MCP-exposed capabilities are a type of AI editing plugin solution for WordPress: it exposes posts, pages, menus, media, plugins, comments, options, and other capabilities to AI assistants via MCP, so you no longer copy and paste back and forth between the chat window and wp-admin backend, but directly describe the goal, let the agent execute, and then verify the result.
Plugin Information:Test result: 7.0 Stable tag: 3.0.76 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html
What it does
This plugin exposes WordPress functionality through MCP (Model Context Protocol), enabling AI assistants to interact directly with your WordPress site. No more copying and pasting between chat and admin.
Example: “Fix phone numbers in these 25 posts as clickable tel: links.” — done in 30 seconds, all 25 posts.
The real workflow
In practice, humans shouldn't have to remember the entire ecosystem.
The normal model is:
Point Codex or another MCP-capable agent to this repository
Let the agent read the README and wiki
Let the agent figure out the required stack and related plugins
Give the agent a task with clear boundaries
The human's job is mainly to describe the goal. The agent's job is to figure out the mechanics.
Why it feels different
Most WordPress AI demos still make you do the boring parts yourself.
This ecosystem is different because the agent can actually accomplish work inside WordPress:
Fix duplicate content issues across multiple pages
Update menus, media, plugins, comments, and options
Use real builders and plugin ecosystems like Elementor, GeneratePress, Rank Math, and Wordfence
Dealing with that kind of website maintenance people usually put off because it’s repetitive and tedious
This changes the experience:
Here is what you should do in wp-admin
To:
Tell the agent what needs doing, and let it carry out the work
Before vs After
Before
Asking AI what to do
Manually copying the answer into WordPress
Clicking through wp-admin to find repetitive sections
Losing motivation because the task is boring
Putting off cleanup, maintenance, or optimization once again
After
Telling the agent what needs to be done
Letting it inspect the site directly
Letting it make targeted changes
Verifying the results
Moving on to the next useful improvement instead of getting stuck in administrative drudgery
This difference is exactly what lies at the core of this ecosystem.
Who This Is For
It’s a great fit for:
Agencies managing many WordPress sites
Companies with duplicated content and operations
Organizations that want AI to perform real maintenance, not just generate text
Technical teams tired of the copy-paste workflow between chat and wp-admin
It is especially useful when work is postponed just because the manual version is boring.
If you want to see more specific buyer cases, start here:
Who benefits the most
Documentation
For setup and troubleshooting beyond the quick start, use the wiki:
Why teams use it
Use cases
Who This Is For
Who benefits the most
Alternatives
Getting started guide
Installation order and dependencies
First working MCP connection
Which plugin do I need?
Troubleshooting
Examples
If you are using an AI agent, the simplest command is usually:
Read https://github.com/bjornfix/mcp-expose-abilities and figure out the stack before making changes.
Start here
If you are new to the stack, use the following order:
Installing API capabilities
Install MCP Adapter
Install the MCP Expose Abilities plugin (this plugin)
Confirm you can list and execute core abilities
Only add vendor-specific plugins that you actually need
If you skip step 4 and start installing add-ons right away, troubleshooting will become harder than necessary.
What you really need
For a minimal working setup, you only need:
WordPress 6.9+
PHP 8.0+
API Abilities
MCP Adapter
MCP Expose Abilities (this plugin)
Everything else in the ecosystem is optional.
5-minute setup
Install and activate the required plugins:
API Abilities:https://github.com/WordPress/abilities-api/releases/latest
MCP Adapter:https://github.com/WordPress/mcp-adapter
MCP Expose Abilities: Download latest version from this repo
Verify that the Abilities API plugin is installed as wp-content/plugins/abilities-api/abilities-api.php
Activate all three plugins in WordPress
Confirm that the MCP adapter route is accessible on your site
First, run a simple read-only function, such as listing posts or reading a page
First successful check
Before adding Elementor, Cloudflare, Gmail, or anything else, make sure the core stack is working properly.
Good initial tests:
List posts
Get page by ID
List menus
List installed plugins
If these work, the stack is wired correctly. If not, fix the core stack before adding add-ons.
