The core abilities cover WordPress itself — posts, terms, users, media, files, code. An integration adds abilities that speak one plugin's own language: Advanced Custom Fields field groups, Bricks templates, Gravity Forms feeds and notifications, Bit Form's own database tables. Without one, an assistant can only reach such a plugin the long way round.

1. Open NibWP → Integrations. Each plugin or service is a card, with a switch and a badge.
2. Read the badge. Detected — switch on to use means the plugin is installed and active here. Not detected means the card exists but the plugin does not. Active means you have switched it on, Locked — needs Pro that it is a premium card, and Always on that it cannot be switched off.
3. Switch on what you need. Activate detected turns on every card whose plugin is actually present, which is usually the right first move. Activate all and Deactivate all are next to it, and you can filter by All, Free or Premium, search, or sort by which plugins were detected.
4. Confirm in NibWP → AI Abilities. The new tools appear there as rows. Reconnect or refresh the tool list in your AI client so it sees them too.

Two things to expect. An integration's abilities only load when the plugin is detected, the card is switched on, and the card is unlocked — so switching one on for a plugin you do not have adds nothing until you install it. And premium cards carry a PRO badge: they need a Pro or Bundle licence, though a standalone Skill licence unlocks the integrations that Skill declares.

If a plugin you rely on has no card, the Need a custom Integration? button on that screen sends the request to us.

Full guide: How to: work with integrations

NibWP writes down every MCP tool call it runs, so "what did the assistant actually do" is a question with an answer. You will find it under NibWP → Audit Log.

What a row contains

• The timestamp, in your site's own timezone and date format.
• The tool that was called, and whether it ended in success or error.
• How long it took, in milliseconds.
• The WordPress account the call arrived as. On an OAuth connection the connected client is named alongside it; application passwords carry no client identity, so that stays empty.
• The IP address the request came from.

The arguments the call was given are stored with the row as well. Keep that in mind when you share a log: whatever was passed is in there, file contents and PHP source included.

Retention

Logging is on by default and entries are kept for 30 days. Both are in NibWP → Settings under Audit Log, and a daily cleanup removes anything older. The log screen also has a Clear entries older than box for doing it now.

When something unexpected happened

1. Set the status filter to Error and read from the top. The four counters — total calls, today's calls, error rate, most used tool — usually tell you whether it was one bad call or a pattern.
2. Type part of a tool name into the filter box to follow a single tool.
3. Ask your assistant instead. The nibwp/read-audit-log ability returns entries oldest first with the arguments each call was given, which is the order things actually happened in.

Full guide: How to: read the Audit Log

If you install NibWP on a site you look after for someone else, the other administrators do not need to see the AI machinery. NibWP → User access lets you decide, per administrator, which NibWP screens appear in their menu. It needs an active Pro licence.

1. Claim ownership. The account that installed the plugin becomes the owner. If nobody has claimed it yet, saving the screen puts you in charge — after that, other administrators can open the page but not change it.
2. Turn on Restrict the menu. While it is off, every administrator sees NibWP exactly as they do today.
3. Set each administrator to Everything, Only some, or Nothing. Two further toggles control whether they see the NibWP badge in the toolbar and NibWP's admin notices, so someone can keep the menu and lose the badge.
4. Save your link back in. The panel gives you direct URLs to the Dashboard and to User access. Keep them, because you may hide NibWP from yourself too.

Two behaviours are worth knowing before you switch it on.

• Deny by default. Turning it on hides NibWP from every other administrator, including anyone added later. Settings, License and User access are never granted to them, so your setup cannot be undone by the people it applies to.
• It hides menu items, it does not lock pages. Anyone holding a direct link can still open a hidden screen — which is exactly how you keep your own access. Nothing here restricts abilities, REST or MCP.

It also fails open. If your account is removed or the licence lapses, every menu comes back rather than leaving a site nobody can administer.

Full guide: How to: control who can use NIBWP

Every tool NibWP exposes over MCP is listed in one place, and you decide which of them your assistant ever sees.

