codevera

WordPress 7.0 introduced the Abilities API. Any active plugin can register an ability and the WordPress AI feature can then invoke it, consuming whatever credits or tokens your AI provider charges per call. By default every registered ability is exposed, and there is no built-in way to see what is exposed or to limit it.
Codevera AI Access Control adds a single settings screen that lists every plugin which has registered AI abilities, grouped by source plugin, and lets you allow or block each plugin as a whole or each individual ability.
How it works:
<ol>
<li>The plugin watches every call to <code>wp_register_ability()</code> and records which plugin made the call.</li>
<li>The Settings -> Codevera AI Access screen groups those abilities by source plugin so you can see at a glance what is exposed.</li>
<li>Untick a plugin or a single ability and save. From the next request onwards, the AI feature can no longer see or invoke it.</li>
</ol>
Free:
<ul>
<li>Per-plugin and per-ability granular controls</li>
<li>Automatic detection of newly installed plugins that register AI abilities, with an in-admin notification so you can review them</li>
<li>Tamper-detect signature on the saved settings, with a fail-closed mode that blocks every non-core ability if the settings option is modified outside the plugin</li>
<li>Filter-level enforcement that neutralises a blocked ability before WordPress constructs it, plus a registry sweep that removes blocked abilities from the listings</li>
<li>Self-check that re-attaches the enforcement hooks on init, admin_init and rest_api_init if another plugin removes them</li>
<li>Search and filter inside each plugin card so large registries stay readable</li>
<li>No external requests, no telemetry, no licence checks</li>
<li>Works on multisite (per-site settings)</li>
<li>Translation ready</li>
</ul>
Works well for:
<ul>
<li>Sites where editorial staff use the WordPress AI feature and you want strict control over what context the AI can pull in</li>
<li>Agency sites where new plugins are installed regularly and you want to review their AI exposure before letting them in</li>
<li>Privacy-sensitive sites that need an explicit allow list of which plugins may expose data to an AI provider</li>
<li>Compliance-driven environments that need an auditable record of which plugins have been allowed to register AI abilities</li>
</ul>
Under the hood:
<ul>
<li>Uses only the official Abilities API surface: <code>wp_register_ability_args</code>, <code>wp_abilities_api_init</code>, <code>wp_unregister_ability</code></li>
<li>Source attribution from <code>debug_backtrace()</code> of the file that called <code>wp_register_ability</code>, normalised to a plugin slug</li>
<li>HMAC-SHA256 signature on the settings option, keyed to a <code>CVAIAC_SECRET</code> constant or <code>AUTH_SALT</code> fallback</li>
<li>No frontend assets shipped, all code runs in admin and on the AI Abilities REST routes</li>
<li>No database tables, just two options in <code>wp_options</code></li>
</ul>
<h3>External Services & Privacy</h3>
This plugin does not contact any external service. It reads only local WordPress data. No telemetry, no analytics, no licence checks, no remote update checks beyond what WordPress core itself performs.
The plugin stores two options in the <code>wp_options</code> table:
<ul>
<li><code>cvaiac_settings</code> – your allow and block selections, signed with an HMAC-SHA256 signature</li>
<li><code>cvaiac_ability_sources</code> – a map of ability name to source plugin slug, populated automatically as plugins register their abilities</li>
<li><code>cvaiac_schema_version</code> – an integer that records the storage format version, used for migration</li>
</ul>
No personal data, no visitor data, and no AJAX requests to remote services.
When the plugin is uninstalled, all three options are removed.
<h3>Support</h3>
Email info@codevera.ai for support, bug reports, or feature requests. Include your WordPress version, PHP version, a list of other plugins that register AI abilities, and a description of the issue with steps to reproduce.
<h3>Technical Requirements</h3>
Minimum:
<ul>
<li>WordPress 7.0 (required for the Abilities API)</li>
<li>PHP 7.4</li>
</ul>
Recommended:
<ul>
<li>WordPress 7.0 or higher</li>
<li>PHP 8.0 or higher</li>
</ul>
<h3>Privacy & Security</h3>
The plugin does not collect or transmit any personal data. The settings option is stored locally and signed with an HMAC keyed to a site-specific secret. The source-tracker option contains only plugin slugs and ability names that are already public to any code running on the site.
Form submissions use a nonce and require the <code>manage_options</code> capability. The enforcement hooks run on every request that loads the Abilities API, so blocking takes effect from the next request after a setting is saved.
This plugin defends against opportunistic interference such as another plugin writing directly to the settings option, removing the enforcement hooks, or re-registering an ability that has already been blocked. It does not claim to be a security boundary against a fully hostile plugin that has code execution in the same PHP process. The safest practice is still to only install plugins you trust.
<h3>Links</h3>
<ul>
<li>Website: https://codevera.ai</li>
<li>Support: info@codevera.ai</li>
</ul>