Modular architecture
Version 3.0 introduces a modular architecture. The core plugin provides native WordPress functionality, while vendor-specific features are available as separate add-on plugins:
| Plugin | Capability | Description |
|---|---|---|
| MCP Exposure Capability (core) | 69 | WordPress core: content, menus, users, media, widgets, plugins, options, comments, taxonomy, system |
| MCP Capability - File System | 11 | File operations with security hardening |
| MCP Capability - Elementor | 40 | Elementor page builder integration |
| MCP Capability - GeneratePress | 26 | Generate Print Theme + Generate Blocks |
| MCP capabilities - Cloudflare | 4 | Cloudflare cache management |
| MCP capabilities - Google Workspace | 16 | Gmail API via workspace service account |
| MCP capabilities - Rank Math | 23 | Rank Math SEO metadata access |
| MCP capabilities - Wordfence | 11 | Wordfence security status + blocks |
| MCP capabilities - Brevo | 22 | Brevo contacts, lists, campaigns |
| MCP capabilities - Advanced Ads | 17 | Advanced Ads management |
| MCP capabilities - Toolset | 38 | Toolset post types, custom fields, taxonomies, relationships |
| MCP capabilities - SitePress | 10 | WPML translation mapping, language switcher recovery and QA checks |
| MCP capabilities - Formidable | 6 | Form settings, usage tracking, styles and CSS cache controls |
| MCP capabilities - Store Locator | 9 | Store locator settings, templates, store records, categories, and temporary cleanup |
Entire ecosystem: 298 capabilities
Install only what you need. Running GeneratePress? Install that plugin. Not using Elementor? Skip it.
Requirements
WordPress 6.9+
PHP 8.0+
API Capabilities Plugin (WordPress Core Team)
MCP Adapter Plugin (WordPress Core Team)
Use the official Capabilities API version ZIP (abilities-api.zip) so it installs as wp-content/plugins/abilities-api/abilities-api.php
WordPress Compatibility
Requires WordPress 6.9 or higher
Tested up to WordPress 7.0
Requires PHP 8.0 or higher
Maintained for the WordPress 6.9 version line and supported additional plugins
Installation
Install and activate the required plugins:
Capabilities API (Official Release ZIP):https://github.com/WordPress/abilities-api/releases/latest
MCP Adapter:https://github.com/WordPress/mcp-adapter
Download the latest version from Releases
Upload via WordPress admin → Plugins → Add New → Upload Plugin
Activate the plugin
(Optional) Install additional plugins for vendor-specific capabilities
Which plugin should I install?
Install add-ons only if your site actually uses that product:
Elementor site: Install mcp-abilities-elementor
GeneratePress/GenerateBlocks site: Install mcp-abilities-generatepress
Cloudflare-managed site: Install mcp-abilities-cloudflare
Gmail/Workspace automation: Install mcp-abilities-workspace
Rank Math site: Install mcp-abilities-rankmath
Wordfence site: Install mcp-abilities-wordfence
Brevo site: Install mcp-abilities-brevo
Toolset site: Install mcp-abilities-toolset
WPML site: Install mcp-abilities-sitepress
Formidable Forms site: Install mcp-abilities-formidable
Store Locator site: Install mcp-abilities-store-locator
By default, do not install every add-on. Most sites only need one or two.
Common failure patterns
The most common onboarding mistake is treating it as a plugin rather than a stack.
When something doesn't work, check in the following order:
Is the API ability active?
Is the MCP adapter active?
Is the MCP exposure ability active?
Can the core plugin work without any add-ons?
Is the vendor plugin itself installed and active?
Then debug specific plugins.
Recent changes
3.0.75
Added comments/update-author-url to narrowly update or clear a comment author URL via per-comment permission checks and write validation.
3.0.50
Security: plugins/update can only run through MCP with explicitly confirmed Devenia manifest management packages; generic plugin code writes remain disabled by default.
3.0.49
Security: options/update now blocks the theme bootstrap options template and stylesheet.
3.0.48
Security: Plugin code writing is disabled by default unless server-side configuration explicitly enables MCP_EXPOSE_ENABLE_PLUGIN_CODE_WRITES.
Security: When plugin code writes are enabled, WordPress.org plugin installations, plugin updates, and plugin deletions now require explicit per-capability confirmation.
3.0.47
Security: MCP transport and generic execution capability entry points now default to manage_options via adapter capability filters.
