FAQ

Does the agent get admin access?

Only if you connect it as an administrator. The agent takes the capabilities of the account it connects as. Over OAuth that is whichever account approves the connection in the browser, so log in as the dedicated low-privilege user the plugin can create for you before you approve, and the agent can only do what that user can do. Each ability also re-checks the user’s capability before it runs, so a connection can never call a tool its user is not allowed to use.

How do I give an AI agent limited access instead of admin?

Connect it as a WordPress user with a smaller role. An Editor can write, edit and publish any post; an Author only their own; a Contributor can write but not publish. The plugin can create a dedicated low-privilege user for you, and you can narrow the tools further for one role or one connection.

Is an Application Password limited to the abilities I enabled?

No, and the plugin says so rather than letting you assume otherwise. An Application Password is a whole-site WordPress credential, bounded only by the role of the user it belongs to, and Agent Abilities for MCP cannot narrow it. The IP allowlist, the high-risk lock, and the audit log govern the calls that arrive at the plugin’s own MCP endpoint; they do not follow that credential to the rest of WordPress. Issue it on a dedicated low-privilege user so that user’s role is the real limit, or connect over OAuth instead, where the token this plugin issues only ever authenticates this one endpoint.

Is it safe to connect an AI agent to my WordPress site?

Yes, when the connection is scoped, which is what this plugin is built around. The agent connects as a real WordPress user, never an admin-equivalent key, and it takes that account’s capabilities, so approve while logged in as the account you want the agent to be. Every ability is off until you enable it, each call re-checks the user’s capability before it runs, and every call to the tools it serves is logged, denied attempts included. Tools that another plugin publishes straight to the default server of the MCP Adapter are outside these controls, and a Settings switch controls that server. The plugin itself never holds an admin-equivalent key.

What can an agent actually do?

Only the abilities you have enabled, and only within the bound user’s capabilities. The catalog is reads and guarded writes over posts, pages, terms, comments, media, post meta, and site structure, plus revision history and a search that spans every post type at once. There is no ability to change options arbitrarily, change roles, or run code. An agent can only write post meta for keys an administrator has explicitly allowlisted, and protected, underscore-prefixed, and authentication keys can never be allowlisted. Deletes move content to Trash where the ability supports it, and the permanent ones are off by default and capability-gated.

What can I ask an AI agent to do on my WordPress site?

Whatever abilities you switched on, and nothing you did not. With the content abilities enabled, an agent can describe your site, count and search your posts, read a page and summarize it, draft a post for a human to publish, and fix a typo in place. It cannot publish, delete, or change settings unless you enable those abilities and bind the agent to a user that holds the capability. Every call to the tools it serves is logged either way.

Can I give an agent read access without any write access?

Yes. Read-only mode is a switch on the Settings tab, and while it is on none of the write tools this plugin serves register as MCP tools, whatever you have ticked. A blocked write is missing from the agent’s tool list rather than refused when it calls. It covers abilities bridged from your other plugins as well, each judged by that plugin’s own annotation, and anything that declares neither way counts as a write and stays out, so the mode fails closed. Tools that another plugin publishes straight to the default server of the MCP Adapter are not covered, and a Settings switch controls that server. Turning it on enables nothing by itself, and turning it off enables nothing either, so your selections are where you left them when you switch back. The switch is written to the audit log. It arrived in 1.6.0 and is off by default.

Is it free?

Yes. Agent Abilities for MCP is free on WordPress.org, with no paid tier, no API key to buy, and no usage limits added by the plugin.

Does it send my content to OpenAI, Anthropic, or Google?

No. The plugin connects to no AI provider and sends no telemetry. Your own AI client connects in to your site and calls the abilities you have enabled. Whatever your AI client does with the results afterward is between you and whoever makes that client. The plugin sends only three things on its own: the Connection tab’s checks of your own site, a fetch of the URL you hand it if you switch on the off-by-default URL upload, and alert emails if you turn alerts on. Those emails never include call content, a user name or an IP address.

What is the difference between this and the WordPress REST API?

The REST API exposes raw endpoints. MCP describes your site’s abilities as discoverable tools an AI agent can reason about and call, and this plugin wraps each one in a governance layer: off by default, with every call to its tools capability-checked and logged. It is the same underlying WordPress, governed so an agent can drive it within the limits you set.

How is this different from other MCP plugins for WordPress?

