codevera

<p>WordPress 7.0 introduced the Abilities API. Any active plugin can register an ability and the WordPress AI feature can then invoke it, consuming whatever credits or tokens your AI provider charges per call. By default every registered ability is exposed, and there is no built-in way to see what is exposed or to limit it.</p>
<p>Codevera AI Access Control adds a single settings screen that lists every plugin which has registered AI abilities, grouped by source plugin, and lets you allow or block each plugin as a whole or each individual ability.</p>
<p><strong>How it works:</strong></p>
<ol>
<li>The plugin watches every call to <code>wp_register_ability()</code> and records which plugin made the call.</li>
<li>The Settings -> Codevera AI Access screen groups those abilities by source plugin so you can see at a glance what is exposed.</li>
<li>Untick a plugin or a single ability and save. From the next request onwards, the AI feature can no longer see or invoke it.</li>
</ol>
<p><strong>Free:</strong></p>
<ul>
<li>Per-plugin and per-ability granular controls</li>
<li>Automatic detection of newly installed plugins that register AI abilities, with an in-admin notification so you can review them</li>
<li>Tamper-detect signature on the saved settings, with a fail-closed mode that blocks every non-core ability if the settings option is modified outside the plugin</li>
<li>Filter-level enforcement that neutralises a blocked ability before WordPress constructs it, plus a registry sweep that removes blocked abilities from the listings</li>
<li>Self-check that re-attaches the enforcement hooks on init, admin_init and rest_api_init if another plugin removes them</li>
<li>Search and filter inside each plugin card so large registries stay readable</li>
<li>No external requests, no telemetry, no licence checks</li>
<li>Works on multisite (per-site settings)</li>
<li>Translation ready</li>
</ul>
<p><strong>Works well for:</strong></p>
<ul>
<li>Sites where editorial staff use the WordPress AI feature and you want strict control over what context the AI can pull in</li>
<li>Agency sites where new plugins are installed regularly and you want to review their AI exposure before letting them in</li>
<li>Privacy-sensitive sites that need an explicit allow list of which plugins may expose data to an AI provider</li>
<li>Compliance-driven environments that need an auditable record of which plugins have been allowed to register AI abilities</li>
</ul>
<p><strong>Under the hood:</strong></p>
<ul>
<li>Uses only the official Abilities API surface: <code>wp_register_ability_args</code>, <code>wp_abilities_api_init</code>, <code>wp_unregister_ability</code></li>
<li>Source attribution from <code>debug_backtrace()</code> of the file that called <code>wp_register_ability</code>, normalised to a plugin slug</li>
<li>HMAC-SHA256 signature on the settings option, keyed to a <code>CVAIAC_SECRET</code> constant or <code>AUTH_SALT</code> fallback</li>
<li>No frontend assets shipped, all code runs in admin and on the AI Abilities REST routes</li>
<li>No database tables, just two options in <code>wp_options</code></li>
</ul>
<h3>External Services & Privacy</h3>
<p>This plugin does not contact any external service. It reads only local WordPress data. No telemetry, no analytics, no licence checks, no remote update checks beyond what WordPress core itself performs.</p>
<p>The plugin stores two options in the <code>wp_options</code> table:</p>
<ul>
<li><code>cvaiac_settings</code> – your allow and block selections, signed with an HMAC-SHA256 signature</li>
<li><code>cvaiac_ability_sources</code> – a map of ability name to source plugin slug, populated automatically as plugins register their abilities</li>
<li><code>cvaiac_schema_version</code> – an integer that records the storage format version, used for migration</li>
</ul>
<p>No personal data, no visitor data, and no AJAX requests to remote services.</p>
<p>When the plugin is uninstalled, all three options are removed.</p>
<h3>Support</h3>
<p>Email info@codevera.ai for support, bug reports, or feature requests. Include your WordPress version, PHP version, a list of other plugins that register AI abilities, and a description of the issue with steps to reproduce.</p>
<h3>Technical Requirements</h3>
<p>Minimum:</p>
<ul>
<li>WordPress 7.0 (required for the Abilities API)</li>
<li>PHP 7.4</li>
</ul>
<p>Recommended:</p>
<ul>
<li>WordPress 7.0 or higher</li>
<li>PHP 8.0 or higher</li>
</ul>
<h3>Privacy & Security</h3>
<p>The plugin does not collect or transmit any personal data. The settings option is stored locally and signed with an HMAC keyed to a site-specific secret. The source-tracker option contains only plugin slugs and ability names that are already public to any code running on the site.</p>
<p>Form submissions use a nonce and require the <code>manage_options</code> capability. The enforcement hooks run on every request that loads the Abilities API, so blocking takes effect from the next request after a setting is saved.</p>
<p>This plugin defends against opportunistic interference such as another plugin writing directly to the settings option, removing the enforcement hooks, or re-registering an ability that has already been blocked. It does not claim to be a security boundary against a fully hostile plugin that has code execution in the same PHP process. The safest practice is still to only install plugins you trust.</p>
<h3>Links</h3>
<ul>
<li>Website: https://codevera.ai</li>
<li>Support: info@codevera.ai</li>
</ul>


Codevera AI Access Control

Decide which plugins are allowed to expose their abilities to the WordPress AI feature. Block any plugin, or any single ability, with one click.

