Governed, off by default

The WordPress MCP server built for governance

A WordPress MCP server lets an AI agent discover and call your site's abilities as tools. Agent Abilities for MCP turns any WordPress site into one, and wraps every ability in a governance layer first: off by default, scoped to a least-privilege user, and audited on every call.

Get it free on WordPress.org See the governance model

The short version

A WordPress MCP server exposes your site to AI agents as callable tools. Agent Abilities runs a governed one: nothing is on until you switch it on, the agent acts as a real scoped user, and every call is logged.

In one line: Your WordPress site, exposed to AI agents as governed MCP tools.
Default posture: Off by default. You enable one ability at a time.
Connects as: A real WordPress user, never an admin key. Its reach is that account's capabilities.
Built on: The WordPress 6.9+ Abilities API and the official MCP Adapter.
Price: Free on WordPress.org. No paid tier.

What a WordPress MCP server is

A WordPress site that speaks the Model Context Protocol, so an AI client can find out what the site can do and call those abilities as tools.

MCP, the Model Context Protocol, is the standard way an AI client talks to tools. A WordPress MCP server is your site on the other end of that connection: instead of a person clicking around wp-admin, an agent connects in, reads a list of abilities the site offers, and calls the ones it needs. Draft a post, update a product, read the latest orders, tidy a taxonomy, all as structured, typed tool calls rather than screen-scraping the dashboard.

The connection runs one way. Your AI client reaches in to your site. The plugin never reaches out to an AI provider, and no content leaves your server on its own. That direction matters: it means the whole exchange stays inside infrastructure you already control.

Agent Abilities for MCP adds this to any WordPress site. It builds on two open standards already in the platform, the WordPress 6.9+ Abilities API and the official MCP Adapter, so there is no bespoke transport of ours sitting in the path. What it adds on top is the part most integrations skip: a governance layer around every ability.

What "governed" means here

Connecting an agent to a site that can publish, edit, and delete is only safe if the connection is scoped. Governance is the whole point of this server, not a settings panel bolted on later.

Plenty of ways exist to hand an AI agent the keys to a WordPress site. Most of them do exactly that: hand over broad access through an admin-level token and hope the agent behaves. A governed MCP server starts from the opposite assumption. The agent gets the least it needs, nothing is on until you turn it on, and everything it does is written down.

Off by default

Nothing is exposed until you enable it, and updates never silently widen access.

Least privilege by design

The agent connects as a real WordPress user, never an admin-equivalent key. It takes the capabilities of whichever account approves the connection, so approve while logged in as the account you want the agent to be. With an Application Password you pick that account up front.

Two-layer capability gating

A connection only sees the tools its user can call, and every call re-checks that capability before it runs.

Honest audit log

Every call is recorded, denied attempts included, with the principal and the argument keys, never the values. It lives in your own database.

Bounded by construction

No arbitrary option or meta access, no remote URL fetch, no code execution. Deletes go to Trash where supported; the last administrator can never be removed.

No data leaves your site

The plugin contacts no AI provider and no external service. Your AI client connects in; the plugin never reaches out. Zero telemetry.

Every one of these is a real control in the plugin, not a promise in a brochure. The features page walks through each, and the security page covers the trust model and how to report a problem.

How it works

Three moving parts: the WordPress Abilities API declares what a site can do, the MCP Adapter exposes those abilities as tools, and your AI client calls them.

Nothing here is a black box. WordPress 6.9+ added the Abilities API, a registry where plugins and core declare abilities, each with a typed input and output schema and a permission check. Agent Abilities registers its own governed catalog there and can also bridge abilities your other active plugins declare. The official MCP Adapter reads that registry and presents each enabled ability to an AI client as an MCP tool.

Your WordPress site

Abilities are declared in the WordPress 6.9+ Abilities API, the built-in registry of what a site can do.

The MCP Adapter

The official adapter turns each enabled ability into an MCP tool. No custom transport in the path.

Your AI client

Connects in over MCP, discovers only the tools it is allowed to see, and calls them.

The Abilities API, explained

What the WordPress 6.9+ registry is, how a plugin registers an ability, and how it becomes an agent tool.

Read the guide

Bridge other plugins

Expose the abilities your other active plugins register through the same API, governed the same way and off by default.