Security: High-risk plugins/upload, plugins/upload-base64, and options/update calls now require explicit per-capability confirmation.
3.0.46
Improved generic post meta writing with a post-meta write strategy interface that has a filterable protected key registry.
Added a local capability contract utility to verify before side effects that protected Elementor meta writes are denied.
3.0.45
Security: Generic content/meta capabilities now block protected Elementor meta keys and require dedicated elementor/* Elementor document write capabilities.
Changed plugin ZIP upload to use the WordPress core Plugin_Upgrader instead of direct plugin directory unzip/copy operations.
3.0.44
Fixed plugins/update so that plugins active before a WordPress native update are reactivated if WordPress leaves them inactive after the upgrader runs.
Added active_before, active_after, and reactivated fields to the plugins/update response.
3.0.43
Fixed: plugins/upload no longer defines a temporary get_current_screen() stub, avoiding a fatal redeclaration when WordPress loads admin screen helpers during REST/MCP plugin installation.
3.0.42
Improved plugins/list efficiency with a search filter parameter and null-safe handling of no-parameter input.
3.0.41
Fixed broad content update and patch capabilities so that they prevent accidental removal of existing GenerateBlocks/design markup unless explicitly overridden.
3.0.40
Added content/update-discussion-status to toggle comments and pings on a post/page.
3.0.39
Added media/upload-base64 for uploading local or generated media files into the WordPress media library via MCP.
3.0.38
Added date support to content/update-post for updating local post dates.
Added post meta support via content/create-post, content/update-post, meta/update-post-meta, and meta/delete-post-meta.
Security: Post meta writes now check edit_post_meta / delete_post_meta by key before modifying meta.
3.0.37
Docs: Removed stray Claude mention from README workflow wording.
3.0.36
Fixed plugins/search-directory so WordPress.org search results are correctly populated when the API returns array-shaped plugin rows.
Fixed plugins/list-updates so it rejects execution parameters via MCP proxy, like the old null-safe list function.
3.0.35
Added plugins/search-directory to search the official WordPress.org plugin directory from MCP.
Added plugins/install-directory to install WordPress.org plugins by slug.
Added plugins/list-updates and plugins/update for discovery and execution of native WordPress plugin updates.
Added plugins/switch with rollback on target activation failure to switch between installed plugins.
3.0.34
Docs: Added clearer GitHub onboarding path: Start Here, setup order, first success check, and add-on selection guide.
Docs: Added explicit WordPress and PHP compatibility notes.
Docs: Corrected ecosystem plugin and ability counts to include Formidable plugins and current Elementor and Rank Math totals.
Docs: Replaced outdated hardcoded Abilities API ZIP URL with a generic latest-release link.
Docs: Fixed GitHub release badge to follow the actual latest version.
3.0.33
Validate local plugin ZIP signature integrity before extraction; plugins/upload or plugins/upload-base64 payloads fail with a direct ZIP verification error if corrupted.
Intended to pair with an MCP proxy HTTP transport fix that increases the default JSON body limit for large base64 plugin uploads.
