WordPress MCP server for Claude and ChatGPT, with limited access and an audit log

Agent Abilities for MCP is a free WordPress MCP server plugin that exposes WordPress abilities to AI agents. You connect Claude, ChatGPT, Cursor or another MCP client to your site, and the AI works as a WordPress user you pick and gets exactly that user’s role. An Editor connection means limited access, not admin: it can write and edit posts, and it can’t install a plugin or change a setting.

It suits site owners, agencies and developers who want an AI agent working on the site without an admin login. Let Claude or ChatGPT draft posts without publishing them, or give either read-only access so it can look around.

Once connected, you can ask things like:

“List my five newest drafts and tell me which ones have no featured image.”
“Fix the typo in the second paragraph of the About page.”
“Which WooCommerce orders are still on hold?”
“Write a post about the spring sale and save it as a draft.”

There are 186 abilities (the tools an AI client can call), 92 for WordPress itself and 94 for plugins such as WooCommerce, ACF and Yoast SEO. Every one starts switched off.

What is a WordPress MCP server?

MCP, the Model Context Protocol, is an open standard that lets an AI app ask a service what it can do and then call it, and a WordPress MCP server is a site that answers. Give Claude or ChatGPT your site’s MCP endpoint, the URL on the plugin’s Connection tab, and it can look up an order or draft a post directly instead of you copying text between a chat window and wp-admin.

Connect Claude to WordPress

Switch on the abilities you want and copy your endpoint from the Connection tab. In Claude, open Customize, then Connectors, choose + Add, then Add custom connector, and paste the endpoint. Approve the sign-in once in your browser. On Team and Enterprise plans an Owner (or, on Enterprise, a role with the right permission) has to add the connector first, under Organization settings, then Connectors.

Anthropic’s help article lists custom connectors on Free (one custom connector), Pro, Max, Ultra, Team and Enterprise. Claude connects from Anthropic’s cloud, so your site has to be reachable from the public internet.

Connect ChatGPT to WordPress

On ChatGPT web, open Plugins, select the plus button, then Add custom MCP server, name it, paste your endpoint under Connection, choose OAuth for authentication, tick the risk acknowledgment and select Create as a plugin. You don’t need to turn on Developer Mode first.

OpenAI’s help article says custom MCP servers and full MCP, writes included, are available on Business and Enterprise/Edu, and that Pro can connect with read and fetch permissions, but it doesn’t mention Free or Plus. On Business, admins and owners add the server, while on Enterprise/Edu admins can, and so can members they grant access to. It’s a web feature only.

Manage multiple WordPress sites from Claude or ChatGPT

Install the plugin on each site and add each endpoint as its own connector. Every site keeps its own user, switches and audit log, so an agency can open one client’s site to the AI without touching the others.

Let Claude or ChatGPT edit WordPress posts without admin access

The role you connect as sets the limit: an Editor can write and edit any post, an Author only its own, and a Contributor can write without publishing. The catch is that on a new install only Administrators can approve a connection. Tick Editor under Roles that can connect on the Settings tab, approve as an administrator and pick the Content editor preset, or use the Application Password route with an agent user you’ve given the Editor role.

Let Claude or ChatGPT draft posts without publishing

Start with Force draft on create in Settings. What the AI creates or tries to publish as a post, page, custom content item, reusable block or WooCommerce product is saved as a draft instead, and a product variation is saved as disabled (private).

The Needs review card on the Dashboard lists those drafts with Preview, Open in editor, Publish and Discard buttons, and Discard moves the post to the Trash. Edits to a post that is already live still go live, so connect the AI as a Contributor, who can’t edit published posts, if every change needs your approval.

Give an AI agent read-only access to WordPress

Turn on read-only mode in Settings and this plugin unloads every write tool, including write tools bridged from other plugins, so the AI can search and read but can’t change anything through it. Your selections come back when you switch it off. To limit a single connection instead, pick the Read only preset when you approve it.

