How to scope an MCP server’s WordPress access (so an agent can’t do everything an admin can)
Scoping an AI agent’s WordPress access, layer by layer: the Abilities API permission callback, the MCP transport gate, and the one user account every check runs against.