Wicked Evolutions Knowledge Docs

The WordPress Abilities API is a registry of named, permission-gated, discoverable PHP functions that let AI agents operate WordPress sites. Instead of learning REST endpoints, decoding authentication schemes, or guessing plugin APIs, an agent calls content/create and gets a blog post. Calls site-health/status and gets a diagnostic report.

Every ability has a name, an input schema, permission annotations (read-only, destructive, idempotent), and a category. AI clients discover them automatically. Humans control access through a permission layer. The API shipped in WordPress core 6.9 — our products extend it from 3 core abilities to 740+.

The Four-Layer Stack

Your AI agent connects to WordPress through four layers:

AI Client (Claude Code, Cursor, etc.)
    │
    │  STDIO JSON-RPC
    ▼
Abilities MCP Bridge         ← local Node.js process
    │
    │  HTTPS
    ▼
Abilities MCP Adapter        ← WordPress plugin (server-side endpoint)
    │
    │  PHP function calls
    ▼
WordPress Abilities API
    ├── Abilities for AI            350 abilities · 26 modules
    │   ├── Core WP: Content, Blocks, Users, Media, Taxonomies…
    │   ├── Suites: Astra, Presto Player, Spectra, SureCart
    │   └── Knowledge Layer: Documents, Sessions, Observations
    │
    └── Abilities for Fluent Plugins   382 abilities · 13 modules
        ├── CRM, Community, Forms, Support, Boards
        ├── Cart, Booking, Affiliate, Auth, SMTP
        └── Snippets, Messaging, Cross-Module

How It Works

1. Register

Plugin developers register abilities using wp_register_ability() inside the wp_abilities_api_init hook. Each ability declares its name, description, input schema, callback, and permission annotations.

2. Discover

AI clients call mcp-adapter/discover-abilities to get a list of all registered abilities with their names, descriptions, categories, and annotations. The response tells the agent what’s available, what’s read-only vs destructive, and what input each ability expects.

3. Execute

The agent calls an ability by name with the required input. The MCP Adapter validates the input against the schema, checks permissions, executes the PHP callback, and returns the result. If validation fails, the error response includes the expected schema so the agent can self-correct.

Who It’s For

AI agents that need to operate WordPress sites — create content, manage users, configure themes, run diagnostics, manage CRM contacts, process orders.

Site owners who want to direct AI agents on their WordPress sites without giving up control. The permission layer means you decide what the agent can do.

Developers building WordPress plugins who want to make their functionality available to AI clients through a standard, discoverable interface.

Agencies building for clients who care about sovereignty, privacy, and owning their platform — not renting it from a SaaS vendor.

Next Steps