Update ACF fields and edit one block

With ACF active, the AI can read a post’s fields and write new values, each sanitized for the field’s type. It can also edit a single block: it lists your block types, reads a block’s settings (an ACF block adds its field names) and swaps one block with Replace block, without resending the page.

Limit what an AI agent can do on your site

These controls cover this plugin’s own tools, plus any tool from another plugin that you switch on from the Other plugins tab. Each call is checked against the capabilities of the WordPress user the AI connects as, over OAuth or an Application Password.

Pause all access on the Connection tab is the emergency stop, the one switch that pauses all agents at once. It refuses every MCP request through your site, OAuth apps and Application Passwords alike. An Application Password can still use the rest of the REST API, so revoke it too for a full cut-off. To pause an AI agent without disconnecting it, use Pause and Resume next to Revoke on an OAuth connection. An OAuth connection can also get an end date, for access that expires, and a lower rate limit of its own; an Application Password has neither.

When you approve an app, or run Quick Connect, you pick an access preset (Read only, Content editor, Shop manager or Custom) that only ever narrows what is already switched on. Per-role and per-connection allowlists narrow it further, since a tool has to be in the global list, the role’s list and the connection’s list before the AI can call it. The rate limit, the IP allowlist, Force draft on create and a maximum title length sit on the Settings tab and do nothing until you set them.

Ten WooCommerce tools that move money or grant authority (refunds, creating and changing orders, customer updates, payment gateways, coupons and tax rates) stay locked until you unlock them in Settings, even if you’ve ticked them. Deletes work differently: the tools named Trash post and Trash page move content to the Trash, but most tools named Delete, such as Delete post, Delete page and Delete media, remove it permanently.

What these controls do not cover

The MCP Adapter has a built-in default server that other plugins can publish their own tools to. Tools on that server sit outside this plugin’s controls, so its read-only mode, allowlists, IP allowlist, rate limit and audit log do not apply to them. Pause all access is the exception, since it refuses requests to that server too. A Settings choice, Allow the MCP Adapter’s default server, takes Automatic (the default, which runs it only when another plugin publishes tools there), Always on or Always off. This plugin’s own tools are never on that server.

Audit log: see what the AI did on your site

The audit log is the Activity Log tab. Every call to one of this plugin’s tools lands there, denied calls included, with the reason for a denial. A row shows who made the call, the connection and source IP, the tool, the argument names, how long it ran and a short note on what it touched (ids, slugs and meta key names, never post text or email addresses).

You can filter by user, connection, tool, plugin, date or text, watch the Live view and export what the filters show as CSV. The log is a table in your own database.

Playbooks and Site Brief: standing instructions for AI agents

Write a checklist once on the Playbooks tab, such as how to check a draft before it goes out, and the AI loads it when a task matches. Five starters come built in and arrive switched off. Site Brief on the Settings tab holds a few standing rules, such as your spelling or pages to leave alone, that every agent gets when its session starts.

Two read tools, List playbooks and Get playbook, stay off until you enable them on the Abilities tab. With both on, the AI sees your Active playbooks when a session starts and loads one with Get playbook. It reads the text word for word, so keep passwords and private details out, and agents can’t edit playbooks. A playbook or the Site Brief is guidance the AI may follow, so the controls above still decide what it can do.

AI for WooCommerce, ACF, Yoast SEO and other plugins

When one of these plugins is active, its abilities appear on the Integrations tab. WooCommerce has the most, 52, covering products, variations, orders, customers, coupons, shipping, tax, payment gateways and reports, and because they reach names, emails and addresses an admin notice flags them. ACF adds 7 for field groups and the field values on posts, terms and users, and Rank Math (5), Yoast SEO (3), All in One SEO (3) and Slim SEO (2) let the AI read and edit a post’s SEO data.

The Events Calendar has 13 abilities, Event Tickets has 3, and Avada has 2 that read a page’s Fusion Builder markup and replace text inside it. GeoDirectory has 4 for business listings, which stay off until you enable that integration on the Integrations tab, even when GeoDirectory is active.

