MCP Abilities Guard – Allow, Reject, Or Hold For Approval — Or Undo — Any MCP Action Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
MCP plugins let an AI agent act on your site. Whichever one you use, the result is the same: a model connected in Claude, Cursor or Codex can create posts, edit content, change settings and delete things, and by default nothing stands between the model deciding and WordPress doing.
MCP Abilities Guard lets you govern every ability an AI agent can call. For each one you can set:
- Always allow — it runs, and what it did is recorded
- Require approval — it is held. Nothing changes until a human says yes
- Always reject — it never runs, and the agent is told to stop trying
By default an ability runs unless it does something an undo cannot fix. Reads and ordinary writes — fetching, creating, editing — go through without asking. What is always held for a person is the rest: removing data, or reaching outside the site to send mail, make an HTTP request, or write a file. Those cannot be taken back, so they wait.
The gate is opt-in for everything else. When you want a particular ability to require approval — or to be blocked outright — you set a rule on it. And a removal that hides inside an ability whose code cannot be read is still caught: once it is seen deleting, it is held from then on.
You do not need the ability’s author to have built any of this. The guard attaches as abilities are registered, so it covers plugins that have never heard of it.
It works with whichever MCP plugin you use
There are many MCP server plugins now, each with its own endpoint, its own authentication and its own way of exposing tools. This plugin is not tied to any of them.
Abilities are guarded at the moment WordPress registers them, so a rule applies no matter which server later exposes that ability. And because MCP is a standard protocol, tool calls are recognised by their shape rather than by any plugin’s URL — so a call is inspected the same way whether it arrives through one MCP plugin, another, or one released next year.
That matters more than it sounds. Several MCP plugins register abilities and run their own server that calls the underlying code directly. Guard only the ability, and a rule you set looks armed while the agent’s actual route sails past it. This plugin watches both, so the rule holds whichever way the call comes in.
How it decides what an ability does
Most tools guess from an ability’s name, or trust whatever its author declared. Both are wrong often enough to matter — an ability called get_report can still send email. This plugin prefers evidence, strongest first:
- Watching it run. While an ability executes, the plugin records what it touches: posts, pages, options, users, terms, comments, and writes to any plugin’s own tables. Seen reading and never writing, it earns read-only status.
- Reading its code. Before an ability has ever run, its callback is inspected for database writes, outbound requests and file changes. This catches a write on the first call rather than the second.
- Its declared annotation. A read-only claim is taken only as a hint. A claim of being destructive, though, is believed and the ability is held — that admission costs its author access, which is why it is worth trusting.
- Its name. The weakest signal, used last, and never enough on its own to auto-allow.
Every row in the admin list shows which of these produced its classification, so you always know whether you are reading a verified result or an assumption. When nothing can be determined the plugin says unknown rather than guessing. An unknown ordinary call still runs; an unknown removal or outbound effect is held, since those are the ones worth stopping when in doubt.
Some things are held no matter how often they run
Removing data, sending mail, making outbound HTTP requests and writing files are the actions an undo cannot fix: a removal’s previous state is gone once it runs, and an outbound effect has already left the site. The plugin never lets one of these through on its own — not on the first call, and not after a hundred clean ones, because a clean run history is not evidence they are safe. They wait for a person. You can still set an explicit always allow rule on a particular one if you have decided it is safe; only that deliberate choice releases it, never observation.
What a held request looks like
Nothing has changed yet. The call is queued, and the agent receives a clear message: approval is pending, do not retry, and do not attempt the same change another way. It can check the outcome later through an ability provided for that purpose, so it waits rather than looking for a way around.
You review it in wp-admin, with the arguments the agent proposed. Values that look sensitive are redacted. Approve and it runs; reject and it never does.
Seeing the change before you allow it
A held request is not a name and a shrug. Where the target can be resolved, the review screen shows the object’s current values against what the agent proposes — a real before and after, read from your database at the moment you are looking at it.
Where that is not possible the screen says so rather than dressing up a guess. A reviewer who believes they are reading a verified diff when they are reading the arguments is worse off than one who knows which they have.
Undoing what already happened
This plugin records that a call happened, who made it, how it was decided and what it touched. Putting a change back is a different problem: it needs every affected object’s previous state kept, which is storage a site that only wants the gate has no reason to pay for. That, with the full before-and-after history, is MCP Abilities Guard Pro.
