內容簡介
HLB Ability Registry for MCP 外掛提供了一個可自訂的 WordPress 能力註冊系統，讓網站擁有者可以精確控制啟用的功能，並確保每個功能的存取權限符合需求，提升網站的安全性與靈活性。
【主要功能】
• 提供可切換的 WordPress 能力清單
• 支援內容、媒體、評論及用戶的能力管理
• 針對多網站環境提供獨立的能力設定
• 整合 WooCommerce、SEOPress 和 Gravity Forms
• 提供可搜尋的管理介面
外掛標籤
開發者團隊
② 後台搜尋「HLB Ability Registry for MCP」→ 直接安裝（推薦）
原文外掛簡介
Most “connect AI to WordPress” tools expose either everything or nothing: a single broad REST scope, or a fixed bundle of tools the site owner can’t trim. HLB Ability Registry for MCP takes a different approach — it ships a declarative catalogue of individually-togglable WordPress Abilities, and the site owner decides exactly which ones are live, per site.
What it actually does
Registers a curated set of abilities against WordPress core’s own Abilities API (wp_register_ability()) — content, media, comments, users, Site Editor templates & patterns, and optional WooCommerce, SEOPress and Gravity Forms integrations when those plugins are active.
Every ability has its own admin toggle in Settings → HLB Ability Registry for MCP, searchable and grouped by category. Read-only abilities default on; write and destructive abilities default off.
Read handlers do per-object capability checks (not just a blanket current_user_can), so a low-privilege caller can’t read drafts or private posts by ID just because a coarse capability check passed. Listing abilities force unprivileged callers back to published content, and abilities only ever address post types the site already exposes publicly or over the REST API.
On multisite, each subsite gets its own on/off set, inherited from a network default unless a subsite administrator explicitly overrides it. An optional network mode lets the main site’s server target any subsite by id, with every permission and capability check re-run inside that subsite’s own context — nothing is granted network-wide by default.
Requires the MCP Adapter plugin, which projects the enabled abilities onto a standard MCP server at /wp-json/{server-slug}/mcp, so any MCP-speaking client or agent can call them. The enabled abilities are also reachable through core’s own /wp-json/wp-abilities/v1/ REST routes.
Source code
Development happens in the open: https://github.com/jdbg/hlb-ability-registry-mcp
Try it without installing anything
This plugin ships a WordPress Playground blueprint so you can click through the settings screen and a live MCP endpoint in a disposable browser sandbox before installing anything on a real site. See the FAQ below for the link.