Core plugin capabilities (69)
Content management (25)
| Capability | Description |
|---|---|
| content/list-posts | List posts filtered by status, category, author, search |
| content/get-post | Get a single post by ID or slug |
| content/get-next-post | Find the next existing post after an ID, even if IDs have gaps |
| content/create-post | Create a new post, including featured_image_id |
| content/update-post | Update an existing post, including featured_image_id |
| content/delete-post | Delete a post (trash or permanent) |
| content/restore-post | Restore a post, page, or custom post type from trash |
| content/patch-post | Find/replace post content |
| content/list-pages | List pages with filtering capabilities |
| content/get-page | Get a single page by ID or slug |
| content/create-page | Create a new page, including featured_image_id |
| content/update-page | Update an existing page, including featured_image_id |
| content/update-discussion-status | Toggle comments and pings on a post/page |
| content/delete-page | Delete a page |
| content/patch-page | Find/replace in page content |
| content/list-categories | List all categories |
| content/create-category | Create a new category |
| content/update-category | Update an existing category |
| content/list-tags | List all tags |
| content/create-tag | Create a new tag |
| content/list-media | List media items |
| content/list-users | List users |
| content/search | Search across posts, pages, media |
| content/list-revisions | List revisions for posts/pages |
| content/get-revision | Get specific revision details |
Menu Management (8)
| Capability | Description |
|---|---|
| menus/list | List all menus and theme locations |
| menus/get-items | Get items from a menu |
| menus/create | Create a new menu |
| menus/add-item | Add items to a menu |
| menus/update-item | Update a menu item |
| menus/upsert-item | Create or update an item by object ID or custom URL |
| menus/delete-item | Delete a menu item |
| menus/assign-location | Assign a menu to a theme location |
User Management (5)
| Capability | Description |
|---|---|
| users/list | List users with roles |
| users/get | Get a user by ID, login, or email |
| users/create | Create a new user |
| users/update | Update a user |
| users/delete | Delete a user (can reassign content) |
Media Library (4)
| Capability | Description |
|---|---|
| media/upload | Upload media from URL |
| media/get | Get details and sizes of a media item |
| media/update | Update title, alt, caption |
| media/delete | Delete a media item |
Widget management (3)
| Capability | Description |
|---|---|
| widgets/list-sidebars | List all widget areas |
| widgets/get-sidebar | Get widgets in a sidebar |
| widgets/list-available | List available widget types |
Plugin management (11)
| Capability | Description |
|---|---|
| plugins/upload | Upload a plugin from a URL |
| plugins/upload-base64 | Upload a plugin from a local file (base64 or zip path) |
| plugins/search-directory | Search the official WordPress.org plugin directory |
| plugins/install-directory | Install a plugin from the official WordPress.org plugin directory by slug |
| plugins/list | List installed plugins |
| plugins/list-updates | List available plugin updates |
| plugins/update | Update installed plugins |
| plugins/activate | Activate installed plugins |
| plugins/deactivate | Deactivate active plugins |
| plugins/switch | Activate one plugin and deactivate one or more others |
| plugins/delete | Delete inactive plugins |
Comments (7)
| Capability | Description |
|---|---|
| comments/list | List comments with filtering capabilities |
| comments/get | Get a single comment's details |
| comments/update-author-url | Update or clear a comment author URL |
| comments/create | Create a top-level comment |
| comments/reply | Reply to an existing comment |
| comments/update-status | Update comment status (approve, spam, trash) |
| comments/delete | Delete a comment |
Options (3)
| Capability | Description |
|---|---|
| options/get | Get option value |
| options/update | Update option (protected options are blocked) |
| options/list | List all options |
System (4)
| Capability | Description |
|---|---|
| system/get-transient | Get transient value |
| system/ability-timings | Read recent slow or failed capability timings |
| system/debug-log | Read the debug.log file |
| system/toggle-debug | Toggle WP_DEBUG, WP_DEBUG_LOG, WP_DEBUG_DISPLAY |
Taxonomy Utilities (1)
| Capability | Description |
|---|---|
| taxonomy/associate-with-post-type | Associate taxonomy with a post type and maintain mapping |
Plugin Capabilities
File System (MCP capability filesystem) - 11 capabilities
| Capability | Description |
|---|---|
| filesystem/get-changelog | Get plugin/theme changelog |
| filesystem/read-file | Read file contents (enhanced security) |
| filesystem/write-file | Write file (PHP code blocked) |
| filesystem/append-file | Append to file |
| filesystem/list-directory | List directory contents |
| filesystem/delete-file | Delete file (create backup) |
| filesystem/delete-directory | Delete directory (recursive optional) |
| filesystem/file-info | Get file metadata |