Codevera AI Access Control

Decide which plugins are allowed to expose their abilities to the WordPress AI feature. Block any plugin, or any single ability, with one click.

Azizul Hasan

AtlasAiDev

AI Agent Hub is the most complete AI integration plugin for WordPress. It provides 80+ abilities across 10 modules, a built-in MCP (Model Context Protocol) server for AI agent connectivity, AI experiments directly in the Gutenberg block editor, role-based access control, JWT authentication, a workflow builder, and full WooCommerce support.
<h4>Highlights</h4>
<ul>
<li>80+ registered abilities covering posts, pages, media, users, custom post types, REST API discovery, site diagnostics, WordPress settings, WooCommerce, and AI-powered content analysis.</li>
<li>11 independently toggleable modules – enable only what you need.</li>
<li>Error Debugger – Monitor PHP errors in real time, receive email alerts with a one-click fix command, and fix errors directly from your AI assistant via MCP (Pro).</li>
<li>AI Experiments in the Block Editor – Generate excerpts, feature images, and more directly from the post editor with multi-provider AI support.</li>
<li>Built-in MCP server – expose abilities as tools, resources, and prompts to AI agents over JSON-RPC 2.0.</li>
<li>External Abilities – automatically discovers and integrates abilities from WordPress core and third-party plugins via the Abilities API.</li>
<li>JWT authentication – secure MCP and REST API access with token-based auth.</li>
<li>Workflow builder – combine abilities into reusable workflows from the admin dashboard or the post editor meta box.</li>
<li>Multi-provider AI – connect OpenAI, Google Gemini, or Anthropic Claude via the WordPress AI Client.</li>
<li>Role-based access control – assign abilities per WordPress role so each MCP connection only exposes what that user is allowed to use.</li>
<li>Backward compatible – bundles the WordPress Abilities API and MCP Adapter as vendor dependencies, so it works on WordPress 6.8+ (not just 6.9+ where these APIs ship in core).</li>
</ul>
<h4>AI Agent Hub Pro</h4>
Unlock the full power of AI Agent Hub with <a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">AI Agent Hub Pro</a>:
<ul>
<li>Unlimited Workflows – Create unlimited MCP workflows (free: 3 max).</li>
<li>T/R/P Access Modes – Granular per-ability Tool/Resource/Prompt toggles for fine-grained MCP control.</li>
<li>Advanced AI Experiments – Templates library, batch generation mode, explain AI reasoning, generation history, and keyboard shortcuts.</li>
<li>Workflow Prompt Builders – 6 pre-built prompt builder workflows (SEO Audit, Content Brief, Site Overview, and more).</li>
<li>External Abilities – Discover and expose third-party plugin abilities via the Abilities API.</li>
<li>Per-Ability RBAC – Assign individual abilities (not just modules) to each WordPress role.</li>
<li>MCP Fix Command – Error emails include a ready-to-paste MCP command that lets your AI assistant read, analyse, and fix the error with one paste — automatic backup included.</li>
<li>Webhook Notifications – Send error alerts to Slack, Discord, or a custom webhook.</li>
<li>Backups Manager – All AI-applied fixes are backed up automatically; restore any backup with one click.</li>
<li>Priority Support – Direct support from the development team.</li>
</ul>
<a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">Upgrade to Pro</a>
<h4>Modules</h4>
Each module can be independently enabled or disabled from the AI Agent Hub dashboard.
<h4>1. AI Content Steward (8 abilities)</h4>
AI-powered content analysis, generation, and improvement for posts and pages.
<h4>2. Posts Manager (13 abilities)</h4>
Full CRUD for WordPress posts, categories, and tags.
<h4>3. Pages Manager (5 abilities)</h4>
CRUD operations for WordPress pages.
<h4>4. Media Manager (7 abilities)</h4>
Upload, update, and manage media files.
<h4>5. Users Manager (7 abilities)</h4>