Minimum versions: WooCommerce 9.1, All in One SEO 4.9.8, The Events Calendar 6.17.3.1 and Event Tickets 5.29.3.1. Below these, their tools stay hidden and the Integrations tab says why.

Plugins that register their own abilities with the WordPress Abilities API appear on the Other plugins tab, and this plugin does not filter what another plugin’s ability returns.

Each tool shows which plugin provides it (or its namespace, when the plugin cannot be identified), carries a Read, Write or Destructive label from the plugin’s own annotations (an unlabelled tool is treated as Destructive and says so), and gets a notice when it may return personal data (a hint from the plugin and tool name, not a full check). Tools a plugin update adds wait for your review.

A plugin that doesn’t declare its reads as read-only has them treated as writes, so read-only mode unloads them. A tool whose own permission check needs an item id is listed for anyone who can edit posts, and that plugin’s own check refuses the call if their role can’t run it.

Built on the Abilities API and the MCP Adapter

WordPress 6.9 added the Abilities API, and the official MCP Adapter turns those abilities into MCP tools. The Adapter comes bundled, so there is nothing else to install, and if you also run the standalone Adapter plugin, this plugin uses whichever copy loads first.

Elementor, Divi and other page builder pages: AI edits are refused

A page builder owns its page’s layout, so an edit to the post text can report success and change nothing on the page. For Elementor, Divi, Beaver Builder, Avada, Visual Composer, Oxygen, Breakdance, Brizy, Bricks and WPBakery the plugin checks first and refuses the write with an error naming the builder. There are two exceptions: an edit that only sets the excerpt goes through and leaves the stored content as it was, unless the plugin can’t tell which builder owns the post, and Avada’s two own tools can change text and refuse shortcode changes.

Is this the right WordPress MCP plugin for you?

It fits if you want to decide tool by tool what an AI agent can do. Your AI client talks straight to your site: the plugin calls no AI provider, sends no telemetry and has no relay, account or API key of ours in the path.

It’s a poor fit if you want every tool on from day one, or an undo for every kind of change. The Changes tab can revert changes from 25 of this plugin’s tools for 30 days. Changes from its other tools can’t be undone, including permanent deletes, orders, refunds, user accounts and file uploads.

Compatible clients

Any MCP client that can reach your endpoint can connect. Claude (web and Desktop), ChatGPT and Manus are hosted apps and use OAuth, while Claude Code, Cursor, VS Code, Windsurf and Gemini CLI can use OAuth or an Application Password. The hosted Gemini app is not supported yet. A client that can’t connect directly can go through a bridge such as mcp-remote, which runs on your own machine.

Disclaimer

The Model Context Protocol is an open specification that Anthropic originally developed. Claude, ChatGPT, Cursor, VS Code, Gemini and other product names belong to their owners, and Agent Abilities for MCP is a third-party plugin that isn’t affiliated with, endorsed by or sponsored by any of them.

External Services

This plugin calls no AI provider and sends no telemetry.

It makes two kinds of outbound request on its own. The first is the Connection tab’s checks, which are requests your site makes to its own address to test the MCP endpoint, the headers and body it receives and, with OAuth on, the discovery documents. The second only happens if you enable the upload-media-from-url ability, which is off by default: it fetches the exact HTTPS URL your AI client supplies so the file can be added to your media library, refuses private and reserved addresses and follows no redirects. The server at that URL sees the URL, your site’s IP address and the time of the request, and the request carries none of your content, credentials or site data.

Connecting a client happens in the client. Some clients reach your endpoint directly, and others use a bridge that runs on your own machine and is not bundled with the plugin:

mcp-remote: https://www.npmjs.com/package/mcp-remote
@automattic/mcp-wordpress-remote: https://www.npmjs.com/package/@automattic/mcp-wordpress-remote

Agent Abilities for MCP – Connect Claude and ChatGPT with Permission Controls and Audit Log