Back to Blog
WordPress WordPress 7.0 Abilities API MCP Plugin Development Tutorial

WordPress 7.0 Abilities API: Building Your First AI-Enabled Plugin

Axtolab —

WordPress 7.0 ships native AI infrastructure, and the piece that matters most for plugin developers is the Abilities API. If you write plugins, this is how your code becomes callable by AI agents — without building a custom integration.

This tutorial walks through registering an Ability, handling the callback, and testing it with Claude Desktop via the MCP Adapter. By the end, your plugin will expose a tool that Claude can invoke directly.

What the Abilities API Actually Is

WordPress 7.0 introduces three interlocked AI layers:

  1. The AI Client — wp_ai_client_prompt(), a PHP function any plugin can call to send prompts to a configured AI provider.
  2. The Connectors screen — a central admin UI (Settings > Connectors) where site owners enter their API keys once for all plugins.
  3. The Abilities API + MCP Adapter — a declarative registry of what AI agents can do on a site, bridged to external tools via MCP.

The Abilities API is the third layer, and it’s the one that changes how plugins are built. Instead of exposing REST endpoints and hoping someone writes an integration, you register an Ability: a structured declaration of what your plugin can do, with a name, description, parameter schema, and callback.

The MCP Adapter then exposes every registered Ability to external MCP clients — Claude Desktop, Cursor, VS Code, or any MCP-compatible tool. Your plugin registers once; every compatible AI agent can use it automatically.

Why This Matters for Plugin Developers

Before 7.0, making a plugin AI-callable required real plumbing. You’d build a REST API endpoint, write a standalone MCP server to wrap it, configure authentication, and wire the whole thing into Claude Desktop’s config. Each plugin needed its own integration. Each integration needed maintenance.

The Abilities API collapses that into a single registration call. You declare what your plugin can do, WordPress handles the MCP transport, and your Ability shows up as a tool in any connected AI client. No separate server. No custom protocol handling. No per-agent configuration.

Here’s a concrete example: a WooCommerce extension that fetches order status. Before 7.0, you’d need a REST endpoint, an MCP server wrapping that endpoint, and documentation for users to set it up. With the Abilities API, you register a get_order_status Ability with parameters for order ID, and it’s immediately available to any AI agent connected to the site. A store owner asks Claude “What’s the status of order 4521?” and Claude calls your Ability directly.

The economics change too. Plugin developers who adopt the Abilities API early will have their tools appear natively in AI workflows. Plugins that don’t will require manual integration — friction that users will increasingly skip.

Step 1: Register an Ability

Registration happens during WordPress init, like most plugin setup. You declare the Ability’s name, a human-readable description (this is what the AI agent sees), a parameter schema, and a callback function.

<?php
/**
 * Plugin Name: Product Info for AI
 * Description: Registers an Ability that lets AI agents look up product information.
 * Version: 1.0.0
 */

add_action( 'init', function () {
    if ( ! function_exists( 'wp_register_ability' ) ) {
        return; // Not running WordPress 7.0+
    }

    wp_register_ability( 'get_product_info', [
        'description' => 'Look up a WooCommerce product by ID. Returns the product name, price, stock status, and short description.',
        'parameters'  => [
            'product_id' => [
                'type'        => 'integer',
                'description' => 'The WooCommerce product ID to look up.',
                'required'    => true,
            ],
        ],
        'callback'    => 'aiprod_get_product_info',
        'capability'  => 'read',
    ] );
} );

A few things to note:

  • The description is your tool description. When Claude or another agent lists available tools, this text is what it reads to decide whether to call your Ability. Write it like you’re explaining the tool to a colleague — clear, specific, no marketing language.
  • The parameter schema follows a JSON-schema style format. Each parameter has a type, a description, and a required flag. Keep descriptions precise — vague parameter descriptions lead to agents passing wrong values.
  • The capability field ties into WordPress’s existing roles and capabilities system. Setting 'capability' => 'read' means the Ability is available to any user (or agent connection) with read access. For write operations, use appropriate capabilities like edit_posts or manage_woocommerce.

