Enable Abilities for MCP -- WordPress 插件

开发者	fabiomontenegro1987
更新时间	2026年9月18日 11:52
捐献地址:	去捐款
PHP版本:	8.0 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

Enable Abilities for MCP gives you full control over which WordPress Abilities are available to AI assistants through the MCP (Model Context Protocol) Adapter. WordPress 6.9 introduced the Abilities API, allowing external tools to discover and execute actions on your site. This plugin extends that functionality by registering a comprehensive set of content management abilities and providing a simple admin interface to toggle each one on or off. Connect from claude.ai with just a URL Since version 2.1 the plugin ships an embedded OAuth 2.1 server built for claude.ai custom connectors. Add your site in claude.ai → Settings → Connectors, log in with your WordPress user, approve the consent screen — connected. No Client ID, no Application Password, no local configuration.

Works from the claude.ai web app, mobile apps, and Claude Desktop
Each team member authenticates with their own WordPress account and role — a subscriber can never do what only an editor should
Every ability execution lands in the activity log under the real user's name
Works on single sites, subdirectory installs, and multisite networks (network-activate so the main site serves the OAuth discovery documents for every subsite)

Connect from ChatGPT with the same URL (beta) claude.ai identifies itself with a fixed metadata URL the plugin already trusts. ChatGPT instead registers itself dynamically per connector (RFC 7591), so it needs its own door: turn on ChatGPT & Other OAuth Connectors on the Connection tab and list the callback URLs a connector is allowed to send users back to. In ChatGPT, turn on Developer mode (available on paid plans) and create a connector with the same MCP server URL; the normal login-and-consent flow takes over.

Opt-in and off by default — with the toggle off the discovery document drops registration_endpoint, /oauth/register refuses every request, and the claude.ai connector behaves exactly as before
A connector may only ever return a user to a callback URL you listed, re-checked on every authorization request — remove one and clients that registered while it was allowed are blocked immediately
Wildcards are allowed inside the path, never in the host; registration is capped and rate-limited per IP
Connectors that ask you to paste a Client ID and Secret instead are covered too — the panel can issue one (the secret is shown once and stored only as a hash)
Same as the claude.ai connector downstream: each user logs in with their own WordPress account and role, approves a consent screen, and every execution lands in the activity log under their name

Prefer tokens? Application Passwords (per-user) and a single-admin Bearer token connect Claude Desktop / Claude Code, OpenAI Codex CLI, and Google Antigravity — the Connection tab generates ready-to-paste configuration for each client, and fills in your credentials automatically. Features

112 abilities organized in 21 categories: Core, Read, Write, SEO (Rank Math), SEO (SEOPress), SEO (Yoast), Navigation Menus, Utility, Multilanguage, Custom Post Types, WooCommerce, The Events Calendar, Code Snippets, JetEngine Options Pages, JetEngine Query Builder, Elementor, LearnDash, Tutor LMS, AI Agent Readiness (llms.txt), FSE Block Templates, and Accessibility (WCAG)
WooCommerce integration — dedicated abilities to manage products, orders, and customers using the native WooCommerce API (HPOS-compatible, formally declared)
The Events Calendar integration — list, get, create, and update events with venue, organizer, and date filters
claude.ai OAuth custom connector — connect from claude.ai (web, mobile, or desktop) with zero local setup: an embedded OAuth 2.1 server with Client ID Metadata Document (CIMD) support lets each user log in with their own WordPress account and role
ChatGPT & other OAuth connectors (beta) — separately opt-in: RFC 7591 dynamic client registration at /oauth/register, gated by an administrator-managed callback allowlist, so clients that register themselves can connect through the same consent flow
Admin dashboard with toggle switches for each ability
Per-ability control — expose only what you need
Third-party ability control — abilities registered by other MCP-ready plugins (e.g. Fluent Forms) appear in the same dashboard, grouped by plugin, with the same per-ability toggles; disabling one removes it from every MCP server on the site
Secure by design — proper capability checks, input sanitization, and per-post permission validation
WPCS compliant — fully passes WordPress Coding Standards (phpcs)
MCP-ready — all abilities include show_in_rest and mcp.public metadata

Available Abilities Read (safe, query-only):