1. Open NibWP → AI Abilities. Each row is one tool: its name, its category, its type (Read, Write or Destructive), whether it is enabled, and what it does. The counters at the top show how many are read-only and how many are destructive.
2. Find things by source. Rows are grouped by where they come from — NibWP itself first, then any add-on that contributes its own — and the Source dropdown filters to one group. Search, category, type and status filters narrow it further, and Export JSON hands you the whole list.
3. Switch individual tools off in NibWP → Settings, under Tool Management. Tick a tool to disable it and it is no longer offered to any connected client. Disable all is there for the times you want to start from nothing and add back.
4. Use the master switch on NibWP → Connect: Turn on AI Abilities for this site. While it is off, the MCP endpoint rejects requests even from clients that are still configured. This is the switch to reach for first.

Beyond that, every call is checked against the WordPress account the client signed in as. Content tools require the capability to edit posts, media tools the capability to upload files, user listings the capability to list users, and most integration tools full administrator rights. An account without the capability gets nothing back, whatever the tool list says.

If you connect with OAuth rather than an application password, the consent screen narrows it again: reading and creating content are offered by default, while deleting, file access and running code start unticked.

Full guide: How to: manage AI Abilities

If you would rather not open wp-admin at all, NibWP has a command-line client. It signs in over the same approval screen, then wires up your editor, runs abilities directly, and bridges clients that cannot reach a site on their own.

One command is the whole setup:

npx nibwp-cli auth login https://yoursite.com

Your browser opens, your site asks which permissions to grant, and you approve. There is no configuration file to find and no application password anywhere. You can narrow the request up front with --scope read — a connection approved for reading cannot write, delete, touch files or run code, and the site enforces that rather than the tool.

It needs Node.js 20 or newer, and a site with AI Abilities switched on. Install it properly with npm install -g nibwp-cli if you use it often, or keep running it through npx.

From there a few commands cover most of the day:

• nibwp discover lists the abilities the site offers, and nibwp run <ability> calls one.
• nibwp agent add cursor --project writes the connection into your editor's own MCP configuration, keeping a .bak of the previous file.
• nibwp mcp bridges a client that speaks only stdio over the connection you signed in with.
• nibwp doctor tells you why something is not working.

Several sites. Each auth login saves a named profile. After that, --site <profile> picks one and --all runs against every site you have connected. Results are printed under each site's own heading, fan-out never stops at the first failure, and the exit code is non-zero if any site failed.

Full guide: How to: connect from the terminal

The second route on NibWP → Connect is Sign in. Instead of minting a key and pasting it into a configuration file, you give your assistant the site's MCP address, it sends you back to your own site, and you approve the connection there. Nothing is copied, and no password is stored in the client.

What the approval screen shows. It names the application asking, and the host it wants to reach. Then It is asking to: with a tick-box for each permission:

• Read your site — view posts, pages, media and settings. Changes nothing.
• Create and edit content — add and update content. Cannot delete.

Anything heavier is grouped separately under And these, which go further: — Delete and reorganise, Read and write files, and Run code and build features. Every box the client asked for starts ticked, and every one is yours to untick before pressing Approve. The screen also states which WordPress account the connection will act as: it can never do more than that account can. If abilities happen to be switched off, it says so rather than letting you approve a connection that quietly does nothing.

When it is offered. Only when your client speaks remote MCP, the site is served over HTTPS, and the host actually serves the discovery documents. A cloud assistant also needs an address it can reach, so a local or private hostname rules it out.

When an application password is the better choice. Any client that speaks only stdio, a site on a local address, and hosts that block /.well-known/ or strip the authentication header. A password works regardless, which is why it is the recommended default.

Connections can be revoked at any time under Manage connections and keys.

Full guide: How to: connect with OAuth

NibWP → Connect is the only screen you need for this. It walks through five numbered steps, and each one reshapes itself around the tool you picked, so you are never reading instructions for somebody else's editor.