Nothing here degrades without it. The gate, the approvals, the previews and the record of decisions are complete on their own.
MCP Abilities Guard Pro
The free plugin decides what may happen and keeps an honest record that it did. The Pro add-on adds what it takes to see and unwind what already happened:
- Full change history. A before-and-after image of every write an agent made — posts, options, users, terms, comments, metadata, and writes to any plugin’s own tables — described in plain language and kept for as long as you choose.
- One-click undo. Revert any recorded change straight from the log, restoring the object to exactly what it was. This includes raw SQL writes to core tables that fire no WordPress hook, which nothing else can put back.
- Multiple approvers, with a quorum. Require several people to sign off on a held request — named users or roles — and choose whether any one of them is enough or all of them must approve. The free plugin applies a request on a single administrator’s approval.
Pro attaches to the free plugin through its own hooks: install it and the audit log gains a history and an undo button, and the approver picker gains a quorum. Remove it and the gate keeps working exactly as before. Learn more at MCP Abilities Guard Pro.
What this plugin does
- Sets every registered ability to always allow, require approval, or always reject
- Covers abilities from any plugin, without their authors doing anything
- Classifies read versus write by observation and code inspection, not naming
- Holds removals and outbound effects (mail, HTTP, files) for approval by default — a clean run history never clears them
- Queues held calls for human review, with the proposed arguments shown and sensitive values redacted
- Keeps every held request with who asked, who answered and when — the history an approver looks back at
- Supports different rules per caller, so one agent can be trusted where another is not
- Applies a held request on a single approval from any administrator (choosing specific approvers, and requiring several — any or all — is available in the Pro add-on)
- Expires unanswered requests after a period you choose
- Learning mode: watch and classify without holding anything, so you can see the list before you set rules
- Reports coverage: which MCP tool calls it saw, and which did not map to a registered ability
What this plugin does not do
- It does not run an MCP server, transport or authentication. Those are your MCP plugin’s job.
- It does not register abilities of its own, other than one small ability that lets an agent look up whether its pending request was approved.
- It does not replace an ability’s own permission checks. Those still run. This is a layer on top, not a substitute.
- It does not govern MCP tools that were never registered as abilities. Some plugins serve tools directly without registering them; those are outside its reach, and the Coverage screen names them rather than leaving you to assume you are covered.
- It does not phone home, collect telemetry, or make any external network request.
Requirements
- WordPress 6.9 or later — the Abilities API arrived in core in 6.9
- PHP 7.4 or later
- At least one plugin that registers abilities, and usually an MCP server plugin to expose them
Source code
Development happens in the open at github.com/KevinPlugins/mcp-abilities-guard.
The admin screen is a Vue application. What runs in assets/ is the compiled bundle; the readable source it was built from ships alongside it, in the app/ directory of the plugin, together with the build configuration (app/package.json, app/vite.config.js). Run npm install && npm run build inside app/ to rebuild the bundle and compare it against what ships.
Privacy
Nothing leaves your site. There is no external service, no telemetry and no account. Requests, approvals and behaviour profiles are stored in your own database.
Arguments passed to abilities are stored with each queued request so a reviewer can see what was proposed. Values that look sensitive are redacted before display. Requests can be purged on a schedule you set, because those arguments may contain personal data.
About MCP
Model Context Protocol is an open specification originally developed by Anthropic. This plugin is a third-party project and is not affiliated with, endorsed by or sponsored by Anthropic, nor by any of the MCP server plugins it works alongside.
Screenshots
The abilities list. Every registered ability, from any MCP plugin, labelled by what it actually does — read, write or remove — with a per-ability rule: always allow, require approval (naming who signs off), or block.
The approval queue, seen by someone who is not an approver for this request. A removal is held with its proposed arguments shown; the Approve button is disabled and explains why.
The same held request, seen by an approver — one click applies it or rejects it. Nothing has touched the site while it waits.
The audit log: every governed call — allowed, queued, blocked or reverted — with the caller, the outcome, and exactly what changed. (Change history and one-click undo are part of the Pro add-on.)
Undo in action: an applied change reverted from the log, the original row marked “reverted”, and the undo itself recorded. (Pro add-on.)
Settings. Reads and ordinary writes run automatically; only removals and outbound effects are held. Plus learning mode, holding unidentifiable callers, and request expiry.
