--- title: "WordPress MCP: What the Abilities API Lets an AI Do" url: https://hostmy.blog/wordpress-mcp/ date: 2026-10-22 modified: 2026-10-22 lang: en author: "Aditya Sharma" description: "The Abilities API describes what a WordPress site can do, and the MCP Adapter lets an AI use it. What each piece is, and what an AI can and cannot do." categories: - "RankReady" image: https://hostmy.blog/wp-content/uploads/2026/10/hmb-card-2569-1024x538.jpg word_count: 1323 --- # WordPress MCP: What the Abilities API Lets an AI Do WordPress MCP is a way for an AI assistant to use a WordPress site, not just read it. The assistant can list what the site is willing to do, ask for the details of one action, and run it. Two pieces make that work: the Abilities API inside WordPress, and an adapter that exposes those abilities over the Model Context Protocol. This post explains what each piece is and what an AI can and cannot do through them. It is an explainer, with no build steps. We run this stack on our own site, so some of what follows comes from using it, and where a fact comes from WordPress's own documentation the post links it. ## MCP in one paragraph The Model Context Protocol, MCP, is a standard way for an AI application to call tools that live somewhere else. The application is the client. The thing offering tools is the server. A server describes its tools, the client picks one, and the server runs it and returns the result. That is the whole idea. WordPress's contribution is a way to describe what a site can do, and a server that offers it. ## The Abilities API: what the site can do The Abilities API arrived in WordPress 6.9. WordPress describes it as a system that lets core, plugins and themes register what they can do in a standard, machine-readable format, in a registry that can be discovered, validated and executed. The [core announcement](https://make.wordpress.org/core/2025/11/10/abilities-api-in-wordpress-6-9/) sets out the details. Three facts are worth knowing. Each ability has a name in a namespace/name form, a description, and a schema for what goes in and what comes out. Every ability belongs to a category that has to exist first. And exposing abilities over the REST API is opt-in: an ability is only reachable that way if its author sets it to be, and access then needs an authenticated user. Nothing is public by accident. An ability is just a described piece of code. It might read a post, list the site's categories, or create a draft. What it can do depends on what a plugin registered, and on what the logged-in user is allowed to do. ## The MCP Adapter: how an AI reaches it The abilities exist whether or not any AI is involved. The adapter is the bridge. WordPress's [MCP Adapter](https://github.com/WordPress/mcp-adapter) is the official package that turns registered abilities into MCP tools, so an MCP client can use them. It supports two ways to connect: over HTTP, at an address under /wp-json, and over STDIO through WP-CLI. | Piece | Job | Where it lives | | ----- | --- | -------------- | | Abilities API | Describes what the site can do | WordPress core, from version 6.9 | | An ability | One described action, with inputs and outputs | A plugin, a theme or core | | MCP Adapter | Exposes abilities as MCP tools | A plugin or package on the site | | MCP client | The AI application that calls the tools | Outside the site, such as a desktop AI app | By default, the adapter keeps abilities private. A site author has to mark an ability as public before an MCP client can see it. And the default server does not list every ability as its own tool. It offers three general ones: one to discover abilities, one to get the details of an ability, and one to execute it. An assistant first asks what exists, then asks about one, then runs it. ## What this looks like in use We manage this site through that sequence. An AI session lists the abilities available, reads the description and schema for the one it wants, and runs it. The steps are small and visible, which is the appeal. A session can read posts and run an audit, and it can create a draft, because those are abilities that exist. It is limited to the abilities that exist, although one broad ability can cover a lot. Two things we learned from living with it. The set of abilities is the real boundary, so the question to ask of any WordPress MCP setup is what abilities are registered, not what the AI is clever enough to do. And the same ability can be harmless or powerful depending on its inputs, so the description and the schema deserve reading before anything runs. ## What it is not It is not a plugin that makes your site visible to AI search. We have seen nothing to suggest it affects whether an assistant cites your pages, and it does nothing for visitors. It is a way to let an AI operate your site, which is a different job from being found. For the side of the web that is about being found, see [AEO tools: what to measure, fix and skip](/aeo-tools-wordpress/). The manual way to check that side is [the five layer AI SEO audit](/five-layer-ai-seo-audit/). It is also not the same as WebMCP, which is a proposal for web pages to offer tools in the browser. That distinction is in [what WebMCP is, and whether a WordPress blog needs it](/what-is-webmcp/). WordPress MCP runs on the server and acts on the site, and WebMCP runs in the visitor's browser and acts on a page. ## Is it worth setting up? It is worth it if you want an AI to do real work on a site, such as drafting, auditing or bulk edits, and you are comfortable deciding what it may touch. It is not worth it as a ranking move. Whether to allow it, and how to limit it, is a security question that deserves its own treatment, and this post does not try to answer it. ## The terms in one place | Term | What it means | | ---- | ------------- | | MCP | Model Context Protocol, a standard for AI applications to call tools offered by a server | | MCP client | The AI application, such as a desktop assistant, that connects and calls tools | | MCP server | The side that describes and runs the tools, which the adapter provides on WordPress | | Ability | One described action a site can perform, registered through the Abilities API | | Category | The group an ability belongs to, which has to exist when the ability is registered | | Meta-tool | One of the three general tools the adapter's default server offers: discover, get info and execute | | Public ability | An ability marked as available to MCP clients, since abilities are private by default | ## The parts of an ability An ability is a small, described unit. On paper it has these parts. `name: namespace/ability-name label: a short human name description: what it does, in plain words category: a registered category input schema: what it accepts output schema: what it returns permission check: who may run it, where one is set callback: the code that does the work` What you can see from outside matters. A client can read the name, description and schemas before running anything, and the permission check decides whether the logged-in user is allowed to run it. The description is the part people skip, and it is the one to read. ## Read-only and changing abilities The most useful distinction is between abilities that read and abilities that change things. Reading a list of posts changes nothing. Creating a draft adds content, and publishing or deleting changes what the public sees. Before you connect an AI to a site, list the abilities it can reach and sort them into those groups. The size of the risk is the size of the changing group, and that list is usually short enough to read in a few minutes. ## Where RankReady fits RankReady does not need any of this. Its [WebMCP manifest](/plugins/rankready/webmcp-wordpress/) is a separate, read-only file that works without the adapter or the Abilities API. The page that describes it says plainly that RankReady's registration with core's Abilities API is not working yet. If you want content that agents can read, that route is simpler. If you want an AI to operate the site, you need the pieces above. The free [AI Readiness Checker](https://hostmy.blog/plugins/rankready/ai-readiness-checker/) is the quickest way to see where your site stands on being read. If an AI could do one thing on your site tomorrow, which ability would you want it to have, and which would you never register?