Let AI assistants edit your WordPress site via MCP.

Tested up to: 6.9 Stable tag: 3.0.28 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

This plugin exposes WordPress functionality through MCP (Model Context Protocol), enabling AI assistants to directly interact with your WordPress site. No more copy-pasting between chat and admin.

Example: "Fix the phone numbers in these 25 articles to be clickable tel: links." - Done in 30 seconds, all 25 articles.

Version 3.0 introduced a modular architecture. The core plugin provides WordPress-native abilities, while vendor-specific features are available as separate add-on plugins:

Total ecosystem: 258 abilities

Install only what you need. Running GeneratePress? Install that add-on. Don't use Elementor? Skip it.

• WordPress 6.9+
• PHP 8.0+
• Abilities API plugin (WordPress core team)
• MCP Adapter plugin (WordPress core team)
• Use the official Abilities API release ZIP (abilities-api.zip) so it installs as wp-content/plugins/abilities-api/abilities-api.php

1. Install and activate the required plugins:
   • Abilities API (official release ZIP): https://github.com/WordPress/abilities-api/releases/download/v0.4.0/abilities-api.zip
   • MCP Adapter: https://github.com/WordPress/mcp-adapter
2. Download the latest release from Releases
3. Upload via WordPress Admin → Plugins → Add New → Upload Plugin
4. Activate the plugin
5. (Optional) Install add-on plugins for vendor-specific features

See the add-on readme for the full list. Common abilities:

See the add-on readme for the full list. Common abilities:

WordPress Admin → Users → Your Profile → Application Passwords

Configure your MCP client to connect to:

https://yoursite.com/wp-json/mcp/mcp-adapter-default-server

Use HTTP transport with a Basic Auth header generated from your WordPress username and application password.

Your MCP client can now edit your WordPress site through conversation.

{
  "ability_name": "content/create-page",
  "parameters": {
    "title": "About Us",
    "content": "<!-- wp:paragraph --><p>Hello world!</p><!-- /wp:paragraph -->",
    "status": "publish"
  }
}

{
  "ability_name": "menus/add-item",
  "parameters": {
    "menu_id": 5,
    "title": "Contact",
    "url": "/contact/"
  }
}

{
  "ability_name": "media/upload",
  "parameters": {
    "url": "https://example.com/image.jpg",
    "title": "Hero Image",
    "alt_text": "Beautiful sunset"
  }
}

{
  "ability_name": "content/patch-post",
  "parameters": {
    "id": 123,
    "find": "+44 203 3181 832",
    "replace": "<a href=\"tel:+442033181832\">+44 203 3181 832</a>"
  }
}

• Authentication required - Uses WordPress application passwords
• Permission checks - Every ability verifies user capabilities
• Your server - AI connects to your site, you control access
• Protected options - Critical settings blocked from modification
• Filesystem hardening - PHP code detection, path traversal protection (in add-on)

Three-plugin stack plus optional add-ons:

1. Abilities API - Framework for registering abilities (WordPress core team)
2. MCP Adapter - MCP protocol layer (WordPress core team)
3. MCP Expose Abilities (this plugin) - Core WordPress abilities
4. Add-on plugins (optional) - Vendor-specific abilities

• Added featured_image_id support to post/page create and update abilities
• Added featured_image_id to content/get-post and content/get-page

• Fixed: content/get-next-post now applies the after_id floor correctly by allowing the query filter to run

• Added: content/get-next-post to find the next existing post after an ID, even when IDs have gaps
• Improved: content/list-posts now accepts case-insensitive order values and friendly orderby aliases like id and slug
• Improved: content/get-post now accepts post_type for slug lookups and returns clearer missing-post context

• Fixed: users/delete now loads wp-admin/includes/user.php before calling wp_delete_user() in REST/MCP contexts

• Performance: debug log reader now tails file content instead of loading full files
• Security: options/get blocks sensitive option names (tokens, keys, secrets)
• Schema: output schemas added for comments and taxonomy-association abilities

• Added: content/update-category ability
• Fixed: Translator comment for placeholder string in post type validation
• Fixed: Stable tag alignment with plugin version

• Fixed: Use literal text domain in translation calls
• Fixed: Add translators comments for placeholder strings

• Added: include_totals flag plus has_more/returned output for list-posts/list-pages/list-media to avoid expensive counts by default

• Added: plugins/upload-base64 now accepts zip_path for server-local zip installs
• Fixed: no-params abilities accept null input (menus/list, widgets/list-sidebars, widgets/list-available)

• Fixed: plugins/delete now loads core file helpers before deletion

• Added: Shared pagination normalization for core list abilities

• Fixed: plugins/upload now loads WordPress download helpers in non-admin contexts

• Added: plugins/upload-base64 ability for local file uploads

• Added: content/create-category ability

• Security: Added per-item capability checks for content, media, users, and comments

• Added: plugins/activate ability to activate installed plugins
• Added: plugins/deactivate ability to deactivate active plugins

• Improved: All 47 ability descriptions now include parameter hints

• Added: comments/create ability for top-level comments

• Added: plugins/delete ability to remove inactive plugins

• Fixed: Use WP_Filesystem API instead of native PHP functions
• Fixed: Replaced wp_get_sidebars_widgets with direct option call

• Added: Revisions abilities (content/list-revisions, content/get-revision)
• Added: Comments abilities (list, get, create, reply, update-status, delete)
• Added: author_id parameter for content creation

• Breaking: Modular architecture - vendor-specific abilities moved to add-on plugins
• Core plugin now contains only WordPress-native abilities
• Add-on plugins: Filesystem (10), Elementor (6), GeneratePress (5), Cloudflare (1), Google Workspace (8)
• Cleaner installation - install only what you need

• Security: Added protected options blocklist (active_plugins, siteurl, admin_email, etc.)
• Security: Prevents accidental site breakage via options/update

• Security: Added UTF-7 and UTF-16 encoding bypass detection
• Security: Blocks encoded PHP injection attempts

• Security: Major filesystem security hardening
• Security: PHP code detection in file writes
• Security: Path traversal protection
• Security: Restricted to wp-content directory

• Added: Filesystem abilities
• Added: Options abilities
• Added: System abilities
• Added: Cloudflare cache clear ability
• Added: elementor/update-element for targeted element updates

• Added: Menu, User, Media, Widget, Page abilities

• Initial release

PRs welcome! For vendor-specific abilities, consider creating an add-on plugin.

GPL-2.0+

Devenia - We've been doing SEO and web development since 1993.

• Plugin Page
• MCP Abilities - Toolset
• Abilities API (WordPress core team)
• MCP Adapter (WordPress core team)