For WordPress 6.9 and the Abilities API
An AI client connected to WordPress acts as a user and can do everything that user can. Agent Warden gives each agent its own token and a policy that says exactly what it may do. Risky actions wait for a person, every action is logged in plain language, and changes can be undone.
agentwarden/create-draftAllowedagentwarden/update-postAllowedagentwarden/publish-post · Waiting for approval · rule holdHeldagentwarden/delete-post · Hard block: deleteRefusedundoUndoneMCP, REST, and WP-CLI calls all pass through the same five steps. Nothing reaches your database on the way around them.
The token names one agent. Its policy version, expiry, IP allowlist, schedule, and pause state are loaded before anything else.
Is the ability allowed? Is the input inside the agent’s scopes, limits, and hard blocks? The answer is run, simulate, hold, or refuse.
The rows the action is about to change are copied first, so the change can be undone later.
The agent gets only the capabilities its policy grants for this call. WordPress’s own permission checks still run.
The action is logged in plain language. Refusals and holds return a reason the agent can read and explain.
Start from a template such as Read-only auditor or Content editor (drafts only), then edit it. Policy reference
{
"schema_version": 1,
"mode": "live",
"abilities": {
"default": "deny",
"rules": {
"agentwarden/get-post": "allow",
"agentwarden/create-draft": "allow",
"agentwarden/publish-post": "hold"
}
},
"hard_blocks": { "delete": true, "plugins_themes": true },
"limits": { "writes_per_hour": 60 }
}A held request returns an approval ID to the agent, which can check back later. Approve runs the exact input the agent sent; it is sealed when the request is made. Deny records your note, and the agent sees it.
Email, Slack with Approve and Deny buttons, Microsoft Teams, and webhooks on Pro.
How approvals workBefore an agent changes anything, the rows it touches are journaled. Undo one action, a whole session, or everything an agent did in a time window. If a person edited a row afterwards, you choose which version to keep.
Posts on Free. Posts, meta, comments, users, options, terms, and store data on Pro.
Undo and conflictsAgent Warden is a streamable HTTP MCP server on your own site. Each client only sees the tools its agent’s policy allows or holds.
claude mcp add --transport http agentwarden \
https://example.com/wp-json/agentwarden/mcp \
--header "Authorization: Bearer <YOUR_TOKEN>"Agency hub
One inbox for every site’s held actions, one policy applied to many agents with local changes shown as drift, and a weekly report for each client. Sites keep enforcing their own rules; the hub never reaches into them.
From $99 a month for 25 sites
No. The free plugin makes no external requests, and Agent Warden makes no AI calls. A site connected to the agency hub sends metadata and counts only: versions, agent names and statuses, waiting approvals, and daily counts. Posts, orders, customers, and what agents sent are never included.
Only for MCP clients such as Claude Desktop, Claude Code, Cursor, or ChatGPT. The REST API and WP-CLI gateways work without it.
They stay denied. A policy’s default is always deny, and there is no global wildcard, so a new plugin never widens what an existing agent can do.
No, and Agent Warden says so up front. Each ability has a reversibility class. Irreversible actions, such as a refund or a sent email, are refused while the irreversible hard block is on, or held for a person to approve.
The plugin is free for two agents. Pro is $24 a month or $199 a year per site. The agency hub starts at $99 a month for 25 sites, with every Pro feature on each connected site.
Install the plugin, pick a template, copy the token into your client. Deactivating the plugin stops every agent at once.