El Proximus

<p><strong>Making Connections Possible</strong> | Now with Claude Opus 4.8, in-chat image attachments and screenshots, GPT-5.5, and Custom Apps in ChatGPT</p>
<p>Abilities Bridge connects AI to your WordPress site. Use the built-in admin chat, connect via MCP to Claude Desktop, or integrate with other MCP-compatible applications. Supports both Anthropic (Claude) and OpenAI models.</p>
<h4>Key Features</h4>
<ul>
<li>Admin chat interface for direct AI interaction</li>
<li>Image attachments in chat — upload images or capture a browser-approved screenshot (can be disabled in settings)</li>
<li>MCP server for Claude Desktop, ChatGPT, and other MCP clients</li>
<li>Persistent memory storage across conversations</li>
<li>Abilities execution with 7-gate permission controls</li>
<li>Integrated Connected Plugins — discover and approve AI abilities that other plugins register, with per-ability permission controls</li>
<li>Claude and OpenAI model support</li>
<li>OAuth 2.0 authentication for MCP connections</li>
</ul>
<h4>Four Ways to Connect</h4>
<ol>
<li><strong>Admin Chat</strong> – Built-in interface using your Anthropic or OpenAI API key</li>
<li><strong>Claude Custom Connector</strong> – Connect Claude Desktop using your Claude subscription (no API key needed)</li>
<li><strong>ChatGPT Developer Mode</strong> – Connect ChatGPT using the built-in MCP endpoint with OAuth</li>
<li><strong>Local MCP Config</strong> – Connect Claude Code and other apps using API key or Claude account</li>
</ol>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.2+, PHP 7.4+</li>
<li>Anthropic API key, OpenAI API key, or Claude account (depending on connection method)</li>
<li>HTTPS required for MCP OAuth 2.0 connections</li>
</ul>
<h3>External Services</h3>
<p><strong>This plugin connects to external API services.</strong></p>
<p>This plugin communicates with Anthropic’s Claude API (https://api.anthropic.com) and/or OpenAI’s API (https://api.openai.com) to provide AI functionality. Data is only sent when you actively use the chat interface or MCP tools. No background data collection or telemetry occurs.</p>
<h4>Data Sent</h4>
<ul>
<li>Chat messages and prompts</li>
<li>Memory contents</li>
<li>Abilities execution requests and results</li>
</ul>
<h4>Legal & Privacy</h4>
<ul>
<li>Anthropic Privacy Policy: https://www.anthropic.com/legal/privacy</li>
<li>Anthropic Terms: https://www.anthropic.com/legal/consumer-terms</li>
<li>OpenAI Privacy Policy: https://openai.com/policies/privacy-policy</li>
<li>OpenAI Terms: https://openai.com/policies/terms-of-use</li>
<li>Abilities Bridge Privacy Policy: https://aisystemadmin.com/privacy-policy</li>
<li>Abilities Bridge Terms: https://aisystemadmin.com/terms-and-conditions/</li>
</ul>
<p>By using this plugin, you acknowledge that data will be transmitted to your selected AI provider for processing.</p>
<h3>Privacy & Security</h3>
<h4>Data Transmission</h4>
<p>This plugin sends data to Anthropic’s API (https://api.anthropic.com) or OpenAI’s API (https://api.openai.com) when you interact with the AI. This includes chat messages, memory contents, and abilities execution requests. You control what data is sent – the AI only accesses data when you use it.</p>
<h4>Security</h4>
<ul>
<li>Permission controls with explicit consent for all write capabilities</li>
<li>7-gate ability authorization system</li>
<li>Isolated memory storage with size limits (50MB total)</li>
<li>Full activity logging and audit trails</li>
<li>OAuth tokens encrypted with AES-256-CBC</li>
<li>MCP access requires authentication for every method, including discovery (initialize, tools/list, ping); unauthenticated requests receive an HTTP 401 OAuth challenge</li>
<li>All admin actions protected with nonce verification and capability checks</li>
</ul>
<h4>Data Retention</h4>
<p>Conversations and logs are stored in your WordPress database until manually deleted. Refer to your provider’s privacy policy for their data retention practices.</p>
<h4>No Telemetry</h4>
<p>This plugin does NOT send usage statistics, telemetry, or analytics to the plugin developer.</p>
<h3>Support</h3>
<p>For support, visit https://aisystemadmin.com</p>
<h3>License</h3>
<p>This plugin is licensed under the GPL v2 or later.</p>


Abilities Bridge


This plugin allows you to easily connect to abilities on your WordPress site and use them as function calls. The built-in admin chat is very useful. Thanks!


Easy to Connect Abilities!

MCP server for WordPress. Connect Claude AI or OpenAI to execute WordPress Abilities with configurable permissions.

Codevera AI Access Control vs Abilities Bridge