Search, create, and manage WordPress users.
<h4>6. Custom Post Types Manager (6 abilities)</h4>
CRUD operations for any registered custom post type.
<h4>7. REST API Tools (3 abilities)</h4>
Discover and execute any WordPress REST API endpoint dynamically.
<h4>8. Site Info & Diagnostics (4 abilities)</h4>
View site info, plugins, themes, and users at a glance.
<h4>9. Settings Manager (3 abilities)</h4>
View and update WordPress site settings.
<h4>10. AI Store Manager – WooCommerce (24 abilities)</h4>
Full WooCommerce management through AI. Requires WooCommerce to be active.
<ul>
<li>Products: search, get, add, update, delete.</li>
<li>Product categories: list, add, update, delete.</li>
<li>Product tags: list, add, update, delete.</li>
<li>Product brands: list, add, update, delete.</li>
<li>Orders: search.</li>
<li>Reports: coupons totals, customers totals, orders totals, products totals, reviews totals, sales.</li>
</ul>
<h4>11. Error Debugger</h4>
Monitor PHP errors in real time and fix them faster. Works out of the box — no configuration required to start tracking errors.
Free features: 
* Real-time PHP error tracking grouped by file and message. 
* Email notifications for errors in plugins and themes — configurable recipient, severity levels, and rate limit. 
* Fix Command in every email — a pre-filled text snippet you can paste into any AI assistant to get fix instructions. 
* Admin dashboard widget showing the last 5 errors and a 24-hour error count. 
* Debug log scanner catches errors that occur before the plugin loads (e.g. fatal parse errors during activation).
Pro features (requires AI Agent Hub Pro): 
* MCP Fix Command — paste directly into Claude Desktop, Cursor, or any connected MCP client. The AI reads the file, suggests a fix, creates a backup, and applies it. 
* Webhook notifications — send error alerts to Slack, Discord, or a custom URL. 
* Backups Manager — all AI-applied fixes are backed up; restore any backup with one click. 
* Extended error sources — monitor WordPress Core, MU-Plugins, and Drop-ins in addition to plugins and themes.
<h4>Coming Soon</h4>
<ul>
<li>AI Support Desk – Summarize comment threads, suggest reply drafts, categorize support requests.</li>
<li>AI Automation Recipes / Workflows – Rule-based AI automations triggered by WordPress events.</li>
</ul>
<h4>AI Experiments in the Block Editor</h4>
AI Agent Hub adds AI-powered experiment panels directly into the WordPress block editor:
<ul>
<li>Excerpt Generation – Generate SEO-friendly excerpts from post content with one click. Appears in the post sidebar excerpt panel.</li>
<li>Image Generation – Generate AI feature images from post content. Integrated into the Featured Image panel.</li>
</ul>
With <a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">AI Agent Hub Pro</a>, experiments gain advanced features: prompt templates library, batch generation mode, “Explain This Generation” reasoning, generation history, and keyboard shortcuts.
<h4>Error Debugger</h4>
The Error Debugger module monitors PHP errors on your WordPress site and helps you fix them faster.
How it works:
<ol>
<li>Enable the Error Debugger module from the AI Agent Hub dashboard.</li>
<li>Optionally enable Email Notifications and configure the recipient address, severity levels, and rate limit.</li>
<li>When a PHP error occurs in a plugin or theme, an email is sent with full error details and a How to Fix block.</li>
<li>Copy the fix command from the email and paste it into your AI assistant to get step-by-step fix instructions.</li>
</ol>
Free fix flow: 
Copy the pre-filled text from the email → paste into ChatGPT, Claude, Gemini, or any AI chat → the AI explains the error and how to fix it.
Pro fix flow (MCP): 
Copy the MCP command block from the email → paste into Claude Desktop, Cursor, or any MCP client connected to your site → the AI reads the file, suggests a fix, creates a backup, and applies it automatically.
Admin dashboard widget: 
