Introduction
AI agents such as Claude or Cursor can now work on your site through an MCP plugin or an Application Password. They call WordPress abilities: small, named actions such as “update a post” or “change a product price”. Ability Gate sits in front of those calls on your server and decides, for each one, whether it runs, waits for you, or is refused.
It is built for agencies and store owners who want to give agents real work without handing them the keys to everything.
What it is best at#
- Holding risky actions for approval. High and critical risk calls wait in a queue in wp-admin. The agent cannot skip or fake the approval, because the check happens on your server.
- Exact rollback. Every gated write is recorded row by row in the database, including options and WooCommerce data, so one click puts it back. A drift check warns you if someone changed the same data since.
- Knowing who did what. Each Application Password and agent user becomes a named agent with its own mode, rules and limits, and every call lands in a tamper-evident audit trail.
- Capping AI spend. Monthly token budgets for AI features that run on your site through the WordPress AI Client.
What it gates#
Ability Gate gates calls from agents: Application Passwords, AI-plugin agent users, MCP STDIO sessions run over WP-CLI, and AI features calling abilities in-process through the WordPress AI Client. People logged in to wp-admin, cron jobs and your own PHP code are not gated; their writes are logged.
Only calls that go through the Abilities API are gated. Some MCP plugins also register their own tools outside the Abilities API. Those tools are not seen by Ability Gate. Everything it can gate is listed on Agent Control > Risk.
Next: check the Requirements, then follow Installation and the Quick Start in this section.