Get posts with filters (status, category, tag, search)
Get single post details (content, SEO meta, featured image)
Get categories, tags, pages, comments, media, and users

Write (create & modify):

Create, update, and delete posts
Create categories and tags
Create pages
Moderate comments
Reply to comments as the authenticated user
Upload images from external URLs to the media library (with optional auto-assign as featured image)
Duplicate any post, page, or custom post type item — including all post meta (ACF, SEO, featured image) and taxonomy terms; saved as a draft by default
Assign a custom taxonomy's terms to a post or page (e.g. a taxonomy registered by a companion plugin)

SEO — Rank Math:

Get full Rank Math metadata for any post/page (title, description, keywords, robots, Open Graph, SEO score)
Update Rank Math metadata: SEO title, description, focus keyword, canonical URL, robots, Open Graph, primary category, pillar content

SEO — SEOPress:

Get full SEOPress metadata for any post/page (title, description, focus keyword, robots, canonical, Open Graph, Twitter Card)
Update SEOPress metadata: SEO title, description, focus keyword, canonical URL, robots directives, Open Graph, Twitter Card

SEO — Yoast SEO:

Get full Yoast SEO metadata for any post/page (title, description, focus keyphrase, canonical, robots, Open Graph, Twitter Card)
Update Yoast SEO metadata: SEO title, description, focus keyphrase, canonical URL, robots (noindex, nofollow, advanced), Open Graph, Twitter Card
Get Yoast sitemap index — fetch and parse the sitemap index, returning all registered sitemap URLs with last modification date

Custom Post Types:

List all registered custom post types with configuration and taxonomies
Get items from any CPT with filtering, search, and taxonomy queries
Get full details of a CPT item including all meta fields (WooCommerce, ACF, JetEngine, etc.)
Create, update, and delete CPT items with taxonomy and meta field support
Get CPT taxonomies with their terms
Assign taxonomy terms to CPT items
Read term meta by exact key, or all meta for a term
Write a term meta field by exact key
Update a term's core fields: name, slug, description, or parent

WooCommerce:

List products with price, SKU, stock status, categories, and type
Get full product detail including gallery, attributes, and variations
Update product price, sale price, stock quantity, and status
List orders with customer, total, status, and date (HPOS-compatible)
Get full order detail: line items, billing/shipping, totals, and notes
Update order status with optional note
List customers with email, name, total spent, and order count

The Events Calendar:

List events with start/end date, venue, organizer, and date range filter
Get full event detail with resolved venue address and organizer contact
Create new events with title, description, dates, venue, and organizer
Update existing events

Navigation Menus:

List menus with item counts and theme locations, and get one menu's full item hierarchy
Create a new menu, and add pages, posts, categories, tags, or custom URLs as items (with parent and position)
Update an item's title, URL, parent, or position
Remove an item, assign a menu to a theme location, or delete a menu entirely (opt-in — destructive)

Tutor LMS:

Read a lesson's video source configuration (type, value, and runtime)
Set a lesson's video source (external URL, YouTube, Vimeo, HTML5, or a third-party source such as Bunny.net) using Tutor's own storage function — avoids the string-only limitation of the generic Update Post Meta ability, which Tutor cannot read back
List courses, and get a single course's full detail with its topics/lessons hierarchy
Get a user's enrollment status and completion progress for a course
Get a user's quiz attempt results, optionally filtered to a single quiz
Enroll a user in a course, and unenroll them (both opt-in, manage_options only)

Multilanguage (Polylang, WPML, or Linguator AI):

List the languages configured on the site
Create the translation of a post or page in a target language, linked to the source: the AI supplies the translated title, content, and excerpt; taxonomies, custom fields, and the featured image are copied over, and an existing translation is updated instead of duplicated
Create the translation of a category, tag, or custom taxonomy term: translated name and description, term meta copied, parent remapped to its target-language counterpart
Assign a language to an existing post or taxonomy term
Link two posts, or two terms, as translations of each other in the same translation group
Get the full translation map for a post or a term

LearnDash:

List courses with enrollment count, and get a single course's full detail (lessons, topics, quizzes)
Get a user's enrollment status/progress and quiz results for a course
Enroll or unenroll a user in a course (opt-in — write, manage_options)