When the Error Debugger module is active, a “AI Agent Hub — Recent Errors” widget appears on the WordPress admin dashboard showing the last 5 errors and a 24-hour error count. You can disable the widget from the Error Debugger settings without disabling the module.
<h4>Connecting AI Agents via MCP</h4>
AI Agent Hub includes a built-in MCP (Model Context Protocol) server that lets external AI agents interact with your WordPress site. The MCP endpoint is:
<pre><code>https://your-site.com/wp-json/awfah_mcp/mcp
</code></pre>
Any MCP-compatible AI client can connect and use all enabled abilities as tools, resources, and prompts.
<h4>Post Editor Meta Box</h4>
On every post and page edit screen, the AI Content Steward meta box provides:
<ul>
<li>Provider selection (Auto, OpenAI, Gemini, Claude).</li>
<li>Ability checkboxes to select which analyses to run.</li>
<li>Editable prompt preview that updates as you select abilities.</li>
<li>One-click workflow execution.</li>
<li>Save workflows for reuse.</li>
</ul>
<h3>Connecting AI Agents</h3>
<h4>Claude Desktop</h4>
Claude Desktop supports MCP servers natively. To connect it to your WordPress site:
Step 1: Generate a JWT token
Send a POST request to your site to get a JWT token:
<pre><code>curl -X POST "https://your-site.com/wp-json/jwt-auth/v1/token" -H "Content-Type: application/json" -d "{\"username\":\"your-username\",\"password\":\"your-password\",\"expires_in\":2592000}"
</code></pre>
This returns a token valid for 30 days (2592000 seconds). Copy the <code>token</code> value from the response.
Step 2: Configure Claude Desktop
Open the Claude Desktop config file:
<ul>
<li>Windows: <code>%APPDATA%\Claude\claude_desktop_config.json</code></li>
<li>macOS: <code>~/Library/Application Support/Claude/claude_desktop_config.json</code></li>
</ul>
Add this MCP server entry:
<pre><code>{
 "mcpServers": {
 "wordpress": {
 "command": "npx",
 "args": [
 "-y",
 "@anthropic-ai/mcp-wordpress-remote@latest",
 "--url",
 "https://your-site.com/wp-json/awfah_mcp/mcp"
 ],
 "env": {
 "JWT_TOKEN": "paste-your-jwt-token-here"
 }
 }
 }
}
</code></pre>
Step 3: Restart Claude Desktop
After saving the config, restart Claude Desktop. All enabled abilities will appear as tools. You can then ask Claude to manage posts, pages, media, users, settings, and WooCommerce from natural language.
<h4>Claude Code (CLI)</h4>
Claude Code can also connect to MCP servers. Add the server using:
<pre><code>claude mcp add wordpress -- npx -y @anthropic-ai/mcp-wordpress-remote@latest --url https://your-site.com/wp-json/awfah_mcp/mcp
</code></pre>
Then set the JWT token as an environment variable before running Claude Code:
<pre><code>export JWT_TOKEN="paste-your-jwt-token-here"
</code></pre>
<h4>Cursor / Windsurf / Other MCP Clients</h4>
Any editor or AI tool that supports MCP can connect. The setup is similar:
<ol>
<li>Generate a JWT token (see above).</li>
<li>Point the MCP client to: <code>https://your-site.com/wp-json/awfah_mcp/mcp</code></li>
<li>Use the <code>@anthropic-ai/mcp-wordpress-remote</code> transport package, or configure your client’s native MCP settings with the URL and JWT token.</li>
<li>The authentication header format is: <code>Authorization: Bearer <your-jwt-token></code></li>
</ol>
<h4>Postman / API Testing</h4>
You can test the MCP endpoint directly using Postman or any HTTP client. The MCP protocol uses JSON-RPC 2.0 over HTTP.
Step 1: Initialize a session
Send a POST request to <code>https://your-site.com/wp-json/awfah_mcp/mcp</code> with:
<ul>
<li>Header: <code>Authorization: Bearer <your-jwt-token></code></li>
<li>Header: <code>Content-Type: application/json</code></li>
<li>Body: 
{ 
 “jsonrpc”: “2.0”, 
 “id”: 1, 
 “method”: “initialize”, 
 “params”: { 
 “protocolVersion”: “2024-11-05”, 
 “capabilities”: {}, 
 “clientInfo”: { “name”: “postman”, “version”: “1.0” } 
 } 
}</li>
</ul>
Copy the <code>Mcp-Session-Id</code> header from the response.