| filesystem/create-directory | Create directory |
| filesystem/copy-file | Copy file |
| filesystem/move-file | Move/rename file |
Element (mcp capability element) - 40 capabilities
For the full list, see the attached file readme. Common capabilities:
| Capability | Description |
|---|---|
| elementor/get-data | Get page elements or JSON |
| elementor/update-data | Replace JSON elements |
| elementor/patch-data | Find/replace in Elementor JSON |
| elementor/update-element | Update specific element by ID |
| elementor/list-templates | List saved templates |
| elementor/clear-cache | Clear CSS cache |
Generate stress (mcp capability generate stress) - 26 capabilities
For the full list, see the attached file readme. Common capabilities:
| Capability | Description |
|---|---|
| generatepress/get-settings | Get theme settings |
| generatepress/update-settings | Update theme settings |
| generatepress/get-typography | Get typography rules and font manager |
| generatepress/list-elements | List generator print elements |
| generatepress/list-modules | List module status |
| generateblocks/get-global-styles | Get global style |
| generateblocks/update-global-styles | Update global styles |
| generateblocks/clear-cache | Clear CSS cache |
Cloudflare (mcp capability Cloudflare) - 4 capabilities
| Capability | Description |
|---|---|
| cloudflare/clear-cache | Clear Cloudflare cache (entire site or specific URL) |
| cloudflare/get-zone | Get resolved Cloudflare zone context |
| cloudflare/get-development-mode | Read development mode status |
| cloudflare/set-development-mode | Enable/disable development mode |
Google Workspace (mcp capability Workspace) - 16 capabilities
| Capability | Description |
|---|---|
| gmail/configure | Set Gmail API service account credentials |
| gmail/status | Check API connection status and configuration |
| gmail/list-labels | List labels |
| gmail/get-label | Get label by ID |
| gmail/create-label | Create label |
| gmail/update-label | Update label |
| gmail/delete-label | Delete label |
| gmail/list | List inbox emails and filter them |
| gmail/list-threads | List threads |
| gmail/get | Get full email content by ID |
| gmail/get-thread | Get thread details |
| gmail/get-attachment | Get attachments in base64 format |
| gmail/send | Send emails with HTML, attachments, CC, BCC |
| gmail/modify | Modify labels (archive, mark read/unread, etc.) |
| gmail/reply | Reply to existing email threads |
| email/send | Send emails via WordPress wp_mail (non-Gmail fallback) |
Usage with MCP Clients
1. Create an Application Password
WordPress Admin → Users → Your Profile → Application Passwords
2. Add the MCP Server
Configure your MCP client to connect to:
https://yoursite.com/wp-json/mcp/mcp-adapter-default-server
Use HTTP transport with a Basic Auth header generated from your WordPress username and Application Password.
3. Start using
Your MCP client can now edit your WordPress site through conversation.
Examples
Create a new page
{
"ability_name": "content\/create-page",
"parameters": {
"title": "About Us",
"content": "<!-- wp:paragraph --><p>Hello world!<\/p><!-- \/wp:paragraph -->",
"status": "publish"
}
}Add a menu item
{
"ability_name": "menus/add-item",
"parameters": {
"menu_id": 5,
"title": "Contact",
"url": "/contact/"
}
}Upload media from URL
{
"ability_name": "media/upload",
"parameters": {
"url": "https://example.com/image.jpg",
"title": "Hero Image",
"alt_text": "Beautiful sunset"
}
}Bulk find/replace
{"<a href="tel:+442033181832">+44 203 3181 832</a>"
}
}Security
Need authentication -Use WordPress application passwords
Permission check -each capability verifies user capabilities
Your server -AI connects to your website, you control access
Protected options -prevent modification of critical settings
File system hardening -PHP code detection, path traversal protection (in plugin)
Architecture
Three-plugin stack and optional plugins:
API capability -capability registration framework (WordPress Core Team)
MCP adapter -MCP protocol layer (WordPress Core Team)
MCP exposing capability (this plugin) -WordPress core functionality
Additional plugins (optional) -vendor-specific capabilities
Changelog
3.0.76
Fixed content/patch-post and content/patch-page so stale invalid assigned template metadata is cleared immediately before content writing, preventing a successful patch from returning an Invalid page template error.
3.0.75
Added comments/update-author-url to narrowly update or clear a comment author URL via per-comment permission checks and write validation.
3.0.73
Fixed content/patch-post passes correctly pruned Gutenberg content to WordPress, so approved design-neutral source code patches retain the same content hash through downstream publishing gates.
3.0.72
Deepened design-neutral source patch approval so MCP preflight and downstream source publishing gate filters share a single approval path.
3.0.71
Fixed design-neutral content/patch-post so that their hash-bound approval is written through the downstream Devenia source publishing gate.
3.0.70
Added content/patch-post support for explicit, reasoned design-neutral patches on published Devenia source code posts without degrading source code design verification.