JetEngine Options Pages:

List all registered Options Pages with their field schema
Get all fields and current values for an Options Page by slug
Update a single Options Page field, including repeater rows (opt-in — write)

JetEngine Query Builder:

List all Query Builder queries with id, name, and query type
Get the full settings of one query by id
Update an existing query's name, type, or arguments — the missing counterpart to JetEngine's own native "Add Query" MCP tool, which has no edit/get/list equivalent (opt-in — write)

Elementor:

Get a compact, read-only tree of an Elementor page/template (element ids, types, text preview)
Update an Elementor element's settings by id — single or batch edits (opt-in — write)
Bind a widget setting to a dynamic tag: post title, or a JetEngine/meta field (opt-in — write)

Code Snippets:

Create a PHP code snippet via the Code Snippets plugin — always saved as inactive. Validates PHP syntax and blocks dangerous functions (eval, exec, shell_exec, and more)
List snippets (without their code) and read one snippet by ID, including its code
Update a PHP snippet's name, description, code, scope, or tags (opt-in); new code is validated, and an active snippet whose code changes is deactivated
Deactivate a snippet, or request its activation (opt-in). Activation is never automatic: the request returns a wp-admin link where an administrator reviews the code and confirms it. The confirmation is bound to the exact code and expires after 24 hours

AI Agent Readiness (llms.txt):

Fetch and validate the site's llms.txt against the llmstxt.org spec, with actionable issues
Write llms.txt content — routes automatically to SEOPress Pro's option when active, or serves it directly (opt-in — write)

FSE Block Templates:

List all wp_template and wp_template_part entries for the active theme, merging theme-file defaults with database overrides
Get the full block markup for one template or template part by slug
Write new block markup to a template or template part — creates a database override automatically when the target is still a theme default; rejects content with unbalanced block-comment delimiters (opt-in — write, edit_theme_options)

Accessibility (WCAG):

Scan the media library for images missing alt text (WCAG 1.1.1 Non-text Content), paginated

Utility:

Search and replace text in post content
Site statistics overview (includes custom post type counts)
Update any post meta field by exact key (with protected internal key blocklist)

Requirements

WordPress 6.9 or later (Abilities API)
MCP Adapter plugin installed and configured
PHP 8.0 or later

2.13.0

New: the CPT abilities can manage post types that are not public, when they are on an explicit allowlist. Tutor LMS topics is on it by default when Tutor LMS is active, so an assistant can finally build a course tree: course, topic, lesson. Every other non-public type is still rejected, WordPress built-ins remain unreachable, and all capability checks are unchanged. Site owners can add their own structural types with the new ewpa_manageable_private_post_types filter. Reported from a Tutor LMS site.
New: ewpa/update-cpt-item accepts post_parent and menu_order, mirroring ewpa/create-cpt-item. A hierarchical item created in the wrong place, or a duplicate, can now be re-parented and reordered instead of being stuck. An item cannot be made its own parent, and a missing parent is refused.
New: Regression suite for the post type guard and the update path (tests/cpt-abilities-test.php, 21 checks). Runs without WordPress: php tests/cpt-abilities-test.php.

2.12.0

New: ability sections in Settings › WP Abilities collapse like an accordion. Click a section header to open or close it; the "All" checkbox keeps working without toggling the section. Sections start collapsed, and the ones you open stay open in that browser.
New: each ability section shows how many of its abilities are enabled (for example, 2/3), updated as you change the toggles.

2.11.1

Fix: the plugin no longer ships its own copy of MCP Adapter. The OAuth library pulled MCP Adapter 0.5.0 into vendor/ as a dependency. Development builds of MCP Adapter check for a copy loaded before them; because this plugin loads first, they found that copy, showed "Another version of MCP Adapter is already loaded", and ran the bundled 0.5.0 instead of themselves. The MCP Adapter plugin you install is now the only copy this plugin provides. Reported by @donbowman.
Fix: the "requires the MCP Adapter plugin" notice now detects the MCP Adapter plugin itself, so it no longer appears when the plugin is active but installed in a folder with a different name.

