admin-equivalent key. Every ability is off until you enable it, each call to its tools re-checks the user’s capability before it runs, and every one of those calls is logged, denied attempts included. Tools another plugin publishes to the Adapter’s default server are outside these checks; the FAQ on the default server explains. The plugin itself never holds an admin-equivalent key.
What can an agent actually do?
Only the abilities you have enabled, and only within the bound user’s capabilities. The catalog is reads and guarded writes over posts, pages, terms, comments, media, post meta, and site structure, plus revision history and a search that spans every post type at once. There is no ability to change options arbitrarily, change roles, or run code. The one ability that fetches a remote URL is a media upload: it only accepts https, refuses a target that resolves to a private, loopback, or link-local address, never follows a redirect, and stays off until you enable it like every other ability. An agent can only write post meta for keys an administrator has explicitly allowlisted, and protected, underscore-prefixed, and authentication keys can never be allowlisted. Deletes move content to Trash where the ability supports it, and the permanent ones are off by default and capability-gated.
Will an agent break my Elementor or Divi page?
No, it will refuse the write instead. Elementor, Divi, Beaver Builder, and Avada all store their layout somewhere other than the normal post content, so an unguarded edit could report success while changing nothing you can see, or corrupt the builder’s own markup. The plugin checks page-builder ownership before any content write and refuses the call with an error naming the builder that owns the page, so you find out immediately rather than discovering it later. Edit that page in its own builder instead. This is a refusal guard, not an integration with any of these builders, and OptimizePress is not covered yet.
How does the plugin handle tools and access?
Agent Abilities for MCP ships everything off, binds the agent to one WordPress user you pick, re-checks that user’s capability on every call to its tools, and logs every one of those calls including denials. You add reach as you build trust, not all at once. It trades raw tool count for control you can audit.
Is it free?
Yes. Agent Abilities for MCP is free on WordPress.org, with no paid tier, no API key to buy, and no usage limits added by the plugin.
Does it work with my other plugins?
Yes, for a set of supported plugins. When one is active, Agent Abilities for MCP adds abilities for it under the same rules as the core: detected automatically, off until you turn them on, capability-gated, and logged. Out of the box it covers WooCommerce, Advanced Custom Fields, and SEO (Yoast, Rank Math, and All in One SEO). The WooCommerce and ACF abilities can read and write real customer and order data, including personal data such as names, emails, and addresses, so they sit behind a clear notice in the admin and stay off until you switch them on. Beyond these built-in integrations, the plugin can also bridge abilities that any of your other plugins register through the WordPress Abilities API. More integrations are planned.
Can I expose abilities from my other plugins?
Yes. WordPress 6.9 lets any plugin register abilities, and Agent Abilities for MCP can bridge the ones declared by your other active plugins. Open Other plugins in the admin, where they are grouped by the plugin that registered them and start off. Turn one on and it becomes a governed MCP tool under the same rules as everything else: scoped to the bound user, capability-checked on every call, rate-limited, and logged. You can enable or disable a whole plugin’s set at once, and nothing is bridged until you choose it.
Can an AI agent manage my WooCommerce store?
Yes, when WooCommerce is active. The plugin adds WooCommerce abilities for reading and writing products, orders, and customers, so an AI agent can help run your store through this MCP server for WooCommerce. Those abilities reach real customer and order data, including personal data such as names, emails, and addresses, so they stay off until you enable them and sit behind a clear notice in the admin, under the same least-privilege and audit-logging rules as everything else.
Can an agent manage my events, tickets, or directory listings?
Yes, when the matching plugin is active. With The Events Calendar active, an agent can read and manage events, venues, and organizers; with Event Tickets active, it can read tickets and attendees, though no ticket-purchase write is exposed. With GeoDirectory active, it can read and manage business and place listings, but that integration stays off even when the plugin is active – you turn it on yourself on the Integrations tab, unlike most other integrations, which are simply off until enabled. All of these abilities follow the same rules as everything else: off until you switch them on, capability-gated, and logged.
Is this the same as the WordPress Abilities API, or the official MCP adapter?
It is built on both. WordPress 6.9 ships the Abilities API, and the official MCP Adapter comes bundled with this plugin; Agent Abilities for MCP registers a curated, governed set of abilities on top of them rather than inventing its own protocol or transport. So there is no bespoke server to trust, and the plugin inherits the standard’s behavior. What it adds is the governance layer: the off-by-default catalog, the capability gating, the safety controls, and the audit log.
How is this different from other WordPress MCP plugins?
Most MCP plugins for WordPress compete on how many tools they can expose. Agent Abilities for MCP competes on control. Everything is off until you enable it, the a
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
