by Unaib Amir 4.5 (2 reviews)

Agent Abilities for MCP – MCP Server with Permission Controls and Audit Log

Name: Agent Abilities for MCP – MCP Server with Permission Controls and Audit Log
Rating: 4.5 (2 reviews)
Author: Unaib Amir

WordPress MCP server. Connect Claude, ChatGPT, or any AI agent, with permission controls, off by default, and a full audit log.

Agent Abilities for MCP ranks #10,756 among WordPress.org plugins with 300+ active installations, is #1,667 of 12,372 in the E-commerce category, a 4.5/5 rating from 2 reviews, and was last updated Sep 15, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.1

v1.7.5 Current Version v1.7.5

Updated 4 days ago Last Update on 15 Sep, 2026

Refreshed 9 hours ago Last Refreshed on

#1,667 of 12,372 in E-commerce Top 25% by installs Downloads -17.4% this week Actively maintained

View on WordPress.org

Rank

#10,756

— No change

Active Installs

300+

+4185.7%

KW Avg Position

119

— No change

Downloads

3.8K

+67 today

Support Resolved

50%

— No change

Rating

90%

Review 4.5 out of 5

4.5 (2 reviews)

Next Milestone 400

Total Progress 43%

300+ 400+

737

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 57 more installs to reach 400+

Rank Changes

Current #10,756

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.5

2 reviews

Overall 90%

1 (50%)

0 (0%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

50%

Resolution Rate

Security History

Source: WPVulnerability

No known vulnerabilities on record for Agent Abilities for MCP. Checked 3 weeks ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.7.5
Last Updated: Sep 15, 2026
Requires WP: 6.9+
Tested Up To: 7.1.1
PHP Version: 7.4 or higher
Author: Unaib Amir

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.5
Reviews: 2
Support Threads: 2
Resolved: 50%

Keywords

ChatGPT Claude mcp mcp-server woocommerce

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,756

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

MonsterInsights - Google Analytics Dashboard for WordPress (Website Stats Made Easy)

Google for WooCommerce

800K+ installs

#75

WooPayments: Integrated WooCommerce Payments

800K+ installs

#76

WooCommerce PayPal Payments

800K+ installs

#81

WooCommerce Stripe Payment Gateway

700K+ installs

#85

WooCommerce Tax (formerly WooCommerce Shipping & Tax)

500K+ installs

#115

View all Ecommerce plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners who want to let AI agents like Claude, Cursor, or VS Code interact with their site through MCP. It solves the problem of giving AI agents controlled, auditable, least-privilege access to WordPress instead of exposing an admin-equivalent key.

153 governed abilities
Off by default
Two-layer capability gating
Honest audit log
OAuth or Application Password connection
Per-minute rate limit
IP allowlist
WooCommerce, ACF, Rank Math, Yoast, AIOSEO integrations

Frequently Asked Questions

Common questions about Agent Abilities for MCP – MCP Server with Permission Controls and Audit Log

No. The agent authenticates as whatever WordPress user you bind it to. Point it at the dedicated low-privilege user the plugin can create for you, and it can only do what that user can do. Each ability also re-checks the user's capability before it runs, so a connection can never call a tool its user is not allowed to use.

Yes, when the connection is scoped, which is what this plugin is built around. The agent connects as a real, least-privilege WordPress user you choose, never an admin-equivalent key. Every ability is off until you enable it, each call re-checks the user's capability before it runs, and every call is logged, denied attempts included. The plugin itself never holds an admin-equivalent key.

Only the abilities you have enabled, and only within the bound user's capabilities. The catalog is reads and guarded writes over posts, pages, terms, comments, media, post meta, and site structure, plus revision history and a search that spans every post type at once. There is no ability to change options arbitrarily, change roles, fetch a remote URL, or run code. An agent can only write post meta for keys an administrator has explicitly allowlisted, and protected, underscore-prefixed, and authentication keys can never be allowlisted. Deletes move content to Trash where the ability supports it, and the permanent ones are off by default and capability-gated.

Agent Abilities for MCP ships everything off, binds the agent to one WordPress user you pick, re-checks that user's capability on every call, and logs every call including denials. You add reach as you build trust, not all at once. It trades raw tool count for control you can audit.

Yes. Agent Abilities for MCP is free on WordPress.org, with no paid tier, no API key to buy, and no usage limits added by the plugin.

Yes, for a set of supported plugins. When one is active, Agent Abilities for MCP adds abilities for it under the same rules as the core: detected automatically, off until you turn them on, capability-gated, and logged. Version 1.0.0 covers WooCommerce, Advanced Custom Fields, and SEO (Yoast, Rank Math, and All in One SEO). The WooCommerce and ACF abilities can read and write real customer and order data, including personal data such as names, emails, and addresses, so they sit behind a clear notice in the admin and stay off until you switch them on. More integrations are planned.

It is built on both. WordPress 6.9 ships the Abilities API and the official MCP Adapter; Agent Abilities for MCP registers a curated, governed set of abilities on top of them rather than inventing its own protocol or transport. So there is no bespoke server to trust, and the plugin inherits the standard's behavior. What it adds is the governance layer: the off-by-default catalog, the capability gating, the safety controls, and the audit log.

The REST API exposes raw endpoints. MCP describes your site's abilities as discoverable tools an AI agent can reason about and call, and this plugin wraps each one in a governance layer: off by default, capability-gated on every call, and logged. It is the same underlying WordPress, governed so an agent can drive it within the limits you set.

WordPress 6.9 or newer, which is where the Abilities API and the official MCP Adapter the plugin builds on are available. PHP 8.0 or newer is required.

Any MCP client that can reach your site's endpoint. With OAuth you paste the endpoint URL into the client and approve the connection once in the browser; clients like Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Gemini CLI connect this way, some directly and some through the mcp-remote bridge that runs on your own machine. You can also connect with an Application Password instead of OAuth. The hosted ChatGPT and Gemini apps want a streamable HTTP/SSE remote connector, which the underlying adapter does not serve natively yet.