3.0.69
Fixed content/update-post and content/update-page so that featured-image-only or taxonomy-only updates do not call wp_update_post() triggering unnecessary publishing/design hooks.
3.0.68
Added dry-run support for MCP create, update, and patch post-writes.
Fixed Devenia source code post-publish edit gate so that status-only publishing of invalid source drafts is blocked.
3.0.67
Added Devenia source code post-edit gate for MCP post-create/update/patch writes, blocking published source posts that fail shared post-edit source design verification.
3.0.66
Added content/update-tag for correcting tag names, slugs, and descriptions via MCP without direct REST or database access.
3.0.65
Fixed content/update-post and content/update-page so generic post/page updates protect translated sibling content and critical Elementor/feature image meta from WPML/Polylang-style sync hooks.
Added translation_guard details to content update responses so callers can verify which translated siblings were protected and restored.
3.0.64
Fixed meta/update-post-meta and meta/delete-post-meta so that updates to _yoast_wpseo_* fields trigger a post-refresh of the SEO indexable rebuild.
3.0.63
Added meta/get-post-meta for narrow read-only inspection of explicit post meta keys with per-post capability checks.
3.0.62
Fixed content/restore-post and content/update-page so stale invalid assigned page template meta is cleared before WordPress state/content writes, allowing safe restoration of old pages abandoned in older themes.
3.0.61
Fixed content/list-pages so the documented search parameter is accepted and passed to the WordPress page query.
3.0.60
Added: content/list-posts now supports status:trash for explicit trash inspection.
Added: content/restore-post restores posts, pages, and custom post types from the trash with per-post edit capability checks.
3.0.59
Changed: Plugin code-writing protections now pipe structured capability names and inputs to dedicated filters, allowing a trusted upload gate without request-body parsing or stack inspection.
Fixed: Plugin upload overwrite:true now recovers from empty stale target directories left by failed installations.
3.0.58
Added: content/restore-revision restores posts, pages, and custom post types via WordPress revisions without transmitting block content through JSON.
3.0.57
Added: MCP HTTP shutdown timed fallback now logs long-running or fatal MCP REST requests even when adapter-level observability does not fire.
3.0.56
Added: MCP adapter transport requests are now recorded in system/ability-timings when they fail or exceed the time threshold, including method/tool context for discovery tools/list diagnostics.
3.0.55
Fixed: content/patch-page and content/patch-post now use shorter per-write locks so concurrent patch calls to the same item do not overwrite each other with stale content.
3.0.54
Added: system/ability-timings exposes a bounded read-only log of slow or failed ability calls.
Improved: Ability callbacks now record timing data only when the call fails or exceeds a default 1000 ms threshold.
3.0.53
Added: menus/upsert-item creates or updates menu items by page/post/category identity or custom URL equivalently.
Improved: Menu add/update now uses a standardized nav menu item module with write-back, object/type preservation, title persistence, and contract test coverage.
3.0.52
Fixed: Menu item title updates now also preserve the underlying navigation menu item title so that frontend labels do not fall back to stale object labels.
3.0.51
Fixed: menus/add-item now validates page/post/category object IDs before creating non-custom menu items.
Fixed: menus/update-item now preserves existing menu item fields when only title, URL, parent, position, target, or classes are changed.
3.0.50
Security: plugins/update can only run through MCP with explicitly confirmed Devenia manifest management packages; generic plugin code writes remain disabled by default.
3.0.49
Security: options/update now blocks the theme bootstrap options template and stylesheet.
3.0.48
Security: Plugin code writing is disabled by default unless server-side configuration explicitly enables MCP_EXPOSE_ENABLE_PLUGIN_CODE_WRITES.
Security: When plugin code writes are enabled, WordPress.org plugin installations, plugin updates, and plugin deletions now require explicit per-capability confirmation.
3.0.47
Security: MCP transport and generic execution capability entry points now default to manage_options via adapter capability filters.
Security: High-risk plugins/upload, plugins/upload-base64, and options/update calls now require explicit per-capability confirmation.
3.0.46
Improved: Generic post meta writing now uses a single post meta write policy interface with a filterable protected key registry.
Added: Local capability contract tooling for validating protected Elementor meta writes before side effects is rejected.
3.0.45
Security: Generic content/meta capabilities now block protected Elementor meta keys and require dedicated elementor/* Elementor document write capabilities.