1. Turn on AI abilities. Step 1 is the master switch. Tick Turn on AI Abilities for this site, press Save Settings and confirm.
2. Choose your tool. Step 2 asks Which AI tool are you using? and offers more than fifteen clients as a single row of chips — Claude.ai, Claude Desktop, Claude Code, ChatGPT, Cursor, VS Code, GitHub Copilot, Windsurf, Cline, Codex, Gemini CLI, Zed and others. Everything below adapts to your answer.
3. Choose how to connect. Step 3 offers Application password or Sign in. The application password is marked Recommended because it works with every client and every host. If sign-in cannot work here, it is disabled with the reason rather than offered and then failing.
4. Create your key. On the password route, give it a Name if you like — it is optional — and press Create password. The value is shown once. If you already have one, expand I already have an application password and paste it in.
5. Connect your AI client. Step 5 shows a ready-made block under Prompt for your AI agent, with your address, username and password already filled in. Press Copy prompt, paste it into your assistant, and it writes its own configuration. Prefer to do it yourself? Manual setup gives you the JSON snippet instead.

Restart or reload the MCP session afterwards, then ask the assistant to list the server's tools. Keys and connections can be revoked later under Manage connections and keys.

Full guide: How to: connect an AI client

Installing NibWP is an ordinary WordPress plugin install. The part people miss is the last step: abilities stay off until you turn them on yourself.

Before you start, check the two minimums from the plugin header — WordPress 6.5 or newer, and PHP 8.0 or newer. You also need an administrator account, since every NibWP screen requires the manage_options capability.

1. Install it. Either search for the plugin in the WordPress.org plugin directory and install from there, or take the .zip and use Plugins → Add New → Upload Plugin. Uploading the nibwp folder into /wp-content/plugins/ by hand works too.
2. Activate it. On multisite, activate per site — each subsite gets its own endpoint.
3. Find the menu. A NIBWP item appears near the top of the wp-admin sidebar. It opens on Dashboard, with Connect, Integrations, AI Abilities, Memory, Audit Log, Sandbox, Status and Settings beneath it.
4. Switch on abilities. Go to NibWP → Connect. Step 1 is Enable AI Abilities: tick Turn on AI Abilities for this site and press Save Settings. A confirmation panel appears first, and it is blunter if the site looks like production — read it before pressing Yes, enable it.

Two things to know afterwards. The switch is tied to the address it was turned on for, so a site that moves to a new domain has its abilities disabled until you turn them on again. And individual abilities have their own toggles under NibWP → AI Abilities, so you can keep the master switch on and still narrow what is exposed.

Full guide: Installation paths

NibWP turns your WordPress site into an MCP server. That means your site publishes one address that AI assistants can talk to, and a list of named jobs they are allowed to ask for. Nothing is scraped, and nothing is pasted back and forth by hand.

Those named jobs are called abilities. Each one has a fixed shape: read a post, search content, upload media, create a term, store something in the site's memory. An assistant can only call the abilities that exist, and only within the permissions you granted.

What that gives you in practice:

• It can read. Posts, pages, media, terms, users, options and search results — through typed abilities rather than guesswork.
• It can change things you allowed. Creating and editing content is a separate permission from deleting, writing files, or running code.
• It cannot go outside the list. There is no free-form access to your database, and the connection acts as the WordPress account that approved it, so it can never do more than that account can.
• You can see what happened. Every call is written to the Audit Log on your own site.

Free or paid, the plugin runs entirely inside your WordPress install. The free plugin gives you the MCP endpoint, the core abilities and the plugin integrations. Pro and Bundle add the heavier work on top: Pro Skills that turn a design into real builder components, writing files back to the server, and the snapshot and restore abilities.

One caution worth repeating: with abilities switched on, an assistant can run PHP and touch files. Use a staging copy and keep backups.

Full guide: NIBWP overview

Welcome to Documentation 📚 — curated, bite-sized how-tos for getting the most out of NibWP.

This space highlights the guides customers reach for most. For the complete documentation, head to nibwp.com/docs — we link into it from posts here rather than duplicating it.

Good places to start

• Getting started & first setup
• Connecting NibWP to your WordPress site
• Common questions and troubleshooting

Can't find something? Ask in 💬 Q&A / Get Help and we'll point you to the right doc (or write a new one). 🧡