by
RuleFence
0 (0 reviews)
RuleFence – AI Agent Permissions & Audit for MCP
See what Claude, ChatGPT and MCP agents can do on your site - then allow, hold or block each ability, with a signed audit trail.
RuleFence ranks #62,827 among WordPress.org plugins with 0+ active installations, is #3,855 of 5,058 in the Security category, and was last updated Sep 24, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.0.0
Current Version v1.0.0
Updated 1 month ago
Last Update on 24 Sep, 2026
Refreshed 1 week ago
Last Refreshed on
#3,855 of 5,058 in Security
Rank
#62,827
—
No change
Active Installs
0+
-100%
KW Avg Position
N/A
—
No change
Downloads
335
+4 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
35,259
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 8 more installs to reach 10+
Rank Changes
Current
#62,827
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.0
- Last Updated
- Sep 24, 2026
- Requires WP
- 7.1+
- Tested Up To
- 7.1.4
- PHP Version
- 8.0 or higher
- Author
- RuleFence
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about RuleFence – AI Agent Permissions & Audit for MCP
Open the Ability Explorer after activating. It lists every Ability your installed plugins register, grouped by the plugin that registered it, with what each one does, how risky it is, and whether it is publicly exposed. You do not have to grant anything, connect anything, or configure anything to read it - and reading it is the point of installing this before you need it.
Use a dedicated least-privilege WordPress user for each security boundary you need to isolate. An agent is a separate RuleFence identity, but its Application Password still inherits the mapped WordPress user's native REST capabilities. Do not map an untrusted client to an administrator.
No, that is the default. Governance fails closed: an ability nobody granted is refused. Grant the specific ability in Abilities > Permissions.
Once, when the connection is created. It cannot be retrieved afterwards. If it is lost, revoke that connection and issue another.
Yes, and the list is telling you something real. WordPress 7.1 registers three Abilities of its own, all read-only: core/get-site-info and core/get-environment-info need an administrator, and core/get-user-info needs only a logged-in user. Everything beyond that comes from plugins, so a short list means the plugins on that site have not registered any - and there is correspondingly little for an agent to do there. Install WooCommerce and the list grows immediately, including writes with previews and captured before-states behind them. There is a wrinkle in the meantime. An Editor mapped to an agent can reach only one of the three, while still being free to write posts through the ordinary REST API, which the permission matrix does not cover. On a stock site the safest mapping and the useful one are not yet the same thing. That is WordPress's design rather than this plugin's, it improves as plugins register Abilities with sensible capabilities, and it is the reason the Readiness screen scores your mapping instead of assuming it.
It controls every Ability an agent invokes, which is what an AI client uses to work with your site. It does not sit in front of the ordinary WordPress REST API: a credential is a WordPress user, and that user's own capabilities decide what it can reach there. So map agents to a least-privilege user and keep it that way - the Readiness screen scores this, and the connection screen warns you if you point one at an administrator. The Activity trail records every Ability decision, and outside the Abilities API it records what a managed credential changed or was refused - so a change made through an ordinary REST route still appears, attributed to the agent that made it. Successful reads there are not kept one by one, because the trail is capped and a read-heavy client would crowd out the decisions.
Yes, and that is what the audit trail is for rather than a side effect of it. Every decision is stored with its reason in a hash-chained record, so the trail can demonstrate it has not been altered after the fact - by anyone, including this plugin. If you have to answer "what did the AI change, when, and who allowed it", the answer is on one screen and it is evidence rather than a log file.
Revoke its connection in Agents > Connections, or stop everything at once with Settings > Emergency mode. The record of what it already did stays intact and signed.
No. Agents, permissions, decisions and the audit trail are stored in your own database, and this plugin makes no outbound request of any kind - there is no webhook code in it to configure.
As many agents as you want, and everything on the governance side, are here: default-deny permissions, approvals, the signed audit trail, risk assessment, emergency mode, the readiness checks and runtime verification. The add-on sells automation and convenience - workflows, policies, undo, scheduling, export. No security control is ever sold; a control you have to buy is not a control. You do not need the add-on to use this plugin, and nothing here stops working without it.
