WordPress Abilities API: The Complete Guide to AI-Ready Automation

WordPress 6.9 “Gene” arrived on December 2, 2025, with a feature that fundamentally changes how external systems interact with your site: the Abilities API. This WordPress Abilities API tutorial walks you through what it is, why it matters for WordPress AI integration, and how to get started building AI-ready functionality into your plugins and themes.

Whether you want Claude, ChatGPT, or Gemini to manage content on your WordPress site, the Abilities API provides the foundation. Here’s what you need to know.

What is the Abilities API?

The Abilities API is a unified registry that exposes WordPress capabilities in a standardized, machine-readable format. It transforms how plugins, themes, and core define what a site can do—making those capabilities discoverable by AI agents and automation tools.

An ability is a self-contained unit of functionality that includes:

• Inputs: Parameters required for execution
• Outputs: Structured data returned after execution
• Permissions: Who can run the ability
• Execution logic: The actual function that performs the work

Before the Abilities API, WordPress functionality was fragmented across hooks, functions, and REST endpoints with no consistent way for external systems to discover or understand them. Now, AI systems can query a WordPress site and reliably understand what actions are available.

This differs from the existing REST API, which exposes data and CRUD operations. The Abilities API exposes actions—discrete units of work with explicit contracts for what they do and who can execute them.

The Four AI Building Blocks

The Abilities API is one piece of a larger WordPress AI initiative. The WordPress AI Team shipped four building blocks in six months:

1. Abilities API – Registry for WordPress capabilities (ships in 6.9)
2. WP AI Client SDK – Provider-agnostic AI communication
3. MCP Adapter – Model Context Protocol bridge connecting WordPress to AI assistants
4. AI Experiments Plugin – Testing ground for AI features before core inclusion

As James LePage, Engineering Director of AI at Automattic, noted: “We are taking a foundational approach to AI in WordPress, creating the necessary building blocks for plugin, developers, and core alike to create and explore impressive AI solutions.”

How It Works: Registration and Execution

Registration Pattern

Abilities are registered using the wp_abilities_api_init hook and the wp_register_ability() function. Here’s a working example:

add_action( 'wp_abilities_api_init', function() {
    wp_register_ability( 'my-plugin/get-site-info', [
        'label'       => 'Get Site Information',
        'description' => 'Returns basic site metadata for AI assistants',
        'category'    => 'site-management',
        'execute_callback'    => 'my_get_site_info',
        'permission_callback' => fn() => current_user_can( 'manage_options' ),
        'output_schema' => [
            'type' => 'object',
            'properties' => [
                'name'  => [ 'type' => 'string' ],
                'url'   => [ 'type' => 'string' ],
            ],
        ],
    ]);
});

function my_get_site_info() {
    return [
        'name' => get_bloginfo( 'name' ),
        'url'  => get_bloginfo( 'url' ),
    ];
}

Key registration parameters:

• label/description: Human-readable identifiers that AI systems use to understand the ability’s purpose
• category: Groups related abilities for organization
• execute_callback: The function that performs the work
• permission_callback: Determines who can run this ability
• output_schema: JSON Schema defining the response structure

REST API Exposure

Registered abilities are automatically exposed via REST endpoints under the wp-abilities/v1 namespace:

Endpoint	Method	Purpose
/abilities	GET	List all registered abilities
/abilities/{namespace/ability}	GET	Retrieve ability details
/abilities/{namespace/ability}/run	GET, POST, DELETE	Execute an ability

Authentication is required for execution. Use Application Passwords for secure access.

Connecting to AI Agents

The MCP (Model Context Protocol) Adapter is where the Abilities API becomes practical for WordPress MCP integration. This plugin bridges WordPress to the Model Context Protocol—a standard that Claude, ChatGPT, and other AI assistants use to interact with external tools.

When installed, the MCP Adapter:

1. Transforms your WordPress site into an MCP server
2. Exposes all registered abilities as discoverable tools
3. Handles authentication and permission enforcement

How AI Assistants Discover Abilities

When an AI assistant connects to your WordPress site through MCP, it queries the available abilities and receives structured information about each one—including the description, required inputs, expected outputs, and permission requirements. The AI can then execute abilities within the user’s permission scope, making complex WordPress operations available through natural language commands.

High-level setup:

1. Install the MCP Adapter plugin from GitHub
2. Configure authentication using Application Passwords
3. Point your AI assistant’s MCP client configuration to your WordPress site’s MCP endpoint

For a deeper walkthrough of MCP configuration, see the WS Form MCP tutorial.

Security Best Practices

The Abilities API implements security at multiple layers:

• Permission callbacks: Each ability defines its own access control using current_user_can() checks
• Input validation: JSON Schema enforces parameter types before execution
• Metadata flags: Mark abilities as readonly, destructive, or idempotent so AI systems understand consequences
• REST exposure control: Use the show_in_rest meta flag for opt-in exposure

Security is built into the architecture—not an afterthought. Every ability execution passes through the permission callback, whether triggered via PHP, REST API, or an AI agent through MCP.

Getting Started

Prerequisites

• WordPress 6.9 or later
• Developer access to add code to a plugin or theme

Quick Start

1. Hook into registration: Add your ability registration to the wp_abilities_api_init action
2. Register an ability: Use wp_register_ability() with the required parameters (see code example above)
3. Test discovery: Visit GET /wp-json/wp-abilities/v1/abilities to confirm your ability appears
4. Test execution: Use POST /wp-json/wp-abilities/v1/abilities/{name}/run with authentication

Resources

• Official Abilities API Documentation – Complete function reference and examples
• GitHub Repository – Source code and issue tracking
• Make WordPress AI – Team discussions and roadmap updates

What’s Next

WordPress 7.0 targets the JavaScript client for client-side ability execution and a proposed Workflows API for chaining abilities together. The JavaScript client will enable abilities to run directly in the browser, opening possibilities for real-time AI interactions within the block editor. The Workflows API will let developers chain multiple abilities into automated sequences.

The foundation is set—now the ecosystem builds on it. Plugin developers who adopt the Abilities API early position their products for the AI-enabled WordPress future.