What is Agent Abilities for MCP?
Agent Abilities for MCP is a free WordPress plugin that turns your site into a governed Model Context Protocol server. It publishes 153 abilities as MCP tools: 83 for WordPress core, plus 70 that only register when the matching plugin is active (WooCommerce, Advanced Custom Fields, Rank Math, Yoast SEO, All in One SEO). Everything starts off. You choose what the agent can reach, and it connects as a real WordPress user you pick rather than an admin key.
It is built on the WordPress 6.9 Abilities API and the official MCP Adapter, so there is no custom server or transport to trust. Transport is streamable HTTP, at an endpoint on your own site:
https://your-site.com/wp-json/agent-abilities-for-mcp/mcp
How to use it
Install and activate the plugin, then open the Agent Abilities for MCP menu in your admin sidebar. Switch on only the abilities you want. On the Connection tab, copy your site's MCP endpoint.
Hosted clients such as ChatGPT, Claude.ai and Manus connect over OAuth 2.1 with PKCE. You paste the endpoint in as a custom connector and approve it once in the browser. You never touch a config file or copy a password.
Clients that run on your own machine (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI) use either the same OAuth flow or an Application Password on a dedicated low-privilege user. Nine clients connect today.
Governance
- Every ability is off until you switch it on, and plugin updates never widen access on their own.
- The agent authenticates as a WordPress user you choose, never an admin-equivalent key.
- A connection only sees the tools its bound user can call, and each ability re-checks that user's capability again before it runs.
- Every call is written to an audit log in your own database, refusals included, recording the principal, the argument keys, and a short note of the identifiers it touched (ids, slugs, statuses), never free-text content.
- Nine WooCommerce abilities move money or grant authority: refunds, order status, order updates, customer updates, payment gateway settings, coupon creation and updates, and tax rate creation and updates. Enabling one is not enough on its own. They stay locked until you also switch on a separate high-risk control in Settings, and flipping that control is itself logged.
- The plugin contacts no AI provider and makes no outbound requests of its own. Your client connects in. There is no telemetry.
- Optional limits you can set, all off until you set them: a per-minute rate limit, an IP allowlist, force-to-draft mode, a title-length cap, and block-markup validation.
What people use it for
- Drafting and editing posts, pages and media without giving the agent the right to publish.
- Running a WooCommerce store: products, orders, customers.
- Reading and writing ACF field data, or managing SEO metadata in Yoast, Rank Math or All in One SEO.
- Read-only checks on site health, plugin status and revision history.
- Moderating comments and searching across every post type.
Requirements
WordPress 6.9 or newer, PHP 7.4 or newer. Current version 1.6.3.
Site: https://agentabilitieswp.com/
WordPress.org: https://wordpress.org/plugins/agent-abilities-for-mcp/
GitHub: https://github.com/unaibamir/agent-abilities-for-mcp
评论