Installation

Requirements

• WordPress 6.9 or newer. This is where the Abilities API and the official MCP Adapter the plugin builds on are available.
• PHP 7.4 or newer.

Install and activate

1. Upload the plugin to the /wp-content/plugins/agent-abilities-for-mcp directory, or install it from the WordPress plugins screen.

2. Activate it from the Plugins screen.

3. Open the Agent Abilities for MCP menu in your admin sidebar. On the Abilities tab, turn on only the abilities you want the agent to have. Everything starts off.

4. On the Connection tab, copy your site’s MCP endpoint. The simplest path is OAuth: paste the endpoint into your MCP client and approve the connection once in the browser. The agent acts as the account that approved it, so log in as the account you want the agent to be before you approve.

5. Prefer not to use OAuth, or on a client that cannot? Create the dedicated low-privilege agent user the Connection tab offers, generate an Application Password for it, and connect with that instead.

6. Use the connection check on the Connection tab to confirm the endpoint is reachable from your server.

Nothing this plugin serves is exposed until you switch it on

On a fresh install every ability is off. You enable them one at a time, and an an update never switches on a tool it serves. Start with a single read ability, confirm the connection, then add reach as you build trust.

Integrations are detected automatically

When a supported host plugin is active, Agent Abilities for MCP adds abilities for it under the same rules as core: detected automatically, off until you turn them on, capability-gated, and logged. The set covers WooCommerce, Advanced Custom Fields, Rank Math SEO, Yoast SEO, All in One SEO, and, since 1.7.4, Slim SEO, The Events Calendar, Event Tickets, Avada, and GeoDirectory. GeoDirectory is the one that works differently: it stays off even when its host plugin is active, until you switch the integration on in the Integrations tab. The WooCommerce and ACF abilities can read and write real customer and order data, including personal data such as names, emails, and addresses, so they sit behind a clear notice in the admin and stay off until you switch them on.

Settings worth knowing about

Site Brief. A box on the Settings tab where you describe your site in a few lines, up to 1,500 characters. The plugin sends it to every agent that connects, when its session starts. Whether an agent follows it depends on the client. Only you can change it.

The Adapter’s default server. The bundled MCP Adapter has a built-in default server that other plugins can publish tools to. A Settings switch controls it: Automatic (the default), Always on or Always off. Automatic starts that server only when another active plugin publishes tools there. This plugin’s own tools are never on it, and the tools that are on it are not governed by this plugin: its read-only mode, allowlists, IP allowlist, rate limit and audit log do not apply to them. Sites that update from an earlier version move to Automatic. If you ran the standalone Adapter only to reach WordPress core’s own public abilities, choose Always on. Choose Always off if you want none of it.

Next steps

• Connecting a client: OAuth and Application Password.
• Troubleshooting: if the connection check fails.