About this plugin
Inhale: MCP Abilities Manager shows you, on one screen, every action your WordPress site offers to AI agents through the Model Context Protocol (MCP), and lets you decide which of them an AI client may use.
Why this matters now. 9, plugins register “abilities”: small, named actions such as “get site info”, “create a post” or “update a product”. The WordPress MCP Adapter turns those abilities into tools that Claude, ChatGPT, Cursor and other AI clients can call.
1, a plugin that marks its ability as public makes it reachable by AI clients without the site owner choosing. And you may already run the adapter without knowing it: several popular SEO, page builder, form and store plugins load their own copy.
Inhale puts that decision back with you. Nothing changes until you choose.
What Inhale does
- Lists every registered ability on the site, from every plugin and theme, with what it does and which plugin registered it.
- Lets you switch each one on or off for MCP with a checkbox, or in bulk.
- Shows the safety hints each ability carries: read-only, destructive, idempotent. Filter to read-only abilities in one click. Turning on a destructive ability asks you to confirm.
- Shows your MCP setup at a glance: whether an MCP Adapter is running, its version and which plugin loads it, your endpoint URL, and whether Application Passwords work on this site.
- Gives copy-paste connection steps for Claude Desktop, Claude Code, Cursor, VS Code and WP-CLI.
- Keeps your choice when a plugin author marks an ability public. On WordPress 7.1, every ability gets an explicit decision from you, so “not selected” really means not exposed.
What Inhale does not do
- It does not run an MCP server or handle sign-in. The WordPress MCP Adapter does that, whichever plugin loads it.
- It does not register abilities of its own or change what an ability does. Every ability still runs its own permission checks for the signed-in user.
- It does not phone home, collect telemetry or load anything from outside your site. Nothing is sent anywhere unless you connect a free Respira account for the site check below.
Free with a Respira account: a weekly vulnerability check
press account from the Inhale screen, and Inhale checks WordPress core, every installed plugin and every installed theme against more than 40,000 known vulnerabilities from the Wordfence Intelligence database, once a week and whenever you click Check now.
- The Inhale screen shows which plugins or themes have known vulnerabilities, how severe the worst one is, and the version that fixes them.
- Your free Respira dashboard lists every record with its CVE and a link to Wordfence, for every site you connect.
- The same free account includes an accessibility scan of any page on the site.
No card and no trial. Inhale works the same whether you connect or not, and Disconnect removes the connection on both ends. What is sent, and when, is listed under External services below.
Requirements
- WordPress 6.8 or later. The Abilities API is in core from 6.9; on 6.8 it needs the Abilities API plugin.
- PHP 7.4 or later.
- A WordPress MCP Adapter, for AI clients to connect: the MCP Adapter plugin or a copy loaded by another plugin. Inhale shows which one is running. You can make your choices before an adapter is installed; they apply once one runs.
Browse the abilities directory
Respira keeps a public directory of WordPress plugins that register abilities. press/abilities to see what a plugin exposes before you install it.
About MCP
Model Context Protocol (MCP) is an open specification originally developed by Anthropic. Inhale is a third-party plugin and is not affiliated with, endorsed by, or sponsored by Anthropic or OpenAI.
About Respira
Inhale is built and maintained by Respira. ai and ChatGPT in the browser. Inhale is free and works on its own.
press/inhale.
External services
press), for the free site check.
- When: when an administrator clicks “Connect a free account” and approves on respira.press, then once a week, and whenever an administrator clicks “Check now”. “Disconnect” sends one last request that deletes the connection.
- What is sent: the site address, the WordPress version, and the folder name, name and version of each installed plugin and theme, with the site’s connection token. No content, no users, no personal data from the site.
- What it is for: matching those versions against known vulnerabilities and showing the result on the Inhale screen and in your Respira dashboard.
- Terms: https://www.respira.press/terms
- Privacy policy: https://www.respira.press/privacy
, used under its licence; each record links to Wordfence.
Before you connect, Inhale makes no external requests. org only when you click them.