Four WordPress MCP plugins in one table
The head-to-head pages cover one rival at a time. This one puts Agent Abilities next to the three we are most often weighed against, on the dimensions that decide the choice. Every rival cell is their own published claim, dated, and every one of them is free to install, so you can test the answer rather than take ours.
| Dimension | Agent AbilitiesOurs | WPVibeChecked 20 August 2026 | Easy MCP AIChecked July 2026 | Enable Abilities for MCPChecked 28 September 2026 |
|---|---|---|---|---|
| Install base | 600+ active installs, 5 ratings (WordPress.org, checked 13 October 2026) | 70,000+ active installs, 117 ratings (WordPress.org, checked 13 October 2026) | 10,000+ active installs, 13 ratings (WordPress.org, checked 13 October 2026) | 4,000+ active installs, 12 ratings (WordPress.org, checked 13 October 2026) |
| Price | Free on WordPress.org. No paid tier, no API key to buy, no usage limits. | Free tier at 0 USD, then Pro at 99 USD a year, Power at 299, Agency at 599, and Scale at 899 | Free on WordPress.org, no paid tier | Free, donation supported |
| Agent connects as | A real WordPress user, never a key this plugin mints with a scope of its own. With an Application Password you point it at the dedicated low-privilege user the plugin creates for you. Over OAuth it takes the capabilities of whichever account approves in the browser, so approve as the account you want it limited to. | An Application Password their service creates and holds for you, encrypted at rest on their infrastructure | A bearer token bound to a WordPress user, or an OAuth client | Their own embedded OAuth 2.1 server with CIMD for claude.ai, RFC 7591 dynamic registration for ChatGPT behind an admin-managed callback allowlist, plus Application Passwords and a single-admin bearer token |
| Capability check | Two layers: a connection only sees the tools its user can run, and WordPress itself re-checks that user’s capability before every call. | Yes. Their listing describes file operations running "through WordPress capability checks, a path sandbox scoped to the draft theme, and PHP syntax validation before save" | Per-call capability check | Each user logs in as their own WordPress account and is held to that role |
| Audit log | Every call, denials included, with the principal, the argument keys, and the identifiers it touched but never free-text content, in your own database. | Yes: an append-only Approval Log in wp-admin recording every destructive operation, its preview, and its result | Yes: token, tool, redacted args, IP, result | Every ability execution logged under the real user’s name |
| Tool catalog | 179 governed abilities (85 core, 94 integration), plus a bridge for abilities other active plugins register. | Content management, media uploads, theme file work, REST API access, and abilities other plugins register. No total count stated on the pages checked | Advertises 283 tools on its WordPress.org listing (checked 28 September 2026) | 112 abilities across 21 categories (WooCommerce, The Events Calendar, JetEngine, Elementor, LearnDash, Tutor LMS, three SEO plugins, and more) |
| Business model | Open source. No affiliate links, no agency upsell, no partner directory shown to your users. | A free tier plus four paid tiers, from SeedProd | Open source, plus an affiliate directory, an agency, and a partner program | Open source, donation supported |
Each rival's claims were verified on the date in its column heading, not all on the same day, so treat the older columns as older. The install counts in the first row are newer: each cell carries the date it was re-checked. Where a cell says their listing does not state something, that means exactly what it says: we could not verify it either way, and we are not going to record an absence as a shortcoming. The per-rival pages carry the full picture, including where each one genuinely beats us.
Which WordPress MCP plugin should I pick?
It depends on what you are optimizing for, and all four are worth a look. Pick WPVibe if you want the shortest path to a working connection and do not mind a metered paid tier above the free one. Pick Easy MCP AI if you want its SEO tooling. Pick Enable Abilities for MCP if you already run the official MCP Adapter or need one of the integrations it covers and we do not. Pick Agent Abilities for MCP if you want one free plugin with no paid tier, your agent entering as a real WordPress user, and an audit log that records refusals as well as successes.
Is Enable Abilities for MCP the same plugin as Agent Abilities for MCP?
No. They are two separate plugins by two different authors, with names one word apart. Theirs is by fabiomontenegro1987 and needs the official MCP Adapter installed alongside it. Ours is a complete server on its own. The slugs are the quickest way to tell them apart: enable-abilities-for-mcp is theirs, agent-abilities-for-mcp is ours.
How current is this table?
Every rival column carries its own verification date in the row beneath the plugin name, because they were not all checked on the same day. Our column is generated from the plugin’s own data, so it moves when the plugin does. Rival claims are taken from their public listings and may have changed since the date shown.
The head-to-head pages: Agent Abilities vs WPVibe, Agent Abilities vs Easy MCP AI, Agent Abilities vs Enable Abilities for MCP, Agent Abilities vs Royal MCP, Agent Abilities vs miniOrange Secure MCP Server, Agent Abilities vs EMCP (Elementor MCP), Agent Abilities vs AI Engine.
Start with everything off.
Install Agent Abilities for MCP, keep every ability disabled, and turn on one at a time. 179 governed abilities, WordPress 6.9+ and PHP 7.4+. Free on WordPress.org.
Off by default, least privilege, and nothing leaves your site without you.