2.11.0

New: ewpa/get-code-snippets and ewpa/get-code-snippet (Code Snippets section, enabled by default) list the snippets stored by the Code Snippets plugin (without their code) and read one snippet by ID, including its code. Requires manage_options.
New: ewpa/update-code-snippet (opt-in) changes a PHP snippet's name, description, code, scope, or tags, leaving every other field untouched. New code goes through the same syntax check and blocked-function list as ewpa/create-code-snippet; an active snippet whose code changes is deactivated so the new code is reviewed before it runs.
New: ewpa/set-code-snippet-active (opt-in) deactivates a snippet immediately, but never activates one directly. Asking for activation files a request and returns a wp-admin link where an administrator reads the code and approves or rejects it. The approval form needs a WordPress login nonce, which MCP credentials cannot produce; the request is bound to a hash of the code, expires after 24 hours, and every check runs again at approval time. Pending requests are announced with an admin notice. Suggested by @torontotoph.
Fix: ewpa/create-code-snippet stored snippets created with scope: frontend as global, because Code Snippets names that scope front-end and silently falls back to global for values it does not know, so a snippet meant for the front end also ran in wp-admin. Both spellings are now accepted and stored as front-end.
Fix: abilities marked opt-in (disabled by default) were enabled on fresh installs, because the first activation enabled every ability. New installs now leave them off; existing installs keep their current settings. ewpa/remove-menu-item, ewpa/assign-menu-location, and ewpa/delete-menu are now flagged opt-in too, matching their descriptions.
Fix: the Code Snippets section showed "plugin is not active" with Code Snippets 3.10 or later, whose API moved into a namespace.
New: Regression suite for the Code Snippets helpers and the confirmation flow (tests/code-snippets-test.php, 33 checks). Runs without WordPress: php tests/code-snippets-test.php.
Updated: Total abilities: 112 in 21 categories.

2.10.1

Fix: ewpa/duplicate-post copied the internal translation-group taxonomies of Polylang and Linguator AI along with regular terms, so on a multilingual site the duplicate joined the original's translation group and its language switcher and translation links pointed at the original's translations. The duplicate now keeps the source language but gets its own group.
Fix: ewpa/link-post-translation and ewpa/link-term-translation reported success on Polylang even when Polylang discarded the link because the translated post or term did not already carry the target language. They now assign that language first, as the WPML and Linguator AI backends already did, and return a translation_not_linked error if the link still does not persist.
Fix: ewpa/list-languages returned term_id 0 for every Polylang language; it now returns each language's term ID.

2.10.0

New: Linguator AI support in the Multilanguage section, alongside Polylang and WPML: detection, languages, post and term languages, and translation groups through Linguator's public API. Contributed by @drbelt27.
New: ewpa/create-post-translation (Multilanguage, enabled by default) creates the translation of a post or page in a target language and links it to the source. The AI supplies the translated title, content, and excerpt; the ability never calls a translation service. Taxonomies, custom fields, and the featured image are copied, with backslashes preserved so JSON meta such as Elementor's _elementor_data survives intact; on Linguator AI the plugin's own duplication engine is used. If a translation already exists in that language it is updated instead of duplicated. Contributed by @drbelt27.
New: ewpa/create-term-translation (enabled by default) does the same for categories, tags, and custom taxonomy terms: translated name and description, term meta copied, and the parent remapped to its target-language counterpart. Updating an existing translation changes only the supplied fields. Contributed by @drbelt27.
New: ewpa/list-languages, ewpa/set-term-language, ewpa/link-term-translation, and ewpa/get-term-translations (enabled by default) list the configured languages and manage term languages and translation groups. Contributed by @drbelt27.
New: Regression suite for the multilanguage backend (tests/multilanguage-backend-test.php, 42 cases), with test doubles that unslash like WordPress core and validate languages like Polylang. Runs without WordPress: php tests/multilanguage-backend-test.php.
Updated: Total abilities: 108 in 21 categories.

