Agent Abilities for MCP

Agent Abilities for MCP - Connect Claude and ChatGPT with Permission Controls and Audit Log

WordPress MCP server for Claude and ChatGPT with limited access, a pause switch, read-only mode, drafts you approve, playbooks and an audit log.

This is the GitHub home of a free WordPress plugin that adds an MCP endpoint to a site, so Claude, ChatGPT, Cursor and other MCP clients can work on it as a WordPress user you choose. It ships 184 abilities (90 core, 94 for plugins such as WooCommerce, ACF and Yoast SEO) and every one starts switched off.

The listing for site owners lives on WordPress.org. This page is for anyone who wants to read the code, wire the plugin into their own stack or send a patch.

What the plugin does

Abilities are registered on the WordPress 6.9 Abilities API and served through the official MCP Adapter, which is bundled, so if the standalone Adapter plugin is active too the plugin simply uses whichever copy loads first. Every call to its tools runs as the WordPress user the connection belongs to, over OAuth or an Application Password, and is checked against that user's capabilities.

The admin screen has a switch for each ability, plus read-only mode, per-role and per-connection allowlists, a rate limit, an IP allowlist and Pause all access, and each OAuth connection gets its own pause, end date, rate limit and access preset. An Activity Log table in the site's own database records the acting user, the tool, the argument keys and an identifier-only note, and it never stores free-text content.

Playbooks are step-by-step instructions the owner writes, and agents read the Active ones through two read tools, aafm/list-playbooks and aafm/get-playbook. Writes through the general content tools to pages owned by Elementor, Divi, Beaver Builder, Avada or Visual Composer are refused. Avada's two dedicated tools are the exception, and they refuse changes to its shortcodes.

One scope note: the Adapter has a default server that other plugins can publish tools to, and those tools are outside this plugin's controls. A Settings choice (Automatic, Always on, Always off) decides whether that server runs, and this plugin's own tools are never on it.

Install and connect

1. Copy the plugin to /wp-content/plugins/agent-abilities-for-mcp, or install it from the Plugins screen, and activate it.
2. Open Agent Abilities for MCP in the admin menu and switch on the tools you want on the Abilities tab, since none of this plugin's tools is on by default.
3. Copy the endpoint from the Connection tab. Hosted apps (ChatGPT, Claude, Manus) take the URL as a custom connector and ask you to approve it once over OAuth.
4. Click Check my connection to confirm the server answers.

The getting started guide and connecting a client cover each client. Claude takes the endpoint under Customize, then Connectors, as a custom connector, while ChatGPT takes it on the web under Plugins, Add custom MCP server, and per OpenAI's help article that needs a Business or Enterprise/Edu workspace for full access, or Pro for read and fetch only.

Endpoint and client config

The endpoint sits under your REST API (replace example.com with your domain):

https://example.com/wp-json/agent-abilities-for-mcp/mcp

OAuth discovery documents are served at /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server, so a server rule that blocks dotfile paths makes discovery fail, and the nginx rule that fixes it is in the troubleshooting guide.

Editors and command-line clients use a config file. The standard block runs the open-source mcp-remote bridge on your own machine, which walks you through the same one-time OAuth approval in the browser, so the file itself holds no secret:

{

"mcpServers": { "agent-abilities": { "command": "npx", "args": ["-y", "mcp-remote", "https://example.com/wp-json/agent-abilities-for-mcp/mcp"] } } }

VS Code keys the same block as servers in .vscode/mcp.json. If you'd rather use an Application Password, create the dedicated agent user the Connection tab offers (a Subscriber, so raise its role to match the job) and connect through the @automattic/mcp-wordpress-remote bridge:

{

"mcpServers": { "agent-abilities": { "command": "npx", "args": ["-y", "@automattic/mcp-wordpress-remote@latest"], "env": { "WP_API_URL": "https://example.com/wp-json/agent-abilities-for-mcp/mcp", "WP_API_USERNAME": "your-agent-user", "WP_API_PASSWORD": "PASTE-APPLICATION-PASSWORD-HERE" } } } }

The Connection tab generates both blocks with your real endpoint, plus a Windows variant that wraps npx in cmd /c. Keep in mind that an Application Password works across the whole REST API, so this plugin's limits apply only to calls through its MCP endpoint, whereas a token it issues over OAuth works on that endpoint alone.

For developers

Hooks and filters

These are the main extension points. Every name starts with aafm_.

WP-CLI

wp aafm catalog export [--pretty] [--include-native]

It prints the abilities that other active plugins register as aafm.catalog/v1 JSON, and --include-native appends this plugin's own abilities.

Running the checks

Everything runs in DDEV on PHP 8.3:

ddev exec phpunit

ddev exec phpcs ddev exec phpstan analyse

Don't run wp plugin check against the dev checkout, because the plugin is symlinked to the repo root and Plugin Check follows the link into the bundled WordPress install. CONTRIBUTING.md explains how to run it against a clean export, and how an ability goes from a registry row to an MCP tool.

Contributing and security

Patches are welcome. Read CONTRIBUTING.md first and keep each commit to one logical change. A vulnerability should go through the Report a vulnerability option on the repository's Security tab (see SECURITY.md) and not a public issue.

Outbound requests

The plugin calls no AI provider and sends no telemetry. It makes two kinds of request itself: the Connection tab's checks against your own site's address and, only if you enable the off-by-default upload-media-from-url ability, a fetch of the HTTPS URL an agent supplies, which refuses private and reserved addresses, follows no redirects and carries none of your content or credentials. The bridges above run on your own machine and are not bundled.

More documentation

• Documentation
• Safety controls
• Connection controls
• Block tools
• Supported clients
• Security

Disclaimer

The Model Context Protocol is an open specification that Anthropic originally developed. Claude, ChatGPT, Cursor, VS Code, Gemini and other product names belong to their owners, and Agent Abilities for MCP is a third-party plugin that isn't affiliated with, endorsed by or sponsored by any of them.

Changelog

1.11.0

• Feature: The Other plugins tab says which plugin provides each group of tools (or its namespace, when the plugin cannot be identified), labels each tool Read, Write or Destructive from the plugin's own annotations (an unlabelled tool is treated as destructive and says so), and marks tools that may return personal data such as form entries, orders, learner or member records. That mark is a hint from the plugin and tool name, not a full check.
• Feature: When a plugin update or a newly activated plugin adds tools, a "New tools since your last review" card lists them. They stay off until you switch them on, and Settings can send a notification for them.
• Feature: Each plugin on the Other plugins tab has an "Allow only read tools" button, and the Activity Log can filter to one plugin's tools.
• Fix: A bridged tool's error names the plugin as WordPress shows it, for example "WPForms Lite" instead of "wpforms", or names the tool namespace and says so when the plugin cannot be identified. The Quick Connect note no longer promises deletes go to Trash, the upload tools name the upload-files capability, and Content editor and Shop manager say they can read playbooks.
• Chore: The TEC events list says whose draft events it returns, the Avada descriptions lost a dash, and leftover internal notes came out of the plugin's PHP comments.

1.10.2

• Fix: A request from another site's web page now gets a 403 even when it carries wrong credentials, and resp