A full server vs a companion layer
The names are one word apart and both build on the WordPress 6.9 Abilities API, so these two get confused. The difference is what you install. Enable Abilities for MCP is a companion plugin: it registers abilities and hands them to the official MCP Adapter, which does the serving. Agent Abilities for MCP is a complete server on its own. Re-verified against their 2.13.0 release on 28 September 2026, by which point they had closed most of the connection gap this page used to describe.
The short version
Both are real WordPress MCP plugins. Enable Abilities and Agent Abilities weigh differently, so this is a priorities decision, not a better-or-worse one.
The two plugins pull in different directions on purpose. Here is the honest shape of each.
Enable Abilities for MCP has grown a long way past the small companion it was when we first wrote this page. As of 2.13.0 it ships 112 abilities across 21 categories, an embedded OAuth 2.1 server that connects claude.ai with nothing but a URL, and a ChatGPT path through dynamic client registration behind a callback allowlist. It shares our off-by-default instinct, it logs every execution under the real user, and on raw integration coverage it reaches further than we do in places. What it still does not do is serve anything by itself.
Agent Abilities sells governance. Nothing is exposed until you switch it on, the agent connects as a real WordPress user with only that user's permissions, every call is re-checked and written to an audit log in your own database, and the plugin makes no outbound calls of its own. If a tight, auditable boundary around the agent is what you want, that is the trade this plugin makes.
Neither approach is wrong. The rest of this page lays out the specifics, including where Enable Abilities genuinely reaches further than we do.
Their claims are quoted from the WordPress.org listing, verified 28 September 2026, and stated as their claims. Ours trace to the plugin readme.
| Dimension | Enable Abilities for MCP | Agent Abilities |
|---|---|---|
| Price | Free, donation supported | Free on WordPress.org. No paid tier, no API key to buy, no usage limits. |
| Standalone server | No. It needs the WordPress 6.9 Abilities API plus the official MCP Adapter to serve anything | A full governed MCP server with its own catalog and bridge, built on the WordPress 6.9 Abilities API and the official MCP Adapter. |
| Default posture | Per-ability toggles, admin controlled | Off by default. You enable one ability at a time; an update never widens access on its own. |
| Agent connects as | Their own embedded OAuth 2.1 server with CIMD for claude.ai, RFC 7591 dynamic registration for ChatGPT behind an admin-managed callback allowlist, plus Application Passwords and a single-admin bearer token | A real WordPress user, never a key this plugin mints with a scope of its own. With an Application Password you point it at the dedicated low-privilege user the plugin creates for you. Over OAuth it takes the capabilities of whichever account approves in the browser, so approve as the account you want it limited to. |
| Capability check | Each user logs in as their own WordPress account and is held to that role | Two layers: a connection only sees the tools its user can run, and WordPress itself re-checks that user’s capability before every call. |
| Guarded writes | Not a stated headline feature | Guarded. Deletes go to Trash where WordPress supports it, and the last administrator can never be removed. No arbitrary option or meta access, no code execution. |
| Audit log | Every ability execution logged under the real user’s name | Every call, denials included, with the principal, the argument keys, and the identifiers it touched but never free-text content, in your own database. |
| Tool catalog | 112 abilities across 21 categories (WooCommerce, The Events Calendar, JetEngine, Elementor, LearnDash, Tutor LMS, three SEO plugins, and more) | 179 governed abilities (85 core, 94 integration), plus a bridge for abilities other active plugins register. |
| Business model | Open source, donation supported | Open source. No affiliate links, no agency upsell, no partner directory shown to your users. |
Said plainly, because pretending otherwise would not help you decide.
112 abilities across 21 categories, including LearnDash, Tutor LMS, JetEngine, Code Snippets, and three separate SEO plugins. On breadth of third-party integrations they reach further than our 179 do in several directions, and if your stack is on that list they will cover it today.
Listed in March 2026 against our July, with 4,000+ active installs to our 600+ and 12 ratings to our 5 (checked 13 October 2026). More than six times as many sites have run their code. That is a real advantage and no amount of feature comparison changes it.
Off by default, per-ability toggles, each user logging in as their own WordPress account and held to that role, and every execution written to an activity log under a real name. We think that instinct is right; the difference now is packaging, not philosophy.