2.9.0

New: ChatGPT & Other OAuth Connectors (beta, opt-in, off by default) — RFC 7591 dynamic client registration at /oauth/register, so ChatGPT and other self-registering clients connect through the same login-and-consent flow as the claude.ai connector. The security boundary is an administrator-managed callback allowlist, enforced at registration and re-checked on every authorization request, so removing a URL immediately blocks clients that registered while it was allowed. The same list gates which client metadata documents are fetched (wp_safe_remote_get, no redirects). Consent, code issuance, PKCE, token signing and refresh rotation stay in the bundled wp-media/mcp-oauth library; with the toggle off, the claude.ai connector is unchanged. Contributed by @keyvansolha.
New: Regression suite for the connector callback allowlist (tests/oauth-connectors-test.php, 42 checks) covering redirect-URI smuggling — userinfo and backslash authorities, subdomain confusion, port and path-prefix mismatches, query strings and fragments through wildcards, protocol-relative and non-HTTP schemes — plus RFC 8252 loopback handling. Runs without WordPress: php tests/oauth-connectors-test.php.
Fix: IPv6 loopback redirect URIs (http://[::1]:port/…) were rejected, because PHP's parse_url() keeps the brackets around an IPv6 literal and the loopback check only knew ::1. It failed closed, so nothing was ever allowed that should not have been; native clients on IPv6 loopback can now connect. Found by the new regression suite.

2.8.1

New: ewpa/assign-post-terms (Write section, enabled by default) — assigns a custom taxonomy's terms to a post or page. ewpa/assign-cpt-terms explicitly rejects built-in post types (post, page, attachment, and others) by design, since native categories/tags on posts are already covered by ewpa/update-post — but that left a real gap for a custom taxonomy registered on post/page by a companion plugin, with no assignment path through MCP at all. Mirrors ewpa/assign-cpt-terms's security checks exactly (edit_post, taxonomy_exists, taxonomy-post_type association, and the taxonomy's own assign_terms capability), so an admin-only taxonomy stays admin-only regardless of post type.
Updated: Total abilities: 102 in 21 categories.

2.8.0

New: Accessibility (WCAG) section — ewpa/get-accessibility-snapshot (read, enabled by default) scans the media library for images missing alt text (WCAG 1.1.1 Non-text Content) and returns a paginated list, so they can be fixed via ewpa/update-post-meta (_wp_attachment_image_alt). Deliberately narrow scope: full WCAG scanning (color contrast, ARIA, keyboard navigation) is a rendered-page/browser concern already covered by browser-based tools such as Lighthouse, not duplicated here.
Updated: Total abilities: 101 in 21 categories.

2.7.2

New: JetEngine Query Builder section (3 abilities) — ewpa/je-list-queries and ewpa/je-get-query (read, enabled by default) list and read Query Builder queries via JetEngine's own internal data layer (Jet_Engine\Query_Builder\Manager); ewpa/je-update-query (write, opt-in) updates an existing query's name, type, or arguments, converting query_args the same way JetEngine's own tools do. This is the missing counterpart to JetEngine's own native "Add Query" MCP tool — JetEngine ships its own separate, bundled MCP server with a tool to create a query but none to list, read, or edit one; these abilities close that gap through the standard WordPress Abilities API instead of JetEngine's internal tool registry. Requires JetEngine with the Query Builder module. Validated end-to-end on a live production site, including a real write to an in-use query with a non-trivial tax_query/post_type configuration that was confirmed intact after the update.
Updated: Total abilities: 100 in 20 categories.

2.7.1

New: ewpa/update-term (Custom Post Types section, enabled by default) — updates a taxonomy term's core fields (name, slug, description, parent term). Only the provided fields are modified. Complements ewpa/get-term-meta / ewpa/update-term-meta (v2.7.0), which only cover custom meta, not these core fields. Requested from a live JetEngine + Polylang site that needed to rename a mistranslated term.
Updated: Total abilities: 97 in 19 categories.

2.7.0

New: ewpa/get-term-meta and ewpa/update-term-meta (Custom Post Types section, enabled by default) — read and write taxonomy term meta by exact key, the term-level equivalent of ewpa/get-post-meta / ewpa/update-post-meta. get-term-meta returns every meta field for the term when meta_key is omitted. Both require the edit_term capability on the target term.
Fix: ewpa/get-cpt-taxonomies threw an output-schema validation error ("not of type string") for taxonomies registered with 'label' => false — a pattern used by internal taxonomies some multilingual plugins (e.g. Polylang) attach to custom post types. The taxonomy slug is now used as a fallback label instead of the raw false value. Reported from a live JetEngine + Polylang site.
Updated: Total abilities: 96 in 19 categories.

