by
KevinPlugins
0 (0 reviews)
MCP Abilities Guard – Allow, reject, or hold for approval — or undo — any MCP action
Allow, reject, or hold for approval — or undo — any MCP action an AI agent takes on your WordPress site.
MCP Abilities Guard ranks #72,105 among WordPress.org plugins with 0+ active installations, and was last updated Oct 3, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.0.0
Current Version v1.0.0
Updated 1 month ago
Last Update on 03 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
Rank
#72,105
—
No change
Active Installs
0+
-100%
KW Avg Position
110
2 worse
Downloads
318
+1 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
44,537
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 10 more installs to reach 10+
Rank Changes
Current
#72,105
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.0
- Last Updated
- Oct 03, 2026
- Requires WP
- 6.9+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- KevinPlugins
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade Now
Frequently Asked Questions
Common questions about MCP Abilities Guard – Allow, reject, or hold for approval — or undo — any MCP action
It should. The guard attaches to abilities as WordPress registers them, so it does not care which plugin later exposes them. Tool calls are recognised by the MCP protocol's own message shape rather than by any particular plugin's endpoint, so no per-plugin support is needed.
No. Everything is set from the admin screen.
Require approval holds the call and waits for a person. Always reject refuses it outright, tells the agent not to retry and not to attempt the same change another way, and records the attempt. Use reject for things no agent should ever do, so you are not answering the same prompt repeatedly.
It is told the request is queued, that nothing has changed, and that it should not retry. It can look up the outcome later through an ability the plugin registers for exactly that purpose. Agents told only "denied" tend to look for another route, which is why the wording matters.
It does nothing on front-end page loads. The work happens only while an ability is executing, which is an admin or API request.
Its code is inspected before it runs, which is usually enough to tell a read from a write from a removal. If that is inconclusive it runs like an ordinary write. With Hold removals on, a call detected — or later observed — to delete is held even if it was never seen before. Nothing is ever labelled read-only on a guess.
Not on its own. This plugin's job is to stop the change before it happens, and to keep an honest record that it did. Reverting one afterwards means storing every affected object's previous state, which is a real cost and belongs with the feature that needs it — MCP Abilities Guard Pro. Email, outbound requests and file writes cannot be undone by anything, at any price. They are not held by default — holding every incidental email would be unusable — but every one is recorded, and you can put a require-approval rule on a specific outbound tool if it is worth stopping.
Yes. A caller proven by authentication can be given its own rules. A caller that merely says who it is can be told apart in the request queue and can have rules made stricter, but never looser — otherwise any client could claim to be your trusted one.
In the free plugin a held request is applied by the first administrator who approves it. Requiring several approvers — naming specific users or roles, and choosing whether any one of them or all of them must sign off — is part of the Pro add-on.
It was probably never registered as an ability. Check the Coverage screen: tool calls that did not map to a registered ability are listed there. Its author would need to register those tools with the Abilities API for them to become governable.