Give AI assistants controlled WordPress abilities.

Let AI assistants work inside WordPress through MCP. The core plugin currently documents 67 WordPress-native abilities. The wider stack spans 19 add-ons and more than 450 documented abilities across content, block editing, builders, SEO, security, email, forms, ads, translations, files, database maintenance, link repair, plugin checks, and cache operations.

Download the latest release | View source on GitHub

Built on top of Abilities API and MCP Adapter from the WordPress core team.

---

What It Solves

Without MCP, AI output still has to be copied into WordPress by hand. MCP Expose Abilities removes that gap. It lets an assistant read and update content, inspect plugins, manage media, work with menus, and handle real admin tasks directly inside WordPress.

---

Released Add-ons

The plugin is intentionally modular. Start with the core plugin, then install the add-ons that match the tools actually running on the site. That keeps the MCP surface smaller and easier to reason about.

Plugin	Abilities	What it controls
MCP Expose Abilities	67	WordPress core: posts, pages, revisions, media, menus, users, comments, taxonomy, plugins, options, widgets, transients, REST, cron, debug, and cache-adjacent operations.
Block Editor	65	Parse, validate, inspect, generate, and safely update Gutenberg content, templates, patterns, navigations, and block trees.
Broken Link Checker	9	Inspect Broken Link Checker data, list broken links, read notification settings, replace URLs in content, auto-fix safe redirects, clear the local queue, and delete stale BLC rows.
Content Demand	2	Track zero-result site searches and expose content-demand candidates for editorial planning and follow-up content workflows.
Database	2	Run confirm-gated post-content search/replace and regex replacement with dry-run-first safeguards for scoped maintenance.
Elementor	75	Inspect and update Elementor data, pages, templates, containers, widgets, forms, global styles, breakpoints, kits, and cache state.
GeneratePress	36	Manage GeneratePress settings, theme mods, blog archive settings, Elements, GenerateBlocks cache, global styles, page meta, and featured-image sizing audits.
Rank Math	23	Read and update SEO metadata, schemas, modules, sitemap state, llms.txt, redirects, 404 logs, publisher profile, and social profile settings.
Wordfence	11	Read firewall and scan status, start scans, inspect issues, manage blocked IPs, lockouts, live traffic, and allowlist entries.
Brevo	42	Work with Brevo account data, contacts, lists, folders, attributes, signup forms, campaigns, transactional email, and direct API requests.
Google Workspace	16	Configure service-account Gmail access, list labels and messages, read threads, fetch attachments, send, reply, and modify email labels.
Filesystem	11	Read, write, append, copy, move, delete, inspect, and list files inside a hardened WordPress filesystem boundary.
Cloudflare	4	Purge Cloudflare cache, inspect zone details, and control development mode when the site uses Cloudflare.
Cache Enabler	13	Inspect Cache Enabler status and settings, diagnose cached pages, list cached files, purge all, site, expired, URL, or post cache, refresh backend files, and enable or disable the cache plugin.
Check Runner	1	Run the official WordPress.org Plugin Check against installed plugins and return structured errors and warnings.
Toolset	40	Manage Toolset post types, fields, taxonomies, terms, relationships, forms, views, access checks, and stale Toolset data cleanup.
SitePress / WPML	13	Inspect active languages, map translations, create translation shells, validate/rebuild language switchers, and audit copied or untranslated content.
Polylang	19	Inspect languages, post and term translation sets, audit multilingual coverage and integrity, plan changes, and apply relationship mutations with dry-run, expected-state, confirmation, and post-write verification safeguards.
Formidable	11	Inspect forms, fields, styles, entries, settings, usage, CSS cache/runtime behavior, and clone or trace form placement.
Advanced Ads	17	List, create, update, and delete ads, placements, and groups; inspect settings and run configuration diagnostics.

Current practical total: 67 core abilities plus 19 add-ons and more than 450 documented abilities across the maintained stack.

Use the release pages for exact package versions. This page explains the operating model: install the core only once, add the smallest set of add-ons needed for the site, and expose named abilities instead of broad uncontrolled admin access.

What Gets Exposed

---

Why the Add-ons Matter

---

Typical Uses

• Rewrite or patch batches of posts without copy-paste.
• Fix metadata and redirections across a site.
• Update Elementor pages and templates without opening the editor.
• Inspect Wordfence issues or blocked IPs from the same session.
• Handle email or file operations as part of a WordPress workflow.

---

Setup

1. Install Abilities API from the official release ZIP.
2. Install MCP Adapter so MCP clients can talk to WordPress.
3. Install MCP Expose Abilities for the WordPress-native core abilities.
4. Install only the add-ons that match the site stack, for example GeneratePress, Block Editor, Rank Math, Polylang, Wordfence, Brevo, or Cloudflare.
5. Create a WordPress application password for the user that should run the abilities.
6. Connect the MCP client to the site adapter endpoint and verify that it can list abilities before making changes.

Full install and usage details live in the GitHub README. A healthy first test is simple: list the available abilities, read one harmless object such as a page, then run a no-risk operation before attempting writes.

---

Free and Open Source