2.6.0

New: FSE Block Templates section (3 abilities) — ewpa/fse-list-templates and ewpa/fse-get-template (read, enabled by default) list and read wp_template / wp_template_part entries for the active theme via get_block_templates() / get_block_template(), merging theme-file defaults with database overrides; ewpa/fse-update-template (write, opt-in) writes new block markup, creating a database override when the target is still a theme default, and rejects content with unbalanced block-comment delimiters before saving. Guarded behind current_theme_supports('block-templates'). Requested by redsoulwarrior in a WordPress.org review.
Fix: ewpa/create-code-snippet failed on every call with "Cannot instantiate Snippet class" on Code Snippets 3.10.0+ — its PSR-4 refactor moved the Snippet class from Code_Snippets\Snippet to Code_Snippets\Model\Snippet. Now checks both locations (plus the legacy global Snippet for 2.x), so it works across Code Snippets 2.x through 3.10+. Reported by redsoulwarrior with a confirmed version-downgrade repro.
Docs: "Available Abilities" section now documents the Multilanguage, LearnDash, JetEngine Options Pages, Elementor, Code Snippets, and AI Agent Readiness (llms.txt) sections — previously listed only in the Features summary, not broken out in detail.
Compatibility: Tested up to WordPress 7.1.
Updated: Total abilities: 94 in 19 categories.

2.5.2

Fix: ewpa/search-replace matched against a sanitize_text_field()-cleaned copy of the search term instead of the raw text — a search containing HTML tags, line breaks, or repeated whitespace would silently never match post_content (which stores that raw). The search and replacement values are now used as-is.
Fix: ewpa/search-replace rejected a search term of "0" as empty, because PHP's empty() treats the string "0" as falsy. Now uses a strict empty-string check.
Fix: Stable tag in this readme was left at 2.5.0 after the 2.5.1 release, so WordPress.org never picked up 2.5.1 as current. Corrected to 2.5.2.

2.5.1

Fix: ewpa/tutor-get-user-progress always returned enrollment_status: null — Tutor's EnrollmentModel::is_enrolled() doesn't select post_status in its query, so the field silently read as null. Now resolved via get_post().
Docs: v2.5.0 also shipped 6 Tutor LMS parity abilities (list courses, get course detail with topics/lessons hierarchy, get user progress, get quiz results, enroll user, unenroll user) that were left undocumented in that release — now reflected here and in the Available Abilities list.
Updated: Total abilities: 91 in 18 categories (corrected from the 85 mistakenly listed in 2.5.0).

2.5.0

New: ewpa/duplicate-post — duplicates any post, page, or CPT item, copying all post meta (ACF fields, SEO data, featured image) and taxonomy terms. The copy is saved as a draft by default. Opt-in write ability.
Fix: meta values are now re-slashed before add_post_meta() to match WordPress's internal wp_unslash() contract — prevents backslash loss in serialized or JSON meta fields (e.g. _elementor_data) when duplicating.
Fix: self-healing migration automatically adds ewpa/duplicate-post to the enabled-abilities list on existing installs upgrading from earlier versions.
Updated: Total abilities: 85 in 18 categories.
i18n: POT and Spanish (es_ES) translation updated.

2.4.0

New: Tutor LMS section — 2 abilities to read and set a lesson's video source: ewpa/tutor-get-lesson-video and ewpa/tutor-update-lesson-video, both enabled by default. Requires Tutor LMS (tutor_utils()).
Fix: writing a lesson's video through the generic ewpa/update-post-meta ability silently broke video playback — Tutor stores _video as a native PHP array, but update-post-meta always writes strings, and WordPress's own serialization safeguards (is_serialized()) prevent a plain or hand-serialized string from ever being reinterpreted as that array. ewpa/tutor-update-lesson-video calls tutor_utils()->update_video() directly — the same function Tutor's own editor uses — so the value is always stored correctly, including third-party sources registered via the tutor_preferred_video_sources filter (e.g. Bunny.net). Validated on a live Tutor LMS site with a Bunny.net-hosted lesson video.
Updated: Total abilities: 84 in 18 categories.
i18n: POT and Spanish (es_ES) translation updated.

