{"id":348852,"date":"2026-08-20T12:28:19","date_gmt":"2026-08-20T12:28:19","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/hlb-mcp-abilities\/"},"modified":"2026-08-20T12:28:08","modified_gmt":"2026-08-20T12:28:08","slug":"hlb-ability-registry-mcp","status":"publish","type":"plugin","link":"https:\/\/tw.wordpress.org\/plugins\/hlb-ability-registry-mcp\/","author":179,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.6.2","stable_tag":"1.6.2","tested":"7.1","requires":"6.9","requires_php":"7.4","requires_plugins":null,"header_name":"HLB Ability Registry for MCP","header_author":"Jordan Hlebarov","header_description":"Exposes a curated, admin-controlled set of WordPress Abilities to the MCP Adapter so third-party tools and AI agents can interact with the site over MCP. Multisite-ready with network defaults and per-subsite overrides. Source: https:\/\/github.com\/jdbg\/hlb-ability-registry-mcp","assets_banners_color":"272267","last_updated":"2026-08-20 12:28:08","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/jdbg\/hlb-ability-registry-mcp","header_author_uri":"https:\/\/jdbg.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":31,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.6.2":{"tag":"1.6.2","author":"jdbg","date":"2026-08-20 12:28:08"}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3656827,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3656827,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3656827,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3656827,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.6.2"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3656827,"resolution":"1","location":"assets","locale":"","width":1280,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3656827,"resolution":"2","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"Settings screen: abilities grouped into searchable, countable categories (Content \u2014 read\/write, Media, Comments, Users, Site Editor, Site &amp; diagnostics), each with its own toggle.","2":"Live search narrows the list by name, id, or description across every category at once."}},"plugin_section":[],"plugin_tags":[256265,2353,242115,441,23853],"plugin_category":[51],"plugin_contributors":[263983],"plugin_business_model":[],"class_list":["post-348852","plugin","type-plugin","status-publish","hentry","plugin_tags-abilities-api","plugin_tags-ai","plugin_tags-mcp","plugin_tags-multisite","plugin_tags-rest-api","plugin_category-multisite","plugin_contributors-jdbg","plugin_committers-jdbg"],"banners":{"banner":"https:\/\/ps.w.org\/hlb-ability-registry-mcp\/assets\/banner-772x250.png?rev=3656827","banner_2x":"https:\/\/ps.w.org\/hlb-ability-registry-mcp\/assets\/banner-1544x500.png?rev=3656827","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/hlb-ability-registry-mcp\/assets\/icon-128x128.png?rev=3656827","icon_2x":"https:\/\/ps.w.org\/hlb-ability-registry-mcp\/assets\/icon-256x256.png?rev=3656827","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/hlb-ability-registry-mcp\/assets\/screenshot-1.png?rev=3656827","caption":"Settings screen: abilities grouped into searchable, countable categories (Content \u2014 read\/write, Media, Comments, Users, Site Editor, Site &amp; diagnostics), each with its own toggle."},{"src":"https:\/\/ps.w.org\/hlb-ability-registry-mcp\/assets\/screenshot-2.png?rev=3656827","caption":"Live search narrows the list by name, id, or description across every category at once."}],"raw_content":"<!--section=description-->\n<p>Most \"connect AI to WordPress\" tools expose either everything or nothing: a single broad REST scope, or a fixed bundle of tools the site owner can't trim. HLB Ability Registry for MCP takes a different approach \u2014 it ships a <strong>declarative catalogue<\/strong> of individually-togglable <a href=\"https:\/\/make.wordpress.org\/core\/2025\/09\/09\/introducing-the-wordpress-abilities-api\/\">WordPress Abilities<\/a>, and the <em>site owner<\/em> decides exactly which ones are live, per site.<\/p>\n\n<h4>What it actually does<\/h4>\n\n<ul>\n<li>Registers a curated set of abilities against WordPress core's own Abilities API (<code>wp_register_ability()<\/code>) \u2014 content, media, comments, users, Site Editor templates &amp; patterns, and optional WooCommerce and SEOPress integrations when those plugins are active.<\/li>\n<li>Every ability has its own admin toggle in <strong>Settings \u2192 HLB Ability Registry for MCP<\/strong>, searchable and grouped by category. Read-only abilities default on; write and destructive abilities default off.<\/li>\n<li>Read handlers do per-object capability checks (not just a blanket <code>current_user_can<\/code>), so a low-privilege caller can't read drafts or private posts by ID just because a coarse capability check passed. Listing abilities force unprivileged callers back to published content, and abilities only ever address post types the site already exposes publicly or over the REST API.<\/li>\n<li>On <strong>multisite<\/strong>, each subsite gets its own on\/off set, inherited from a network default unless a subsite administrator explicitly overrides it. An optional <strong>network mode<\/strong> lets the main site's server target any subsite by id, with every permission and capability check re-run inside that subsite's own context \u2014 nothing is granted network-wide by default.<\/li>\n<li>If the <a href=\"https:\/\/github.com\/WordPress\/mcp-adapter\">MCP Adapter<\/a> plugin is active, the enabled abilities are projected onto a standard MCP server at <code>\/wp-json\/{server-slug}\/mcp<\/code>, so any MCP-speaking client or agent can call them. Without the MCP Adapter, the abilities you enable are still fully registered and reachable through core's own <code>\/wp-json\/wp-abilities\/v1\/<\/code> REST routes \u2014 this plugin has value on a bare WordPress 6.9 install, the MCP Adapter is an optional extra hop for MCP clients specifically, not a hard requirement.