Small and focused
If you already run the official MCP Adapter and just want a curated set of abilities to switch on, Enable Abilities is lighter than a full server. Less to install, less to reason about.
A full server vs a companion layer
Agent Abilities vs Enable Abilities for MCP
Enable Abilities for MCP is a free companion plugin that turns on abilities for the official MCP Adapter. Agent Abilities is a full governed server with its own catalog, bridge, and governance layer. If you are choosing between them, the real question is how much you want to assemble yourself.
Summary and contents
The short version
Both are real WordPress MCP plugins. Enable Abilities and Agent Abilities weigh differently, so this is a priorities decision, not a better-or-worse one.
- In common
- Both free, both build on the WordPress 6.9 Abilities API, and both enable abilities one at a time.
- Enable Abilities wins on
- Small, focused, and light if you already run the MCP Adapter.
- Agent Abilities wins on
- A complete server with nothing else to install, guarded writes, and refusals written to the audit log.
- Enable Abilities today
- 1,000+ active installs (WordPress.org)
What each one optimizes for
The two plugins pull in different directions on purpose. Here is the honest shape of each.
Enable Abilities for MCP is deliberately small. It exposes a set of abilities, grouped by category, that you toggle for the official MCP Adapter to serve. It validates the same off-by-default idea we do, and if you already run the Adapter and want a light companion, that focus is a fair fit.
Agent Abilities sells governance. Nothing is exposed until you switch it on, the agent connects as a real WordPress user with only that user's permissions, every call is re-checked and written to an audit log in your own database, and the plugin makes no outbound calls of its own. If a tight, auditable boundary around the agent is what you want, that is the trade this plugin makes.
Neither approach is wrong. The rest of this page lays out the specifics, including where Enable Abilities genuinely reaches further than we do.
Side by side
Their claims are quoted from the WordPress.org listing, verified July 2026, and stated as their claims. Ours trace to the plugin readme.
| Dimension | Enable Abilities for MCP | Agent Abilities |
|---|---|---|
| Price | Free, donation supported | Free on WordPress.org. No paid tier, no API key to buy, no usage limits. |
| Standalone server | No. It needs the WordPress 6.9 Abilities API plus the official MCP Adapter to serve anything | A full governed MCP server with its own catalog and bridge, built on the WordPress 6.9 Abilities API and the official MCP Adapter. |
| Default posture | Per-ability toggles, admin controlled | Off by default. You enable one ability at a time; an update never widens access on its own. |
| Agent connects as | A bearer token or an Application Password | A real WordPress user, never a key this plugin mints with a scope of its own. With an Application Password you point it at the dedicated low-privilege user the plugin creates for you. Over OAuth it takes the capabilities of whichever account approves in the browser, so approve as the account you want it limited to. |
| Capability check | Relies on the ability’s own permission and the Adapter’s handling | Two layers: a connection only sees the tools its user can run, and WordPress itself re-checks that user’s capability before every call. |
| Guarded writes | Not a stated headline feature | Guarded. Deletes go to Trash where WordPress supports it, and the last administrator can never be removed. No arbitrary option or meta access, no code execution. |
| Audit log | Activity logging | Every call, denials included, with the principal and argument keys but never the values, in your own database. |
| Tool catalog | 58 abilities across 13 categories (WooCommerce, Events Calendar, JetEngine, and more) | 153 governed abilities (83 core, 70 integration), plus a bridge for abilities other active plugins register. |
| Business model | Open source, donation supported | Open source. No affiliate links, no agency upsell, no partner directory shown to your users. |
Where Enable Abilities leads
Said plainly, because pretending otherwise would not help you decide.
Same governance instinct
It shares our off-by-default, per-ability philosophy, which is a point in its favor. We think that instinct is right; we just take it further.
The trade-offs in Enable Abilities
Real, evidenced trade-offs a security-minded owner would weigh. Not a knock, just the other side of their design.
Trade-off
Not a complete server
It cannot serve anything on its own. You still need the official MCP Adapter alongside it, so you are assembling the stack yourself rather than installing one governed server.
Trade-off
Fewer write and audit guarantees
Its Application Password path puts the agent in a WordPress account much as ours does, so identity is not the gap. What it does not headline is two-layer capability gating, guarded writes, last-admin protection, or an audit log that records refusals as well as successes.
Where Agent Abilities leads
The governance thesis, which is the reason to pick this plugin over a broader one.
Off by default
Every ability starts disabled. You open access one toggle at a time, and an update never widens it on its own.
Least-privilege identity
The agent connects as a real WordPress user through OAuth or an Application Password, never an admin-equivalent key. It takes that account’s capabilities, so you decide its reach by choosing which account approves the connection.
Two-layer capability gating
A connection only sees the tools its user can run, and the capability is re-checked before every call.
Zero outbound, single-sourced facts
No connectors, no telemetry, and every number on this site comes from one source so it never contradicts itself.
Where Agent Abilities falls short
The honest other side. If one of these matters most to you, Enable Abilities may be the better fit.
Where we fall short
More plugin, more surface
We are a full server, which is more code and more configuration than a small companion. If all you want is to toggle a few abilities on the Adapter, that can be more than you need.
Where we fall short
A different starting point
If your site is already set up around the raw MCP Adapter, a companion that plugs into it may fit your existing setup with less change than adopting a full server.
Which should you choose
A short, honest rule of thumb.
Reach for Enable Abilities for MCP if what it leads on maps to your priorities: small, focused, and light if you already run the MCP Adapter.
Reach for Agent Abilities if you want an agent that starts with zero access, connects as a real WordPress account you choose rather than an admin key, is audited on every call including refusals, and makes no outbound requests. Governance and a tight boundary are the point.
Both are free, so the lowest-risk move is to install the one whose default matches how you want to start. See what a governed WordPress MCP server is, or read the governance model.
Comparing others too? See all MCP plugin comparisons.
Frequently asked questions
Direct answers about how the two compare.
Is Enable Abilities for MCP a server?
No. As of July 2026 it is a companion plugin: it enables abilities for the official MCP Adapter, which does the serving. Agent Abilities for MCP is a full governed server on its own.
Do they use the same underlying technology?
Yes. Both build on the WordPress 6.9 Abilities API. Enable Abilities relies on the official MCP Adapter to expose them; Agent Abilities ships its own governed catalog and bridge on top of the same standards.
Which should I choose?
Choose Enable Abilities if you already run the MCP Adapter and want a light set of abilities to toggle. Choose Agent Abilities if you want one server with nothing else to install, guarded writes, last-admin protection, and an audit log that records refusals as well as successes.
Comparison based on each product's public documentation. Enable Abilities for MCP claims were verified against the WordPress.org listing in July 2026 and are stated as their claims; their product may have changed since. Agent Abilities for MCP facts come from its own readme. Agent Abilities for MCP is not affiliated with, or endorsed by, Enable Abilities for MCP.
Start with everything off.
Install Agent Abilities for MCP, keep every ability disabled, and turn on one at a time. Requires WordPress 6.9+ and PHP 7.4+. Free on WordPress.org.
Off by default, least privilege, and nothing leaves your site without you.