Agent Abilities for MCP – MCP Server for AI Agents
Changelog
1.1.1
AI agents that write pages, posts, or templates are now steered to keep block styling in the block attributes instead of inline CSS, the mistake that made blocks show “unexpected or invalid content” in the editor.
Block markup is checked before it is saved, and anything that would break in the editor is flagged back to the agent to fix on its next try.
A new strict option under Safety controls rejects a write outright when its block markup would be invalid, off by default so existing sites are unchanged.
1.1.0
Bridge abilities from your other plugins: any active plugin that registers abilities through the WordPress Abilities API can now be exposed as a governed MCP tool, opt-in per ability and off by default, on a new “Abilities from other plugins” screen grouped by the source plugin.
Turn a whole plugin’s abilities on or off at once, with each source plugin’s name shown in title case.
Bridged abilities run under the full governance layer: a capability re-check on every call, rate limiting, and the same audit log as the built-in catalog.
Added a WP-CLI catalog exporter, wp aafm catalog export, that lists a site’s discoverable abilities as JSON.
Refreshed the branding with a new icon, banner, and a matching admin menu mark.
Added a WordPress Playground blueprint so the plugin page can offer a one-click live preview.
1.0.0
Initial release.
153 governed abilities: 83 across WordPress core (reads and guarded writes for posts, pages, terms, comments, media, users, post meta, revisions, blocks, templates, and site structure, plus a search that spans every post type) and 70 from auto-detected integrations for WooCommerce, Advanced Custom Fields, Yoast, Rank Math, and All in One SEO.
Built on the WordPress Abilities API and the official MCP Adapter, with no custom transport.
Connect over OAuth in the browser, or with a least-privilege Application Password user.
Everything off by default, with two-layer capability gating and per-connection tool filtering.
Optional safety controls: rate limit, IP allowlist, force-to-draft, and title-length cap.
Audit log that records every call, denied attempts included.
Guided connection screen with endpoint diagnostics.
