Agent2Wp

Agent2Wp Security-focused AI agent infrastructure for WordPress, built around the WordPress Abilities API and the Model Context Protocol (MCP). Most WordPress AI plugins generate text. Agent2Wp is concerned with what happens when an AI agent executes something — and with making that execution authorized, classified, rate-limited, audited, and fail-closed. Developed by Taibur Rahaman. Why Agent2Wp? AI agents connected over MCP can already perform meaningful WordPress operations: writing files, running WP-CLI, executing PHP, editing content. The hard part is not capability. It is answering, for every single invocation: - What is being invoked? - How dangerous is it? - Is the caller allowed to do it? - What happened, and can anyone tell afterwards? Agent2Wp is the engine that answers those questions. Three design commitments shape it: It is WordPress-native. Authorization lives at the WordPress ability invocation boundary — WPAbility::checkpermissions() — not at a single HTTP endpoint. WordPress can invoke an ability over MCP, over the REST route /wp-abilities/v1/abilities/{name}/run, or internally from PHP. A gate that only watches one of those is not a gate. It fails closed