內容簡介
RuleFence 是一款專為 WordPress 設計的外掛，提供 AI 代理的權限管理與審計功能。它能夠清楚列出所有外掛所註冊的能力，並讓管理員精確控制每個代理的行為，確保網站安全性與透明度。
【主要功能】
• 能力探索器顯示所有外掛的能力與風險
• 每個代理擁有獨立身份與憑證
• 允許、要求批准或阻止的權限矩陣
• 風險請求需人員批准
• 每個決策都有記錄與理由
• 緊急控制可立即停止所有代理
外掛標籤
開發者團隊
② 後台搜尋「RuleFence – AI Agent Permissions & Audit for MCP」→ 直接安裝（推薦）
原文外掛簡介
Start by finding out what your site already exposes. Install RuleFence and the Ability Explorer lists every Ability your plugins register, classified by what it does and how risky it is, before you grant anything. Most administrators are surprised by that list. Everything else here is what you do about it.
Because give an AI agent a WordPress login and it can do anything that login can do. The role is the only limit, and roles come in whole jobs: a Shop Manager can refund an order as easily as fix a typo in a product description.
RuleFence draws the line inside the job. Every agent gets its own identity and its own credential, so you can see which agent did something and not just which user. Every registered Ability gets a decision – allow it, hold it for a person, or refuse it outright – and a request that turns out riskier than the Ability looked can be escalated on the spot rather than waved through. One switch stops every agent on the site at once. All of it – the decisions, the requests, the refusals – lands in a signed record that cannot be edited afterwards, not even by this plugin.
In practice that reads like: this agent may look up orders and add notes to them, must ask a person before it changes an order’s status, and may never delete a product.
It connects to the clients people are actually using – Claude Desktop, Claude Code, Cursor, ChatGPT, anything else that speaks the Model Context Protocol, or plain REST. Setting up a connection ends with a configuration block you paste into the client, with the credential already in it.
Nothing leaves your site
This plugin contacts nothing, ever. There is no analytics call, no version ping, no licence check and no webhook. Your agents, permissions, decisions and audit trail live in your own database and are never sent anywhere.
That is worth checking against anything else you are considering. A governance tool that ships your site’s activity to someone else’s server has moved the problem rather than solved it.
The rule everything else follows
An Ability nobody granted is refused. A new agent starts paused and is allowed nothing, and stays that way until you say otherwise, one Ability at a time. Nothing you install can widen that by accident, because nothing widens it except you.
What it does
Exposure. The Ability Explorer shows everything your installed plugins let an agent do, by action, risk and source – before you grant any of it.
Identity. Each agent is a managed identity with its own credential, mapped to a least-privilege WordPress user. You can see which agent did what, not just which user.
Permissions. A matrix of every registered Ability against every agent: allow, require approval, or block.
Approvals. A risky request stops and waits for a person. The approval is bound to the exact input it was granted for, so it cannot be reused for a different request.
Risk. A contextual engine reads the request itself – how many records, how large a change, how sensitive – and can make a decision stricter than the matrix, never weaker.
Previews. See what a write would do before it happens.
Evidence. Every decision is recorded with its reason, allowed or blocked, in a hash-chained trail that can prove it has not been edited – so “what did the AI do to our data, and who allowed it” has an answer you can show someone.
Emergency controls. Stop every agent on the site immediately, or drop everything to read-only, in one click.
Readiness. A scored check of what still weakens the site, with the evidence behind each score.
Runtime verification. The governance controls are re-tested on the installed site rather than assumed.
How much there is to govern, and how to find out
RuleFence governs the WordPress Abilities API, so it covers whatever your plugins register – core, WooCommerce, your own – rather than a fixed list. That also sets the scale: a site whose plugins register a lot of Abilities has a lot for this to govern.
WordPress 7.1 registers three of its own, all read-only. Plugins are where the rest comes from, and a growing number of them now register Abilities – page builders, custom fields, commerce, management tools. Rather than take a number from anyone, install this and read your own: the Ability Explorer is the first screen worth opening, and it answers the question for your site specifically.
Abilities are what it governs, and that is worth being exact about. An agent’s credential is a WordPress user, so anything that user could already do through the ordinary REST API, it still can – the permission matrix is not in that path. What limits it there is the WordPress user you map the agent to, which is why this plugin asks for a least-privilege one, warns you when an agent is mapped to an administrator, and scores it in Readiness. WordPress capabilities are the ceiling; the matrix is how you carve out what an agent may do underneath it.
Using it with Claude, ChatGPT, Cursor and other MCP clients
RuleFence is not the MCP server and does not pretend to be one. WordPress 7.1 registers Abilities, the official MCP Adapter publishes them over the Model Context Protocol, and an MCP client – Claude Desktop, Claude Code, Cursor, ChatGPT, Windsurf, whatever you use – calls them. RuleFence is the layer that decides which of those calls are allowed, which wait for you, and which are refused, and records all of it.
That means it governs whichever of those clients you connect, including more than one at a time, each with its own identity and its own credential that you can revoke on its own.
Setting up a connection ends with the endpoint, a username, an Application Password and a configuration block you paste straight into the client. A site with no MCP Adapter is still covered: the same credential works against the REST endpoint.
What this plugin is, and what a separate add-on adds
Everything above is this plugin. There is no licence key, no edition, and nothing in it that a payment unlocks – what you install is what you get, working, for as many agents as you care to run.
A separate paid add-on, RuleFence Pro, is available from rulefence.com and adds conditional policies and ready-made policy sets, a simulator that tries a draft policy against calls already recorded, a record of which rules actually fire, multi-step workflows with human checkpoints, undo and rollback, scheduling, email alerts and webhooks, approval routing, risk threshold and rate ceiling tuning, audit export, custom retention, saved activity views, reusable agent and permission profiles, and configuration transfer between sites. A further tier governs a multisite network: shared policies, one approval queue, a fleet inventory, and named site groups. It is a second plugin you install alongside this one; nothing about it is present here.
That is worth being plain about, because the two arrangements look similar from outside and are not. This plugin does not ship the paid features in a disabled state. The screens have no buttons that exist to tell you what something would cost, and no control is switched off waiting for a key.
What is never sold, in this plugin or that one: default-deny, human approvals, the signed audit chain, audit logging, secret redaction, emergency mode, WordPress capability checks, failing closed when audit integrity is unavailable, and session expiry. A security control that only works if you pay is not a security control.
External services
None. See “Nothing leaves your site” above.
The two features that could make an outbound request – webhook notifications, and validating a licence key – both belong to the paid add-on. Neither is here, so there is no code in this plugin that could make a request even if something asked it to.
Agents reach your site from outside it, over the REST API, using an Application Password you issue and can revoke. That is inbound, and it is what the plugin exists to govern.
