Client and platform breadth
Royal documents ChatGPT, Gemini, Cursor, Windsurf, and local models like Ollama and LM Studio, plus agent frameworks. That is a wider out-of-box client story than we advertise today.
Least privilege vs broad reach
Agent Abilities vs Royal MCP
Royal MCP is a capable, security-minded MCP server with wide platform coverage, and it shares our no-telemetry stance. The differences are more specific: how the agent authenticates, how granular the default access is, and whether a paid suite sits around the free plugin.
Summary and contents
The short version
Both are real WordPress MCP plugins. Royal MCP and Agent Abilities weigh differently, so this is a priorities decision, not a better-or-worse one.
- In common
- Both free on WordPress.org, off by default, audited, rate-limited, and no telemetry.
- Royal MCP wins on
- More documented clients and platforms, local models, and a deep troubleshooting library.
- Agent Abilities wins on
- A WordPress account instead of an admin-level API key, granular per-ability control, single-sourced numbers, and no paid suite around the plugin.
- Royal MCP today
- 7,000+ active installs (WordPress.org)
What each one optimizes for
The two plugins pull in different directions on purpose. Here is the honest shape of each.
Royal MCP sells reach and operational polish. It documents more AI platforms, including ChatGPT, Gemini, and local models, opens a preconfigured WordPress Playground demo straight from its product page, and keeps a deep library of host-specific troubleshooting guides. It is inbound-only with an explicit no-telemetry stance, so on privacy it is close to us. If breadth of client coverage and support content is what you weigh most, that is its strength.
Agent Abilities sells governance. Nothing is exposed until you switch it on, the agent connects as a real WordPress user with only that user's permissions, every call is re-checked and written to an audit log in your own database, and the plugin makes no outbound calls of its own. If a tight, auditable boundary around the agent is what you want, that is the trade this plugin makes.
Neither approach is wrong. The rest of this page lays out the specifics, including where Royal MCP genuinely reaches further than we do.
Side by side
Their claims are quoted from royalplugins.com and the WordPress.org listing, verified July 2026, and stated as their claims. Ours trace to the plugin readme.
| Dimension | Royal MCP | Agent Abilities |
|---|---|---|
| Price | Free, no Pro tier, plus optional premium support at 149 USD per year | Free on WordPress.org. No paid tier, no API key to buy, no usage limits. |
| Default posture | Off until enabled, but broad once on; scoping tools requires code-level filters | Off by default. You enable one ability at a time; an update never widens access on its own. |
| Agent connects as | An API key that runs as full admin, or OAuth mapped to a WordPress role | A real WordPress user, never a key this plugin mints with a scope of its own. With an Application Password you point it at the dedicated low-privilege user the plugin creates for you. Over OAuth it takes the capabilities of whichever account approves in the browser, so approve as the account you want it limited to. |
| Capability check | Per-tool capability checks (added in a 1.4.x release) | Two layers: a connection only sees the tools its user can run, and WordPress itself re-checks that user’s capability before every call. |
| Audit log | Yes, detailed, exportable to CSV | Every call, denials included, with the principal and argument keys but never the values, in your own database. |
| Rate limit | Yes, 60 per minute per IP | Optional, per minute. Off until you set it. |
| IP allowlist | Not offered | Optional IP allowlist. Off until you set it. |
| Tool catalog | 129 total (their pages state 67 and 69 core in the same readme, plus 60 integration) | 153 governed abilities (83 core, 70 integration), plus a bridge for abilities other active plugins register. |
| AI clients | Documents 10-plus platforms, including ChatGPT, Gemini, Cursor, and local models | 9 today, including ChatGPT, Claude.ai, and Manus through custom connectors. The Gemini app is not supported yet, stated plainly. |
| Outbound calls | Inbound only, no telemetry, supports local inference | Zero outbound calls of any kind. No connectors, no telemetry. Nothing leaves your site on the plugin’s initiative. |
| Business model | Free anchor for a 14-plugin paid suite, plus an affiliate program | Open source. No affiliate links, no agency upsell, no partner directory shown to your users. |
| Vendor in the chain | No vendor service in the data path, but the plugin issues an API key of its own and sits inside a paid suite | Nothing between the agent and WordPress belongs to a vendor. No token of ours carrying its own scope, no service of ours in the path, and no licence that can lapse and stop your automation. |
Where Royal MCP leads
Said plainly, because pretending otherwise would not help you decide.
Operational troubleshooting
Royal keeps roughly 15 symptom-to-fix guides for real host-level failures (SiteGround .well-known 404s, Cloudflare Zero Trust, ModSecurity 406). That is genuine operational depth, and we have nothing like it.
A demo that arrives already set up
Both plugins open in WordPress Playground from their WordPress.org listing. Royal goes further: its "Try it live" blueprint lands you in wp-admin with a demo API key in place, platforms already enabled, and sample activity-log entries to look at. Ours installs the plugin and stops there, because everything starts off. That is the product working as intended, and it is also a worse first five minutes.
