WordPress MCP permissions: limit each AI app’s tools
WordPress MCP permissions in BetterShield have one layer that is easy to miss: each connected AI app can be limited to the tools you choose, under BetterShield › Agents › Connect. It sits on top of the read and fix switches, and it can only narrow what an app may do, never widen it. A second screen, Agent surface, watches the AI connections other plugins add to the site.
The switches and rules for the whole arrangement are in MCP security best practices for a WordPress site, and the change side is in WordPress MCP write access: approvals, limits and undo. This post covers what those two only touch on: choosing tools per app, and keeping an eye on endpoints and ability changes that belong to other plugins.
Quick summary
- Each connected app has its own Tools list. Keep only what its job needs, then select Save Tools.
- A tool limit is an additional boundary. It does not grant anything the read and fix switches, the credential scope or the account’s permissions forbid.
- The app sees the saved selection the next time it reads its tool list, so ask it to refresh or reconnect before you test.
- Agent surface shows other plugins’ MCP connections and abilities, and current versions monitor endpoints and changes to them.
- Seeing something on that screen is not approval of it, and not proof that it is safe.
Why limit tools per app
Turning on Let AI assistants see security info registers BetterShield’s readable abilities for every connection that signs in. That is the right default for one assistant you trust. It is less comfortable when you have several: a chat assistant you ask questions, an editor plugin a developer uses, a script someone set up last year. They do different jobs, and they do not all need every tool.
The principle of least privilege is the idea behind per-app limits: give each caller the smallest set of powers that gets its work done. The Model Context Protocol is the open standard that lets an assistant call tools on a site like yours, and a tool list is how that standard describes what a connection can do. Limiting the list is a way to shape that description for each app.
How tool limits fit with the other switches
A tool limit never opens a door. Three other things decide first:
| Layer | What it decides |
|---|---|
| The site’s read and fix switches | Whether BetterShield offers reading or fixing at all |
| The credential’s scope | Whether this key or sign-in may only look |
| The account’s permissions | What the account the app signs in as is allowed to do |
| The tool limit | Which of the remaining tools this one app is offered |
If a tool is switched off at the site, adding it to an app’s list does nothing. If a tool is left out of an app’s list, it stays out of reach for that connection, even though another app can use it. Our advice is to read this as a funnel: the first three layers set the ceiling, and the tool limit lowers it for one app.
Limit the tools for one app
Set it up
- Open BetterShield › Agents › Connect.
- Find the connected app and open Tools.
- Review the tools on offer and keep only those the app needs for its job.
- Select Save Tools.
- Ask the app to refresh its tool list, or reconnect, so it picks up the new selection.
That is the whole procedure. The saved selection is stored for that connection only, so a limit on one app does not change another.
Monitor MCP endpoints and ability changes
Your own BetterShield connection is only one of the AI-facing doors a site can have. Other plugins can register their own MCP connections and abilities. BetterShield › Agents › Agent surface shows the AI-facing surface registered on the site, and current versions monitor endpoints and changes to it.
Review the surface
- Open Agent surface and review Other plugins’ AI connections.
- Review the endpoints and the abilities each plugin offers. Use Show abilities and Search ability names where they are offered.
- Compare anything unexpected with recent plugin installs, updates and configuration changes.
- Open the relevant finding or the activity evidence before you change the plugin responsible.
The screen only reads. It lists what is registered; it does not approve any of it. An ability that writes, can be reached over REST and is open to lower roles can become a finding, so the list is worth a look after you install or update any plugin that talks to AI. The platform’s own Abilities API handbook explains what an ability is, and WordPress Abilities API: see what AI agents can reach and do shows how to read the list.
Two limits are worth knowing. Your tool selection narrows what your own BetterShield connection can do, but it does not configure another plugin’s server. And if a check is unavailable, the screen keeps that distinguishable from a result that says an endpoint was tested and is safe.
What it can break, and how to undo
- An app that loses a tool it needs can no longer finish that workflow. Open Tools for that app, put the tool back and select Save Tools, provided the site permission underneath is still right for it.
- Removing a tool does not undo anything already done. If the app completed an action before the limit, reverse that action separately.
- Reviewing Agent surface changes nothing. If an endpoint is too open, use the other plugin’s own settings, because revoking an app password or turning off an endpoint can interrupt that plugin’s integrations. A revoked secret cannot be reconstructed.
Check it is working
After you save, ask the app to refresh its tool list and confirm that only the tools you chose are offered. A tool you excluded should not become callable just because another app can use it. On Agent surface, the providers and abilities you expect should appear, and a change should be identified after a relevant plugin update. For the record of what an app actually called, open Activity › Agent activity, which Record what agents do on this site explains.
Recommended settings
We recommend a separate connection for each app, and a reviewed tool selection for each. Start with reading and checking, and add more only when an app’s job needs it. Do not share one credential between unrelated operators. Keep only the plugin connections the site needs, and look at newly exposed write abilities when they appear. The doc for each screen is Per-app tool limits and Monitor agent surface.
Frequently asked questions
Can a tool limit give an app more access?
No. It is an extra boundary on top of the read and fix switches, the credential’s scope and the account’s permissions. It can only narrow what the app sees.
When does an app see a new tool selection?
The next time it reads its tool list. Ask the app to refresh the list or reconnect before you test.
Does a limit on one app affect my other apps?
No. The selection belongs to that connection. That is why we recommend a separate connection for each app.
Does Agent surface block another plugin’s MCP endpoint?
No. It shows and monitors them. Seeing an endpoint there is not approval, and it is not proof that it is safe. Use the other plugin’s own settings to change it.
What if I remove a tool by mistake?
Open Tools for that app, tick the tool again and select Save Tools. Nothing else is lost, as long as the underlying site permission is still appropriate.
Conclusion
Per-app tool limits let you answer a simple question for each connection: what does this one actually need? Keep the list short, refresh the app to check it, and use Agent surface to see what other plugins have opened up.
BetterShield is free on WordPress.org. The doc for this feature is Per-app tool limits.