{AI4WP}

Abilities API

The Abilities API is the list of what your WordPress site can do and what it allows. Core, your theme and your plugins each add their own abilities.

Goal

Manage your WordPress site from your AI app, and let that app do only what you allowed.

What It Is Made Of

  • The list. Part of WordPress core since 6.9. Any code can register an ability or read the list.
  • An ability. One entry: its name, the input and output schemas, and a permission_callback that says who may call it.
  • 4WP MCP Connector. Everything is off by default. An administrator switches on abilities one by one, and every call is logged.
  • One password, one file. The connector file already has your site address and login in it. Double-click it, paste the password, Install.
  • Your AI app. It now knows what your site can do, and only what you allowed.

Common Problems

  • A weak permission_callback. Each ability needs its own check, and never __return_true for anything that changes data.
  • Vague schemas. If input and output are not described precisely, the agent guesses.
  • Abilities that do too much at once. Pick actions a person would actually ask for.
  • The public flag. meta.mcp.public makes an ability available to the MCP Adapter, so set it on purpose.
  • No HTTPS. The connector password is an Application Password, and outside local environments those require HTTPS.

Read more: WordPress Abilities API: What It Is and How It Works

Video series