Not on tool count. The agent enters as a WordPress user rather than through a key the plugin issues with a scope of its own, and WordPress re-checks that user’s capabilities before every call, in core rather than in code of ours. Every ability is off until you enable it, and every call to its tools lands in an audit log in your own database, refusals included. Several other WordPress MCP plugins now describe strict defaults and audit logs in similar terms, so the part worth checking is the rest: nothing in the chain belongs to a vendor, there is no vendor service behind it, and there is no paid tier waiting behind the free plugin.

How does Agent Abilities for MCP compare to Easy MCP or Royal MCP?

All three are free WordPress MCP plugins. Easy MCP leads on raw tool count and external data connectors. Royal MCP leads on client breadth. Agent Abilities for MCP starts with everything off, gives the agent a WordPress account instead of an API key of its own, and has no external-data connectors. Easy MCP binds its token to a WordPress user too, so on identity the two of us are close; Royal’s API-key path runs as full admin. The site has honest, dated side-by-side comparisons for each.

Which WordPress MCP server should I use?

It depends on the job, so the site publishes a roundup of the whole field rather than an answer that always ends in us. AI Engine is the pick if you want a full AI suite with MCP as one part of it. WPVibe is the quickest to a working connection, through a hosted service, and suits people who mostly build and edit content with an agent. Royal MCP documents the most clients and platforms. Easy MCP AI pairs a large tool catalog with the only external data connectors. miniOrange Secure MCP Server advertises the longest list of security controls, from approvals to prompt-injection detection. Enable Abilities for MCP is a light layer for sites already running the MCP Adapter. EMCP goes deepest into Elementor. Agent Abilities for MCP is the one that starts with everything off, hands the agent a WordPress account rather than a key of its own, and stays free at every tier. The roundup orders the WordPress.org plugins by active installs, which puts ours last, and it links to a head-to-head for each one.

Is this the same as the WordPress Abilities API, or the official MCP Adapter?

It is built on both. WordPress 6.9 ships the Abilities API, and the official MCP Adapter comes bundled with this plugin; Agent Abilities for MCP registers a curated, governed set of abilities on top of them rather than inventing its own protocol or transport. So there is no bespoke server to trust, and the plugin inherits the standard’s behavior. What it adds is the governance layer: the off-by-default catalog, the capability gating, the safety controls, and the audit log.

What is the WordPress Abilities API?

WordPress 6.9 added a standard registry where plugins declare abilities: a name, a description, an input and output schema, a permission callback, and an execute callback. The official MCP Adapter reads that registry and exposes each ability to AI clients as an MCP tool. Agent Abilities for MCP builds its governed catalog on this API, and it can also bridge abilities that your other active plugins register.

Do I need to install the MCP Adapter separately?

No. The official MCP Adapter is bundled with this plugin. If you also run the standalone Adapter plugin, this plugin works with it. The Adapter has a built-in default server that other plugins can publish tools to. Settings has a choice for it: Automatic (the default), Always on or Always off. Automatic starts the server only when another active plugin publishes tools there. WordPress core’s own public abilities do not count as a publisher, so if you ran the standalone Adapter only to reach those, choose Always on. This plugin’s own tools are never on that server, whatever you choose. The tools that are on it are not governed by this plugin: its read-only mode, allowlists, IP allowlist, rate limit and audit log do not apply to them. Choose Always off if you want none of it.

Which WordPress version do I need?

WordPress 6.9 or newer, which is where the Abilities API and the official MCP Adapter the plugin builds on are available. PHP 7.4 or newer is required.

Does it work with WPML?

Yes, on a WPML site the content reads become language-aware. Posts, pages, search, terms, media, products, and single-item reads take an optional language argument, and each result reports which language it returned, so an agent always knows what it is looking at. A single-item read can also fetch a specific translation. The count abilities now share the list’s language scope, which fixes the case where a list returned only the default language while the count reported every language and told the agent more items existed than it could read. No abilities were added for this, the catalog is unchanged, and the plugin does not translate anything: it reads what WPML already holds and calls no translation service. If you do not run WPML, nothing changes and there is nothing to configure.

Which AI clients work?