Changed: Plugin ZIP upload now uses WordPress core Plugin_Upgrader instead of direct plugin directory extraction/copy operations.
3.0.44
Fixed: plugins/update now preserves active plugin state during native WordPress plugin updates and reports pre- and post-activation status.
3.0.42
Added: plugins/list now supports a search parameter for filtering installed plugins by file, slug, name, author, or description.
Fixed: plugins/list now executes with no arguments accepted via MCP proxy, consistent with other empty-safe list functions.
3.0.41
Fixed: Extensive content update and patching functionality now prevents accidental removal of existing GenerateBlocks/design markup unless explicitly overwritten.
3.0.40
Added: content/update-discussion-status for toggling comments and pings on posts/pages.
3.0.39
Added: media/upload-base64 for uploading local/generated media files to the WordPress media library via MCP.
3.0.38
Added: content/update-post now supports updating the local publication date using a date parameter.
Added: Post meta support via content/create-post, content/update-post, meta/update-post-meta, and meta/delete-post-meta.
Security: Post meta writing now checks edit_post_meta/delete_post_meta capability by key before modifying meta.
3.0.37
Documentation: Removed stray mention of Claude GitHub README workflow wording.
3.0.36
Fixed: plugins/search-directory now correctly handles WordPress.org directory rows when plugin data is returned as an array instead of an object.
Fixed: plugins/list-updates now executes with no arguments accepted via MCP proxy, consistent with other empty-safe list functions.
3.0.35
Added: plugins/search-directory searches the official WordPress.org plugin directory from MCP.
Added: plugins/install-directory installs a plugin by slug from the official WordPress.org directory.
Added: plugins/list-updates and plugins/update for discovery and execution of WordPress local plugin updates.
Added: plugins/switch rolls back to switch between installed plugins if the target activation fails
3.0.34
Docs: Added clearer GitHub onboarding path with Start Here, setup order, first-success check, and add-on selection guide
Docs: Added explicit WordPress and PHP compatibility notes
Docs: Corrected ecosystem plugin and capability counts to include Formidable add-ons and current Elementor and Rank Math totals
Docs: Replaced outdated hardcoded Abilities API ZIP URL with a generic latest-release link
Docs: Fixed GitHub release badge to follow the actual latest version
3.0.33
Fixed: Plugin upload path now validates the local ZIP signature before extraction, so corrupted payloads fail with a direct ZIP verification error
Improved: Paired with proxy-side HTTP JSON limit increase so plugins/upload-base64 is no longer rejected or truncated by the MCP proxy layer
3.0.31
Fixed: Featured image creation/update path is now idempotent when the requested image is already assigned
3.0.30
Fixed: plugins/upload and plugins/upload-base64 now fall back to copy_dir() when the filesystem move() fails after extraction
Improved: Plugin installation failures now include underlying filesystem context
3.0.29
Fixed: content/update-post now clears stale, invalid assigned page template metadata before unrelated post updates
Fixed: content/update-page now clears stale invalid assigned templates on update and validates the explicit template input
Fixed: content/create-page now validates explicit page template slugs before saving
3.0.28
Added featured_image_id support to post/page create and update functions
Added featured_image_id to content/get-post and content/get-page
3.0.27
Fixed: content/get-next-post now applies after_id correctly by allowing query filters to run to set the floor
3.0.26
Added: content/get-next-post finds the next existing post after an ID even when the ID has gaps
Improved: content/list-posts now accepts case-insensitive order values and friendly orderby aliases such as id and slug
Improved: content/get-post now accepts post_type for slug lookups and returns clearer missing-post context
3.0.25
Fixed: users/delete now loads wp-admin/includes/user.php before calling wp_delete_user() in REST/MCP context
3.0.24
Performance: debug log reader now tracks file content instead of loading full file
Security: options/get blocks sensitive option names (tokens, keys, secrets)
Schema: add output schema for comment and taxonomy term capabilities
3.0.23
Added: content/update-category capability
Fixed: translator comment for placeholder string in post type validation
Fixed: tag alignment with plugin version stable
3.0.17
Fixed: use text domain in translation calls
Fixed: add translator comment for placeholder strings
3.0.16
Added: include_totals flag + has_more/returned in output for list-posts/list-pages/list-media by default to avoid expensive counts