Step 2: Send initialized notification
Send a POST with the session ID header:
<ul>
<li>Header: <code>Mcp-Session-Id: <session-id-from-step-1></code></li>
<li>Body: 
{ 
 “jsonrpc”: “2.0”, 
 “method”: “notifications/initialized” 
}</li>
</ul>
Step 3: Call a tool
Now you can call any ability as a tool:
<pre><code>{
 "jsonrpc": "2.0",
 "id": 2,
 "method": "tools/call",
 "params": {
 "name": "awfah-site-get-site-info",
 "arguments": {}
 }
}
</code></pre>
Note: In MCP tool names, the <code>/</code> in ability IDs is replaced with <code>-</code>. So <code>awfah-site/get-site-info</code> becomes <code>awfah-site-get-site-info</code>.
<h4>JWT Token Management</h4>
AI Agent Hub provides three JWT endpoints:
<ul>
<li>Generate token: <code>POST /wp-json/jwt-auth/v1/token</code> – Pass <code>username</code>, <code>password</code>, and optional <code>expires_in</code> (seconds, min 3600, max 2592000).</li>
<li>List tokens: <code>GET /wp-json/jwt-auth/v1/tokens</code> – List all active tokens (requires authentication).</li>
<li>Revoke token: <code>POST /wp-json/jwt-auth/v1/revoke</code> – Revoke a specific token (requires authentication).</li>
</ul>
Tokens are signed with HS256 using a per-site secret key stored in the <code>awfah_jwt_secret_key</code> option. Each token includes the user ID, issued-at time, expiration, and a unique JTI.
<h4>Role-Based MCP Access</h4>
AI Agent Hub provides role-based access control for MCP connections. This means different WordPress users see different abilities depending on their role.
How it works:
<ol>
<li>An administrator configures which abilities each WordPress role can access via the Access Control tab in the AI Agent Hub dashboard.</li>
<li>When an AI client connects via MCP, it authenticates as a specific WordPress user (using JWT or Application Password).</li>
<li>The plugin checks that user’s role and only exposes the abilities assigned to that role.</li>
<li>The AI client can only see and execute the allowed abilities — everything else is hidden.</li>
</ol>
Example scenarios:
<ul>
<li>Administrator — Full access to all 80+ abilities including post CRUD, site settings, user management, media, WooCommerce, and content analysis.</li>
<li>Editor — Content-focused abilities only (e.g. analyze posts, generate excerpts, suggest titles, focus keywords). No access to site settings, user management, or destructive operations.</li>
<li>Author / Contributor — Can be fully restricted or given a minimal subset of abilities as configured by the site admin.</li>
</ul>
Setting up role-based access:
<ol>
<li>Go to the AI Agent Hub dashboard in WordPress admin.</li>
<li>Click the Access Control tab.</li>
<li>Select a role from the dropdown.</li>
<li>Check or uncheck abilities to grant or revoke access for that role.</li>
<li>Click Save. Changes take effect immediately for all MCP connections using that role.</li>
</ol>
Multiple MCP connections:
You can create multiple MCP connections in your AI client config, each authenticating as a different WordPress user. For example:
<ul>
<li>A “full-access” connection using an administrator account.</li>
<li>A “content-only” connection using an editor account.</li>
</ul>
This lets you switch between permission levels depending on the task at hand.
<h4>Application Passwords (Alternative)</h4>
If you prefer not to use JWT, you can also authenticate with WordPress Application Passwords (available in WordPress 5.6+):
<ol>
<li>Go to Users > Profile > Application Passwords.</li>
<li>Create a new application password.</li>
<li>Use Basic Auth with your username and the application password.</li>
</ol>
However, JWT is recommended for MCP connections as it avoids sending credentials with every request.

MCP Server & AI Experiments – WooCommerce Compatible

AI-powered WordPress hub: 80+ abilities, MCP server, block editor AI experiments, RBAC, JWT auth, and workflows.

Codevera AI Access Control vs MCP Server & AI Experiments – WooCommerce Compatible