WordPress Abilities API: The Complete 2026 Guide

The WordPress Abilities API is a core-level system, shipped in WordPress 7.0, that lets plugins expose specific actions, like creating a post or updating a setting, as structured, discoverable functions that AI agents and other tools can call safely. It replaces guesswork with a typed contract: an agent asks what a site can do, and the site answers exactly.

What Is the WordPress Abilities API?

The WordPress Abilities API standardizes how plugins and themes describe “abilities”: self-contained actions with a name, description, input schema, output schema, and permission check. Instead of an AI agent guessing at custom REST endpoints or reading a plugin’s source code, it queries a single discovery point built into WordPress core and executes only what the site owner has explicitly permitted (WordPress AI Team, “Abilities API,” make.wordpress.org, 2026).

Think of it as a menu instead of a maze. Before the Abilities API, connecting an AI tool to WordPress meant writing custom REST routes for every action, documenting them by hand, and hoping the AI client guessed the right parameters. Now a plugin registers an ability once, and any compliant client can read its schema and call it correctly on the first try.

This matters most for the long tail of WordPress functionality that never had a public REST route at all. A membership plugin’s “check subscription status” logic, a form plugin’s “list recent submissions” query, or a caching plugin’s “purge this URL” action typically lived only in admin-screen PHP, invisible to anything outside the WordPress dashboard. The Abilities API gives plugin authors a lightweight way to surface exactly that kind of internal logic without building and maintaining a full REST namespace around it.

How Does the Abilities API Actually Work?

A developer registers an ability with a single function call, typically wp_register_ability( 'namespace/action-name', $args ). The $args array defines everything a caller needs to use that ability correctly and everything WordPress needs to keep it safe.

• Label and description — a human- and AI-readable explanation of what the ability does
• Input schema — a JSON Schema describing exactly what parameters the ability accepts
• Output schema — a JSON Schema describing the shape of the response
• Permission callback — a function that checks whether the current requester is allowed to run this specific ability
• Execute callback — the actual PHP function that runs when the ability is called

Every registered ability lands in one central, site-wide registry. That registry is what makes discovery possible: an AI agent, a WP-CLI command, or another plugin can list every available ability before calling any of them, rather than needing prior knowledge of a plugin’s internals.

What Does an Ability Registration Look Like in Code?

A minimal registration is short, because most of the safety work happens inside the permission callback rather than the registration call itself. Here’s a simplified example that exposes a “publish a draft post” ability:

wp_register_ability( 'my-plugin/create-post', array(
    'label'               => 'Create a blog post',
    'description'         => 'Creates a new post in draft status.',
    'input_schema'        => array(
        'type'       => 'object',
        'properties' => array(
            'title'   => array( 'type' => 'string' ),
            'content' => array( 'type' => 'string' ),
        ),
        'required'   => array( 'title', 'content' ),
    ),
    'permission_callback' => function() {
        return current_user_can( 'edit_posts' );
    },
    'execute_callback'    => function( $input ) {
        return wp_insert_post( array(
            'post_title'   => $input['title'],
            'post_content' => $input['content'],
            'post_status'  => 'draft',
        ) );
    },
) );

Notice the ability hard-codes post_status to draft. That’s a deliberate developer choice, not a WordPress Abilities API requirement, but it’s a common and sensible pattern: an ability can be written to only ever perform the safer half of an action, leaving publishing itself to a human.

What Are Some Real-World Examples of Registered Abilities?

Abilities map closely to actions a plugin already performs internally; the API just gives each one a name and a contract. Common early examples include:

• Creating or updating a post, page, or custom post type entry
• Reading site settings, such as the site title, tagline, or timezone
• Listing recent WooCommerce orders or a single order’s status
• Updating SEO metadata registered by an SEO plugin
• Uploading a media file to the library and returning its attachment ID
• Running a cache purge on a caching plugin

How Does the Abilities API Connect to the WordPress MCP Adapter?

The Abilities API defines what a site can do; the WordPress MCP Adapter, a companion plugin, exposes those same abilities over the Model Context Protocol (MCP) so external AI agents like Claude or ChatGPT can discover and call them through a standard, cross-platform protocol instead of a one-off integration. That is the same mechanism behind AI-driven publishing tools that create posts, upload media, and set SEO fields on a WordPress site through chat, the way this very article was drafted.