Any MCP client that can reach your site’s endpoint. With OAuth you paste the endpoint URL into the client and approve the connection once in the browser; clients like ChatGPT, Claude.ai, Claude Desktop, Manus, Claude Code, Cursor, VS Code, Windsurf, and Gemini CLI connect this way, some directly and some through the mcp-remote bridge that runs on your own machine. ChatGPT connects through its Developer Mode custom connectors, a beta feature on ChatGPT’s paid plans. Claude.ai, Claude Desktop, and Manus connect the same way, as a custom connector you add and approve over OAuth, and Claude.ai is in beta but not gated behind a paid plan. Claude Desktop shares the Claude.ai connector rather than running a bridge of its own, so it needs your site to answer on the public internet like the other connector apps do. ChatGPT and Claude register themselves with your site as part of that first approval, which needs dynamic client registration on. It is on by default from 1.7.2 and has its own switch on the Settings tab. You can also connect with an Application Password instead of OAuth. The Gemini app wants a streamable HTTP or SSE remote connector, which the underlying adapter does not serve natively yet.

Why can’t ChatGPT or Claude connect to my WordPress site?

Open the Connection tab and click Check my connection (the Connection Doctor). It runs the checks from your own server and names the fix, for example a host that strips the Authorization header. The other usual causes are a CDN or firewall blocking the /mcp path and a local site with a self-signed certificate.

My agent signs in but nothing happens. Is my CDN blocking it?

Usually that is a CDN or firewall in front of WordPress rather than the plugin. Cloudflare’s AI bot blocking and Super Bot Fight Mode stop the agent’s request at the edge after the sign-in has already succeeded, so it looks like a plugin problem when the request never reached your site. Since 1.7.2 the Activity Log also records requests that reach WordPress and fail, so a completed sign-in with no ability calls under it usually means something in front of WordPress stopped them. To confirm, check your CDN’s firewall or security events for a blocked request to the endpoint whose path ends in /mcp; the entry names the rule. On Cloudflare, open Security Settings and use Configure AI bot policies to allow the AI client’s traffic. The older Block AI Bots switch is deprecated from 15 September 2026. If you cannot allow that traffic across the whole zone, a custom rule with the Skip action for the /mcp path can skip Super Bot Fight Mode rules, though not Bot Fight Mode on the Free plan. On WP Engine, check the Edge traffic rules under Insights, Traffic and Security, Settings (that page shows only for production environments with an active Global Edge Security domain), and if calls fail with HTTP 429, ask WP Engine support to review the limit.

Is there rate limiting?

Yes. Set a per-minute cap on the Settings tab under “Rate limit (per minute)”. Each connection can make that many agent calls a minute, counted per agent user, and 0 turns the limit off. Calls over the cap are denied and logged on the Activity Log tab, so you can spot a connection that keeps hitting it.

What gets logged?

Every ability call is logged, whether it started, succeeded, errored, or was denied, with the acting user, the ability name, the argument keys and a short note of the identifiers it touched. Free-text content, like a post body or an email address, is never stored, and for a failed call to another plugin’s bridged ability it keeps that plugin’s error code, never its message. Since 1.5.0 the log also records every ability switched on or off and every setting changed, and since 1.7.2 it records requests that reach WordPress and fail, as (transport) rows, at most five of each kind per source address every ten minutes. A request that succeeds without calling a tool, such as listing tools, leaves no row, so a sign-in with no ability calls after it usually points at a CDN or firewall in front of WordPress. Since 1.9.0 the admin log also shows each call’s connection and source IP address, records how long the tool took, and notes why a denied call was refused, a reason that stays in the log and not in the message the agent sees. The activity log lives in your own database and can be cleared from the admin screen.

How do I find what an agent did?

Open the Activity Log tab, which records every call to the plugin’s tools and can be filtered by user, connection, tool, plugin, date and text. Each row shows the connection name, the source IP address and how long the tool ran. A summary at the top covers the last 7 days, and a Live view keeps the first page current while you watch (it needs a date range when a text search or a user filter is applied). Export CSV downloads exactly the rows the filters show. The IP is the address the request came from, so behind a proxy or CDN it is the proxy’s address. Duration is the time spent inside the tool, not what the agent experienced. A denied call never runs, so it has no duration.

Where do I review what the agent wrote before it goes live?

The Needs review card on the Dashboard lists the drafts and pending posts an agent starts, with Preview, Open in editor, Publish and Discard buttons. Discard moves the post to the Trash, and is unavailable when the Trash is off. Turn on Force draft on create in Settings to hold new posts, and requests to publish, as drafts so they land there.

Can I tell the AI agent about my site, such as my house style or what to leave alone?

Yes. Site Brief on the Settings tab takes a few lines about your site, up to 1,500 characters. The plugin sends it to every agent that connects when its session starts. Whether the agent follows it depends on the client. Only you can change it.

Can I get an email when something important happens?

