AI Content Manager Role

WordPress plugin that registers a custom role ai_content_manager with a tightly-scoped capability set for AI-driven content management (e.g. via MCP clients like Claude Code, WordPress MCP plugins, or any chat-backed editor).

The role is designed to create and edit content but never delete it and to never touch plugins, themes, users, or site settings, with a second layer of defense via a map_meta_cap filter that force-denies dangerous capabilities regardless of the base role definition.

Use case

When you give an AI agent write access to your WordPress site via MCP, you typically want it to:

• Create posts, pages, custom post types
• Edit Gutenberg content and ACF / JetEngine meta fields
• Upload media
• Manage taxonomies (create/assign terms)
• NOT delete anything — ever — not by accident, not by prompt injection, not by a rogue tool call
• NOT install, activate, or edit plugins/themes
• NOT create, edit, or delete users
• NOT edit PHP files, site options, or theme options

This plugin gives you exactly that role in one activation.

Installation

Option 1 — WordPress Admin upload

1. Download the ZIP from Releases (or clone and zip the folder yourself)
2. WP Admin → Plugins → Add New → Upload Plugin → pick the ZIP → Install Now → Activate

Option 2 — git clone

cd wp-content/plugins
git clone https://github.com/lutyi2856/ai-content-role.git

Then in WP Admin → Plugins → activate AI Content Manager Role.

On activation the plugin creates the role. On deactivation it removes the role. Re-activate to recreate with the latest capability set.

Creating an AI user

1. WP Admin → Users → Add New User
2. Username: anything (e.g. ai-content-editor)
3. Role: AI Content Manager (appears in the dropdown after plugin activation)
4. Save, then use that user's credentials (or a JWT token scoped to that user) as the identity your MCP client uses to talk to the site

What's allowed

read                        edit_posts              edit_others_posts
edit_published_posts        edit_private_posts      publish_posts
edit_pages                  edit_others_pages       edit_published_pages
edit_private_pages          publish_pages           upload_files
manage_categories           assign_categories       edit_categories
assign_post_tags            manage_options          *

* — manage_options is required by some MCP companion plugins (e.g. acf-mcp-manager) as a generic "can administrate content" check. If you want to remove it, also drop acf-mcp-manager or patch its permission callback.

What's explicitly denied

Every delete_*, install_*, activate_*, edit_plugins, edit_themes, switch_themes, edit_theme_options, create_users, edit_users, delete_users, promote_users, list_users, import, export, update_core, update_plugins, update_themes, edit_files, unfiltered_html.

Second layer: map_meta_cap force-deny

Even if some WP code path or plugin tries to probe capabilities through the meta-cap mapping, the plugin hooks map_meta_cap and returns array('do_not_allow') for a blacklist of dangerous primitives:

delete_post, delete_page, delete_user, delete_users, delete_plugins,
delete_themes, install_plugins, install_themes, activate_plugins,
switch_themes, edit_theme_options, edit_files, create_users, edit_users

This means a role override via user_has_cap filter or a plugin that grants extra caps to all users won't accidentally let the AI delete things.

Companion projects

• koystrubvs/acf-mcp-manager — ACF CPT/Taxonomies/Field Groups via MCP (39 tools)
• koystrubvs/jetengine-mcp-integration — JetEngine meta/relations/taxonomies via MCP (19 tools)
• Automattic/wordpress-mcp — base WordPress MCP server

License

GPL v2 or later. See LICENSE.

Author

Sergey (@lutyi2856)