MCP itself isn’t a WordPress invention; it’s an open protocol originally built for connecting AI assistants to external tools and data sources in general, and WordPress is one of many platforms that has since adopted it as a transport layer. The MCP Adapter’s job is narrow on purpose: it translates registered abilities into MCP’s tool format and back, so WordPress core doesn’t need to know or care which specific AI vendor is on the other end of the connection.

If you want a deeper walkthrough of connecting an AI assistant to a WordPress site through this kind of connector, see our guide on using the Claude connector in WordPress, which covers the setup steps from the client side.

Which WordPress Version Introduced the Abilities API?

WordPress 6.9 shipped the Abilities API as a stable core feature in December 2025. WordPress 7.0 followed in May 2026 and paired it with the Connectors API and a built-in AI HTTP client, giving sites a standard way to store credentials for external AI services. A merge proposal landed on July 2, 2026 to expand the registry ahead of WordPress 7.1, and the WordPress 7.1 Release Candidate, published August 6, 2026, folded those changes into more than 145 editor and core updates for that cycle (WordPress News, “WordPress 7.1 Release Candidate 1,” wordpress.org, August 2026).

If you want the full list of what else shipped in that release, our breakdown of WordPress 7.1’s new features covers the editor, styling, and admin changes outside the Abilities API scope.

Why Is WordPress Building the Abilities API Now?

WordPress still powers more than 43% of all websites (W3Techs, 2026), which makes it the largest single surface AI agents encounter when they try to act on a website rather than just read one. Without a standard discovery layer, every AI vendor that wanted to integrate with WordPress had to build and maintain its own custom connector against whichever plugins its users happened to run, which does not scale past a handful of popular plugins.

The Abilities API flips that arrangement. Instead of AI vendors reverse-engineering WordPress plugins one at a time, plugin authors describe their own actions once, and any AI client that understands the registry format can use them immediately. That’s also the reasoning behind pairing the Abilities API with the Connectors API in WordPress 7.0: one system defines what a site can do, the other defines how an external service authenticates to do it.

How Does the Abilities API Compare to the REST API and WP-CLI?

Abilities aren’t a replacement for the REST API or WP-CLI. They sit alongside both and solve a different problem: letting a caller discover what’s possible without reading documentation first. A REST route or a WP-CLI command still does the underlying work in many cases; an ability is often a thin, self-describing wrapper placed on top of one.

How Do I Let an AI Agent Use My WordPress Site’s Abilities?

Getting a site ready for agent access is mostly configuration, not code, unless you are the one building the plugin that registers abilities.

1. Update to WordPress 6.9 or later; 7.0 or newer is recommended for the built-in Connectors API.
2. Check which of your installed plugins register abilities; look for Abilities API support in their changelog.
3. Install the WordPress MCP Adapter plugin if you want an external AI client, such as Claude or ChatGPT, to connect over MCP.
4. Create a connection under Settings → Connectors, using an application password or the plugin’s guided authorization flow.
5. Review the list of registered abilities and confirm each permission callback matches the access you actually intend to grant.

Most of this happens once per site, not once per AI conversation. After the initial connection is authorized, the AI client can query the ability registry on demand, so adding a new plugin that registers additional abilities generally doesn’t require reconfiguring the connection itself, only reviewing what the new plugin has exposed.

Is the WordPress Abilities API Safe for My Site?

Yes, when it’s configured correctly, because every ability runs through its own permission callback before execution. An agent can only do what the specific user account it’s connected as is already allowed to do inside WordPress; the API does not bypass roles and capabilities, it exposes them through a structured contract.

Site owners should still audit which plugins register abilities, because a poorly written permission callback carries the same risk a poorly secured REST route or AJAX handler has always carried. Recent vulnerabilities in unrelated WordPress plugin code, like the one we covered in our WooCommerce Social Login vulnerability guide, are a reminder that any new surface area, including an ability’s permission check, needs the same scrutiny as an old one.

How Do Abilities Interact With User Roles and Capabilities?