A wide, fast-moving feature set
It iterates quickly, credits outside security contributors, and ships real fixes. It is an actively maintained, broad plugin.
The trade-offs in Royal MCP
Real, evidenced trade-offs a security-minded owner would weigh. Not a knock, just the other side of their design.
Trade-off
Their own counts contradict each other
The same WordPress.org readme states both 67 and 69 core tools, while other pages say 129 and "100-plus." Our numbers are single-sourced so they never disagree with themselves, which is a small but real trust signal.
Trade-off
The API-key path runs as full admin
By their own changelog, the API-key connection runs as admin. Narrowing that only comes through OAuth role mapping. We mint no key at all: the agent is always a WordPress account, and its ceiling is whatever that account can do. Connect it as an administrator and it will have administrator reach, which is why we tell you to point it at the low-privilege user instead.
Trade-off
Broad by default once enabled, hardened reactively
The plugin is off until enabled, but once on the default tool exposure is wide and scoping needs code-level filters rather than granular admin toggles. It has also fixed privilege-escalation bugs reactively across point releases.
Trade-off
A paid suite around the free plugin
The free MCP plugin sits inside a 14-plugin paid suite; its best integrations and support beyond the forum are paid. We are a single open-source plugin with no suite and no upsell.
Where Agent Abilities leads
The governance thesis, which is the reason to pick this plugin over a broader one.
Off by default
Every ability starts disabled. You open access one toggle at a time, and an update never widens it on its own.
Least-privilege identity
The agent connects as a real WordPress user through OAuth or an Application Password, never an admin-equivalent key. It takes that account’s capabilities, so you decide its reach by choosing which account approves the connection.
Two-layer capability gating
A connection only sees the tools its user can run, and the capability is re-checked before every call.
Zero outbound, single-sourced facts
No connectors, no telemetry, and every number on this site comes from one source so it never contradicts itself.
Where Agent Abilities falls short
The honest other side. If one of these matters most to you, Royal MCP may be the better fit.
Where we fall short
Fewer documented clients
We connect 9 clients today and do not document local models or as many platforms as Royal does.
Where we fall short
Less troubleshooting content, and a barer demo
Royal has a deeper library of host-specific fix guides. Our Playground blueprint opens the plugin with nothing switched on, so a first-time visitor has to know what to enable. Royal hands you a working setup to poke at. That is a real onboarding gap on our side.
Where we fall short
A narrower feature surface
Royal moves fast across a wide tool set. We keep a smaller, governed catalog on purpose, which means fewer edge-case tools.
Which should you choose
A short, honest rule of thumb.
Reach for Royal MCP if what it leads on maps to your priorities: more documented clients and platforms, local models, and a deep troubleshooting library.
Reach for Agent Abilities if you want an agent that starts with zero access, connects as a real WordPress account you choose rather than an admin key, is audited on every call including refusals, and makes no outbound requests. Governance and a tight boundary are the point.
Both are free, so the lowest-risk move is to install the one whose default matches how you want to start. See what a governed WordPress MCP server is, or read the governance model.
Comparing others too? See all MCP plugin comparisons.
Frequently asked questions
Direct answers about how the two compare.
Is Agent Abilities for MCP a free alternative to Royal MCP?
Yes. Both are free on WordPress.org with no Pro tier for the MCP plugin. Royal leans into platform breadth and support content; Agent Abilities leans into least-privilege identity and granular control.
Does Royal MCP send my data anywhere?
No. Royal states it makes no telemetry calls and no outbound connections to its own servers, and it supports local inference. On privacy it is close to Agent Abilities, so the real differences are elsewhere: the identity model, count consistency, and the paid suite around it.
What is the main difference?
Identity and default granularity. Royal’s API-key path runs as full admin, and scoping its tools needs code-level filters. Agent Abilities issues no key of its own: the agent is always a WordPress account, capped at that account’s capabilities, and every ability stays off until you toggle it on.
Which should I choose?
Choose Royal MCP if you want the widest documented client and platform coverage, local-model support, and its troubleshooting library. Choose Agent Abilities if you would rather the agent hold a WordPress account than an admin-level API key, want per-ability toggles instead of code filters, and want a plugin with no paid suite behind it.
Comparison based on each product's public documentation. Royal MCP claims were verified against royalplugins.com and the WordPress.org listing in July 2026 and are stated as their claims; their product may have changed since. Agent Abilities for MCP facts come from its own readme. Agent Abilities for MCP is not affiliated with, or endorsed by, Royal MCP.
Start with everything off.
Install Agent Abilities for MCP, keep every ability disabled, and turn on one at a time. Requires WordPress 6.9+ and PHP 7.4+. Free on WordPress.org.
Off by default, least privilege, and nothing leaves your site without you.