3.0.15
Added: plugin/upload-base64 now accepts zip_path for server-local zip installation
Fixed: capabilities without arguments accept empty input (menus/list, widgets/list-sidebars, widgets-available/list)
3.0.14
Fixed: plugin/delete now loads core file helpers before deletion
3.0.13
Added: shared pagination normalization for core list functions
3.0.12
Fixed: plugin/upload now loads WordPress download helpers in non-admin environments
3.0.11
Added: plugin/upload-base64 local file upload capability
3.0.10
Added: content/create-category capability
3.0.9
Security: added per-item capability checks for content, media, users, and comments
3.0.8
Added: plugins/activate capability for activating installed plugins
Added: plugins/deactivate capability for deactivating active plugins
3.0.7
Improvement: All 47 capability descriptions now include parameter hints
3.0.6
Added: comments/create top-level comment capability
3.0.5
Added: plugins/delete capability to delete inactive plugins
3.0.4
Fixed: Use WP_Filesystem API instead of native PHP functions
Fixed: Replaced wp_get_sidebars_widgets with direct option call
3.0.3
Added: Revision capabilities (content/list-revisions, content/get-revision)
Added: Comment functionality (list, get, create, reply, update status, delete)
Added: author_id content creation parameter
3.0.0
Breaking: Modular architecture - moved vendor-specific capabilities to add-on plugins
Core plugin now contains only WordPress native functionality
Add-on plugins: Filesystem (10), Elementor (6), GeneratePress (5), Cloudflare (1), Google Workspace (8)
Cleaner installation - install only what you need
2.2.12
Security: Added protected option blocklist (active_plugins, siteurl, admin_email, etc.)
Security: Prevent accidental site breakage via options/update
2.2.11
Security: Added UTF-7 and UTF-16 encoding bypass detection
Security: Block encoded PHP injection attempts
2.2.10
Security: Major filesystem security hardening
Security: PHP code detection in file writes
Security: Path traversal protection
Security: Restricted to wp-content directory
2.1.0
Added: File system functionality
Added: Options capability
Added: System capability
Added: Cloudflare cache purge feature
Added: elementor/update-element for target element updates
2.0.0
Added: Features for menus, users, media, widgets, and pages
1.0.0
Initial version
Contribution
PRs welcome! For vendor-specific features, consider creating an add-on plugin.
License
GPL-2.0+
Author
Devnia — We've been doing SEO and web development since 1993.
Links
Plugin page
MCP capabilities - Toolset
API capability (WordPress Core Team)
MCP adapter (WordPress Core Team)
Star and Share
If this ecosystem saves you time, gives your team a saner way to handle WordPress work, or helps you finally finish the repetitive maintenance no one wants to do, please:
Star the repo
Share it with someone who runs WordPress sites
Point them to the wiki so they can see what the ecosystem can actually do
Why do this?
Because it’s good for the whole WordPress ecosystem. The more people use agent-friendly open WordPress tools, the more boring but important work actually gets done instead of sitting in backlogs forever.
Frequently asked questions
Is this plugin only responsible for generating posts?
No. Its focus is not just generating text, but letting AI assistants call WordPress capabilities through MCP to perform actual operations on posts, pages, menus, media, plugins, comments, options, and more.
Does a regular website need to install all the additional plugins?
Not recommended. The core principle is to only install the capabilities the current website actually needs. For example, install the Elementor capability plugin only if you use Elementor, and the Cloudflare capability plugin only if you use Cloudflare.
Will MCP connections affect website security?
Security depends on authentication, permissions, and capability boundaries. The approach mentioned in the article requires WordPress application passwords, per-item permission checks, protected option interception, and confirmation for high-risk capabilities. Production sites should only grant necessary permissions to trusted agents.
What kind of team is it suitable to try first?
It’s best suited for teams that maintain multiple WordPress websites and frequently do batch content organization, menu adjustments, media maintenance, plugin checks, and SEO metadata updates.
Join the discussion
You must log in to post a comment.
After logging in, you can join the discussion. New users can register an account for free.
Do not post spam comments, advertisements, or content with malicious links. Comments must comply with relevant laws, regulations, and community guidelines.