Abilities don’t introduce a parallel permission system; they call directly into the same role and capability checks WordPress has always used, functions like current_user_can(). That means an ability connected as an Editor account can never do what only an Administrator account can do, regardless of what an AI agent asks for. It also means the fastest way to limit an AI connection’s reach isn’t a special Abilities API setting, it’s simply connecting through a lower-privilege WordPress user account in the first place.

What Are the Current Limitations of the WordPress Abilities API?

Adoption is still uneven. Because ability registration is opt-in for plugin authors, most of the WordPress plugin ecosystem, including many popular plugins, has not registered any abilities yet, so an AI agent’s actual reach on a given site depends entirely on which plugins its author has updated. Core itself only registers a limited starter set of abilities, covering basic post, page, and settings actions.

There is also no built-in rate limiting or usage auditing specific to abilities in the initial release; a site relies on the same login security, application-password scoping, and server-level protections it already uses for the REST API. Site owners running high-traffic or highly regulated sites should treat an AI connection the same way they’d treat any third-party API integration, with monitoring and periodic review, rather than assuming the Abilities API adds safeguards beyond permission checks on its own.

What Does This Mean for Plugin Developers and SEO?

For plugin developers, registering abilities is quickly becoming the expected way to make a plugin’s core actions usable by automation, in the same way a REST endpoint became expected a decade ago. For site owners thinking about SEO, the Abilities API is part of a broader shift toward making WordPress sites directly legible to AI systems, not just crawlable by them.

That shift overlaps closely with generative engine optimization, the practice of structuring content so AI answer engines can cite it accurately. Our guide to generative engine optimization for WordPress covers the content side of that work in detail.

What Should WordPress Site Owners Do Now?

• Update WordPress core to at least 6.9, and ideally 7.1, once it’s out of release candidate testing.
• Keep every plugin updated, since ability registrations ship inside normal plugin updates.
• Only connect AI clients using accounts with the minimum role they actually need.
• Revisit connected apps periodically under Settings → Connectors and remove any you no longer use.

Frequently Asked Questions

Is the Abilities API only useful for developers?

No. Developers register abilities, but site owners benefit directly, since it’s what lets an AI assistant safely create drafts, manage settings, or read site data on their behalf without a custom-built integration. A non-developer’s involvement is usually limited to installing plugins, connecting an account, and reviewing what gets exposed, not writing any code.

Do I need a separate plugin to use the Abilities API?

The Abilities API itself is built into WordPress core from version 6.9 onward, so no plugin is required for it to exist. You only need an additional plugin, like the MCP Adapter, if you want an external AI client to reach those abilities over a network protocol.

Does the Abilities API work with Claude, ChatGPT, or other AI assistants?

Yes, through the WordPress MCP Adapter, which speaks the Model Context Protocol that Claude, ChatGPT, and similar AI clients already support, so no custom code is needed on the AI side.

Will the Abilities API slow down my WordPress site?

No measurable slowdown occurs from registering abilities, since they only execute when a caller specifically invokes one; an unused ability sits in the registry doing nothing, similar to an unused REST route.

Is the Abilities API available on WordPress.com, or only self-hosted sites?

Because it ships in WordPress core itself, the Abilities API is available on any site running WordPress 6.9 or later, including self-hosted installs; availability on managed WordPress.com plans depends on which core version that host has rolled out.

How is the Abilities API different from a REST API key?

A REST API key just authenticates a request; it doesn’t describe what that request can do. The Abilities API adds a discoverable, typed layer on top of authentication, so a caller knows both who it’s allowed to be and exactly what actions are available to it.

The WordPress Abilities API is still young, but it’s moving fast: three major core releases in under a year have taken it from proposal to a documented, versioned system that plugin developers are actively building on. For any site owner planning to let an AI assistant touch their WordPress install, understanding this layer is quickly becoming as basic as understanding user roles.

The practical takeaway is simple even if the underlying system is new: update core and plugins regularly, connect AI tools through accounts scoped to the minimum role they need, and treat every new ability the same way you’d treat a new REST route, worth knowing about, worth reviewing, and never assumed to be safe by default just because WordPress built it.