2.3.0

New: Navigation Menus section — 8 new abilities to create and manage a site's navigation menus entirely through MCP: create-menu, list-menus, get-menu, add-menu-item (pages, posts, categories, tags, or custom URLs, with parent/position), and update-menu-item are enabled by default; remove-menu-item, assign-menu-location, and delete-menu are opt-in (destructive). All require edit_theme_options, the same capability WordPress demands for Appearance → Menus.
Updated: Total abilities: 82 in 17 categories.
i18n: POT and Spanish (es_ES) translation updated.

2.2.1

Fix: ewpa/get-cpt-items ignored the requested post_type when the s (search) parameter was set, silently returning items from a different post type. Caused by suppress_filters => false on the internal get_posts() call, which left third-party pre_get_posts hooks free to rewrite the query once a search term was present (observed on a Tutor LMS site, where lesson is excluded from search and a search-integration plugin fell back to courses). Removed the override so the ability uses get_posts()'s own safe default (suppress_filters => true), matching every other CPT-listing ability in the plugin. Reported by a user testing the MCP connector against a live Tutor LMS site.

2.2.0

New: third-party ability management — abilities registered by other MCP-ready plugins (e.g. Fluent Forms 6.2.12+) now appear in the Abilities tab under a "Third-party" section per plugin namespace, with the same per-ability toggles. Disabling one unregisters it at the end of wp_abilities_api_init, removing it from every MCP server on the site (this plugin's claude.ai OAuth connector, the default adapter server, and the third-party plugin's own MCP endpoint). New third-party abilities start enabled, and disabled ones stay listed for re-enabling — validated end-to-end against Fluent Forms' MCP tools.
New: plugin homepage at https://mcp.fabiomontenegro.com/ (Plugin URI); donations moved to Ko-fi.
i18n: POT and Spanish (es_ES) translation updated.

2.1.1

Fix: OAuth discovery-document handling (canonical-redirect prevention and RFC 9728 path-suffixed URLs) now works for sites installed in a subdirectory — the matchers derive the site's base path from home_url() instead of assuming a root install.
New: multisite discovery bridge — on subdirectory networks, OAuth clients resolve /.well-known/oauth-* against the domain root, which belongs to the main site. With the plugin network-activated, the main site now resolves those requests to the owning subsite and relays its discovery document, making the claude.ai connector work for every subsite (validated against claude.ai on a production-style subdirectory multisite).
Docs: Multisite FAQ updated with the subdirectory-network requirements.

2.1.0

New: claude.ai OAuth Custom Connector — embedded OAuth 2.1 server (wp-media/mcp-oauth) with Client ID Metadata Document (CIMD) support. Add your site as a custom connector in claude.ai (web, mobile, or desktop) with just a URL — no Client ID, no Application Password: each user logs in with their own WordPress account and approves a consent screen. Opt-in from Settings > WP Abilities > Connection.
New: Connection tab redesigned — authentication methods now read top-down as options (claude.ai OAuth, Application Passwords, Single Admin Bearer Token) and the client configuration examples (Claude Desktop / Claude Code, OpenAI Codex CLI, Google Antigravity) moved to a shared, highlighted "Connect your AI client" section with the MCP endpoint URL, since they apply to both token methods.
New: generating Application Password credentials now auto-fills every client example with your real Basic authorization header — copy-paste ready, no manual editing.
Fix: OAuth discovery documents (/.well-known/oauth-*) and /oauth/* endpoints no longer receive WordPress's trailing-slash 301 canonical redirect, which strict OAuth clients (claude.ai) reject as a failed metadata fetch.
Fix: RFC 9728 path-suffixed discovery URLs (/.well-known/oauth-protected-resource/<mcp-path>) are now served, matching the lookup order of Anthropic's OAuth client.
Docs: FAQ entries on diagnosing hosting WAFs (cPGuard/Imunify/ModSecurity) and Cloudflare bot protections that block Anthropic's python-httpx client.
i18n: POT and Spanish (es_ES) translation updated with the new strings.

2.0.25 and earlier

See changelog.txt for the full history of older versions.

Enable Abilities for MCP

标签

下载

详情介绍:

安装:

升级注意事项:

常见问题:

更新日志: