WP Pinch registers 35 core abilities across 10 categories, plus 10 WooCommerce abilities when WooCommerce is active. Every ability has built-in security guards: capability checks, input sanitization, existence validation, and audit logging.

Every ability execution goes through these checks before any work is done:

1. Capability check -- Does the current user have permission? (e.g., edit_posts, manage_options)
2. Per-post verification -- For meta operations, verifies current_user_can( 'edit_post', $post_id )
3. Input sanitization -- All parameters sanitized with sanitize_text_field(), sanitize_key(), absint(), esc_url_raw()
4. Existence validation -- Posts, comments, terms, and media are verified to exist before modification
5. Audit logging -- Every execution is recorded in the audit log with user ID, ability name, and parameters

add_filter( 'wp_pinch_abilities', function ( array $abilities ): array {
    unset( $abilities['delete_post'] );
    return $abilities;
} );

add_filter( 'wp_pinch_abilities', function ( array $abilities ): array {
    $abilities['my_custom_ability'] = array(
        'label'       => 'My Custom Ability',
        'description' => 'Does something custom.',
        'callback'    => 'my_custom_ability_callback',
        'category'    => 'custom',
        'capability'  => 'manage_options',
    );
    return $abilities;
} );

Navigate to WP Pinch > Abilities in your admin sidebar. Toggle individual abilities on or off without writing code.

WP Pinch registers a dedicated wp-pinch MCP endpoint that curates which abilities are exposed to AI agents. Only abilities you've enabled (via the admin UI or filters) are discoverable through MCP.

The MCP endpoint is available at:

https://your-site.com/wp-json/wp-pinch/v1/mcp

Connect OpenClaw:

npx openclaw connect --mcp-url https://your-site.com/wp-json/wp-pinch/v1/mcp

The get-option and update-option abilities only work with explicitly allowed option keys. Sensitive options (auth salts, active_plugins, users_can_register, default_role, the API token) are blocked by a hardcoded denylist that runs before any filter.

Extend the allowlists:

// Allow reading additional options
add_filter( 'wp_pinch_option_allowlist', function ( array $keys ): array {
    $keys[] = 'my_custom_option';
    return $keys;
} );

// Allow writing additional options
add_filter( 'wp_pinch_option_write_allowlist', function ( array $keys ): array {
    $keys[] = 'my_custom_option';
    return $keys;
} );

AI agents cannot:

• Promote any user to administrator
• Assign roles with dangerous capabilities (manage_options, edit_users, etc.)
• Modify the current user's own role
• Deactivate the WP Pinch plugin itself

Customize blocked roles:

add_filter( 'wp_pinch_blocked_roles', function ( array $roles ): array {
    $roles[] = 'editor'; // Protect editors too
    return $roles;
} );