<\/li>\n<\/ul>\n\n<h4>Source code<\/h4>\n\n<p>Development happens in the open: https:\/\/github.com\/jdbg\/hlb-ability-registry-mcp<\/p>\n\n<h4>Try it without installing anything<\/h4>\n\n<p>This plugin ships a <a href=\"https:\/\/playground.wordpress.net\/\">WordPress Playground<\/a> blueprint so you can click through the settings screen and a live MCP endpoint in a disposable browser sandbox before installing anything on a real site. See the FAQ below for the link.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate the plugin as usual (upload the zip, or <code>wp plugin install<\/code>).<\/li>\n<li>Visit <strong>Settings \u2192 HLB Ability Registry for MCP<\/strong> to review and toggle the abilities available on this site.<\/li>\n<li>(Optional) Install the <a href=\"https:\/\/github.com\/WordPress\/mcp-adapter\">MCP Adapter plugin<\/a> \u2014 it's not in the wordpress.org directory, so download it from its GitHub releases page and upload it via <strong>Plugins \u2192 Add New \u2192 Upload Plugin<\/strong>. Once it's active, this plugin's admin notice clears and your MCP endpoint goes live automatically; no extra configuration needed.<\/li>\n<li>On multisite, network-activate to set a network default; individual subsites can override it from their own settings screen unless network mode is enabled.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20require%20the%20mcp%20adapter%20to%20do%20anything%3F\"><h3>Does this plugin require the MCP Adapter to do anything?<\/h3><\/dt>\n<dd><p>No. Abilities register with WordPress core's Abilities API regardless, and are reachable via <code>\/wp-json\/wp-abilities\/v1\/<\/code>. The MCP Adapter is only needed if you want the dedicated MCP protocol endpoint. This plugin never downloads or installs the MCP Adapter automatically \u2014 it only detects whether it's present and links to its GitHub releases page if not.<\/p><\/dd>\n<dt id=\"which%20abilities%20are%20enabled%20by%20default%3F\"><h3>Which abilities are enabled by default?<\/h3><\/dt>\n<dd><p>Read-only abilities (listing\/getting posts, media, comments, taxonomies, templates, site info) default on. Anything that writes or deletes data defaults off until a site administrator turns it on explicitly.<\/p><\/dd>\n<dt id=\"can%20i%20try%20this%20before%20installing%20it%3F\"><h3>Can I try this before installing it?<\/h3><\/dt>\n<dd><p>Yes \u2014 open it in WordPress Playground: https:\/\/playground.wordpress.net\/?blueprint-url=https:\/\/raw.githubusercontent.com\/jdbg\/hlb-ability-registry-mcp\/main\/blueprints\/demo.json<\/p><\/dd>\n<dt id=\"is%20this%20safe%20on%20multisite%3F\"><h3>Is this safe on multisite?<\/h3><\/dt>\n<dd><p>Yes. Per-subsite settings are always intersected with the currently-available ability registry, so a stale or renamed id can never be registered. In network mode, every permission and capability check still runs inside the target subsite's own context via <code>switch_to_blog()<\/code>, so a non-member is denied exactly as if they'd called the API on that subsite directly.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.6.2<\/h4>\n\n<ul>\n<li>The MCP Adapter dependency notice no longer reports an adapter that is active but failed to load as \"installed but not active\", and no longer offers an Activate button that would do nothing.<\/li>\n<li>The notice now names the actual cause \u2014 missing bundled dependencies, a suppressed <code>WP_MCP_AUTOLOAD<\/code> autoloader, or an unexplained load failure \u2014 and gives the remedy that fits it.<\/li>\n<li>The post-activation success notice is only shown when the adapter really loaded, instead of appearing alongside the error notice.<\/li>\n<\/ul>\n\n<h4>1.6.1<\/h4>\n\n<ul>\n<li>Fix a fatal error in network mode: abilities whose input schema has no properties (e.g. <code>get-current-user<\/code>) aborted registration, silently dropping every ability after them from the MCP tool list.<\/li>\n<li>Tested up to WordPress 7.1.<\/li>\n<\/ul>\n\n<h4>1.6.0<\/h4>\n\n<ul>\n<li>Security: <code>wc-list-products<\/code> no longer returns draft, pending, private or trashed products to callers who cannot edit products.<\/li>\n<li>Security: abilities only address post types that are public or exposed in the REST API, so a coarse <code>read<\/code> capability cannot reach a plugin's private post types. Filterable with <code>hlb_mcp_allowed_post_types<\/code>.<\/li>\n<li><code>get-active-theme<\/code> only reports the theme version and author to callers who can manage options, matching <code>get-site-info<\/code>.<\/li>\n<\/ul>\n\n<h4>1.5.0<\/h4>\n\n<ul>\n<li>Rework the settings screen with tabbed categories, search, and the Settings API.<\/li>\n<\/ul>\n\n<h4>1.4.0<\/h4>\n\n<ul>\n<li>Version bump.<\/li>\n<\/ul>\n\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>Add SEOPress ability integration.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Add Frontend Gatekeeper integration.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Restrict pattern category creation.<\/li>\n<li>Add Site Editor template and pattern abilities.<\/li>\n<li>Security refactor.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"An admin-curated ability registry for the WordPress Abilities API, with a per-ability on\/off switch and optional multisite network control.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/348852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=348852"}],"author":[{"embeddable":true,"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/jdbg"}],"wp:attachment":[{"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=348852"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=348852"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=348852"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=348852"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=348852"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/tw.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=348852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}