Choose what your assistant may do
Every tool NibWP exposes over MCP is listed in one place, and you decide which of them your assistant ever sees.
- Open NibWP → AI Abilities. Each row is one tool: its name, its category, its type (Read, Write or Destructive), whether it is enabled, and what it does. The counters at the top show how many are read-only and how many are destructive.
- Find things by source. Rows are grouped by where they come from — NibWP itself first, then any add-on that contributes its own — and the Source dropdown filters to one group. Search, category, type and status filters narrow it further, and Export JSON hands you the whole list.
- Switch individual tools off in NibWP → Settings, under Tool Management. Tick a tool to disable it and it is no longer offered to any connected client. Disable all is there for the times you want to start from nothing and add back.
- Use the master switch on NibWP → Connect: Turn on AI Abilities for this site. While it is off, the MCP endpoint rejects requests even from clients that are still configured. This is the switch to reach for first.
Beyond that, every call is checked against the WordPress account the client signed in as. Content tools require the capability to edit posts, media tools the capability to upload files, user listings the capability to list users, and most integration tools full administrator rights. An account without the capability gets nothing back, whatever the tool list says.
If you connect with OAuth rather than an application password, the consent screen narrows it again: reading and creating content are offered by default, while deleting, file access and running code start unticked.
Full guide: How to: manage AI Abilities