HLB Ability Registry for MCP
| 开发者 | jdbg |
|---|---|
| 更新时间 | 2026年10月7日 17:01 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Most "connect AI to WordPress" tools expose either everything or nothing: a single broad REST scope, or a fixed bundle of tools the site owner can't trim. HLB Ability Registry for MCP takes a different approach — it ships a declarative catalogue of individually-togglable WordPress Abilities, and the site owner decides exactly which ones are live, per site.
What it actually does
- Registers a curated set of abilities against WordPress core's own Abilities API (
wp_register_ability()) — content, media, comments, users, Site Editor templates & patterns, and optional WooCommerce, SEOPress and Gravity Forms integrations when those plugins are active. - Every ability has its own admin toggle in Settings → HLB Ability Registry for MCP, searchable and grouped by category. Read-only abilities default on; write and destructive abilities default off.
- Read handlers do per-object capability checks (not just a blanket
current_user_can), so a low-privilege caller can't read drafts or private posts by ID just because a coarse capability check passed. Listing abilities force unprivileged callers back to published content, and abilities only ever address post types the site already exposes publicly or over the REST API. - On multisite, each subsite gets its own on/off set, inherited from a network default unless a subsite administrator explicitly overrides it. An optional network mode lets the main site's server target any subsite by id, with every permission and capability check re-run inside that subsite's own context — nothing is granted network-wide by default.
- Requires the MCP Adapter plugin, which projects the enabled abilities onto a standard MCP server at
/wp-json/{server-slug}/mcp, so any MCP-speaking client or agent can call them. The enabled abilities are also reachable through core's own/wp-json/wp-abilities/v1/REST routes.
安装:
- Install and activate the MCP Adapter plugin (required). WordPress offers to install it for you from the plugin's card in Plugins → Add New.
- Install and activate this plugin as usual (upload the zip, or
wp plugin install). - Visit Settings → HLB Ability Registry for MCP to review and toggle the abilities available on this site.
- On multisite, network-activate to set a network default; individual subsites can override it from their own settings screen unless network mode is enabled.
屏幕截图:
常见问题:
Does this plugin require the MCP Adapter?
Yes. It declares the MCP Adapter as a required plugin, so WordPress won't activate it until the adapter is installed and active, and won't let you deactivate the adapter while this plugin is active. On multisite, network-activate the adapter before network-activating this plugin.
Which abilities are enabled by default?
Read-only abilities (listing/getting posts, media, comments, taxonomies, templates, site info) default on. Anything that writes or deletes data defaults off until a site administrator turns it on explicitly.
Can I try this before installing it?
Yes — open it in WordPress Playground: https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/jdbg/hlb-ability-registry-mcp/main/blueprints/demo.json
Is this safe on multisite?
Yes. Per-subsite settings are always intersected with the currently-available ability registry, so a stale or renamed id can never be registered. In network mode, every permission and capability check still runs inside the target subsite's own context via switch_to_blog(), so a non-member is denied exactly as if they'd called the API on that subsite directly.
更新日志:
1.7.1
- The MCP Adapter is now a required plugin (
Requires Plugins: mcp-adapter). WordPress will not activate this plugin until the adapter is installed and active, and offers to install it from wordpress.org. Existing installs with the adapter active are unaffected.
- Add Gravity Forms ability integration: list and inspect forms, query and read entries, update entry status, add entry notes and delete entries. Entry abilities contain personal data and are off by default.
- An ability's capability can now be a list, any one of which grants access.
- The MCP Adapter is now on wordpress.org: the dependency notice offers an Install button through the core plugin installer instead of linking to GitHub, and the Live Preview installs the adapter from wordpress.org.
- Bulgarian translation updated.
- Maintenance only — no changes to plugin behaviour.
- The Live Preview on the plugin page now installs the MCP Adapter alongside this plugin, so the preview opens on a working MCP endpoint rather than the dependency notice.
- Maintenance only — no changes to plugin behaviour.
- The WordPress Playground blueprint now sits where wordpress.org looks for it, so the plugin page offers a Live Preview.
- The MCP Adapter dependency notice no longer reports an adapter that is active but failed to load as "installed but not active", and no longer offers an Activate button that would do nothing.
- The notice now names the actual cause — missing bundled dependencies, a suppressed
WP_MCP_AUTOLOADautoloader, or an unexplained load failure — and gives the remedy that fits it. - The post-activation success notice is only shown when the adapter really loaded, instead of appearing alongside the error notice.
- Fix a fatal error in network mode: abilities whose input schema has no properties (e.g.
get-current-user) aborted registration, silently dropping every ability after them from the MCP tool list. - Tested up to WordPress 7.1.
- Security:
wc-list-productsno longer returns draft, pending, private or trashed products to callers who cannot edit products. - Security: abilities only address post types that are public or exposed in the REST API, so a coarse
readcapability cannot reach a plugin's private post types. Filterable withhlb_mcp_allowed_post_types. get-active-themeonly reports the theme version and author to callers who can manage options, matchingget-site-info.
- Rework the settings screen with tabbed categories, search, and the Settings API.
- Version bump.
- Add SEOPress ability integration.
- Add Frontend Gatekeeper integration.
- Restrict pattern category creation.
- Add Site Editor template and pattern abilities.
- Security refactor.
- Initial release.