Real, evidenced trade-offs a security-minded owner would weigh. Not a knock, just the other side of their design.
Trade-off
This is the durable difference and it is still true at 2.13.0: their own requirements say "MCP Adapter plugin installed and configured". Two plugins to install, two to keep current, and a serving layer whose behaviour is not theirs to guarantee. Ours is one plugin that serves its own catalog.
Trade-off
They require PHP 8.0. We require 7.4. On older managed hosting that is the difference between installing and not.
Trade-off
Their listing does not state whether refusals are logged as well as successes, whether writes are guarded against the silent no-op case, or whether the last administrator is protected from deletion. We are not going to claim they lack those on the strength of a listing that simply does not say. If you need those specifically, ask them.
The governance thesis, which is the reason to pick this plugin over a broader one.
Every ability starts disabled. You open access one toggle at a time, and an update never widens it on its own.
The agent connects as a real WordPress user through OAuth or an Application Password, never an admin-equivalent key. It takes that account’s capabilities, so you decide its reach by choosing which account approves the connection.
A connection only sees the tools its user can run, and the capability is re-checked before every call.
No connectors, no telemetry, and every number on this site comes from one source so it never contradicts itself.
The honest other side. If one of these matters most to you, Enable Abilities may be the better fit.
Where we fall short
We are a full server, which is more code and more configuration than a small companion. If all you want is to toggle a few abilities on the Adapter, that can be more than you need.
Where we fall short
If your site is already set up around the raw MCP Adapter, a companion that plugs into it may fit your existing setup with less change than adopting a full server.
A short, honest rule of thumb.
Reach for Enable Abilities for MCP if what it leads on maps to your priorities: a bigger catalog than ours in several integrations, more than six times the installs, and their own OAuth server for claude.ai and ChatGPT.
Reach for Agent Abilities if you want an agent that starts with zero access, connects as a real WordPress account you choose rather than an admin key, is audited on every call including refusals, and makes no outbound requests. Governance and a tight boundary are the point.
Both are free, so the lowest-risk move is to install the one whose default matches how you want to start. See what a governed WordPress MCP server is, or read the governance model.
Comparing others too? See all MCP plugin comparisons, or the side by side table.
Direct answers about how the two compare.
No, and they are not from the same author. They are two separate WordPress plugins with names one word apart, which is genuinely confusing and worth spelling out. Enable Abilities for MCP is by fabiomontenegro1987, listed March 2026, and needs the official MCP Adapter alongside it to serve anything. Agent Abilities for MCP is ours, listed July 2026, and is a complete server on its own. Both are free and both build on the WordPress 6.9 Abilities API. If you searched for one and landed on the other, the slug is the quickest way to tell them apart: theirs is enable-abilities-for-mcp, ours is agent-abilities-for-mcp.
Not on its own. Re-verified against their 2.13.0 release on 28 September 2026, their stated requirements still include the MCP Adapter plugin, which does the serving. They do now run their own embedded OAuth 2.1 server for the connection itself, so claude.ai connects with just a URL. Agent Abilities for MCP serves its own catalog with nothing else installed.
Yes. Both build on the WordPress 6.9 Abilities API. Enable Abilities relies on the official MCP Adapter to expose them; Agent Abilities ships its own governed catalog and bridge on top of the same standards.
Choose Enable Abilities if you already run the MCP Adapter, if your site needs LearnDash, Tutor LMS, JetEngine or a specific SEO plugin they cover and we do not, or if a bigger install base matters to you. Choose Agent Abilities if you want one plugin rather than two, if you are on PHP 7.4, or if you want guarded writes, last-administrator protection, and an audit log that records refusals as well as successes. Both are free, so the honest answer is to install whichever fits and switch if it does not.
Comparison based on each product's public documentation. Enable Abilities for MCP claims were verified against the WordPress.org listing in 28 September 2026 and are stated as their claims; their product may have changed since. Agent Abilities for MCP facts come from its own readme. Agent Abilities for MCP is not affiliated with, or endorsed by, Enable Abilities for MCP.
Install Agent Abilities for MCP, keep every ability disabled, and turn on one at a time. Requires WordPress 6.9+ and PHP 7.4+. Free on WordPress.org.
Off by default, least privilege, and nothing leaves your site without you.