Yes, but it is off by default. Under Settings, Notifications, choose how to be told: an admin notice only, an email right away (plus the notice), or one daily email (plus the notice). Then tick the events you want to hear about. They are an app being authorized to connect, an Application Password created for a user who can edit posts or for the agent user, a high-risk tool, a permanent delete or a destructive tool from another plugin running, a burst of denied calls or a connection hitting the rate limit, and read-only mode or the high-risk lock being switched. Each type of event sends at most one email every 15 minutes. When that limit holds a message back, the next one says how many it missed. Emails say what happened and link to the Activity Log. They never include the content of a call, a user name or an IP address. They go out through WordPress’s own mail, so on a host where mail is unreliable the admin notice is the dependable option. The daily email needs WP-Cron.

Does uninstalling the plugin revoke my agent’s access?

Not on its own. Uninstalling removes the plugin’s own settings and activity log, and its OAuth tables too if you turned on “Delete data on uninstall” first. It never removes the dedicated agent user or any Application Password issued to it, because those are ordinary WordPress account credentials that exist outside the plugin’s data. To fully cut an agent off, revoke its OAuth grant on the Connection tab, or delete its Application Password or its user account on the Users screen. Either works before or after you remove the plugin.

Can an AI agent edit my Elementor or Divi pages?

No, and since 1.7.4 it will tell you so instead of pretending otherwise. Elementor, Divi, Beaver Builder, and Avada keep their layout outside the normal post content, so a write aimed at one of those pages used to report success and change nothing visible. The plugin now checks who owns a page before writing and refuses the call with an error naming the builder. This is a guard rather than an integration: the plugin gains no ability to read or edit those layouts. Avada is the one exception, with two abilities of its own that read Fusion Builder markup and replace text without disturbing the shortcode tree. OptimizePress is not detected yet.

Does Agent Abilities for MCP work with Elementor’s official MCP?

Not as a layout editor: its own content abilities refuse to write to pages Elementor owns. Elementor’s MCP registers its abilities through the WordPress Abilities API, so the Bridge can list them, each off until you enable it, and run the ones you choose as the connected user, rate limited and audited. Elementor’s own code does the work.

Can I expose abilities from my other plugins?

Yes. WordPress 6.9 lets any plugin register abilities, and Agent Abilities for MCP can bridge the ones your other active plugins declare. They appear on an “Other plugins” screen, grouped by the plugin that registered them and off by default, so you turn on each one yourself, the same as the core abilities. Once enabled, a bridged ability runs under the same governance as the built-in catalog: scoped to the bound user, capability-checked on every call, rate-limited, and audited.

Which plugins work with the Bridge?

We checked 196 real WordPress plugins against their own current code, not their marketing claims, and found 3,640 abilities the Bridge can discover as of 28 September 2026. The full plugin directory is at agentabilitieswp.com/bridge/plugins/, and every plugin has its own page naming exactly which abilities it registers, how each one is gated, and how to turn it on.

Can I give one connection less access than another?

Yes, since 1.7.4. Alongside the site-wide list of enabled abilities there is an allowlist that narrows what a single role or a single connection can reach. The lists only ever narrow: an ability has to clear the global list, the role’s list, and that connection’s list before an agent can call it, and that is checked both when the agent asks what tools exist and again when it calls one. A site that never opens the screen sees no change. Scoping works per role and per OAuth connection; there is no per-Application-Password scoping. Since 1.7.5 you set it with a searchable checkbox picker and real role and client selects rather than by typing ability slugs into a text box; the stored data and the rules are identical, only the input control changed.

After updating, my agent gets an error on something that used to work. What changed?

Most likely the operation was failing silently before and 1.7.5 is the first version to tell you. WordPress returns the same value for “there is nothing here” and “the read did not complete”, so several paths used to treat a failed database read as a real answer and report success on work that never happened. Post, block and template writes now confirm what actually landed, a failed token revoke no longer reports success, and a read that could not complete raises an error rather than returning a plausible-looking result. No default, permission, or capability changed in 1.7.5 and the catalog stayed at 179 abilities, so nothing an agent could do in 1.7.4 was taken away.

How do I see what changed in each release?

The changelog page lists every release, newest first, copied word for word from the plugin’s own readme. Permission and security fixes are written out in full rather than softened into a line about general improvements. Releases that change behaviour you might be relying on also carry an upgrade note, so you can see what to expect before you update.

How do I report a security issue?

Please report security issues privately rather than in the support forum, so a fix can ship before details are public. Use the security contact listed on the plugin’s GitHub repository.