v2.7.1

Full Changelog: v2.7.0...v2.7.1

v2.7.0

Full Changelog: v2.6.0...v2.7.0

v2.6.0

Full Changelog: v2.5.0...v2.6.0

v2.5.0

Full Changelog: v2.4.0...v2.5.0

WP MCP Abilities 2.4.0

First public release of WP MCP Abilities — administrator-level MCP abilities for WordPress, built on the official mcp-adapter plugin.

Every ability is registered as a first-class MCP tool with its full input schema, so an agent calls it once instead of walking the adapter's discover → info → execute meta-tool chain. No relay service, no call limits: the client talks straight to your site over HTTPS.

What's inside

14 wpmcp/* abilities, each requiring manage_options:

Ability	Purpose
wpmcp/agent-context	Site profile, stack, ability catalog, skill index, warnings — start here
wpmcp/rest-request	Any WordPress or WooCommerce REST route as the current user
wpmcp/wpcli	The real wp binary, pipelines allowed, 90 s timeout
wpmcp/files	List/read/write/delete/search under wp-content, with rollback copies
wpmcp/elementor	Safe Elementor builder — 16 actions in one tool
wpmcp/fetch-page	Rendered HTML, for verifying edits
wpmcp/media-import	Sideload a file from a URL into the Media Library
wpmcp/audit-url	PageSpeed Insights with a local fallback
wpmcp/list-skills / get-skill / search-skills / skill-write	46 WordPress/WooCommerce/Elementor playbooks, searchable and writable
wpmcp/site-health	Scored diagnostics across six sections
wpmcp/restore	List, restore and prune the automatic rollback copies

46 skill playbooks covering the traps generic model knowledge misses: HPOS tables, Elementor's _elementor_data format, block checkout, cache purge matrices, search-replace ordering, and more.

Third-party abilities: sites running Elementor's own MCP plugin also expose 22 elementor/* and 3 core/* abilities on the same endpoint (42 tools total), controlled by the wpmcp_extra_tool_namespaces filter.

Safety model

• Every ability checks manage_options.
• WPMCP_READONLY (or the wpmcp_readonly filter) disables every write path, including WP-CLI.
• Destructive actions require confirm: true.
• wpmcp/files cannot leave wp-content; .. and symlink escapes are rejected.
• Every file write/delete and every Elementor write keeps a rollback copy.
• Atomic writes via temp file + rename(); Elementor writes are read back and reverted if the layout did not survive.
• Last 200 ability calls are logged with secret-like keys redacted.

This plugin is administrator-level by design. wp eval is PHP execution, wpmcp/files can write PHP, and wpmcp/rest-request can install plugins. Use a dedicated administrator account, HTTPS, and a scoped application password. Read the security policy and README before connecting a client.

Requirements

• WordPress 6.9+
• PHP 8.0+
• mcp-adapter 0.7+, active
• HTTPS and an Application Password for an administrator

Installation

1. Install and activate mcp-adapter.
2. Upload wp-mcp-abilities.zip under Plugins → Add New → Upload Plugin.
3. Activate WP MCP Abilities.
4. Create an application password under Users → Profile → Application Passwords.
5. Point your MCP client at https://example.com/wp-json/mcp/mcp-adapter-default-server (or ?rest_route=/mcp/mcp-adapter-default-server/ with plain permalinks).

Verify the download

wp-mcp-abilities.zip
sha256  a0532e18b23eb112f9f679832ead96524eaa767d85574ed49c2145b08fa59833
size    168,569 bytes

Known limitations

• Agent-written playbooks live in the plugin directory, so a plugin update replaces them. Moving them to wp-content/wpmcp-skills/ is the next change.
• wpmcp/wpcli is enabled by default. Making it opt-in is planned.
• URL-fetching abilities do not yet block private network ranges (SSRF).
• media-import documents a 25 MB limit that is not enforced.

Track these in CHANGELOG.md under Unreleased.

License

GPL-2.0-or-later.