WordPress 6.9 added the Abilities API, which lets a plugin register actions (with their own permission check) that AI agents can call. I wanted to know how many plugins actually use it, so I read each one's current free wordpress.org code instead of trusting its readme. This is the state as of 28 September.

• 196 plugins register abilities. 3,640 abilities between them.
• 44 register as soon as the plugin is active. The other 52 wait for something first: a setting, a licence tier, or a filter. ACF only loads its Abilities integration once "Enable ACF AI" is switched on. Fluent Forms waits for its own MCP setting, which ships off.
• The biggest by count: The Plus Addons for Elementor (106), WDesignKit (95), LatePoint (82), Masteriyo (81, conditional), WPFunnels (78).
• Some names you probably run: Ninja Forms 32, Rank Math 29, Elementor 27, FluentCRM 25, ACF 16, WPForms 8, SEOPress 8, WooCommerce 7, WPCode 5, Yoast 3, WP Mail SMTP 1.
• I left out 31 plugins that turned out to be AI connectors with their own MCP server, and one that registers nothing.

Disclosure, since it's why I did this: I build Agent Abilities for MCP, a free plugin (500+ installs) whose Bridge exposes these abilities to an MCP client such as Claude or Cursor. Every bridged ability stays off until you enable it. Each call runs as a WordPress user, gets that user's capabilities re-checked, and lands in an audit log.

The full list, with every ability name per plugin, is here whether or not you use my plugin: https://agentabilitieswp.com/bridge/plugins/

Plugin authors: if you gated yours behind a setting, what made you decide to? I'd like to know if it was caution or support load.