Agent Abilities for MCP – Connect Claude and ChatGPT with Permission Controls and Audit Log

A WordPress site that AI apps can call to do things like list posts or update a product, with this plugin supplying the endpoint and the rules about who can use it and for what.

Follow the steps under Connect Claude to WordPress above, which add your endpoint as a custom connector under Customize, then Connectors. The one thing to add here is that Claude connects from Anthropic’s cloud, so a site on localhost or behind a VPN won’t work. The Claude guide has the full setup.

You don’t need to turn on Developer Mode first, and the steps are under Connect ChatGPT to WordPress above (the ChatGPT guide walks through them too). ChatGPT reaches your endpoint over the public internet, so a site on localhost or behind a VPN won’t connect, and because custom servers are a web feature you can’t add one from the mobile app.

It can be, as long as you keep the access small: the AI works as one WordPress user you choose, this plugin’s tools start off, and each call to them is checked against that user’s capabilities and logged. I’d start with read-only mode or Force draft on create and widen from there once you’ve seen what it does.

What ChatGPT or Claude does with the content it reads is up to that vendor, and text on your own site (a comment, say) can try to steer an AI, a risk called prompt injection that the post on indirect prompt injection covers.

The code is GPL-licensed and public on GitHub , the plugin makes no calls to AI providers and sends no telemetry, and it stores OAuth credentials as SHA-256 hashes in its own tables. The security page lists the controls and says how to report a problem.

Not unless you connect it as an administrator, which I wouldn’t. It gets the role of the user it connects as: for OAuth that’s whoever approves the connection, and Roles that can connect on the Settings tab decides who may approve, with a new install allowing Administrators only. The Application Password route uses a Subscriber account the Connection tab creates, which you can raise to Editor or Author.

An Application Password works across the whole REST API and this plugin’s limits apply only to calls through its MCP endpoint, whereas a token issued over OAuth works on that endpoint alone.

Yes, through the user’s role. An Editor can write and publish any post but can’t touch site settings or install plugins, an Author is confined to its own posts, and a Contributor writes without publishing. The Content editor preset narrows it further to posts, pages, media, categories and tags, and because a new install lets only Administrators approve a connection, add the role under Roles that can connect first or approve as an administrator and pick the preset.

Flip Pause all access on the Connection tab, the emergency stop for every connected app and Application Password. Nothing is deleted and Resume all access turns everything back on, but since Application Passwords keep working on the rest of the REST API you should revoke one if it has to go.

Yes. Each approved OAuth connection on the Connection tab has Pause next to Revoke, and a paused connection keeps its sign-in and can still list tools while every tool call comes back with a message that the connection is paused. Resume it and nobody has to approve it again. The same person’s Application Password is unaffected, since it has no pause of its own.

For an OAuth connection, yes. Set an end date on its row on the Connection tab and the connection stops at the end of that day and stays refused until a site administrator renews it, and its old tokens never work again. An Application Password has no end date, so revoke it when the job is done.

Turn on read-only mode in Settings and no write tool is loaded, whatever else is ticked, including write abilities you bridged from other plugins. Search and read keep working, and your selections come back when you switch it off. To limit a single connection instead, pick the Read only preset when you approve it.

With Force draft on create switched on in Settings, anything the AI creates and any request to publish is saved as a draft, which covers posts, pages, custom content items, reusable blocks and WooCommerce products. Edits to a post that’s already live still go live, so if every change should be reviewed, connect the AI as a Contributor, who can’t edit published posts. The drafts wait on the Needs review card on the Dashboard.

I’d leave the delete tools off, which is how they ship. Trash post and Trash page move content to the Trash where you can restore it, but most of the tools named Delete, such as Delete post, Delete page and Delete media, remove it permanently. Read-only mode takes away every write and delete tool at once and the Content editor preset has no deletes in it, and the Activity Log shows which tool ran on which item though it keeps no copy of deleted content.

Open the Activity Log tab (the guide to finding what an agent did walks through it). Each row gives the time, user, connection, source IP, tool, run time and a short note on what the call touched, such as a post ID or a meta key name, and a 7-day summary sits at the top. Export CSV downloads whatever your filters show. The log records which tool ran on which item and never stores the text the AI wrote.

Yes, once you set it. Enter a number under Rate limit (per minute) on the Settings tab and each agent user can make that many calls a minute, shared across all its connections, with 0 turning the limit off. One OAuth connection can have a lower limit of its own on the Connection tab, in which case its calls count against both, and calls over a cap are denied and logged.

Yes. Enter addresses or CIDR ranges, one per line, under IP allowlist on the Settings tab and requests from anywhere else are refused before they sign in. Behind Cloudflare or another proxy, switch on Real visitor address behind a proxy or CDN first, because otherwise the plugin sees the proxy’s address and the allowlist can lock your agents out.

A preset caps what one OAuth connection can reach, and you pick it when you approve an app or in Quick Connect and can change it later on the connection’s row.

• Read only: look at your content, never change it.
• Content editor: posts, pages, media, categories and tags. No deletes, users, settings or comments.
• Shop manager: everything in Content editor plus WooCommerce, minus deletes and the money and authority tools.
• Custom: everything you’ve switched on, limited by the approving user’s role.

Someone who approves an app but can’t manage the site gets the default preset or a narrower one, never a wider one.

Step-by-step instructions you write on the Playbooks tab, for example how to check a draft before it goes out. A site can keep 50 of them, with steps up to 8,000 characters, and you can add your own or start from one of the five starters. Once List playbooks and Get playbook are switched on, the AI sees your Active playbooks at the start of a session and loads one when a task fits, and the list refreshes when the client reconnects.

Yes. Put the plugin on every site and add each endpoint as a separate connector, and name the connectors after the sites so you can tell them apart in the chat.

With ACF active, the ACF tools list field groups and read and write field values on posts, terms and users, sanitizing each value for its field type, and a write that names a field ACF doesn’t know is refused with an error that names it.

For layout, the AI can list block types and read one block’s attributes, plus field names and an example for an ACF block. Replace block then swaps one block in a post, found by its position, and leaves the others alone, although WordPress may still sanitize the whole post on save for users who can’t post unfiltered HTML. Questionable block markup saves with a warning unless you turn on Strict block validation in Settings.

Before any content write the plugin checks whether a page builder owns the post, and if one does it refuses with an error that names the builder. Elementor, Divi, Beaver Builder, Avada and Visual Composer are covered, so edit those pages in the builder itself. Avada’s two dedicated tools can replace text in a page and refuse changes to its shortcodes.

With WooCommerce active, 52 abilities cover products and variations, orders with notes and refunds, customers, coupons, shipping, tax, payment gateways and reports, and because they reach customer data an admin notice flags them. The tools that move money or grant authority stay locked until you unlock them in Settings, and the Shop manager preset leaves them out.

No, the official MCP Adapter is bundled, and if the standalone Adapter plugin is active too, this plugin uses whichever copy loads first. It builds on the WordPress 6.9 Abilities API.

The Adapter also has a built-in default server that other plugins can publish tools to, and those tools sit outside this plugin’s c