See the bridge

What an agent can do

Agent Abilities ships 153 governed abilities: 83 across WordPress core plus 70 from auto-detected integrations. Each is off until you enable it.

Across WordPress core

Reads and guarded writes over the content and structure a site is built from. A sample of the 83:

Browse all 153 abilities

Through integrations

When a supported plugin is active, its abilities appear too, off until you switch them on:

See the integrations

Connecting your AI client

Turn on the abilities you want, copy your endpoint, and point your client at it. 9 clients connect today.

The simplest path is OAuth: paste your site's MCP endpoint into your client and approve it once in the browser, with no secret to store. The agent then acts as the account that approved it, so log in as the account you want the agent to be before you approve. The alternative is an Application Password bound to a dedicated low-privilege user, which the plugin's Connection tab helps you set up and check. Either way, the agent only ever holds the access that one WordPress user has.

Working today: ChatGPT, Claude.ai, Manus, Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI. ChatGPT connects through its Developer Mode custom connectors, a beta feature on its paid plans. Each client has its own setup guide, including the macOS, Linux, and Windows differences where they matter.

Client setup guides

Step-by-step connection walkthroughs for every client that works today, per operating system.

Pick your client

Getting started

The four steps from install to first call, plus what to check if the connection does not come up.

Read getting started

Is it safe

An MCP server that can edit and delete content is only as safe as its limits. This one is bounded by construction and honest about what it records.

The agent can only do what the user you bound it to can do, and the capability is re-checked before every call, not trusted from the moment of connection. Deletes go to Trash where WordPress supports it, so they can be restored, and the last administrator can never be removed no matter what an agent asks. There is no arbitrary option or meta access, no remote URL fetch, and no code execution.

Every call lands in an audit log in your own database, denied attempts included, with the principal and the argument keys but never the values. And because the plugin makes no outbound calls and keeps no telemetry, nothing about that activity leaves your site. The security page covers the full model and the vulnerability-disclosure path.

Frequently asked questions

Direct answers to what people ask about running a WordPress MCP server.

What is a WordPress MCP server?

It is a WordPress site that speaks the Model Context Protocol, so an AI client can discover and call the site's abilities as tools. Agent Abilities for MCP adds one to any WordPress site, built on the WordPress 6.9+ Abilities API and the official MCP Adapter, and wraps every ability in a governance layer before an agent can reach it.

Is Agent Abilities really free?

Yes. It is free on WordPress.org, with no paid tier, no API key to buy, and no usage limits. The plugin also makes no outbound calls of its own, so there is no metered service behind it.

How is a governed MCP server different from other WordPress MCP plugins?

Not on tool count. In Agent Abilities for MCP the agent enters as a WordPress user rather than through a key the plugin issues with a scope of its own, and WordPress re-checks that user's capabilities before every call. Every ability is off until you enable it, and every call is written to an audit log in your own database, refusals included. Other WordPress MCP plugins describe strict defaults and audit logs too, so the rest of the answer matters: nothing in the chain belongs to a vendor, and there is no paid tier behind the free plugin.

Do I need to write code to run one?

No. Install Agent Abilities for MCP, turn on the abilities you want, and connect your AI client. There is no code to write and no external service to configure.

Which AI clients can connect to a WordPress MCP server?

ChatGPT, Claude.ai, Manus, Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI connect today. Most connect directly or through the open-source mcp-remote bridge that runs on your own machine, and ChatGPT connects through its Developer Mode custom connectors, a beta feature on ChatGPT's paid plans. The Gemini app is not supported yet, because it wants a streamable HTTP connector the adapter does not serve natively yet.

Is it safe to run an MCP server on my WordPress site?

It is designed to be. Nothing in Agent Abilities for MCP is exposed until you enable it. The agent is scoped to a least-privilege WordPress user, never an admin key. The capability is re-checked before every call, not trusted from the moment of connection. Deletes go to Trash where WordPress supports it, so they can be restored. The last administrator can never be removed, no matter what an agent asks. The plugin makes zero outbound calls and keeps zero telemetry.

Run a governed WordPress MCP server.

Install Agent Abilities for MCP, keep everything off, and turn on one ability at a time. Requires WordPress 6.9+ and PHP 7.4+. Free on WordPress.org.

Get it on WordPress.org See the governance model

Off by default, least privilege, and nothing leaves your site without you.