Step 2: Handle the Ability Callback

The callback function receives the parameters from the AI agent, does the work, and returns structured data. It’s a normal PHP function — same patterns you’d use for a REST API handler or an AJAX callback.

function aiprod_get_product_info( $params ) {
    $product_id = absint( $params['product_id'] );

    if ( ! $product_id ) {
        return new WP_Error(
            'invalid_product_id',
            'A valid product ID is required.'
        );
    }

    // Verify the product exists and is a WooCommerce product
    $product = wc_get_product( $product_id );

    if ( ! $product ) {
        return new WP_Error(
            'product_not_found',
            sprintf( 'No product found with ID %d.', $product_id )
        );
    }

    return [
        'id'                => $product->get_id(),
        'name'              => $product->get_name(),
        'price'             => $product->get_price(),
        'regular_price'     => $product->get_regular_price(),
        'stock_status'      => $product->get_stock_status(),
        'short_description' => wp_strip_all_tags( $product->get_short_description() ),
        'permalink'         => $product->get_permalink(),
    ];
}

This is a read-only lookup, so the logic is straightforward. For Abilities that modify data — updating a product, creating a post, changing settings — apply the same validation and capability checks you would for any admin-facing endpoint:

  • Validate all input. absint(), sanitize_text_field(), type checks — the usual WordPress sanitisation. AI agents can pass unexpected values just like any other API consumer.
  • Return structured data. The MCP Adapter serialises your return value for the AI agent. Arrays and objects work well. Avoid returning raw HTML — structured data is what agents can actually reason about.
  • Return WP_Error on failure. The Adapter translates WP_Error responses into MCP error responses that the AI agent can interpret and relay to the user.

AI-callable does not mean public. The Ability inherits the capability you set during registration, and the site’s authentication still applies. An Ability registered with manage_woocommerce is only available to connections with that capability level.

Step 3: Test with Claude Desktop

Once your plugin is active on a WordPress 7.0 site, your registered Ability is available through the MCP Adapter. To test it with Claude Desktop:

  1. Install the WordPress MCP Server on your site. This is the transport layer that connects Claude Desktop to your WordPress instance. (See the WordPress MCP Server product page for setup.)

  2. Configure Claude Desktop to connect to your site via MCP. Add the server entry to your Claude Desktop configuration with your site URL and authentication credentials.

  3. Open Claude Desktop and check the tool list. Your get_product_info Ability should appear alongside other registered Abilities. The name and description you set during registration are what Claude sees.

  4. Test it. Ask Claude: “What’s the price of product 42?” Claude calls your Ability, receives the structured response, and presents the result in the conversation.

If your Ability doesn’t appear, check: Is the plugin activated? Is the site running WordPress 7.0+? Is the wp_register_ability function available? The function_exists guard in Step 1 will silently skip registration on older WordPress versions — useful for backwards compatibility, but easy to miss during testing.

Governance: Who Can Call What

Here’s the gap you should think about before shipping to production.

Any plugin can register Abilities. A site with twenty plugins could expose twenty different AI-callable operations — some read-only, some writing data, some touching sensitive settings. As the plugin ecosystem adopts the Abilities API, sites will accumulate an expanding surface area of AI-accessible actions.

The Abilities API has basic capability checks, but no built-in mechanism for site owners to say “this AI agent can call these five Abilities but not those other fifteen.” There’s no per-plugin access control at the Ability level, and no audit trail showing which agent called which Ability and when.

This is a real operational concern. A WooCommerce store owner might want Claude Desktop to look up order statuses but not modify product prices. A content agency might want their AI assistant to create drafts but not publish or delete posts. The Abilities API doesn’t make these distinctions — it’s all-or-nothing based on the WordPress capability assigned at registration time.

The Agent Control Panel is built for exactly this scenario. It adds scoped permissions per agent connection, so you control which Abilities each AI agent can actually invoke. Pair that with AI Governance for per-plugin budget caps and hard stop enforcement on the AI Client side — so you’re covered on both what agents can do and how much they can spend. The combination gives site owners a full prompt audit log, cost rate configuration, and CSV export for compliance evidence.

Not every site needs this on day one. A personal blog with one AI connection and a few read-only Abilities is low-stakes. A WooCommerce store processing orders, or an agency managing client sites — that’s where granular controls matter.

What to Build Next

Once you’ve registered your first Ability and confirmed it works, the next steps are straightforward:

  • Register multiple Abilities to give agents a richer interface to your plugin. A WooCommerce extension might register get_order_status, search_products, and get_sales_summary — each as a separate Ability with its own parameters and capability requirements.
  • Add write operations carefully. Start with read-only Abilities to build confidence in the pattern. When you add Abilities that modify data, use appropriate capabilities and consider adding confirmation parameters that agents must explicitly set.

If you’re building plugins that touch content, products, or site configuration, the Abilities API is how your plugin stays relevant in an AI-assisted WordPress ecosystem. The registration pattern is simple, the plumbing is handled by core, and the reach — every MCP-compatible AI agent — is immediate.

To connect your WordPress site to AI agents today, start with the WordPress MCP Server. For production environments where you need control over which agents can do what, add the Agent Control Panel. And for per-plugin budget caps and hard stop enforcement on AI Client spending, see AI Governance. Review pricing for the current plan structure.

Back to Blog