by Fabio Montenegro 5 (17 reviews)

Enable Abilities for MCP

Name: Enable Abilities for MCP
Rating: 5.0 (17 reviews)
Author: Fabio Montenegro

Connect Claude, ChatGPT & any MCP client to WordPress. 112 abilities: content, SEO, WooCommerce, FSE, LMS & more. Free & self-hosted.

Enable Abilities for MCP ranks #3,026 among WordPress.org plugins with 5,000+ active installations, is #420 of 14,124 in the E-commerce category, a 5/5 rating from 17 reviews, and was last updated Oct 16, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v2.13.7 Current Version v2.13.7

Updated 3 weeks ago Last Update on 16 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#420 of 14,124 in E-commerce Top 5% by installs Downloads +68% this week Actively maintained

View on WordPress.org

Rank

#3,026

— No change

Active Installs

5K+

+25%

KW Avg Position

37.3

1 worse

Downloads

61.5K

+1,226 today

Support Resolved

100%

— No change

Rating

100%

Review 5 out of 5

5 (17 reviews)

Next Milestone 6K

Total Progress 73.9%

5K+ 6K+

103

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 261 more installs to reach 6K+

Rank Changes

Current #3,026

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

5.0

17 reviews

Overall 100%

17 (100%)

0 (0%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

100%

Resolution Rate

Security History

Source: WPVulnerability

No known vulnerabilities on record for Enable Abilities for MCP. Checked 3 months ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.13.7
Last Updated: Oct 16, 2026
Requires WP: 6.9+
Tested Up To: 7.1.4
PHP Version: 8.0 or higher
Author: Fabio Montenegro

Support & Rating

Rating: ★ ★ ★ ★ ★ 5
Reviews: 17
Support Threads: 8
Resolved: 100%

Keywords

AI content management mcp rest-api woocommerce

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)

Google for WooCommerce

800K+ installs

#74

WooPayments: Integrated WooCommerce Payments

800K+ installs

#76

WooCommerce PayPal Payments

800K+ installs

#82

WooCommerce Stripe Payment Gateway

700K+ installs

#85

WooCommerce Tax (formerly WooCommerce Shipping & Tax)

500K+ installs

#115

View all Ecommerce plugins

TL;DR

AI summary of the plugin's readme

Enable Abilities for MCP is for WordPress site owners who use the MCP Adapter to connect AI assistants to their site via the Abilities API. It solves the problem of controlling which content management abilities are exposed to those AI assistants by letting admins enable or disable each one individually.

Per-ability enable/disable toggles
Admin dashboard with toggle switches
24 abilities in 5 categories
Get posts with filters
Create, update, delete posts
Rank Math SEO metadata support
Search and replace post content
Site statistics overview

Frequently Asked Questions

Common questions about Enable Abilities for MCP

Yes. This plugin requires WordPress 6.9+ (which includes the Abilities API) and the MCP Adapter plugin to connect abilities with AI assistants like Claude.

Yes. On first activation, all abilities are enabled. You can disable any of them from Settings > WP Abilities.

Write abilities respect WordPress capabilities. For example, creating a post requires the publish_posts capability, and editing checks per-post permissions. The MCP user must have the appropriate WordPress role.

Yes. The plugin can be network-activated. Each site in the network has its own ability configuration, its own OAuth toggle, and its own connector URL — enabling MCP on one subsite never exposes the others. For subdirectory networks (site.com/blog-a, site.com/blog-b) the claude.ai OAuth connector needs the plugin network-activated (or active on the main site): OAuth clients resolve discovery documents against the domain root, which belongs to the main site, so the plugin bridges those requests to the owning subsite automatically.

Yes. The Custom Post Types section automatically detects WooCommerce products, orders, coupons, and any other registered post type. You can list, create, update, and delete items with full access to WooCommerce meta fields like _price, _sku, _stock_status, _regular_price, and more.

This plugin registers abilities using the standard wp_register_ability() API. You can register additional abilities in your own plugin using the wp_abilities_api_init hook.

Yes. Since 2.2, abilities registered by other plugins appear in the Abilities tab under their own "Third-party" section, grouped by plugin namespace, with the same toggles as this plugin's abilities. New third-party abilities start enabled; disabling one unregisters it before any MCP server can expose it — including this plugin's claude.ai OAuth connector and the other plugin's own MCP endpoint. Disabled abilities stay listed so you can re-enable them at any time.

In almost every reported case the OAuth flow is fine and the request never reaches WordPress: a security layer in front of your site is blocking Anthropic's backend, which connects with a non-browser User-Agent (python-httpx). Common culprits are hosting WAFs (cPGuard, Imunify360, ModSecurity rules like "generic HTTP client User-Agent") and Cloudflare's Bot Fight Mode or AI-crawler blocking. To diagnose, run curl -A "python-httpx/0.28.1" https://your-site.com/.well-known/oauth-authorization-server from an external machine — a 403 confirms the block. Ask your host to allow that User-Agent (or Anthropic's IP range 160.79.104.0/23) for /.well-known/oauth-*, /oauth/*, and /wp-json/mcp/*, or disable the relevant bot protection for the site.

Turn on the OAuth server on the Connection tab, then turn on ChatGPT & Other OAuth Connectors below it. Check the Allowed callback URLs box — it is prefilled with the callbacks ChatGPT is commonly seen to use, so confirm the exact one your connector screen shows and delete the rest. Save, then in ChatGPT turn on Developer mode (available on paid plans) and create a connector with the same MCP server URL. ChatGPT reads the discovery document, finds registration_endpoint, registers itself, and runs the normal login-and-consent flow. The callback allowlist is the security boundary: a self-registered client can only ever return a user to a URL you listed.

The discovery documents do advertise S256, and checking them in a browser proves nothing: ChatGPT reads them server-side with the same non-browser User-Agent Claude uses (python-httpx). When a WAF or bot protection answers that request with a 403 or an HTML challenge page, ChatGPT never gets the authorization-server document and falls back to the protected-resource document, which has no PKCE field — hence this error. Diagnose it like the claude.ai case above, with curl -A "python-httpx/0.28.1" https://your-site.com/.well-known/oauth-authorization-server from an external machine, and ask your host to allow that User-Agent for /.well-known/oauth-*, /oauth/*, and /wp-json/mcp/*. With WP_DEBUG_LOG on, [DISCOVERY] request received lines in wp-content/debug.log tell you whether the request reached WordPress at all.