Open-source WordPress MCP plugin gives agents least-privilege access, not admin keys
wpninjapro · reddit · 2026-07-24
The developer launched Agent Abilities for MCP, a free open-source WordPress plugin that turns a site into a governed MCP server so AI clients like Claude, ChatGPT, Cursor, and VS Code can read and write content without using an admin-equivalent key.
Key points:
- The agent connects as a real WordPress user with only the capabilities you explicitly grant.
- A fresh install exposes no tools by default; abilities are enabled one by one.
- It is self-hosted, makes no outbound calls, has no telemetry, and stores logs locally.
- The implementation is based on WordPress 6.9’s Abilities API and the official MCP Adapter.
- The author emphasizes the limits: OAuth/application-password connections still inherit a user’s full capabilities, so security depends on which user you bind and which abilities you enable.
The post includes links to the WordPress.org directory and GitHub repo, and asks other builders what actions an agent should never be allowed to perform on a live site.
More from coding & agent
- Codex users can enable realtime conversation with a config.toml flag — rudrank · 2026-07-24
- ChatGPT Voice on desktop becomes a planning mode that turns ideas into Codex tasks — jxnlco · 2026-07-24
- A plugin lets agents control Codex Micro lights for email, Stripe and subagents — dkundel · 2026-07-24
- LangChain shows how Rillet uses LangSmith to monitor AI agents across 500+ customers — LangChain · 2026-07-24
- Localbrain turns any app into an offline, OpenAI-compatible local AI service — Everglow915 · 2026-07-24
- Nous Research’s Hermes Agent sends its first message in Buzz — Teknium · 2026-07-24