MCP Expose Abilities

Let AI assistants edit your WordPress site via MCP.

Tested up to: 6.9 Stable tag: 3.0.9 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

What It Does

This plugin exposes WordPress functionality through MCP (Model Context Protocol), enabling AI assistants like Claude to directly interact with your WordPress site. No more copy-pasting between chat and admin.

Example: "Fix the phone numbers in these 25 articles to be clickable tel: links." - Done in 30 seconds, all 25 articles.

Modular Architecture

Version 3.0 introduced a modular architecture. The core plugin provides WordPress-native abilities, while vendor-specific features are available as separate add-on plugins:

Total ecosystem: 79 abilities

Install only what you need. Running GeneratePress? Install that add-on. Don't use Elementor? Skip it.

Requirements

• WordPress 6.9+
• PHP 8.0+
• Abilities API plugin (WordPress core team)
• MCP Adapter plugin (WordPress core team)

Installation

1. Install and activate the required plugins (Abilities API and MCP Adapter)
2. Download the latest release from Releases
3. Upload via WordPress Admin → Plugins → Add New → Upload Plugin
4. Activate the plugin
5. (Optional) Install add-on plugins for vendor-specific features

Core Plugin Abilities (49)

Content Management (20)

Menu Management (7)

User Management (5)

Media Library (4)

Widget Management (3)

Plugin Management (5)

Comments (6)

Options (3)

System (3)

Add-on Plugin Abilities

Filesystem (mcp-abilities-filesystem) - 10 abilities

Elementor (mcp-abilities-elementor) - 6 abilities

GeneratePress (mcp-abilities-generatepress) - 5 abilities

Cloudflare (mcp-abilities-cloudflare) - 1 ability

Email (mcp-abilities-email) - 8 abilities

Usage with Claude Code

1. Create Application Password

WordPress Admin → Users → Your Profile → Application Passwords

2. Add MCP Server

claude mcp add wordpress-mysite "https://yoursite.com/wp-json/mcp/mcp-adapter-default-server" \
  -t http \
  -H "Authorization: Basic $(echo -n 'username:application-password' | base64)"

3. Start Using

Now Claude can directly edit your WordPress site through conversation.

Examples

Create a new page

{
  "ability_name": "content/create-page",
  "parameters": {
    "title": "About Us",
    "content": "<!-- wp:paragraph --><p>Hello world!</p><!-- /wp:paragraph -->",
    "status": "publish"
  }
}

Add menu item

{
  "ability_name": "menus/add-item",
  "parameters": {
    "menu_id": 5,
    "title": "Contact",
    "url": "/contact/"
  }
}

Upload media from URL

{
  "ability_name": "media/upload",
  "parameters": {
    "url": "https://example.com/image.jpg",
    "title": "Hero Image",
    "alt_text": "Beautiful sunset"
  }
}

Batch find/replace

{
  "ability_name": "content/patch-post",
  "parameters": {
    "id": 123,
    "find": "+44 203 3181 832",
    "replace": "<a href=\"tel:+442033181832\">+44 203 3181 832</a>"
  }
}

Security

• Authentication required - Uses WordPress application passwords
• Permission checks - Every ability verifies user capabilities
• Your server - AI connects to your site, you control access
• Protected options - Critical settings blocked from modification
• Filesystem hardening - PHP code detection, path traversal protection (in add-on)

Architecture

Three-plugin stack plus optional add-ons:

1. Abilities API - Framework for registering abilities (WordPress core team)
2. MCP Adapter - MCP protocol layer (WordPress core team)
3. MCP Expose Abilities (this plugin) - Core WordPress abilities
4. Add-on plugins (optional) - Vendor-specific abilities

Changelog

3.0.9

• Security: Added per-item capability checks for content, media, users, and comments

3.0.8

• Added: plugins/activate ability to activate installed plugins
• Added: plugins/deactivate ability to deactivate active plugins

3.0.7

• Improved: All 47 ability descriptions now include parameter hints

3.0.6

• Added: comments/create ability for top-level comments

3.0.5

• Added: plugins/delete ability to remove inactive plugins

3.0.4

• Fixed: Use WP_Filesystem API instead of native PHP functions
• Fixed: Replaced wp_get_sidebars_widgets with direct option call

3.0.3

• Added: Revisions abilities (content/list-revisions, content/get-revision)
• Added: Comments abilities (list, get, create, reply, update-status, delete)
• Added: author_id parameter for content creation

3.0.0

• Breaking: Modular architecture - vendor-specific abilities moved to add-on plugins
• Core plugin now contains only WordPress-native abilities
• Add-on plugins: Filesystem (10), Elementor (6), GeneratePress (5), Cloudflare (1), Email (8)
• Cleaner installation - install only what you need

2.2.12

• Security: Added protected options blocklist (active_plugins, siteurl, admin_email, etc.)
• Security: Prevents accidental site breakage via options/update

2.2.11

• Security: Added UTF-7 and UTF-16 encoding bypass detection
• Security: Blocks encoded PHP injection attempts

2.2.10

• Security: Major filesystem security hardening
• Security: PHP code detection in file writes
• Security: Path traversal protection
• Security: Restricted to wp-content directory

2.1.0

• Added: Filesystem abilities
• Added: Options abilities
• Added: System abilities
• Added: Cloudflare cache clear ability
• Added: elementor/update-element for targeted element updates

2.0.0

• Added: Menu, User, Media, Widget, Page abilities

1.0.0

• Initial release

Contributing

PRs welcome! For vendor-specific abilities, consider creating an add-on plugin.

License

GPL-2.0+

Author

Devenia - We've been doing SEO and web development since 1993.

Links

• Plugin Page
• Abilities API (WordPress core team)
• MCP Adapter (WordPress core team)